cfb69b4cf04dba5f60575f569a06ca58a363263c07cebfe577bb9c71f323a612

Analysis

max time kernel
110s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Size 727KB
Sample260706-sc615sgx41
SHA256 cfb69b4cf04dba5f60575f569a06ca58a363263c07cebfe577bb9c71f323a612
MD5 9ea6b8dcbd78eb310c6d8896b85464c4
SHA1 93e3b52280337aa0c9d2c88fe2fecf4056832057
SHA512 683dad43484f14ab08bdf1e07ea65fcc49f5fba06ecad7d053e85a7c53afc545916fa006fde4dc925c78f425ec5812bae6d8c3ee0cfde2a11987143cbeedec29
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJng4Rc+D/0vxBzkip:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L88
TLSH
T16AF4AE17E7A110F9D11AC13499E64A22FB75BC72176096DF236882262F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 47 IoCs

resource	yara_rule
behavioral2/memory/3068-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c672-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b7-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3068-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/248-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e4-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c73-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a4b-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-342.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-475.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-500.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-579.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a48-622.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-642.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-747.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-790.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-827.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-858.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-936.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-956.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-982.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1013.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1056.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1124.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1143.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1168.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1188.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1356.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1407.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 44 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c672-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b7-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e4-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c73-60.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a4b-220.dat	aspack_v212_v242
behavioral2/files/0x000400000001983a-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-342.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-475.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-500.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-579.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a48-622.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-642.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-747.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-790.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-827.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-858.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-936.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-956.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-982.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1013.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1056.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1081.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1124.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1143.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1168.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1188.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1225.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1330.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1343.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1356.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1381.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1388.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1403.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1405.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1407.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
248	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3068	2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
248	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_9ea6b8dcbd78eb310c6d8896b85464c4_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3068

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 727KB
SHA256 cfb69b4cf04dba5f60575f569a06ca58a363263c07cebfe577bb9c71f323a612
MD5 9ea6b8dcbd78eb310c6d8896b85464c4
SHA1 93e3b52280337aa0c9d2c88fe2fecf4056832057
SHA512 683dad43484f14ab08bdf1e07ea65fcc49f5fba06ecad7d053e85a7c53afc545916fa006fde4dc925c78f425ec5812bae6d8c3ee0cfde2a11987143cbeedec29
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unalixTgaLaEiIJng4Rc+D/0vxBzkip:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L88
TLSH
T16AF4AE17E7A110F9D11AC13499E64A22FB75BC72176096DF236882262F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.2MB
SHA256 f8deaba0d96eec96870a6144f046e44bd1ccd0051e6e43f474cf137291be0454
MD5 2892ce247510ea72e0bdb4b37a404054
SHA1 8914d6952079424167c9c002e7c8d79e89278170
SHA512 b61e62094e80625306074b22030f54adfa62ea0163b1abfff8c60debc7e620d775548c55bd9f363c26c349889124a9a1ae3385900f671d1deb9bd4c02912ed6e
SSDEEP 24576:A3mnXoZjzyacNVOE/Z7OzyE0Le5ji0hmxNrM:A3kMvPPji0Aj
TLSH
T190556B17F6A442B5D033C179C9D29A5AEB7134521B308ACB1399C7382F27BE19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 742KB
SHA256 5565d2f1b7d9ada7ae7ec34166143c9ecb79bfc46f373b5775c963d2f72dcd47
MD5 db5494b15163fc712e3581eff75b23d7
SHA1 88e00f7effc40079ef6eef91b8a09b2084f3054a
SHA512 876dcb59a85cfbb7970de446ed9e386aad8f73645ce0b0071b237c252c9055bdd765e249b271efe1b5d5175a00e7e5e8974a13e579dfefc7f382c5b892643e08
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8ua:A3mnXoZjzyacNVOE/Z7Ozyua
TLSH
T100F4AE17E7A110F9D11A813499E65A22FB75BC321760D6DF236883262F237D06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 775KB
SHA256 a38a48b7125e6ca0cc0678530ee5b427c967e6bfd553921a699951a40d8fa4b8
MD5 a72aae96359e149525ccf285a28e66fa
SHA1 70e2061b9f3893fd3e454d58682755aa7baeef34
SHA512 c2b60f2709471253d0a71f818253851288316c5a593449cffb29d4bf2aede6b2db3bd2989e8de69d6882fa2e7a4780d98374dbcdd5ce9bbdadcafb4a86a4ed65
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8tb:A3mnXoZjzyacNVOE/Z7Ozytb
TLSH
T17EF4AF03E7A110F9D11A823499E54A22FB75BC661760D6DF236882262F637D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 751KB
SHA256 8e84a132308e548dd86a4c550c47efda9d52c2a5c627d36e4dfb4546cc12920a
MD5 2d42f638776698bf0f5f6fcc92486fe1
SHA1 171c7757f1ae31ba208d470f7f1e5f781065f910
SHA512 7fc5537c611299c0712c85c0dd8a629bbab4a8d1057f814fc9b552378aa0eaf483904d9a305015697732faad921224992c07f3e5ab52e9f6bd58becfb3fab99c
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8P6:A3mnXoZjzyacNVOE/Z7OzyP6
TLSH
T113F4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 751KB
SHA256 75cfd46ea180c28a5771cfa9c90ab13fa643fcc6ac689eb8273cd5a9ee060061
MD5 1cb5b24b67b260803387142164eb7458
SHA1 d515235a8d2e8c640e2767221a132fa40863d1b1
SHA512 76abc7f1f3c0dfc7c5eef4efc2622b041611c7c5adf29016d9b65068e1e8733c36cf1086e5d32bf936be474ae41c4784c6d3e2bef9ceac676ca528fdd154f83d
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8RN:A3mnXoZjzyacNVOE/Z7OzyRN
TLSH
T16AF4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 751KB
SHA256 c8de9ae98450f7e1dafe7b2d07f251e0632ebbd9221e24a1155ec02ac5f488b8
MD5 7243b255e5841c35df4651a0c0cc5659
SHA1 064e1cbbd9bb70b3b11f5cbe0680d5f91bb20d4b
SHA512 ee616e52cef7f73fe8c1658c079e67de91eb59095d3c1f71bd7064077aff55e294edfc31083a601affc5c0796ab69eb34c25ffc45e10b7e2d5cc264b6f178a9b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8Hf:A3mnXoZjzyacNVOE/Z7OzyHf
TLSH
T1DAF4AE17E7A110F9D11A823499E64A22FB75BC661760C6DF236883252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 889KB
SHA256 f4bf29517a1203206247c271367c652661c1a04f65c5b1d77fd8c0c223c508b5
MD5 b8373f0593dfeaf520fabb66948e0e26
SHA1 90faae9d1c7aaec960514fe46be4c6121e25bd49
SHA512 1f265c454f0a637fd6f34fdb52a3722379a65101b2c3ca1cd4d094bda24f1a4219f2a8ae2bee1db4ef61f4c5e2f17560cedaa9253b03ff0b57ad4684356b0e8e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8jyPz5L87:A3mnXoZjzyacNVOE/Z7OzyOzy7
TLSH
T11E159E17E7A120F9D126823499E61A12F775B876176086DF236883362F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 751KB
SHA256 0e334a49cb53adb4542b41f7154b1ffacd428c2b20f8c2d784cb197ba5e45f82
MD5 a37b6c71bc300b201c7d3fd6ba99ca94
SHA1 a069e8ec8124181ff64fda6d5fb085cc0ab7a4f4
SHA512 44bc2c097e0cd76bbdf23a6ba53d99dccd995a489f94419f1c0f1ae55458ce72ad6c72ec1d5e8bff30341fadbb6b7728442f28403017a07d92bfa9a5f08cd58d
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8Jo:A3mnXoZjzyacNVOE/Z7OzyJo
TLSH
T174F4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 751KB
SHA256 f3bc8dc93104e609d1206a3ce160fb894f4f8d07ce949fb95b4ec4b1e188daed
MD5 a8ec724f49e67230ef73eb7cc1463723
SHA1 9587110b3038395362bd3ab644db141584e76dac
SHA512 5ad3c9c779b30107b996be5070cb148c565f0148c1cf5457cfb8017c89e51dc69507c68f18e3915df0c39440c0ef39ddaa033382ebf882dc6a98a2674c94b128
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L85u:A3mnXoZjzyacNVOE/Z7Ozy5u
TLSH
T15DF4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 889KB
SHA256 6006d2fa3a9ef390eb648e13e3e282999ce8e921f0d1ed2604688c62eaa864ba
MD5 2a9002ada84f9133342ee556995db875
SHA1 d944de5114caa3e24caa6ecf3559abf7a8be4a90
SHA512 7162766c310512d4668382eb99cf55bf1c2cbbebb213f901c89337ec0d586fed36be28550c095ecde68aaaa68a90a078a8dfaec990b1b5ae56023bd399ad3970
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8WyPz5L88:A3mnXoZjzyacNVOE/Z7Ozyrzy8
TLSH
T166159E17E7A120F9D126823499E61A12F775B876176086DF236883362F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 751KB
SHA256 fee09e92352e7ca72b2c99c3ce8313179357c220c1c5cc17e00cb791a23f5b11
MD5 91afa1e78e7337a8788cdc27058c726b
SHA1 4e81137c18767f7dfdbfc57ee1d9aa52927bef76
SHA512 8d22cb45a69727206dedd76d0026e8346da899d97120c9f6363177a8216ec1850b98dfc658767218374491c2d8690d56f3ce223bce2d68d831917aa117f678d6
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8f9:A3mnXoZjzyacNVOE/Z7Ozyf9
TLSH
T130F4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 751KB
SHA256 bb23c6a1d3301fe871e9ac1cd793f416674cf248a00c0fae7bce501d4e702860
MD5 a9e0ba452a8c0a91d6eb2cddc1624a33
SHA1 a0e51822d5c21ac6e77451d514726cc27816f5b6
SHA512 def455ba5f481ebd99930318739200719ef6dd8f3826a6b87742f868723d5fab38597fce512ee7ed89b36aebf2ad85bf8d268c6ec9dea98961e9e19f662b88ae
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L87c:A3mnXoZjzyacNVOE/Z7Ozy7c
TLSH
T163F4AE17E7A110F9D11A823499E64A22FB75BC721760C6DF236882252F637D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 751KB
SHA256 a171ea90085626416399e8b452dfe568ea1c84899840467d64593c6a92b39664
MD5 9d274ab589c9774d482167b83cf3f38c
SHA1 9469ea96f32f6d681c3a4994c69a9e2b2d4e1bb8
SHA512 7c4adff959bff12d14f40a529954c96fbf105458519a6d692484914a4754a33e56e5046a2203b02a7d0421988e34a197bdf4201ffcd283d07a415f392bf47997
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8kp:A3mnXoZjzyacNVOE/Z7Ozykp
TLSH
T163F4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 751KB
SHA256 9163a3ccf87aca0723885dd0dccf045a9ee3e2aabd96a60e74574cd04f5f8dba
MD5 5210568aff885a73e920d4e1572c49a3
SHA1 d806ffd4bbab256b14865def472cecada7e25243
SHA512 e78ef7eeb0fe0c3c8e8f0090652054df1c97db7b25e731f604f76ed5fac78f43ad6e050e04e735f838090a2a4c74bc6529dd0f0f7cd300b6a3e61abd2ac5b124
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8r0a:A3mnXoZjzyacNVOE/Z7OzyrN
TLSH
T1C5F4AE17E7A110F9D11A823499E64A22FB75BC661760C6DF236883252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 751KB
SHA256 7f623f6b890425ae16dacf521b43c4c80a60552c2286cab85cba0b8a41c06192
MD5 113f21256e822b993b64c97dbc620499
SHA1 06ca56ad12b4cb45baa03580a6d5711b9c0f2636
SHA512 96ffa9856493e6124c13e121200d2c733fae155463ea8394550a1168eb5bc6e94b28ba24cdffdf8bbff48896034413b9816e081ace3d4fd1edcfa7324f9eafd9
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L85F:A3mnXoZjzyacNVOE/Z7Ozy5F
TLSH
T108F4AE17E7A110F9D11A823499E64A22FB75BC721760C6DF236882252F637D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 751KB
SHA256 8c8c305ef5430e20c5e8509dd347d82611a6709853826a1e9b03ef094fe48e68
MD5 a7bae75bcfec4e0f66ee269539a430b3
SHA1 195e9c37d7de3236c293da2e58c0a2f5af209785
SHA512 0b966493052f88fbe1f88ac40aaa05c6701e6f62a33d5bd7833437ebcae9e29c2a47c2343a5fedfe033a608be05a41bafcf5c8f150ac444e0bb7b0a9baf53524
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8SC:A3mnXoZjzyacNVOE/Z7OzySC
TLSH
T1CDF4AE17E7A110F9D11A823499E64A22FB75BC721760D6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 751KB
SHA256 927e1cd3c1a81c2f01ba2b34743e5cda1ada403386f8056a040599b49abe37de
MD5 8143f443b9902b25d389fdab5b800fa1
SHA1 107f6b04233bd7aebf9e0d02575d1b99c9e0ee62
SHA512 965e92d35d44e1302090768da0df55b5059bfd2cbf6964bbdb7207c576083894c6848aac1d1240686098e9e72d07726dc2f8af8b53407ea778e1244f7c3a9596
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8Nw:A3mnXoZjzyacNVOE/Z7OzyNw
TLSH
T11CF4AE17E7A110F9D11A823499E64A22FB75BC721760D6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 751KB
SHA256 4ff61b85855acd9c40b6b9189fd0708895f8f68d881008d86b21f6bc267c2887
MD5 7be4cab77752b7c1924aa5cbae024c8a
SHA1 5184d3f4585a721d876fad68447a513bb0717c9a
SHA512 acbfe9b150072ae908ed5aab7121628613f7b3b77d5f1bc81b804950663f5b8e1d4cba0754bb152ccd8a637aa643eb6f0537632c5f5b875b8582cd566f32903a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L88T:A3mnXoZjzyacNVOE/Z7Ozy8T
TLSH
T12AF4AE17E7A110F9D11A823499E64A22FB75BC661760C6DF236883252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 751KB
SHA256 9a4473212631aa74ded9da7385e3f1f09407967d1c7f30873565eb9e42540715
MD5 96db771ec64846e5059420b991b69d8c
SHA1 73c150caa31f4eb3fb285dd0bd16bca0be985dbb
SHA512 68c56479ca029b7aeb8610ee1fb61a7c38ea9925a537512f8e933996d0f7df641a3f2b347171f9d9789072a4190415216c30fde0424035a8ac8e4b2abcbfcfae
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8Qu:A3mnXoZjzyacNVOE/Z7OzyQu
TLSH
T1FEF4AE17E7A110F9D11A823499E64A22FB75BC721760D6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 751KB
SHA256 0194d353d25d2df2b143059376d64e4c33a28cd6c94fdadfb2ebb52969294cc9
MD5 62e05011519fe8d0075582ebd545916b
SHA1 ef305d2ca370784778de1ef4912ea7f06c8495a2
SHA512 fd2ed2f1ad7c13f6500c67a3c79f7cc0f990b2cf6fb58e8b495a1e184efca182c8587a21a8b9700ef0d904722153f40a2a4df184bc5e189506b6b177689369c6
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8ub:A3mnXoZjzyacNVOE/Z7Ozyub
TLSH
T1C0F4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 751KB
SHA256 124cee6d82005eade10c9babd937bc8ec8e855482114477db236e4c4731baf04
MD5 c9dabde6f66e58aebda4eb7dae13af47
SHA1 6602db4cf8223427bc89d792ac20662702d6a82a
SHA512 01a3386fdb92e0c24db58d0aafaa01fc6a56440cf78a23acba063bc4a5799ef80097fc4daece253e1079a3d4fc4f97502eecc98d3e2d6f9a200081927d4c69cd
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8Yf:A3mnXoZjzyacNVOE/Z7OzyYf
TLSH
T1CBF4AE17E7A110F9D11AC23499E64A22FB75BC661760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 751KB
SHA256 5bfa7c603a472c088a3b9321332f55ee3f706788d315eebc8e1d4d8b52a055bd
MD5 39d8baa7a51abbff16f46164be4df838
SHA1 f47e18c85e771d49920ef33642480a2f1ef91358
SHA512 d8b7d1b2ad03d89fcf7b0eaae2f4c1b2cf773ca710bb230dccf5d6a10e0326ccebff59b968ecc8fcf912ce5de3c3c93646baa4e5740c1f917ce3c8d17d957548
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8VK:A3mnXoZjzyacNVOE/Z7OzyVK
TLSH
T189F4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 751KB
SHA256 d915ff3e0ff2e7ce7355b279d09372660fe9ee8fae0eeadebc2c0c368274438a
MD5 d383a1a9082b613cef79b8daa06e9165
SHA1 1c434f0dd0568b196869c5b99159a621edb90e0d
SHA512 0bbdc39fee160922bb23ac18e28a2d1130f719f0e48ecfa7ccd7e2784e6026298cde81ce874f0c3935dc59a75feef45fee22e53108d3993fb73c76181bd55f04
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8Wk:A3mnXoZjzyacNVOE/Z7OzyWk
TLSH
T131F4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 751KB
SHA256 b4f1f399d0e929764ebbe2342b95c41f8dc9fa5cd06cc9e257b603d63602a6f1
MD5 6f526f9765146eb82b96aed341e9bf27
SHA1 f53017936f2ba104673691186bf9132acb164aa0
SHA512 50b214a2cb4c67dda4b3aea636e911a822467308a87d50536339d2e8149ab027007c211bce9201d6c70f0ea6d03ec4a1e20d9fea13d9474a68aaf37570e72423
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8z0:A3mnXoZjzyacNVOE/Z7Ozyz0
TLSH
T1D1F4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 751KB
SHA256 9a49af519c086b8559d2f5bbe059b88a18ca0954a388f05bb2491ba8ea853781
MD5 2dfb362aee1050f12f519b14f8c5fe01
SHA1 a8ccd5a910e8b2cd109a46026ca7a128e3af94af
SHA512 6568fe59d8a0ff4938e14a3a66d43d30bed80d18066fbfb6d2f5a9dc91c12a9714411c8140ce68bd848e20e35c6d374659457e0783c341ee8b006da8b295b84b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8C70:A3mnXoZjzyacNVOE/Z7OzyCg
TLSH
T188F4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 751KB
SHA256 63a35f2b32103dca2be57e643328254ec2d6f5dcdfccd16d8a6c32549b6cbe16
MD5 cd8a4a35fd6303aec66a45863be8fac7
SHA1 6256f599551449c9b37babad89f42cfc37c7a267
SHA512 53cc77511b05063d8abe40438a1977123330ddd7303ea7cf41a0c7819504935f3194683c5af009498969059864aefc62b910f1da57a8a6bc7b5155921c1a563b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8jr:A3mnXoZjzyacNVOE/Z7Ozyjr
TLSH
T158F4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 751KB
SHA256 133c11c9b06d4c8ff76eda48d396a7f450cd94d347fb6378d282433fa88e9741
MD5 80cd85933f4f7b88922f482e688a67e3
SHA1 92ef5c372d9bcc35d3afac749eb33340664bbd67
SHA512 83a95e7677e101483f324b55610fe7b781d15af0030327824df187e9a5400d76af0ffae578a7c274bf490acd12c10be12ae83851c8bd6c94b1409dd5a47a961e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8Fn:A3mnXoZjzyacNVOE/Z7OzyFn
TLSH
T155F4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 751KB
SHA256 79f774ae983807ac63b6bf5d7dfbaf639a74ec22443ca1d5d4f18486a50bae6e
MD5 77db045fa6e60cd15ba7f595dc84ad37
SHA1 3969db914884596b014f61647dde2ebf4192d5a5
SHA512 2105858f8bab240c601da76f6eb5e7810a171f61bb4b75303872a7e309c887b9fbfd61f5f0d1668eb3be3ef355cf4c68aca3831b499d8d1feabaeee65e0bd818
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8xx:A3mnXoZjzyacNVOE/Z7Ozyxx
TLSH
T1E9F4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 751KB
SHA256 a5c6f3a58babfae575fcfcdafceb114160fa8df71159c7c94754a6ff02a24e46
MD5 6ad26af12f612e108bb5fb6d5d0936e4
SHA1 ab210329a05ffa06d27ae4d647d8463f7be5753e
SHA512 ea419eb23bb32f3783d5e1091afa94f7e50b0ddcd5811d432aaee81430f117afdc0db3e414dae200792081e7842fd357298735e78ee962406eab9f51201d6dcb
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8fA:A3mnXoZjzyacNVOE/Z7OzyfA
TLSH
T1C1F4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 751KB
SHA256 1be1f5fc6e2b1d6e5f2c16268aaa0c53f4c9cacc915a9fe8a8b4f502bc6c3d10
MD5 f2a39a7a79f3c153b44a901ca2ccb3bf
SHA1 3e452ecb5a72b5ae4cc6445fcb3d64a571b0411d
SHA512 fbb20781987293b98b5baf5e59339ba9a3e3fcbeeee64f5b468e2c712e412db05d6afb9de733056d9376f74c7bf6f59a12611f5289a8caf35cd43e3ddcf7c509
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8w9Q:A3mnXoZjzyacNVOE/Z7Ozyw9Q
TLSH
T15AF4AE17E7A110F9D11AC23499E64A22FB75BC621760D6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 751KB
SHA256 449a9b4dad2964d828b785b929e68236386156c93aa5e485fdbb45ef77fdee41
MD5 d0d4ddb48a0ab60c4c8df1fd8a174870
SHA1 004738ace3de84cfe35f1cdecc83b574b7cc7992
SHA512 20d395c1c7fa5f23b57914d50b5ab239ac8b5fd12e29ebbb210f093f5eb4d4ddfe971eb1409f7a0eafd6edfb8126b35f6952d5e5fcbd967786619797efca0bcc
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8R4:A3mnXoZjzyacNVOE/Z7OzyR4
TLSH
T1D3F4AE17E7A110F9D11A823499E64A22FB75BC721760C6DF236882252F637D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 751KB
SHA256 15c8dfd14e653e94b517342d5df13102875ff4d06f4b76787dc1917730b736cd
MD5 4d2950935cceae4b99d542d1bee6e504
SHA1 49bda47fe9994bfc9d482527d6dc107be323e602
SHA512 8dace544ff420ef3d623b5591d4f99e2de3603cd7c3261917ad132c2d089a5d7e92de047ca908a37eeff9d6d30985ac26bda672c197c01bf636467763a5124df
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8Uu:A3mnXoZjzyacNVOE/Z7OzyUu
TLSH
T15EF4AE17E7A110F9D11AC23499E64A22FB75BC621760C6DF236882252F637D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 751KB
SHA256 0b2e39a08e97831debcb73dcb75e2c43b3237131c070d21b8520dfe3a29bba10
MD5 a6e028763e64fe2e100436487dbb0bc9
SHA1 49e73acaadada6a7b88729f3dd0bada15593d064
SHA512 7d5cdcd59e76bb4b69104ab791239be862c27067285782aaf1e87f8ba15b10cc0c230bed4e5f4dc9718bcaff3a2d3e25189826fb962b46cbfb91edb266cea7e4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8lj:A3mnXoZjzyacNVOE/Z7Ozylj
TLSH
T146F4AE17E7A110F9D11A823499E64A22FB75BC721760C6DF236882252F637D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 751KB
SHA256 246604722bc2a7410c6deb3ca3f38d25f2a1c097b03fab0c8eb35a002202d8e3
MD5 a92907e77c717666a9705268054fcd9e
SHA1 e8637187d17a7705cd9c538006b1ace7b837bfb1
SHA512 c236e706acf7c8dc038f3ed37b5fedddd4b5d3ed29f6c4f59f483e746c31e4e6b1af501906125deb21b2931861111c2edcc0eb1347550c2b7a9c05ecfd4c135e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8sg:A3mnXoZjzyacNVOE/Z7Ozysg
TLSH
T173F4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 751KB
SHA256 5a0bd5d2c87d287f824e56787240a9cb65be577e8eb1375c9659225720719489
MD5 4a440dcfd1ea891dc2cb81ef8e620263
SHA1 4e8961af62f921f64907f09bed2ba1951343de87
SHA512 f05ae1e7ce69a480474f48555b64c943949ccf05e865dcfa8d43a15a3865d2cf96cfd246439f729f5661eebfe2102dd41619645666f27cda4ec010d5b41bad51
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8zI:A3mnXoZjzyacNVOE/Z7OzyzI
TLSH
T17DF4AE17E7A110F9D11A823499E64A22FB75BC661760C6DF236883252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 751KB
SHA256 91db53f96487eac1996be0f8fabd98110a6d39cbcdec5cc8f2fa05d5956591b2
MD5 e4f8af42204148cd94e6456fc072fd00
SHA1 d0b3f4e28a79a378db9dc9117709c36bd9ca36c5
SHA512 6201a967e57f987b4414fc7ee468241d87bf152472ae24f640f0aee8fb1322c814452ebf7fcfd80f6dc228d48049139ae90e3970f1e85fbb7d66a4bedd24e234
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8Jo:A3mnXoZjzyacNVOE/Z7OzyJo
TLSH
T17FF4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 751KB
SHA256 9beb37c34ebd781ff90a30074e9e401978e2f75f20ecb3318f9c1bdb26e93815
MD5 a2501b63d9b3aa461965b20119c8ca5a
SHA1 0d4ec5902e6277edbf4a1b6caf9a35616c2474ac
SHA512 38c613417d25325351d9a721717d3ab94a496035e4835195f86b2bc9863a68ed502b2e37495e4f4cfb3cf94cba164bb97ed37c0f1e28f03a5dda9c4e8c531d6e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L86+:A3mnXoZjzyacNVOE/Z7Ozy6+
TLSH
T139F4AE17E7A110F9D11A823499E64A22FB75BC721760C6DF236882252F637D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 751KB
SHA256 19d35c164e547f83c5bce99d61d4a47acdd33b8b7286cc4aaf9794049684ee51
MD5 c853380218e77533db936f6ae4d266a3
SHA1 a33ea91e28f49e1338cb7bae16b2e669795851a7
SHA512 3510b072bad090f5d4d9f496def7c6ad85514337835633597490aa3c0119dd07748ef1729e783446233b99b3484d0964743e7c04601c7f3a17c574b467ff09d7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L86Q:A3mnXoZjzyacNVOE/Z7Ozy6Q
TLSH
T1A7F4AE17E7A110F9D11AC23499E64A22FB75BC661760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 751KB
SHA256 9fcd4b67dd1810820a645ae7105ca40fd17363b3ad16d17452dc55f58d1a7676
MD5 9f3400d108ecd4f008e4bd9a434ef26c
SHA1 c43d9b94c0487241801396ef138059e9c7227baa
SHA512 39fea9cf0a6079e912b43c32f51ff893ae442e468cc777d8adf525a63254528239857e2b7d33a814bb5fa9647aef437ff4e9f4e73810e7dcf3d54084200e4728
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8LX:A3mnXoZjzyacNVOE/Z7OzyLX
TLSH
T1B3F4AE17E7A110F9D11A823499E64A22FB75BC721760D6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 947KB
SHA256 23292b113e78042d164bb58145c080562302708b857c2c24b25cb2671e239559
MD5 32cc79eb75e9e3804b0b822edecf346a
SHA1 70b8e406ac0a5332d0389de842f7c16063cc1af5
SHA512 cd4f17b04e85ddddd0784177230be8a1e6e569f552e406aceb891a2c7a8c15071fdcc038a959b733d459c58aad19b7c4c915b42dbfeaf6d1f442bf50775bf8f7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8HQ0dWCXSyCq7IwZ:A3mnXoZjzyacNVOE/Z7OzywjCXF7IwZ
TLSH
T18E25AE17A7A110F9D1668134D9D24A26F775BC32176087DF63A883262F237D06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 751KB
SHA256 85e44256f8a35cc56b6f3386b6be11cbcfc6d9cd64e988e29c8e57557584c079
MD5 849cdb4a0c2d6088a4ec43feeaf19216
SHA1 60bb14f1732dcf62112b4855a4b8c04f30c37429
SHA512 ab162b961513cd82492ccfc728c4ba4bef3a4ad174068e5f87e28eb7acd588bf7d4c773386578ed1bb043067d2a21e1d6cd9526691fa83a141679f4664f7073e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8ZL:A3mnXoZjzyacNVOE/Z7OzyZL
TLSH
T174F4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 751KB
SHA256 800534e130f03881e065493ca5135b3106f8d620023b241e48a0c021b1bffc7e
MD5 0f8057b32e9765385a81a59628ee413f
SHA1 b7d0b64d28468fa267077535b22fe9dc765b4852
SHA512 fa7606673e085750ec51e635a2b053ae0f7c53f2f9e3eff4f5ee44307dd833eb86e72fbd97775fa578e3630b33091700c1021a7fa98d84252e04fb79a312bb00
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8HFC:A3mnXoZjzyacNVOE/Z7OzyHM
TLSH
T15DF4AE17E7A110F9D11A813499E64A22FB75BC761760C6DF236882262F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 751KB
SHA256 ba573076d7b00e19788779c2a3c5a730f9bafc3e4800c52f9b09e2c3b8b26340
MD5 e770b81a40ee9a380acb276ab211f55f
SHA1 12f7749d2d39d20899a686fb904c2dab42831587
SHA512 59c637c7f12d50aba3ed9454e7d18728b8ce8026f1360ea5973c10b7b9ba5fee81ecfaf45e59f9d6ef0606461d6e6009198d258c684b334721d3ac3a017b3eb6
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/Z7jyPz5L8wh:A3mnXoZjzyacNVOE/Z7Ozywh
TLSH
T14FF4AE17E7A110F9D11A823499E64A22FB75BC761760C6DF236882252F237D06F3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3068-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3068-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads