f899785661740fb241791a28269328f12dfe192fd6819873910fdd37551a3b5f

Analysis

max time kernel
89s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
Size 803KB
Sample260825-qdpr5ssfke
SHA256 f899785661740fb241791a28269328f12dfe192fd6819873910fdd37551a3b5f
MD5 5532bed3cf275546b1cae96a1c70a5df
SHA1 3a6fa5010792e7a9a5e614e18d1e6ff39008d787
SHA512 002860649f9c4038d52327486b959b3d450eb156147a95ccd96d9dcadb9d00cc9b3c1607605c0d0d2d52bf496a820dbb30f19314c7a3578f0ff0ea39bbce7684
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CE6:8o/CKJsGWDMA6
TLSH
T1C6055B1CFEA48FBDD9920634C466C72E6275BE204812E91B339CB64EF970F42752E653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3320	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2100	2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
3320	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_5532bed3cf275546b1cae96a1c70a5df_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2100

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 803KB
SHA256 f899785661740fb241791a28269328f12dfe192fd6819873910fdd37551a3b5f
MD5 5532bed3cf275546b1cae96a1c70a5df
SHA1 3a6fa5010792e7a9a5e614e18d1e6ff39008d787
SHA512 002860649f9c4038d52327486b959b3d450eb156147a95ccd96d9dcadb9d00cc9b3c1607605c0d0d2d52bf496a820dbb30f19314c7a3578f0ff0ea39bbce7684
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CE6:8o/CKJsGWDMA6
TLSH
T1C6055B1CFEA48FBDD9920634C466C72E6275BE204812E91B339CB64EF970F42752E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 6156dea6b4c5521bdd1f4d6c1477f1a18de93dcf7ec68495c53f1e840116de79
MD5 96e9dbdd3d14dd5acc525b9646a6315b
SHA1 fb79531050b19fb3bd54d14a0cc556e36d1076c5
SHA512 26f20021eeb07b9efc7237fb4824cd86fbb196762100d53b5cc511b9471a439755e989b126ea019092e862ebbfa2e056e5dbacf959973b296df05eb00d478e73
SSDEEP 12288:8o/CKJsGWDMAGXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:hzsGeK0Le5ji0hmxNrM
TLSH
T1AE554A1DFE648F79D0628174C4A2D75EEA313D51073099CB2389B62DFE32F92953A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 817KB
SHA256 f1329ab9a569c19994fe9abfbbb0060cb7076989988be0f0fe3311774458c80d
MD5 094f49f0af3a5077dbd750d05c8662d0
SHA1 54eb9a9bbd243f34002810ed543a0330d69aad6b
SHA512 7f61520c12ef43a67c8f2333dad03585f319912c3895fb1e479fae0614dcf47cf369ffca633d7f68dcb7aabf05c1e32e937a955df498f58d3c897f27db065ecf
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEEa7:8o/CKJsGWDMAEa
TLSH
T1D2056B0CFEA48FBDE9920634C466D72E5275BE204812E91B339CBA4EF970F41752E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 826KB
SHA256 fbd72f5cbc16836e525f3ac2c8a18f30090817c7b00a4888816f755bd35db4e0
MD5 151da18649f73153fa94ea065958aef3
SHA1 9b62e792533e603b381381f76ed872d0aa83acab
SHA512 901bcf73b9480fd285ed691b7981b981e3aff942fe9e3262badcd502e5fb7a5f06e8570d9f58c93109829d02065e9cfa7208c20a89a1114702d1e6ea6470f001
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEsE6:8o/CKJsGWDMA96
TLSH
T1A2056B1CFEA48FBDE9520634C466C72E5275BE204812E91B339CB64EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 826KB
SHA256 99c8ced779aa433db76a5dd6e17f2e2171a0c2bfd46165ed1786d02429d1a5b7
MD5 3dcbe5c5274dfa052da9264bf6f87b3d
SHA1 46f3dbd8bdd36ffef9b6039982abf094019867de
SHA512 cc7e81e086f80444477e2a1ba7de308b21bc8bdac931cfea56741da502a2c33a73d90f8207a3e4a8c5771e875d2993694191c1438388426ce85ac96f490c0ccc
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEY4N:8o/CKJsGWDMATN
TLSH
T1F3056C1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 826KB
SHA256 a2f2ce6ef11f992210e9dda6ae18a25c77b420220c83b05687ca982fcedf8718
MD5 6e26099b9a388adc8b82d49a5189fc89
SHA1 1729a497e6ffa3fa7c20d4da5bf80dda98cfe4aa
SHA512 eeae208bbe9f8c1bb87b78f5fba7d779d24408e49621685b881d54a203af426991d6f2b6324a5e927bf30ddd5898e64a22d328e94aae60a47c0d6822cc3e01f8
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEsaf:8o/CKJsGWDMAhf
TLSH
T104056B1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 964KB
SHA256 0c619c8ac08f4f485338ebb69bf574936bbd20d80ec7d07a9227f8cc2e873fcf
MD5 c445ef5eacf3326d5f963a0abfd0e1cb
SHA1 a2405e78d55cc9f089d5ee0388f048db149116e2
SHA512 dfcb6a257a438ce369f859b2b17b6a23e51aafe0470782d285afa72baec0690ca470998d77910254d6f0d0976321b121576c546402c2465cb6e9343ffc449c61
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEzc+D/0vxBzkiLz9u7:8o/CKJsGWDMAlyPz5L87
TLSH
T10A257B0DFEA48EBDD5620234C466C72EA374BD304611A95B3398B61AFA31F417D2E763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 826KB
SHA256 7611884b0eb0d582372da6bec36df07d01a6de9a4b196536c9ea2bd82293a73d
MD5 9ebb32faa704af368a1238efcbad97db
SHA1 8639c992f0a12b68eb3ab93a2ae83b968cd7fc51
SHA512 9d992adee49d8a102edcac742e2e028cf33e198c71665bdf054bb03d72f0fefe3034cb7f5e30a25ce96fcaf3c176ca4bb2c0347398cb5a11de3806e20b7309b7
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEyio:8o/CKJsGWDMADo
TLSH
T197056B1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 826KB
SHA256 077973e5c90a0c939bdafdb3e3b3b2819068534ba4910d4c9f79b84e47ea9a20
MD5 8c41b132f5d43cd9d2697dd7566f4868
SHA1 c9ce12cde90bfeb750879d74d0b3fcfb42513d0e
SHA512 476f00430f71e1bfcd32c432827ffdbc32b73db00263bf326f0ceeb3f0ec55c4d81ddedd44d9fb5a2718e665011da7eec8b89be97237d33d0e1fbc66101a9698
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEjTu:8o/CKJsGWDMA3u
TLSH
T182056B1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 964KB
SHA256 b099795fd093242a3ebb1c9ef886960a4238ec8abef3381630d06f9dd0c746ee
MD5 90818927030a0c4d2bd00388bfc87422
SHA1 a68b35b8629e64c520e23f27b4effcbb2de1b6a9
SHA512 5bc081ab701cb0ecabe3ea4d63614a48400e43c212e2ab6388cda81ee455adc68cf6c875fb2cbedf0b4891511949e2bcf3161faaaa6aeb899f4ed31f3c57d81a
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEsc+D/0vxBzkiLz9u8:8o/CKJsGWDMAkyPz5L88
TLSH
T19A257B0DFEA48EBDD5620234C466C72EA374BD304611A95B3398B61AFA31F417D2E763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 826KB
SHA256 ab1d9a0c298b9a1318995e9221da10614fe034a0be974277d6ccceab7b202ca7
MD5 eb3aafe2b7f784dbed9f2b7bbf176c04
SHA1 6188a009094c807d960d0138d9adbd9f225f7ad4
SHA512 15dd2c32b8f1894604c3a6e89415d5c2fb1d65deabced3ebd57f1e09c9754a81c0a0a08dcb635d9ac494ebe1c76cf075085bc83074e19adc5edb7c26623c3d2d
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CE0I9:8o/CKJsGWDMAF9
TLSH
T1AB056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 826KB
SHA256 969af0519ef13e2cd0e7574f633a36b80684cfbc2d6342eef0bc406a31ef9187
MD5 16de560769ae34c7931a8bdc64346157
SHA1 0b46db05eeaadd533880313198c0a5a0c08d2089
SHA512 148af87796b9bb207a5b8e6b1bbe812a91928bb962a59d1cb007751faa62f9e53ac1409940f80d7486aa306c0ef5e4a4de5e2a5216d0c12e8dfd9da815843585
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEhc:8o/CKJsGWDMAhc
TLSH
T1F3056B1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 826KB
SHA256 935525fb1275176f139c212867acc8cda33ffc5c9dd531bdd644115ac9e8d85f
MD5 d5881a1f968a61d16743402acffc686d
SHA1 f06b1cc5b29e493a4b13d7ead9b588adbe4a8de0
SHA512 ae6e6829f93ac1bce53240aa0540312ec60e522bcf3efb0c09c9347e6ac00fe8200b3ec1846a82c3627490dfe4db3ded6633789aa9602e98c52c7ab0296017f0
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEF4p:8o/CKJsGWDMAKp
TLSH
T13A056B1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 826KB
SHA256 bedc545fd058d5790492944d45bbf7969fc3d496f491620844b56db35f6f6dbc
MD5 edc8aed686cef1658c04c5e9678aae13
SHA1 c56abde07fe8ad9b24645acd614b60d9cb12cf8e
SHA512 6919f84e516f6fbc057bf79917cd1232b51dc41ddd0affc6079901f7bfec6003f9f65afb1573b30aeb36d32e4b8239f94028da23f12725780d7c78732102a64e
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEqRe0a:8o/CKJsGWDMAt0a
TLSH
T1ED056B1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 826KB
SHA256 7a2deb8632b8892b374edcb25b44734efd309c5bed907fbaf3428ceaaa55b09b
MD5 dc1e8daf8c96c9b987b59acd405c3e14
SHA1 bba6da8826a10ad878f385ef68cee2e805ae32eb
SHA512 3f95776999b4042e0fbdf38913fe1cf05564803a89c81540617082278499b69c99620af2b92d70bc87a1a8902aefd6638b65778186c49473a70bb7f12947a9f5
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEpxF:8o/CKJsGWDMAfF
TLSH
T189056C1CFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 826KB
SHA256 ab2365688d27c8772fbcd022910d4561da470e0c8930384c055df806770ee66b
MD5 a4d6c37450db91badabd8748e2f3eea4
SHA1 6796b4f25d4fdd93554c9cf34f26a74e67431b76
SHA512 9be04df197f6efa41065f4e214769524917db627c62816d2762e49817757715bd6460e2c7ee1ef925942b3d5fc3cfe82d5dd42920bd0ca14317d785bb0ae8de6
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEAnC:8o/CKJsGWDMAAC
TLSH
T181056B1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 826KB
SHA256 b7cfd4e9a252851b071720e2596f70217e01a6e2f5f45c40ebec6a5f9ee38d19
MD5 a65a0636b6712c35f62cabf6b9122ac8
SHA1 cbf9ac45e6a7c093c063965c425b1d85aea3744b
SHA512 4c5a7fe034b444fd8abf977d139de49b7f86414376c48fbaef5a2b0566bad5c24805e1354a7581c2c9b0abb2e73fec9113e8eea0b0a8b0abaf7b0e6e74ee22c7
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEKiw:8o/CKJsGWDMATw
TLSH
T1CA056C1CFEA48FBDD9520634C466C76E6275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 826KB
SHA256 22133146cc3a410b2164e700b8e0fa56f9ef5f9189e540eb924c4000f3f9b921
MD5 39400d88ef9a889ea2ebb807563d72a6
SHA1 5ab3d7c936347cd669911cc94ecb3188568c4ae4
SHA512 34edde437dd388bcb53a8ea60d45dc40c820a84cb72aa9f22e58826d8eb71eb5789c13b8b94a166c6b01e9cb6e93a722f359db974e6d6fd7398e25595ac862d3
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CE98T:8o/CKJsGWDMAaT
TLSH
T183056B1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 826KB
SHA256 52e7deff2cd98cdb51b157f13b6c40119806c60f1c02a5c8a36879625bc6a834
MD5 d9084d8c970f43c5ef406858c7b42211
SHA1 42d60f38c388ce7384428535924a30d239e914f2
SHA512 0f23334d9f3f931a0abba55db9e884f4610245bf1f0afa05d280e05031126fda0149da805ca8c29f14c72fabcb8cc9c6c707feaba41083a461451d5c8115e480
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CESnu:8o/CKJsGWDMA6u
TLSH
T122056C1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 826KB
SHA256 0f30b6c1c4122807c79fc5ed0af6f46ee13a000f8f50fce79d4ed18d1c907eff
MD5 c2f5c0307d8506266aaa0b6a11b1f108
SHA1 f3e531f7ef96d6fbe87dee22b8f8b191aca897ca
SHA512 59ed1c9504fb5e1de303218ba542079772dde2452a880ab61e2419a529c39480c868f7559371831d8d6f8df9d1350ef4ceefc4fbfe5372c00ccba9f439c37cd9
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEpeb:8o/CKJsGWDMAEb
TLSH
T1FB056C1CFEA48FBDE9520634C466C76E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 826KB
SHA256 3a864b5e267cc7fb139102d40d9902e08a4ef42c9095b83a48e08d7db3854fb5
MD5 7f196bb1b77ee00fbd56280caa2afabc
SHA1 002ffeb18f385410b260ae242297538aea119241
SHA512 e78fe4ca320612ba6be88439c9f87187522ed63bf29e809669276418a87f28ac89c511a16dd9888670141107819293330d60d3378d35408073fdbe126a1465dc
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEshf:8o/CKJsGWDMAKf
TLSH
T1B1056B1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 826KB
SHA256 c9d03d114c5353389feda9c6a3983803e8f3f001d93ffbbb030bed9a8ab4bfe4
MD5 92f197d8a2360560b6238391f370d137
SHA1 31e9ccdfcbcc472c19b97497e9f51e52a37fd908
SHA512 1d0c9e0a429331d4fbe471534ae7811cf6241b2134812ae8722e303f19e8b356c4c3d8a803335375e1ec9f34c02534a4216a42c0a30fd587ab90c533017be6ab
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEyQPy:8o/CKJsGWDMAXK
TLSH
T1EC056B1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 826KB
SHA256 a5eb0b207a39df96f43342d5eeeadaa802c7232bb3645a3caf79b62ad87c0f4b
MD5 644ec1b2817bcec0c1b354698d61b7b7
SHA1 bc7a76489b1fa1ab2784fd7b1f093bc7927e76e8
SHA512 060b0097d45c6dc8122c8cec24a0669e720937e84c35c5caf74d97736983613f6796fe06c581e1f23cb5a8f639897f2e35ae08cc91747614b64f40f51f94d839
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEO1k:8o/CKJsGWDMAgk
TLSH
T183056C1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 826KB
SHA256 13a19d2b30cd965278a10e16550731dc13551abee6fa9ae2c632467e19b6cb86
MD5 5b40493c7593af169a8eb8ec3aa08086
SHA1 23eac105b926e105a80354b2000d2ffcbaea3dad
SHA512 4d895686bd42f42cc51562aef1c269a09080469ab39062d43b647e5b332fc8a04501f8910fe0b094bd83952060c61c13d8c750ff2cf86a05a76486e488330dc3
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEu+0:8o/CKJsGWDMAR0
TLSH
T159056B1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 826KB
SHA256 7e80222930f2f3f9800ad2b52d7069991c57e572d48bf350b3a2f9596bfeea5d
MD5 e74882cfa92b9bd186d270e0b00d9317
SHA1 0c1e76dd33173c5ded2ccfa9d1a2e9d9e3672d1a
SHA512 2c940f585eee1c462ecfd0a65e107c68a81997033ba64334496320e67bd0a27c36ee0021161111d5a21579e2b7bb09eb3fb15095b03cc87c83782c53cdd847c1
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEqJ70:8o/CKJsGWDMAE70
TLSH
T1F0056C1DFEA48FBDD9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 826KB
SHA256 c990c04f3e1ea49049ac86059d75d7e6dd1a82bd2f4d2d19058e569d3dd30d05
MD5 b4175a5745f36f18d52fe2488388e53b
SHA1 6a7b6fcad428bef9cddbe40dc8bccbb4344d1fd0
SHA512 ca9f9a7a7edff5ff00b79abf0e8f5eee69ca42aaad06dd8419a2abb4aa14c38365f1178d5fd33a61a1cea329c01e72b876624e36e29ba034aee855de72d5011c
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEa4r:8o/CKJsGWDMAhr
TLSH
T1DC056B1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 826KB
SHA256 66486a21e8b220e4b437e6b6cf434c340dd0081af410efa3db9a62ef71a25c4e
MD5 a583539a452b20ca7ee7099342a92241
SHA1 8d276a34de0a264b1b0ff6baf7ea442fbfeccba2
SHA512 13dd552836f6fcd965a3a3331f5cdee039f1c686c895a8922346c5452bc3f94e18446f70deff47141cf6284bead939f0796fdafc44d8e4086e1f5495ed26ebbf
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEZhn:8o/CKJsGWDMAjn
TLSH
T122056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 826KB
SHA256 dbb27b8d9922c5622b0f191039346cc3b459f50afcf06753b7ef6d69e401ab8d
MD5 80553d8a60f348d6a81d132804468b37
SHA1 6ae99db1d4f2616361eebcea5005af03dba8459d
SHA512 2e7aa52f13a031d0e32c95d8faaa8c64d7f0db3865f4f23a21a24475e76fb41bcaf7ce1588402848a3c968847dc1d46490226dfb413e73ff7911e071c7c264a4
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEkix:8o/CKJsGWDMA/x
TLSH
T132056C1CFEA48FBDE9520634C466C76E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 826KB
SHA256 dcc897cde3a14bcc8733c39a3437c619a32c0d218ae42e72f834130b14a25abf
MD5 4c3e5b1777f1150152721fd9c2f7ea50
SHA1 f441a46e4dfb9b4d935b8e6b2b57a4bed1b0d79e
SHA512 ac1024f5dc2b50828ea4c75fd04bcc2052830f35dec58fcd0b0ff8d6a4df4ecde818a170116bcc3dde988e63993aeb70e1ba773eb5e7ca234719c575ffb6e68c
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEUwA:8o/CKJsGWDMAlA
TLSH
T10D056B1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 826KB
SHA256 e596d07955f5078a3cdaa35c4bc3387b7f2c7102ed0e50253a902c76a9892632
MD5 5858a9addf2f8a94e08f3b7e57ddc9fa
SHA1 ae26f1f8f998dd898d356c8db5c3a2eaab254f25
SHA512 af07a10a86ffd39b0e4d3f8cbda6c96a264e7d2037d211bb6d485d7bc6891627fe1fc3f9652607ff43ad2e57a2c0ff40a65d02940028271e5d16ec81979ba82b
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEFc9Q:8o/CKJsGWDMAe9Q
TLSH
T181056B1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 826KB
SHA256 860ed9d9db67a4eb08e8871c98b3e7ac973df2c8f3f05852cf30076040f689da
MD5 60d521fa0417be65bd27f94f855e2846
SHA1 5711991a8828970e351fc8724430272a49b06181
SHA512 534c699c1f51b948fb981c2b3560d9af4688b3de6009b29585ee15d331a2b8ef837be0af4f8af9e25347f534f7f59d7669319d0c3ff78dedc6351903b0ff0901
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CE5R4:8o/CKJsGWDMAL4
TLSH
T1B9056C1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 826KB
SHA256 2b1a153ff2f0f60331b48a16592b95d92a79781806172337e199b4283f7e8b3d
MD5 99ea3166d7280c0a6e5024d9fa18631d
SHA1 e13a105fb8b56e168cb89d27f918e11ff324c593
SHA512 1f100b9d65287cc3beb9aaba510b38437b515560789b0ff92b0784c492a2b05f11ee154a1491770ee7ce5b8bc380874433110021b23445ddb0ef8706cd3e3bbb
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CE5Au:8o/CKJsGWDMACu
TLSH
T142056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 826KB
SHA256 a20493b603685ee3b4cc22272aae452e38d356f9567f71d9519bd8a7720a457d
MD5 dcde1a096ecf48cebf05c64cc97168ce
SHA1 8ef714b930ad4cff9cf8b3cfeb0cac72b639ccb8
SHA512 5fa6dad297f05e9a389fb9594ad2c219d582106839cc0bc112d13df2e840dbbd556a242c99f5e5a142b83704dc20768e9e45e1883b8b26912700c1ad542dc7d2
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEq8j:8o/CKJsGWDMATj
TLSH
T1B0056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 826KB
SHA256 84d8e0b9e94c7a45ce33bd2f41f40f3676dc8dec84ea15e0022a0442def38fe5
MD5 7d2d8a6ff2e20b9b2e8de3bffbf5e1d2
SHA1 364ef10f4450aa3b24c9fac4ac0c6924ff68e04e
SHA512 2beba1e926a79fc01f23488e4af4773817bfca79cc77f37c94138e7843fc49012c0387a2f83393fd102690ac4b9982937c0423ab7bf097e970bb78113d986e84
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEEzg:8o/CKJsGWDMAeg
TLSH
T12D056C1CFEA48FBDE9520634C466C76E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 826KB
SHA256 c2cebfc2c09ea74c81fb3833e078f04651e70249e9e01de4398e5e32a892a5fb
MD5 86923d534c87e840cb4a57d7b7ab5ba1
SHA1 e0eef98c617abd26302bd6a14b98c6a8a76abca0
SHA512 fa67c98ad7542b0fc36fb1430359f66a2b223d6978302f02b9af47b9201720e5c7679eb825d8d629e3c093a23b929ecde042ee9a826c3132ae3d1bbf8e16baf0
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEHxI:8o/CKJsGWDMARI
TLSH
T1BD056C1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 826KB
SHA256 6fda7ca15dbdb10750b544ca7bde6f52f1bfa5c075fcbc0cc43815042fe45dce
MD5 589b25ce87b7c94c36d266fe1b12b1f8
SHA1 4b0ad99d4aa1775c4e01eebb37e6f775f04a3784
SHA512 82913ec4537cb8f985675ed36b3b6030b8b7d2e608a4244a3a95ef35146f8649d36d9e4d8f0e05c881381fa88cd59a25da1b271edecaccc185f8d70358f89211
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CExdo:8o/CKJsGWDMATo
TLSH
T128056B1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 826KB
SHA256 baef53083ed2a526371b41f91a3a46ea7207793db76f8495d3ad15bcd2c143e5
MD5 e4853b9307db9807983f6840376d2144
SHA1 086cb2a70e9714944bcd1ba0653375ce3592cb7f
SHA512 416732a090a6058815439e440c0e922b7d19152f6925729926d46a3f844935c75790f81c65d23f8f1e5e3075f117019371ce940accdbef7598c4410261a74b95
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEXo+:8o/CKJsGWDMAY+
TLSH
T1BF056B1CFEA48FBDD9520634C466C76E6275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 826KB
SHA256 7cf7a75a682bca04395109439f668344270fbf27d3f1127b0a598fd9fd65c7a5
MD5 ffc0ddeaeb220c3f3fa2a201b43ffb89
SHA1 cb1e4e395e7dc348f7096521b611366341bbe386
SHA512 c43d8003b4eddb40f1937d976a28464074034c42a68759e627f42142f76c4c55b77494a98139fdc579d76e6df276824e1916b16e7ed2f140d9d957b161b2cbfa
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CE7cQ:8o/CKJsGWDMAwQ
TLSH
T187056C1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 826KB
SHA256 0871cf35db52fc26befd56111f38b74dbf33fe9243dca00a29433cd2a998313e
MD5 53540d8fd7b4d19eb2a8ae4fdea6cd19
SHA1 4c4476ac16334d191c00527ab7a0d153615a4f0e
SHA512 59c4a94367e80ab600bc296c954961e83438c262b04c2657dc2ce384131d4fa1dd3f2c58512e4f355689aeddc0411ef442c7a1a5a72477032f32299e52f5ff9d
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CERDX:8o/CKJsGWDMAZX
TLSH
T1CD056B1DFEA48FBDE9520634C466C72E5275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 826KB
SHA256 2e4a96cedf7b6dd4803faa39ac7ff24cc745b50644cd1b89409f2cd01ad67836
MD5 5bbcd93c836ebe637a7b3a2ec6970bd1
SHA1 f5736e7f6f01ddd532c0dceec8b1364cbb3929a1
SHA512 d5e2c95d91fe387411ff935554e79f26fe04e0af79b53a924eaf46d39952635134749ae3cc3e7d18669445fa892b9f0e9f07e742f740a9832dc9cf1e7122809b
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CESeL:8o/CKJsGWDMAzL
TLSH
T118056B1DFEA48FBDD9520634C466C72E6275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 826KB
SHA256 9c586d751e415a0679024059b918eb83e31d22aeb350d89fba27ec86c821439e
MD5 a76b68897b1bd20e4a17bda8396898fe
SHA1 9677deb04c7f876e4fca64c01cdb7f39f0756481
SHA512 0dfc10fb7b46bcf3ff7e0ddd1badc2aeaf7ca8d573a61c0ae2571789d71159190de8d33b32e407446a95bbcf4da1d5e5da5873c416f8fb7e1fcc36ba3214fe31
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEQoFC:8o/CKJsGWDMAZFC
TLSH
T1AE056B1DFEA48FBDE9520634C466C72E6275BE204812E91B339CB60EF970F41752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 826KB
SHA256 26b1fbaf7ee48d395ce6a67e3832f689495082df688117561eac8b5e053d7a9a
MD5 12afaec9bd1b405c07423bd488b1fb29
SHA1 c1cad91f8dbdd6046f1ccc942ded28b9673a403f
SHA512 fdb74826c390177dc3e0467632e81b0c5167aba90afad80488c96fd1de8eea17fbbc3ee0a16137f870e3e1494efd4ddfc8a97dc6315396f86e2aec6fc947a0d9
SSDEEP 6144:ntt6tttttXFvw/CKC2sGzi2ookjHw7i633Z+CEERh:8o/CKJsGWDMAih
TLSH
T1B5056B1CFEA48FBDD9520634C466C76E6275BE204812E91B339CB60EF970F42752E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2100-169-0x0000000002180000-0x0000000002183000-memory.dmp

Download

memory/2100-1-0x0000000002180000-0x0000000002183000-memory.dmp

Download

memory/2100-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3320-261-0x0000000002040000-0x0000000002050000-memory.dmp

Download

memory/3320-11-0x0000000002040000-0x0000000002050000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads