922f7cb8dc2bde4ac431b8965af3abf63033b0f8da48c6dc4b8aee01cf3c54db

Analysis

max time kernel
90s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
Size 803KB
Sample260825-pyxstasdrc
SHA256 922f7cb8dc2bde4ac431b8965af3abf63033b0f8da48c6dc4b8aee01cf3c54db
MD5 5a715a3fb14395503a71461ce466a7de
SHA1 7954a51562df369d08d4265d7be012bfc7eb8fa5
SHA512 6bfb3ff520b055b5350796c7d98a7b76b0a63356fa6708019dca78236caf75e7cd4a3bc031267ebc085ac25b2f2c2b1cf0f9698efa4f174ac6ee507858ec71e4
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/c:8o/CKJsGWDMwc
TLSH
T139055B1CFEA48FBDD9920634C466C72E6275BE204812E91B339CB64EF970F42752E653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4480	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4300	2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
4480	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_5a715a3fb14395503a71461ce466a7de_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4300

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 803KB
SHA256 922f7cb8dc2bde4ac431b8965af3abf63033b0f8da48c6dc4b8aee01cf3c54db
MD5 5a715a3fb14395503a71461ce466a7de
SHA1 7954a51562df369d08d4265d7be012bfc7eb8fa5
SHA512 6bfb3ff520b055b5350796c7d98a7b76b0a63356fa6708019dca78236caf75e7cd4a3bc031267ebc085ac25b2f2c2b1cf0f9698efa4f174ac6ee507858ec71e4
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/c:8o/CKJsGWDMwc
TLSH
T139055B1CFEA48FBDD9920634C466C72E6275BE204812E91B339CB64EF970F42752E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 f04d4266e230b976dbecee73169acbe24041a924c2c3e471b40ecf21c6e736e7
MD5 3dee54a9d310356fe5951233a951783d
SHA1 ae301a73c4abeaa871561b59dfaef933e6f92791
SHA512 ca781c9a5f3577720b2ed1827b34ed92b7f12328f228a82dcb6fed896d62197687e50f8cdf80c53442b1b043c0aac34daeec7b284601933dc633bfd6a2cadd7d
SSDEEP 12288:8o/CKJsGWDMwkXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:hzsGuk0Le5ji0hmxNrM
TLSH
T184554A1DFE648F79D0628174C4A2D75EEA313D51073099CB2389B62DFE32F92953A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 817KB
SHA256 fb294a45628b4b24cdeef6c23aaa2f3ed21be88cc4947644aee9055035ffd888
MD5 7889f7181321659e212a694522f5f56d
SHA1 642dba792d310169c8aa30e699f1576c13c27817
SHA512 7c5ef3949f07be51c1200a6967fb992d75806a08c1a049c180fd487e357c833cb541b4bb93855c5e1cca7ce8a375330f2aa52849b0b799d398c99ae5329024a0
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/Oa7:8o/CKJsGWDMwOa
TLSH
T189056B1CFEA48FBDE9920634C466C72E5275BE204812E91B339CBA4EF970F41752E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 826KB
SHA256 94466db61cb1df49b351d932949934b78b08fb4c45b71e880d317bad1a38d832
MD5 1f16892cb7277a355e94085bf8b26d3f
SHA1 97c9010537a8232e317a2189289ddd2c8d0e99e5
SHA512 c774d2fe4194841da46ff26eb58fbaad17aaa856c388e79b370901f5ba08025d54d33e16c1305df631c598cfec205c909b4d7009f5b6b2632b17c86193b3194f
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/mE6:8o/CKJsGWDMwv6
TLSH
T1D1056B1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 826KB
SHA256 33425a6156bdc876799affcc9ea3828195b3bc6cabf0cc80727903faabcdf5a5
MD5 2b4e4f498960659351a27e503c6ae29d
SHA1 039987da9d4f7a2d04c3eb555f1aef9739697159
SHA512 b3ef2f48129b35759e0ec5d2c56c83c734260af47fd3b926a8dd2ad64419d4559f1263e5a71d956b8c27ac20f802ab88a4d2288f5dde21c3cdb4056a2c30733a
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/24N:8o/CKJsGWDMwxN
TLSH
T117056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 826KB
SHA256 350ee70d939670f535635fb1dba62ff00572341616c996310fce501738fff365
MD5 227be167332e5b89a194d585981bcf99
SHA1 74baae843dc916da539b469af7cd827c8dda470b
SHA512 0d4f849d5e52437bd72f0defdfc22982d7eda941e788af713074c075b430e5039db64994119a43265d7ba25984461a2d96eb6773df21985e1beabc7ce4d5b7ab
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/Waf:8o/CKJsGWDMwnf
TLSH
T1B5056B1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 964KB
SHA256 8b51cb8ebb5c6e76f0f24963efcdc4206b30349848d998d4bc1b61ca4ddc8edb
MD5 55ae22058458be028bac1b81acfebbb1
SHA1 9fb867dc55561c51e30a42abb4b7e6c51afe565f
SHA512 31cf80c56f6176415f23895e54d86072df704e733d3143ecf046923de35c24398225d8a304f2c1e2320556d2ecef20f14319883eca2e27198ba739569e0a244d
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/xc+D/0vxBzkiLz9u7:8o/CKJsGWDMwDyPz5L87
TLSH
T143257B0DFEA48EBDD5620234C466C72EA374BD304611A95B3398B61AFA31F417D2E763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 826KB
SHA256 0ff5bb384278604a1d06656573f2ca445ec85b48f0d421a6344d0d67d635de7a
MD5 da3ebf233df43dad770f31d0d6d039b3
SHA1 30063fd28701e5694c666ba38eb9760e65ba524a
SHA512 eb88ddc6c62cdfc580fb88c8ab94ded4f8c550a9562cb7c5bbe40d25d1e6d29bbc090deb6d70bbc25d51d36cd7fa32a4a879841cac9eb0a85153756198d5fa58
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/cio:8o/CKJsGWDMwpo
TLSH
T17E056B1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 826KB
SHA256 2ec3a485d8836ab101a1609df7b4361375a43b373d7b8ffc2e5ff138e721412d
MD5 d4f37fe1dfe6bf04f59485dceb3b0db1
SHA1 01ad5994fb08a0b80e545f9d9788f087c96f66c5
SHA512 d58b18682b1e0dfccd4ba4dccd1587de4f866eadd7e6702efb71e22e520d4eb695c7aad496ad6573ae3bbced66d374974b76c0262a5ba4e7beeebc0e7358bcc4
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/1Tu:8o/CKJsGWDMwZu
TLSH
T1BA056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 964KB
SHA256 2b1bc8730c721aea369423d7067080c9efcd3867ffbebdd1673e6f820952706a
MD5 e02fcf0c2887cbe18a2475bf6515581c
SHA1 e3a00f92435b1d1ace64876d482b3f1b8f0d8a42
SHA512 52d9f34dff9f4004df8f94032c86377205687cd0e8636d8ce17c265c936e662c8af3d93536f60c39e97d786092b703739846102819c8725029b42d6f31230c92
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/+c+D/0vxBzkiLz9u8:8o/CKJsGWDMw2yPz5L88
TLSH
T1E0257B0DFEA48EBDD5620234C466C72EA374BD304611A95B3398B61AFA31F417D2E763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 826KB
SHA256 a451f2d0dccd924d480703618f9d39b25ebba8d88811c7f15b312018312c5d2f
MD5 346fd43c7472bc3c595bed0196137d62
SHA1 69b0540e44320108d8750c140f2f77dfc6995c8d
SHA512 972480336650187c1f860520a6062387bdc181ad6f2753ab3d896106ab978a0b745ac999099ce040619cbdaa5dc2b454d0d915f0e2593ab041d384df1e0514db
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/iI9:8o/CKJsGWDMw/9
TLSH
T172056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 826KB
SHA256 95119200baa578d49d184f8a59cc1de57238c45b69ccdea7a209efe1f199956a
MD5 52485ce091c21237d9611e2f2ab25221
SHA1 30a602adfe57d662fdc4011df73f67e7131dfe4e
SHA512 8a9154123facc9f563aefb84574eb3e262abbfb08282fb1f3035e9679aae609c2a19671445e6ea2574f669ba322b7898f58bba78bcb38445add28d0c2a473c13
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/bc:8o/CKJsGWDMwbc
TLSH
T1D3056B1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 826KB
SHA256 9758aecd8223688ffb800cba9d081691dd0d6ef03e2423b787e73df19c68ba2b
MD5 ff803045e3062d5712cdf313edc375cd
SHA1 0d0d2613064cb73d731951b44723e41f0822b6df
SHA512 2b1c6572b1a515785f705fbd6753d7b9b91088accb9e2d1e16656045561d1ebc8fe24653b99426918829c6fd297606200e69debc2fc98bf39ace901dd2c0b246
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/b4p:8o/CKJsGWDMwEp
TLSH
T158056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 826KB
SHA256 36369ff77ea972524792f34860dea92bd2d5e94caa833ef91c15e4d84cf72880
MD5 700cdc9ba4cac750a58905c3292e8adf
SHA1 8d74d8fd462448695d12015c2c9fe3e72ecbaa5a
SHA512 fbc74db316e9867191c612f90b068b5edbcada342b1e88ce2e5717b30ded37e927358ce30e4868ce21201e99d8829ff37fa50e1fa93d1b0ab2b798e267ef4d30
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/ERe0a:8o/CKJsGWDMwL0a
TLSH
T105056C1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 826KB
SHA256 6a49e591f496b3b2f02af95c2d3534360d710771e0d95d09d26f060524a7c0ff
MD5 7fc8a49eec91448bc9992d3ef8c2841d
SHA1 0dc6685e6f02c6066ffb5cca996ac93004457c78
SHA512 b133e7c96280c07f6970479a4c6bcef4632a9ba97b7a03d937e65bc069dbdaba1a1685a2cbff3872666912532fd76beba07949f8bd273ad4b660f2f0f8151aa9
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/vxF:8o/CKJsGWDMwZF
TLSH
T1EB056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 826KB
SHA256 4db85d925a93b531d0ae5d949e6ce7224c176e58eff2bb5a84b610a8e8481de8
MD5 f8aedbfa8fc8af9d3ba13bc3ad07eee4
SHA1 386fca87284bf98debf4abd7166859a040034e92
SHA512 ce48912e005276ce891de2a38e9ee0cfb0296564d92ba7ad0cddc54ef9b65c3fbe81afb7df06a65572104e7e450748582a23330d9585d8a7d54a3500c1ca41f6
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/CnC:8o/CKJsGWDMwyC
TLSH
T1E3056C1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 826KB
SHA256 6a3139ce048a4f286c86ffdd1b92505af0da2a1a665672f662719042efb22aeb
MD5 e78896a5843b44dff82e8a02f3b9ff08
SHA1 9432cb806735000793869145ff8fff16d23891cd
SHA512 918b2149c3f258fa5ae47f581327f89057d60ad8cf18fe403e87524c233c92b1131d8941cc2506dcf9a05769bc0a28ce40c2413c1a4b3330ef930843798a183f
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/giw:8o/CKJsGWDMwtw
TLSH
T1EA056C1CFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 826KB
SHA256 412e25a96697d1d4208856e70f6585a44d88a762f5fb2357d1df399db78efadb
MD5 52c3eb0fe02d3fe214555dbe48c6f371
SHA1 e5cf9dace3761b2f60ec499fdf4f2ea2c2b1e741
SHA512 ac12e16a14cc696baab9c19bc20a24bbbf3acb092f422e2bb5d5ae9de8e4bbf987a038e64a38b308f1df9105326921091f7d4b6d63854408c51b92ac533b00de
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/H8T:8o/CKJsGWDMwcT
TLSH
T1D7056C1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 826KB
SHA256 392e26381cdf721afeacd5060311437d2cb34c6ab68f3fcaf7bb59a75edd5d64
MD5 f479dd7ac1a77f80e03fa2cd283d816f
SHA1 043aa406f5d3af81fb16957356084ee8b07c2d11
SHA512 cc18b0c626628978f1ea17613a978022f9f622a7bfa4fc3fae9a53070cf8868801075151681db14d25bab3abf1183bd1e49b3ea44977fe98b51de36899678fbf
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/knu:8o/CKJsGWDMwwu
TLSH
T1DF056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 826KB
SHA256 51cb3670369479b0233d9242f42d0d29f5bb4bc66ada663e44ca07bbf98d84bb
MD5 5f732ee126f2fd4d7bc822fa666754b5
SHA1 076c57b89d9cfe19090ac210d65a64fa5606c1c2
SHA512 fb3c0c802ea44aed18c985bb845fc4dd21654543d654f8bb759d4478b36f67ba5d791d82d1ffb0e08505dbb9ca34b83f9446c71fe3dc6822ff76d749c9ba7b70
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/3eb:8o/CKJsGWDMwOb
TLSH
T144056B1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 826KB
SHA256 0978587b94e8c9dc0bd519f773fbce4b5e4a9b75234dad8c8c3380a8a370001d
MD5 030abe6d87f5c3e98de1b09e48431415
SHA1 894fa15e6077063a752c45b2fb47712431aeb466
SHA512 1fb5bf404fd85888187ef6e59f5b11e386d153bf4521b303e8d562b138930df80f32dd925bbff2c124bddc03b94e42e7cebe08a0d57c6c9de312508b3b4b861d
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/Ohf:8o/CKJsGWDMw4f
TLSH
T162056B1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 826KB
SHA256 6c8d0fdfc007607c55083609d67f9c260ab65879d8c640f63a1af1267820992d
MD5 0323851ca9d83f0986c35e125c72c9b4
SHA1 fc8635ffc657309bee573973ead82e3509683579
SHA512 0fa4afea7356c6d7dd5c0df45eb06d2ea75e618763fb1e5eb27e885addfcba50a89e20911ba9b579f48ab8eebb645bcace89ae7f576cdb7c00061346cb343bd4
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/kQPy:8o/CKJsGWDMw1K
TLSH
T1AA056C1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 826KB
SHA256 631067be669e30685ad07c86e0c030cd2531bdf208addb58ad51c8ff1ee3705e
MD5 2d578a1dcccbeb7c1ae0cdbbf8ed30dd
SHA1 f45223f23eb612677e8fe4ce979cb7874909a410
SHA512 05b034ce6ed38d744ccea9e3fe5c89920e2beda1281b7283d3fa20c61c936e93447352d9d0649f07aa58e4f845d2f76c1bcdf021f69b9109b266b81b65e528aa
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/g1k:8o/CKJsGWDMw2k
TLSH
T125056B1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 826KB
SHA256 f6a28cb8292f610e67d53be6f7f0314272ffdb7f7879b116bff5cfd84023d75d
MD5 4f3076e97cdde7e0ff56332b7a1a6f5f
SHA1 1d6565c5df39a335b2887a5dcd99986742c33f70
SHA512 5b3cbfe5d94783586c717c85a80c84d6b182602a218a8e8bf1c494829f65c9787ddb7581b23b0b95ef9977ef6b71312e762348c8c116459f40431b768b31ff5e
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/g+0:8o/CKJsGWDMwT0
TLSH
T1D8056B1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 826KB
SHA256 9975b8cc60c97db7eece80a557d2831e8fee94e8117513c83e0fda2f5345d04a
MD5 17f384b9e17cc66c3bdeb60025574ecd
SHA1 04dbeaedd2a92e496207a9a2ea2fd83e2bef6905
SHA512 02dfd2ba68e7d0b60871a6cda0a151b4348bcdbb39adb00e1847118e3fb97e5b4d9f6a0a85e8f340f220d62f39e702b47241cdbb898dc3a79c1b09e49c4bb286
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/oJ70:8o/CKJsGWDMwi70
TLSH
T15E056B1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 826KB
SHA256 4311dd915b08babb0860cb5c2a8bec793baa1c65998219b0828a58e6c75bebe8
MD5 f234c784616fb47648ef137b76a09e9f
SHA1 dc2d3dd5a5183364130949cf09a191dd92e32005
SHA512 f7aefcb11f8bb8b236e6384261e495a04cfbf61d35a4c2bad2058fc00ccdb99542749296f5a1dc32b60225363c38a2e410275cb0cf2efd32604d9b122665dd62
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/44r:8o/CKJsGWDMwDr
TLSH
T166056B1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 826KB
SHA256 225a148c5e4ed9c21708421708a8f70d7ae68c0967a1490d5f86178baa8e4aee
MD5 eed7f1220db1ae2b7f4fd419a403f03c
SHA1 3247b9ba79ca71e177ce66d0b45b4ad2042fc58f
SHA512 2fe9005859af5487e77dc985628d34a6fa4e792a8f528693d901f1f78545fc43d6505563d6a2aad129c1edfed3db0b6e9133d8df7549f66af59485f65a1f5f97
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/7hn:8o/CKJsGWDMwln
TLSH
T1CF056B1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 826KB
SHA256 d6b902a896d08e074d778f4bba63d175b1168322dd5a4654a358be59370c89c6
MD5 4c3b91fa56170e3827610075bf979bf4
SHA1 f2d40e398dea94baba5ff9d9512545983572adc5
SHA512 170c03620e04ad007f560940c8315489ecc4e33a0ac6d03bce2fe2be6d2ba5a949c3ea98999558262b01fbc1e28a773cd54e2b3657d13ffbcb6c5f6b0a7acfeb
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/eix:8o/CKJsGWDMwRx
TLSH
T187056C1CFEA48FBDE9520634C466C76E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 826KB
SHA256 a2d5451151755911e5d480c0e73a016805a01a1edda8c19925a88deaf965cfbf
MD5 b21a8f84205790af4fd919304efec53f
SHA1 6e006850e9d5d8afa5f82ba4f394e2fd4bb74e18
SHA512 e8c1a41ff2c5bbbed8cd6005c7a6ae386073435d0950c3ba24db0d0335f33001db3d1ccfcd278c1ffe368e448df7b74789f3cdae56b3ed27df9cf72f35445620
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/ewA:8o/CKJsGWDMw/A
TLSH
T1AC056B1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 826KB
SHA256 7fedabfbb8d3da05637c96f40483766c281d881e9d48456182c494edacfd6657
MD5 3ddf6c12eb8f9cb317936d581b1352f2
SHA1 7d35c884928f65f42f9b7b152e22bc7f89c338aa
SHA512 5c916f8a5c38ea110d7e44d9c0b75bc35746a4b7427c1fc4fd22e46bff95ed76104f9491c19e5c0f6b85970ef94df98e155db19c5aa984e53c6bcbb7e23cbd19
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/Tc9Q:8o/CKJsGWDMwQ9Q
TLSH
T16E056C1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 826KB
SHA256 c90fd5c03a1abd0f3a167706f3a97b1e6f5144ffd67995cce2f19a95f2797f65
MD5 5f248f0483dc5f44fd223a8a080d2505
SHA1 e56a33d0bef70dba949ad4483590f5780cd35006
SHA512 94894c2f794d6cd1de0f1478b5ab67b4299a59c4d667173c79a50b4c9433a1f610719a540607d1aa063854d6c5f0ccdb862f0f51003c8f383d3b508a4d89bca3
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/HR4:8o/CKJsGWDMwx4
TLSH
T10F056B1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 826KB
SHA256 ed57baaa80fb0f19f4deb3bcb08376fd1f3ec4f0f6da50d80546320254e2a852
MD5 75eee241526a33a034dc794b71b9dcef
SHA1 4ee0d23e4d5a115d679b0668bf5b24f291902e4d
SHA512 7676eb8aa55558da208d10d7a808744810eceda64ca6ecf16fad5409ad607780b2f6b3dda3e9a54cf7183181d9bb6bd31e5377b0e0f84487493f30300e15b10c
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/7Au:8o/CKJsGWDMw0u
TLSH
T197056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 826KB
SHA256 79694098e11d4a4fb277cc3892341c2bf1d9b7abf5096d7c769b42f79e79aba9
MD5 89d2d2e2f41155be54e390c3a0339c5b
SHA1 e6d3613e7bd51722f0e3e72181c95c61879eacca
SHA512 5bc6f740f510379fe1470c109844c2a1b7f1d02a1bea0fbb9db49bd4538f3805161061ce9e980206c7d7a495a912c1265f04a0e5940384fd11158ccc6cc46c81
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/I8j:8o/CKJsGWDMwFj
TLSH
T192056B1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 826KB
SHA256 9419be7570aca30cbf31a1e686b5f8da7fa62f181782e12abe5dc45b6fa06177
MD5 ed53ecde2cc655ee73d34c44c6c73f88
SHA1 d31c425c7af7f380e0cc57e54cf443a38dbd6717
SHA512 379b64fd7001021fb4794e2337eb0b6c546db09fa3b021269c5cc83268e6e630d8a9d79000f309e4af0e52e866f804dcf5a79d5300f655256d82d5a1759b6d45
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/Wzg:8o/CKJsGWDMwMg
TLSH
T122056C1CFEA48FBDE9520634C466C76E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 826KB
SHA256 4d1d0d188d9641922199b856eef8c0bb8f66fc3de631a53c72d358e699d668ac
MD5 27b2ae0eea97ce9de2cb7128c9fd82ee
SHA1 acdb72ffc4ede287eaa5d35545890ac4fd88ffa2
SHA512 4e25965640bc549b81f1d3507d4973ee1e5125078108196037a59233b43fcf4ac05d9ba905164add04c95496a636dff2db66ecf771ffc95c3003af4dd51bf7c4
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/BxI:8o/CKJsGWDMwTI
TLSH
T1E9056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 826KB
SHA256 f29ec15fdc62b4aad1c10c4c3415426fa12c9f915b7e837053bb442c61e17553
MD5 1aff390a1d3ea4db1023a478845b32aa
SHA1 19c51cc2c460be37e7f6104923591b0d8bbdc7b3
SHA512 a91cc91ce0f6536b7cb4a73287fb551c47ae76d19c502cc2bd010e98802f89056e10a7ed936ce33dfea709ae2ac4edc1f541b95f5949f32ae5e87ea7fd70d652
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/Ldo:8o/CKJsGWDMwpo
TLSH
T156056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 826KB
SHA256 d17cadbded82bfac17ea0c94613936d536175de07034a40e0ec35b852e0697ef
MD5 bab3428cc44222868e89111ceb00f5c7
SHA1 c69af923d0c9f6b0f0a15898d758bdd80e47b699
SHA512 9b2f4ff9b1d7d72602cd49be09fc03793beb218f5f72081b2b7c6d06239467b4c52fab59c4c9096807b9b4733c5ccd79bc1510121b20ee61aa2b7606deb81b20
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/to+:8o/CKJsGWDMwa+
TLSH
T16B056B1CFEA48FBDE9520634C466C76E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 826KB
SHA256 4754ed104100e6bf038e4cbe05748c160ad7098bee274046eca7300ceeb71177
MD5 ac75c2e005b9cd78c2fa8d39dc8afcb3
SHA1 ecd7f2a6f89effc90f5176e458030d20e9ceb8a5
SHA512 1fb52d37d89347359363b9404c34575084776194f6540df4dc0a7235af600e5cc5a3131423bcd1066d0dc06bf40c57acf43d650e788a588e8ba0a8cca5a5ad8c
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/xcQ:8o/CKJsGWDMwaQ
TLSH
T170056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 826KB
SHA256 e431cc8539aca8d9fcc0ab5644406703d3aeab449c48b49f514dd9ccd8ed5941
MD5 8c0ba83f328d74bf58ef4308ed061a29
SHA1 3aa2abed3830cbe5775c87da6879f89c0d824ae3
SHA512 8eaa51a2070a8350a5d853d7b369c476458c760d69bd4bf915e6d4b25fcad90753477cd4a66cd975d39d320a2821c4f93e4a53fd86bf4c66d09391450b0e6fd0
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/PDX:8o/CKJsGWDMwrX
TLSH
T11A056C1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 826KB
SHA256 c73ec2919fb0c13719de1c39fb305d4588812766a147b577473f84bebb339134
MD5 ec1e88196ba2dd703eed47d5aaf6e9df
SHA1 8ee480c3f4cd01db1113b091729c01142b5a21e1
SHA512 8f7e9572daaa13864aaa564923344de6218d61a2895e8f1a32f15de2bbffc83005ec0817226683bcf28b58ff40fb73d4f7a44cd9735c83a71ac69e0aa692a5e9
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/weL:8o/CKJsGWDMw5L
TLSH
T17A056B1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 826KB
SHA256 096c77b00cc4d447f07ed468ae79384371925ca51a52619639c6d18e0c1c754c
MD5 75fb165d260f05fc5eddbec2a0bc9ccd
SHA1 7103dad71520f7c1c82cb6e9b29469e2e8d93729
SHA512 3af9f1d40bb3d9080da05e83c3cbd1b8e5ee548fc860dcbdc3d73dd1c7a2e98d51921f7ad4e5a4868b4468eeb31ecdec3cd2e01738f0dfc9fdbdf68e2d08cfd9
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/2oFC:8o/CKJsGWDMwnFC
TLSH
T1E6056B1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 826KB
SHA256 a1a5cbe0c37cd2e6075c9f642701bd9d1179a72b242af05faccce33843e9ce5a
MD5 1d8b4abea7418846046794c0a4b501ff
SHA1 35a5f36e5c50d34442abb4445fda693535c1c13c
SHA512 6c88f7cc309af9aaf9f7d57fc3e43703da8a2b209f5b8bd6d014b3ca7c0130c153f88c22f1bea4468e0396d9691d85e4a2c75f09bb9e64a4143a31e720dabfec
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+/SRh:8o/CKJsGWDMwQh
TLSH
T16D056B1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4300-169-0x0000000002180000-0x0000000002183000-memory.dmp

Download

memory/4300-1-0x0000000002180000-0x0000000002183000-memory.dmp

Download

memory/4300-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4480-170-0x00000000006A0000-0x00000000006B0000-memory.dmp

Download

memory/4480-11-0x00000000006A0000-0x00000000006B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads