b616db55d4202a7d1458f595553a151c9beed6e78e55b0643f3bbc036b034bbf

Analysis

max time kernel
105s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 08:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 948KB
Sample260820-kp9c2atake
SHA256 b616db55d4202a7d1458f595553a151c9beed6e78e55b0643f3bbc036b034bbf
MD5 18dd9b26f345bb34a5eb34e7b39d7c19
SHA1 9affa915eac1f6f630e687610828feec7c2fa2ac
SHA512 75ed48121689e35467f2ae54d0d483a2356ffd3dbf3fbb69a96898004e4e167eab68c05913597631ce1ed6050ad57264637af60e8fef5ab0119df7b6efcf6a80
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOu:A3k03kHRJi
TLSH
T1D225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5884-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c524-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-9.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5884-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1100-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-570.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-668.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-731.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-982.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c524-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-9.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fe-41.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-224.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-491.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-570.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-668.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-731.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-982.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1043.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1062.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1123.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1341.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1100	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\OptimizeFormat.exe	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5884	2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1100	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_18dd9b26f345bb34a5eb34e7b39d7c19_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5884

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 b616db55d4202a7d1458f595553a151c9beed6e78e55b0643f3bbc036b034bbf
MD5 18dd9b26f345bb34a5eb34e7b39d7c19
SHA1 9affa915eac1f6f630e687610828feec7c2fa2ac
SHA512 75ed48121689e35467f2ae54d0d483a2356ffd3dbf3fbb69a96898004e4e167eab68c05913597631ce1ed6050ad57264637af60e8fef5ab0119df7b6efcf6a80
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOu:A3k03kHRJi
TLSH
T1D225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 36a36423fdd0181604d9902cff4026119a27296d45f4945a23a810221649bb1b
MD5 18c06dd3a697634a64c49e5be4675925
SHA1 5a73f6ae652649d902b381b607a504f61940855d
SHA512 e40f3ef1f88701077368c0520f11d0317e92476237a4646f0a2859aa472d8a427b6d9a403e3894c80bee341d0f2a3c1afbeceee1992066e175386c89ba0e1433
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOe0Le5ji0hmxNrM:A3k03kHRJiPji0Aj
TLSH
T11A658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 962KB
SHA256 0a5e92f566a3a6e5306964ffcef9f53860afe61ebf28637ba19c243b3dad79d3
MD5 f4c92006cc344e73cb00ed1d4a48c1d6
SHA1 66199d9ef25e00fc5ecf0a0e8320e96da908746b
SHA512 ef578bf28e2b76ca46864c608ae277839e0b9695086a7df7a1fbdde4002ecefa8bd7991deff1ff5c5c74fc29d744ef8e5cb3fa185b53005343b841b59530ec9c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOYa:A3k03kHRJ
TLSH
T14325AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 971KB
SHA256 9797c2bf95a567720fa570cfe5abfd18ace76d2c894ae443dbba22428f1e4233
MD5 61936edf9d0145b27a5266fe10a01a86
SHA1 1aa7187d3fd16556d851f96bec2fcb5749deb70c
SHA512 60f74c7e4b68c564d7d9904d687914900d2f4b82aa74784f27dbb0b88ae8868c6ec88ee64549af4cc586cd2d7aafe62420258c3a223d9f3247579c52910c7a40
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOx6:A3k03kHRJM
TLSH
T1CC25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 971KB
SHA256 b9f2e09bf243bd6087b9da54a146d79c9f6590acd9e73c46733576dde8094d6f
MD5 f5b4228f94366e5dbda7e1860964eef7
SHA1 b7c79952fbee12f9a93e1bf1d0bab1a2e422d5fa
SHA512 c46b18749fc92cde997ab7a0b73497d86f5941a5d89d36bae2f59df90a89c7326bee98d59b781cc32cf6b7e6ecd6c3ea60d4fb44e98fa1a1567920a4fde74e54
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOvN:A3k03kHRJx
TLSH
T1D125AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 971KB
SHA256 e5c76683783a6be7291bc15fa99c757bce79178a83f5888883e16541dea350ef
MD5 547c896b20723ff88e81571b44230996
SHA1 9e89e8c9687abef5349b28c6c35ac8376d63eb99
SHA512 625bdb362638c768eb31c3cef7d67bc6e6ae25b29de90c0a4979dd490a22c775f949116bcbb6cf6aa6173e24ce5297c75300ca73e5c79e57115c8d33e3d1e72c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOVf:A3k03kHRJx
TLSH
T14F25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 971KB
SHA256 371dbce1c47152a3fb754623383869e39515e19e577349fc858c635fafd45305
MD5 b87ebc7ee0d5d99496c88219c7806433
SHA1 72ce6ecfdcf545fff0a24ab4711fd15c9975e22e
SHA512 7a47cdc11469df69eab97f0dbc3b094ab08e74a733e1ed35f054aad043de49cfd032fcac5633e46a324e064829ee1a2d242ba5d0f8da19246fe9b477d1a38cda
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOXo:A3k03kHRJE
TLSH
T19B25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 971KB
SHA256 c61c6a5b5e19a65bf88d855b4893b0ebf1c966083cfcfc98c2ff657cc4ed9b6e
MD5 47acc2845ec5bf1ec8a586c492942c76
SHA1 4d3947042bf88fca5283b1147f73cb8700077942
SHA512 60d91f5d83fe8954c075b4f767783b78f7a11f25df3a29e999bf027970eb28a6837c0e05e464ec7e365d2e7352f7a1ffd249dd2eb62ca7049a19e3fd3b7068e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaObu:A3k03kHRJ2
TLSH
T19925AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 971KB
SHA256 e006af6cc2cb6ba4c432d8aac4978f639e7d458e19145c59d7e32920729fe17b
MD5 246f34235761cbc25e759b02577baed4
SHA1 718be260c64933d74be6f3314955ae9b76cb3d06
SHA512 05aa0f93475811bc72da4ac4e9540c6a4fd292ecda48df7c9ed2086f095d02f623002131abdd490c82865ca54ebc4308a216a16c55326f7012fa0dae63214573
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOJ9:A3k03kHRJX
TLSH
T19A25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 971KB
SHA256 abb70c76b4c2c65d00ddbe05af9cface43d96e394ccab4005f342994f0d46740
MD5 0c7bb54c0427cd7a55744fef7e6446e0
SHA1 a64070a49de3ddd433573d792e21ee0e731f70d9
SHA512 e9b3993cfcb85e556e4c7242a2df0e33c8577547c9a6f4ae18aa27f204c7c68eca7f5ef6bbc51766d53501c3ca5a8f9442813476ba014fcde3442decc62e5016
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOlc:A3k03kHRJm
TLSH
T15625AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 971KB
SHA256 8555d8749460ddfbfa876c0943fdeba8f0fb76272c2d9ba507dceb04c9881b8f
MD5 b6b6a8e181f7995266d2fd990b423512
SHA1 e0fdf63eb53be93a086582a334ef684a71ee3eb4
SHA512 3118f1eb84c67eab4dbd2507cf41106bd28e18d28fab418295861039fc97b4002d4b7669b1be6c08e2d2d0fecc5196f6d0b6a05709b2eff6a66656ea7fd6c439
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOep:A3k03kHRJ0
TLSH
T14025AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 971KB
SHA256 1f8ed6efab59aa61930b67b9ee3aa0b7440ec34dcbfbc73ea512005ac991b382
MD5 8e6a6dda3452232a217f69f2b42d1793
SHA1 e47543098bfba2a71b80d5f7a687b11cc5a8e6f4
SHA512 864b862526e1b59439b03065602c1850492d6f5b16cec847cc331c9a17ebdc4965583f1972810c96e41fa78102e4670abd7d33484344b2c80233b4eaed604939
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaORN:A3k03kHRJD
TLSH
T18C25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 971KB
SHA256 45511af9327f5d0ae8caeaac816d9544ad4fce6273e55a4caa08f0faf6555d42
MD5 176436146d943718a67e295d78424f45
SHA1 7596ba2d336c46699b8235a507fc7b32f256be4a
SHA512 ccdda890f98e7ce98a561d7fa9ad82f08382a665458f2bda21ffa5aa58823e23bd073c056f35a3ed1a8d1330f9fbea761b79abc0b8f461985627d48aaa7be1a8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOzF:A3k03kHRJV
TLSH
T1AA25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 971KB
SHA256 dd156ddb4e40bbd6acfe4d4ce16cb0c4abe8d45980943e3b50cb76df62391a54
MD5 a420cc984c90654028776f73d0ee0cd9
SHA1 36d523e33230974e1ba879311f16ed6afb692ee9
SHA512 6f3c100a2ee8f46e0f18f403e263a9dc6f100bd0a9b5a16ea5fcbc6e4223d7103cf3e7b479d478bfa5229a5db02e45329c84484d75a9321155cb608132dcf3ea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOcC:A3k03kHRJ5
TLSH
T13825AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 971KB
SHA256 3c77de28d21d0cf86213eb911767a28f4544827084a8c279948e404ca6f2dca0
MD5 faf1f939d2ab829c3786f89c424d3ac4
SHA1 b561c48463ade5e1ca5df45277f6d56e67fa63cc
SHA512 f636491864aba500ff6cb1e83d5a4aac4e94527f18bd7dfaace2a8419cc2416a39184da8bc7c2e270785781f31b91c6924669575cd6672a810ebf1996d871c05
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaO3w:A3k03kHRJk
TLSH
T1C325AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 971KB
SHA256 d4e942001c184d478dba58be390dfd10fe236ae8cd46c89024e3b16db51e4d20
MD5 4d2f9a5e15494ff30a2de3d8b44bed81
SHA1 1c0f7037e302b2bda313dcb42a9ed03e4eee4709
SHA512 bece44bba87468280745da86a8e41945b4b0ba315e429766932542302e4d986699f6cd4d7a2cb99bef27f1b7a4dbe9496cfa6e4d3968bdc318da412e2e3cc28a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOmT:A3k03kHRJM
TLSH
T12E25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 971KB
SHA256 cc0ebb1492dba6fde0c5f431383e327640390b239cc8cdc1cf6b34b95116a3d2
MD5 5ec2cd5368bd994ba163484bd0845b2d
SHA1 c6b29db8606026f7dcc6897dbbc6021c6640ea0c
SHA512 c90e46e8db5781568c0262e17c8a875750fa9067b792f6f96e744330a243f0ecfdb054a7fb108ccbd8be3afb6f327530a1388ed1b4ca45f7b3fc039dde988b75
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOeu:A3k03kHRJr
TLSH
T1F025AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 971KB
SHA256 a8382770d071fe0419aa4d68753118adb21edbcf15ba85b67d9caf5f9d0024bf
MD5 5a5d0cb66c9b875c728187d48a4dbecb
SHA1 f99e644b3cad4c815af2f004014fa053a56540b9
SHA512 44a556dc2fffb383f26f47e1545a7c7c6cace7ce0085718561afe6e461324889dfcc318f153c631e6335d48aad7994d8d41a35efd1d95c00571b0b3a56c39067
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOYb:A3k03kHRJC
TLSH
T19925AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 971KB
SHA256 4ce0d22407cd41336e246a425ecca4ec464d65821f149a1a7005e2a58a9b4a6a
MD5 c1d511aa9d69630d4d9e67fab9d14c10
SHA1 c34bdaa926161e50720db9c21a24a68d3cb62651
SHA512 202f9d4e24b062566086c813df378490c6bb5b43535e3478393f30bf7373209aeb3669676e1f9b2e82971aac3c23be6dafb44f278381f6fba19f28ec31b7ba6a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOGf:A3k03kHRJi
TLSH
T19925AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 971KB
SHA256 f541d28b7226d54352259739fc1753caea9319a6e97c391b26ef0e71bb4cee85
MD5 80c812710336af1ff5c23092c792976f
SHA1 128fd2c09235d8bec75f2f0826abad1de6c35660
SHA512 fa1f908ab062433d32ce3b1675f87429c3c751fa80988d6622469aaf95bff9f6c342c50e06a4a50b7d082226839635d5e1748d1d37b65e66bf4d8f2e02e91882
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaODK:A3k03kHRJC
TLSH
T19B25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 971KB
SHA256 b7c62f9bc48326eb85fd7902913dbc2e1e1ef2db5575ad49835b633fe316edba
MD5 7ad23cd6f0c95005aaf4e058df722e1b
SHA1 0476d6a90e54502d4da8e50f22143c52febaf829
SHA512 735b2d1e3e560c4c693933ac2a54d262e10731b70c7f817133ce0645bb2e34522f138046ee6c7a95d96a8f3df2419dde5a2a9004220fc5f37f8d51624aa43f65
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOkk:A3k03kHRJX
TLSH
T12225AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 971KB
SHA256 57dd580a0a64f685704cd0ebf175e4f93514357c0ce329c0a315ef101f8ae4b0
MD5 396ffc2c32bda06d846e12407fb36017
SHA1 635f06f065c73ec6c08c29af754556a88939178a
SHA512 e8bb14c4a4aeb49cd8be771468a3a1fd9dbf6edc2e38b7f97f0e8430c8851190e29de47a8599ba4d41e996d5074ad3b1cd0f014d50fc5c884340a88d43d07bda
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOt0:A3k03kHRJ2
TLSH
T19E25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 971KB
SHA256 341d0cf733b738a9d6e1abe5e6c6d1489e1844974b252685f6572318f30fb238
MD5 0f5d80ac2872b8ebecf98616ab945271
SHA1 11ff8c7a5ffe8c13c5a189b4bbb533c5dd1c51f6
SHA512 92a214fbaf4684cc9f1103f84b66a037afd291ab2631a797d36488fd27fdac9811c3b041cd1fb75200dc059739715b9abd2271059ba7de248643c81deea85214
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOwg:A3k03kHRJP
TLSH
T10825AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 971KB
SHA256 7dc7f0febd2cb81b1b33dacf2958ebfb292bd486d4ddeff563de8690e481833b
MD5 00ebb88f7bbe58c5df262eb73bc00e05
SHA1 2fa5509b6afe451d44b86ec6dc771b9fc43cc356
SHA512 87df704fb318fa701b60f3da1feac5f61cba14a53a4bac3861185fb5b78eed91ddecb409135c313582fa463a53ebe0fbeda62b1617f4247bc9c8433ca142d638
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOFr:A3k03kHRJp
TLSH
T1CB25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 971KB
SHA256 52b10aefb984c06c1010831c0d4b32e8013ad24fbbb99d1608133459d70c60fe
MD5 6cc59007536283298f00282b880d3650
SHA1 17f16d0801159f4034d2a8955333afce251e56d5
SHA512 efbd636f1f8f071548ab6ef5de8e97ff2bb64724c384de35c0344a44414519391857888818ff8b2fcfaf2e288471a5999ea6cf40695094eedd33edf7683ad5be
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOPn:A3k03kHRJD
TLSH
T16E25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 971KB
SHA256 8848b08c209af16a7f23fc46dbfc141e9f60b45e50967ed23d3e83b36de3f183
MD5 e70e71f56421a02f3321dce8288dcbe5
SHA1 caf8fde0d15659396e2dd54828ea4cccece2d899
SHA512 bb450f1bae71dda332f44190316765105e464b45d8f4247bc7db4e21644596e27a9ae3ae3e9648358f286370bffade849914d9a51e427273db33c27bfc186a28
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaO7x:A3k03kHRJh
TLSH
T19125AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 971KB
SHA256 94c9ee3f75a15a97faa0aa50c89a47a44f431b888d18eae7efbe6cf642bf5a90
MD5 1e4ca245983ba43e8c836e1cd7ec8320
SHA1 ecb3f7fd74802f9dafaa1ac1ab565d91d9b85377
SHA512 4c2a2fe5397923398da256a4a5d2ae0bff12a84581d92484403149fdf859bb77811b4b0057fc6b46e41cf7518bb9c3ad1161c1736b893579625b47423d15ad60
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOpA:A3k03kHRJO
TLSH
T1B225AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 971KB
SHA256 5997cc01d1c2c254a6609375a97cb30f1c42e4de3f3613c935d6aa80c4a1787d
MD5 1c43214616dc7e77081dd8ee8d4b7126
SHA1 9c9fc7e44c01de6ed8902286d614b78bd8b479d6
SHA512 62f05ef8964480a1b4735cda7c117a619a83fd219f842a51ac01adcd1b4093fc07ad2e1722a825c6afce739b9387bc96fb52027cb73dbd39cacb1cc17a5a77f2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOi9Q:A3k03kHRJT
TLSH
T1FE25AE13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 971KB
SHA256 0ffd82d75160da3171fd3903bb461f90be92b88e9b8203270fa8fdb063d3df06
MD5 f7e695dbc4d34844dff09e1f0bffe4ad
SHA1 412f3c29fc6c9147b67e655bc993bb6ff276c4d8
SHA512 08e2d379255d495401c97337d72125596e436910a291b606d64d2ae387ba8c3937d9443a98a7142b058d57ffadc5b039d097f8fff26e385d90f77b6b111c4874
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOH4:A3k03kHRJU
TLSH
T17E25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 971KB
SHA256 18a1d6bfd41328f6fee2ce0421445c78a1e60976c32ffff51a0b445a512b0d90
MD5 35a158ede83f322b4aa2696528b79108
SHA1 762f0d5c19943678287a08e17e2c05f31f765c8a
SHA512 b01be52767dfc982395f194174b8f1fa321d9c6df1f925a140c80bf3280accc291618bada185e5e70382abc55a8bff8b4fef7afd192c3b7745186b795034d334
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOmu:A3k03kHRJF
TLSH
T1BC25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 971KB
SHA256 0ba86a0e9c883dd39358042f48dda36f408b572544ba723f0ad7c8783876107f
MD5 fa297e94a2340120bf61eb00aa2cec34
SHA1 451a5b2258bd33c388ea2181ec2c63412fc1ee3a
SHA512 9fb9bacce61867ae695197fababbf18287f6b667da7729d0cbe3dda7bca68c6dba7f86c3d965ce1bf6beb855adc4ca148f407fc3075dc47d28ed79f6bf357d4b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOXj:A3k03kHRJH
TLSH
T19325AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 971KB
SHA256 b9d4e2a36e8e749f3465e4b19da94c19a36698d4ec08952f4257aaeb86e63a3e
MD5 b24f7df9123e5bd9053b7ef76023fcd2
SHA1 91eda489ab2efbd8d31a8b632fe8a300ea3f5100
SHA512 341f29bcf0c27c971452584aa1f8e58c5a996244a2af60b0c18863ec20096ea9ebd69745aa0ab9b1577e4565a3ce38b07b80cb914253902e1dddd3c6b0ff0053
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOCg:A3k03kHRJv
TLSH
T16525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 971KB
SHA256 6976bffc68059864ba6afb415a71b3276f823ad44e83d2f87cfe0c4184ab42d3
MD5 15c6f57dcee67164d44afe5fd9f2e963
SHA1 7bff05652ba696252e461a376afe1680f0906383
SHA512 ac928052cf9eed7225d2fb63736dd02d60d00e20c38b7d1f8aa429ad675197333f67b45b256d829c3200250c0bffcb3941027a92776dc344056a5ad9d0fb63dc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaO9I:A3k03kHRJ+
TLSH
T17325AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 971KB
SHA256 6b184529acbf41fea872dcdf6966aef9db816daf859075fc5f8f6e294bfb1667
MD5 ebe29fb701d28459cc108f4e3fda591d
SHA1 11712247367862653e31ff3248766d629de8d88b
SHA512 52b0711a2bdc325d5d83447df15080b245b3f90d000b3ec048d8a648ac6626cbe69265edb7070bc85800d39195ed14b3a39902c27efcfbfc9558e651d82a123d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOvo:A3k03kHRJ8
TLSH
T18B25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 971KB
SHA256 dd95cc6e79d0355908a7ba9cbb3243d14a47e4210f781464b11af99cedfdb36c
MD5 fe36edd2b8fcbf8ae9b44dad3e5b5166
SHA1 0783a373e98321caf1023663bdf723b922775f40
SHA512 834c7a779f099e85b47c1568114abea6cb338ccbc33b4457c95f774a2f85a825f6e868dc3e9e719241d529a2572ff4741d8069d15627f89ac67693788c35a7c9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaO0+:A3k03kHRJx
TLSH
T19D25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 971KB
SHA256 267072cbef09db262eba3800bd61571f2857e8ae39a28cc01538690e56eb0898
MD5 825fc7f2797b196d063232fa61a5beef
SHA1 0e007be48c291754a407e466353c800b458ce30d
SHA512 571345b79278ad5d4f3b4e21b50428917d7cb66a80cc337dd756ba5a4a888c0e5028b953cd47870738aa729cb5ae6cc804dba5f2263aaec0464b86d8a6a95c58
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaO8Q:A3k03kHRJx
TLSH
T19B25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 971KB
SHA256 bb46e5cbc9127dfc4f1379560e8d9cff5da772e2ddb310bb5b3f72794ae2cc72
MD5 071b41209f00f21dc0d90f446ebb6a3e
SHA1 ea92120343a4debefc344d0696b747425fd4f768
SHA512 9267100a8b4279579bcb6d620cca0067bcbb9c149bf3866b6b96c5da1748b16362b4bb9044dcb09227a838052713d5fc995951409561abcb8f654a7a0d6ee060
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOlX:A3k03kHRJ9
TLSH
T17B25AE13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 971KB
SHA256 d48c62958a5a197930574b1dfb63eaa20a742169ecbe2d2d350d95e2a63adcb3
MD5 4e0683ede8e3c4228d1a14f6ddb5870a
SHA1 f17bff65ead0ba17129d28f699673fe8508ec019
SHA512 f4a514a87707c7cc56e7f4c4f1c5af902daaa9a11137b0f3c361510c8e0d8dd62d2617c401e3f6ce2932336aa828bc806218e7633d98b3a109b801c119979696
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOHL:A3k03kHRJ/
TLSH
T18525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 971KB
SHA256 d7495af21be5f6e0c403f51805549adcddf4a15da44325b0b97a50028370eedb
MD5 f41bfcc3243d007409b8a7da2bb98c2d
SHA1 b25d1c9e43e847e209c64f29404cf7b9141e0559
SHA512 b0e9d88b9706227a7f052d8a9dd18ce5cac19fcdf51dea4043f349c61f666aa287b68873f94462859c15b824d158bb0b5bd23bcb346a3479264c3dc655fbf4ff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaO9M:A3k03kHRJK
TLSH
T19425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 971KB
SHA256 1a158aebe6e8ed4ae76d595cdd29aa8a16269879160ad3969b6d679aee9f4a9e
MD5 2c3fac81fb56bd62ab7088a013d8b36d
SHA1 6f4eed0a1318b0abeab56e84e1d3cc13d30ed2e6
SHA512 f6295ee8135e804abdd0606860ec02b3c2b69e1c840313dcc351134cfc3e9aaf2d29683ef67912335db82db4e9d8da4cf374c58e751d459ee7854ce9ad2168f0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEv4LTaaOuh:A3k03kHRJE
TLSH
T1DC25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1100-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5884-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5884-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads