dc1bd5f76f1122301b3d8a1c57f3473bdc0ec654456496661da1e7cfdeedd43f

Analysis

max time kernel
95s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 739KB
Sample260707-p4ejesfs9q
SHA256 dc1bd5f76f1122301b3d8a1c57f3473bdc0ec654456496661da1e7cfdeedd43f
MD5 c2c6f40f8d63dd5342ef1956df8f4b1f
SHA1 736fd63f2bac2821f2b22fb046126677c452db07
SHA512 6ff4a88408df4af212055d6bbeb064533569e8047c53cd162d06225be7579a02b2f07f739b72b5dbaf86f12d6bbc143a2e64880dabdf8b8fb4101957cf425a1d
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCq:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekf
TLSH
T129F44907D69400E9D11E8134DB954A12F7737C2257E096DB23E4E23D2F72780AEEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1380-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c5e1-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b30b-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1380-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3056-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000018a6c-483.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-593.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-680.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-730.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1008.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1064.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1101.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1163.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1357.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c5e1-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b30b-57.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-398.dat	aspack_v212_v242
behavioral2/files/0x0006000000018a6c-483.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-496.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-593.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-680.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-730.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-743.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-920.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-934.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-953.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1008.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1045.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1064.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1101.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1138.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1163.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1176.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1184.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1222.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1325.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1344.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1357.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1376.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1383.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3056	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1380	2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
3056	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_c2c6f40f8d63dd5342ef1956df8f4b1f_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1380

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 739KB
SHA256 dc1bd5f76f1122301b3d8a1c57f3473bdc0ec654456496661da1e7cfdeedd43f
MD5 c2c6f40f8d63dd5342ef1956df8f4b1f
SHA1 736fd63f2bac2821f2b22fb046126677c452db07
SHA512 6ff4a88408df4af212055d6bbeb064533569e8047c53cd162d06225be7579a02b2f07f739b72b5dbaf86f12d6bbc143a2e64880dabdf8b8fb4101957cf425a1d
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC923psmeI+sQFqT3QheXIJVCq:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekf
TLSH
T129F44907D69400E9D11E8134DB954A12F7737C2257E096DB23E4E23D2F72780AEEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 e3e709d01f1a31a05f993f5d4b110f7c234bea212e953a084e0e3409461310e8
MD5 eda64aae39a3b5776bb67fe7c41c96df
SHA1 2b54f4465fd20fdbed60e22901d31db3fe0b8fb2
SHA512 efc86408092479c3711674937bb95644ccb613bb868d87ceab8f6724c7c287551fc1270eae33fcf13281109f40db8a683e6b90f868fa9a6f9f239bf050037569
SSDEEP 24576:A3mnXoZjzyaEFkR4ugsOekL0Le5ji0hmxNrM:A3kMkPji0Aj
TLSH
T1A1554916E6A402A5D02EC079C7D2965AFA73384217F086CB13D4D63C2F277D19AFA763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 754KB
SHA256 10653039d6404658abe4281a1024e10d1aaaffc77d8ae4b7d29190163cf9367f
MD5 ae4923250f051c501c46ed6b9b9d11b5
SHA1 51db3b53c84e7271ee5b6ff1825d2139c608cf9a
SHA512 b8406db853c27a02c91996c358320c302d4f33a08c52fb430ae4c4f72c8f2918c1a4163de14d7fe44ef1b9919fc96a5a3ca0a3e589af0925d356b5439debcfc3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekNa:A3mnXoZjzyaEFkR4ugsOekNa
TLSH
T114F44907D69400E9D11E8134DBA54A12F7737C2257E096DB23D4E63D2F32780AEEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 763KB
SHA256 e4013166f5a013e3834c91b4521a2d14baf8b34b12313d2225d8e43605f09114
MD5 cc2007c2ad372c59d42fde792a2d0165
SHA1 921199adb29287231edb82cc641b3fcdefdd0178
SHA512 e2bed0d1aa233d75d2c80e9ca9997723f6ac26ed1232265f37b729d329f848cf319b798a27efe439de575301b10df8a05acdb513cd1b4a45aeb8abc9960bae42
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekE6:A3mnXoZjzyaEFkR4ugsOekE6
TLSH
T169F45907D69400E9D11E8134DB954A12FB737C2257E096DB23E4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 763KB
SHA256 072b1b08e11887a4604de06001981e087db65c22a7981f7365ded412c0802b6b
MD5 1bf8d592c9a8035033558bad674b8191
SHA1 47a18160cfbf754557c5cc68a0372194bba57440
SHA512 523eddd22602abed0fdbbef1be5a8c30a766b9bf97dc4b5130c299494164f43599415c282891dabe18801c95a86aaec569435562e328fec429c3aed43f208877
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOek4o:A3mnXoZjzyaEFkR4ugsOek4o
TLSH
T1A1F45907D69400E9D11E8134DB954A12FB737C6257E096DB23D8E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 763KB
SHA256 28619fcdd19de4876ec041583bfab7f851eeb089538af60d6a80b29a77e6dfd4
MD5 cc773fdc9eaa0c80ca0150c9d8bb9a12
SHA1 f4a93824d7c98c915a9d99c81696a4afd88d94e7
SHA512 0a9476250c322200efc3ac2628ac7c35f0f09288d390f4a8102aac86a7b65edf22041cf8751db4cce76ac981449de096934af18504fd80fe9c9a2e22cee16c67
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekIu:A3mnXoZjzyaEFkR4ugsOekIu
TLSH
T11EF45907D69400E9D11E8134DB954A12FB737C6257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 901KB
SHA256 90c0c07a41a2ae94f75d3428ea86d276386dae0be2fc96ca9c9095e801a6a1d4
MD5 4e9e28cdd1335eedb2e70d7bed91d7ad
SHA1 061f41908ce79e72dbe0127aaa0e2a969db956c0
SHA512 28b3bf664d7191cc4cc7ca181a650702da73b779cbfaf11bba4d91403367d1deaf43b05daf109d73cfc8a2b8aaaa649ec98dd1459a7273111e550a74f47daa4a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOektyPz5L88:A3mnXoZjzyaEFkR4ugsOekEzy8
TLSH
T1D3154907E69410E9D11E8134DB954A12F7737C2257E096DF23E4D23D2F32690AEEA7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 763KB
SHA256 f56cb4e934ff58adcd27b27b11e3916e5e6960f85bc960df8589a54a45ec6e7d
MD5 e3288da502c465b93c8244d6d85378a3
SHA1 e9a9a0833612046811da022a5d69a7b09e024883
SHA512 947fe1dcc2733fcf187e15b15500ce63e0b07095ce65fc5c883ebf2731f43fdbef9c44421add5cc47d0f23c907c14af4f25bddf1cfbedfe7ab8af3a730fe0645
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekc9:A3mnXoZjzyaEFkR4ugsOekc9
TLSH
T12EF45907D69400E9D11E8134DB954A12FB737C6257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 763KB
SHA256 8d828391632b4862972c576c2ad86be5df4d6b53f0e9d17689c722f361b7b4d8
MD5 47beae98e36c494cb6b42faeb3cae040
SHA1 0eeca45b7eb223791157590765e6812da7467f42
SHA512 15c06b13a88d4a7e45a82116da6d06000e0a24376b7c459aed566a92d594f06a97a3b4901102929ce15033ec5596f0d0cc151b560ec286cec1ccbd85eb1946f6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekEc:A3mnXoZjzyaEFkR4ugsOekEc
TLSH
T10EF45907D69400E9D11E8134DB954A12FB737C2257E096DB23E4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 763KB
SHA256 0db4d62ba600d81e90499bccefbb2860a4070ba043c78ed044e90c3ba22d5e25
MD5 9cdea8b106e56828f89989fc197bda48
SHA1 f3f472dc98b385fa713d1f341a8e2d5c3fa77604
SHA512 5cb7db9c4199cff5793c2059fc343679eb99ac81d596d76a156afbf0037939c8e7c58116f997967a41d9d0a770a9adadbb25aaad94c2dfbde562adcfd7d9df4f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekdp:A3mnXoZjzyaEFkR4ugsOekdp
TLSH
T195F45907D69400E9D11E8134DB954A12FB737C6257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 763KB
SHA256 23c0f9b5c8f83922784b98ea0d0ac34f7d44181c34852eca6b21598ac595df75
MD5 40657795d87e192d90a205ba273fb6b1
SHA1 e018a5bc1c2a6b2425574726912b39ca5632db18
SHA512 a2ac8239f405deed5d071914265de522ee52511d0cad1a2e9b417fc5b9a01127b44241aa3163dabe4f0101eef3a1738d2508a3cca0d335136a9136fb6d574c30
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOeki0a:A3mnXoZjzyaEFkR4ugsOekiN
TLSH
T1A7F45907D69400E9D11E8134DB954A12FB737C6257E096DB23D8E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 763KB
SHA256 9f8db0b4fd85e8c8515ccf00a5c063087baae54c5c0b938f0ee07a7d559dfab0
MD5 5449371f47d3efc3c408c31acdfceda5
SHA1 787eaad11391371556df775ead251bfdb504f068
SHA512 d41c9cbafd12ebe2abc17e0bdd9f53acd70df2f751f55156ffe97536cbb667b005d5d4680d5b620942feb85673a4b7c4e03d224ff0a0e0a328421603d816ea14
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekGF:A3mnXoZjzyaEFkR4ugsOekGF
TLSH
T11CF45907D69400E9D11E8134DB954A12FB737C6257E096DB23D8E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 763KB
SHA256 7c8061c5419c1a490c7b3aff49b2874c3c209ee8c060d28aa0667e23c1ae38b4
MD5 2a8ebbb511f39424fa669fe9db8a8282
SHA1 98f150ffcab383f690ed7e774bfde2c1b1fac049
SHA512 5a9ca6cac2a7bd741766dc0dcdcdbc475953278e855701e8fd1e32f5565e4ba761c801d0a8ed9770db39dbf5b75e57097df31e0f7c883c7e563245463f1bd555
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekTC:A3mnXoZjzyaEFkR4ugsOekTC
TLSH
T1C2F45907D69400E9D11E8134DB954A12FB777C2257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 763KB
SHA256 6354686a85748184fb1a5d144f707a633b067b5f73f87b308e7c926f628319c4
MD5 019ecfa9d8fe8639b1a2cb69c7c64f41
SHA1 05dbc893224729be5a373bbfbb7ef2dbd2a996b6
SHA512 2e73320d614bd9ea734f0df07e6988a1a319f293598daf65fc5102efe053be00bc964a3f957c751c469d389aa5dc4f57a7891b2ea772f81ecd1ff5a5b97b363d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekcw:A3mnXoZjzyaEFkR4ugsOekcw
TLSH
T18EF45907D69400E9D11E8134DB954A12FB737C6257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 763KB
SHA256 d76d2eccc8ebbc02bd78e2d465c04d82411f36c1d03fed107e42958084a64769
MD5 eb97aef811e8e4582f8e540409229dbe
SHA1 54f2b8c57f6d2add714f25082e41f4187198d661
SHA512 b66592b83ef67e408ab4b1c0dd30bce6de7ed381308e176f294a42f017d7b8eced8c8d84f609dca63206f492c03734b223954c414fcc695013a9b4b737416b45
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekTT:A3mnXoZjzyaEFkR4ugsOekTT
TLSH
T19EF45907D69400E9D11E8134DB954A12FB777C2257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 763KB
SHA256 fa7403398ef013786e13476917ae3c449ac71642fa55001c46d6b9a54a4ca98a
MD5 0d0b35e5acd24af5c9121a5b8449544d
SHA1 32c3b2813353bce2e1cb1c8705ee80bca18ded3d
SHA512 cab6765340debc9a344b66382f93364fc7cc0d0e47e083e256708f97f985ff5e67ee35f543a70cc9ff4e9986aed7e692b2cc0ab83c856e1b809b2492b1ce283f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOeklu:A3mnXoZjzyaEFkR4ugsOeklu
TLSH
T12FF45907D69400E9D11E8134DB954A12FB737C6257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 763KB
SHA256 bcb88cb7e8bb1d1a2fc166fceb7a279162fc024f1514223c279a5fa2f59f7717
MD5 ed38547d13caf198193a50d46fc5caf5
SHA1 cc9ebfd5f31f5c26d3308eb70fe20d96d5142b62
SHA512 3e60e651b2fa17987043d50994b3b832da2e1edd0c7c9462bfeb5f21fbcde7bd2a1cd202807e4afd5fee041c5582f07c207e17ff2ce0324658975ed9b7f52a47
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOektb:A3mnXoZjzyaEFkR4ugsOektb
TLSH
T149F45907D69400E9D11E8134DB954A12FB737C6257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 763KB
SHA256 4045e2cfa18a2d01350310e326e515866ac28d7a0a1d111751e65e8ef91d953e
MD5 04eca38d82c6f87e8d777cfcbdf712de
SHA1 1d30b56c88e18669fb0c05a9f82235794199d211
SHA512 f0b6a4a9aefd760d8eb94cfaa9787d9ea5b740d72eada913f61bd804d7c76e862983b3719a7341cd0545cdc774baf4a2234995c663c623a0d9703768c43e0c82
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekdf:A3mnXoZjzyaEFkR4ugsOekdf
TLSH
T1EFF45907D69400E9D11E8134DB954A12FB737C6257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 763KB
SHA256 c451e041521d1b2d39f5d86aa7521cae39c69b29269519bcd803d71d2d52ac99
MD5 80ae8d00808b32c2335e2d0cd71cff46
SHA1 ca7489e9d977647e88b13c981757bc743ddcb38d
SHA512 7c968355d161db44750928d8eb661a0b39695f2230835fc015c02e4d6949fb7ec3f310804eea7aa32d14250566504f5775a07445015128e357083bd7a245681b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekGK:A3mnXoZjzyaEFkR4ugsOekGK
TLSH
T1E4F45907D69400E9D11E8134DB954A12FB777C2257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 763KB
SHA256 acb2c0e52690c476eee1375e354a5348404ae40efdae02db1364d273d21dd2f8
MD5 198ef8cce6ede98e2e5efbc30bfd187b
SHA1 324d6249643e111184df5bd700487a718c3310a0
SHA512 1e507d91e2ae3e0d1a54c65c471341f76cb8441eb3e9b130aa9be23e8cdb5910f895811a48f1f963c97cfb9012550f7dce100d95319647052a8ffe9ba8f30046
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekzk:A3mnXoZjzyaEFkR4ugsOekzk
TLSH
T12EF45907D69400E9D11E8134DB954A12FB777C2257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 763KB
SHA256 4506a354f2e62873bfbd255523de069c4442219eabc3ec869b84ef25d019a22f
MD5 e18262667afaeeb467cf53a54c7ef74f
SHA1 6d9c267105f40152b5add9e4cc930e92e955712a
SHA512 e83d508471f9cb333cad205710f4a0532cd45593a2e98fe5317062afcd379669f99d359a9049898b3a497f7cbd6270c033ba462cda9b7e517dff2cd572b20a23
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekE0:A3mnXoZjzyaEFkR4ugsOekE0
TLSH
T119F45907D69400E9D11E8134DB954A12FB737C2257E096DB23E4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 763KB
SHA256 5e6871c4dc5f51d64450db8bbba17e4f8d947acf4198dbad0b23fdf5747309d9
MD5 adac1dcab2d3e08c16bf4ccbd48e0a11
SHA1 ff61913c9c3a24b5e199b5337f5fa0b4610be3e9
SHA512 5909047a0e76f087b29056233e13fc56f95dfa83389ec094ec4c16e2d6a9c4b7f41031bf0f17abbc47548f15068fef98f24e53353dee77a811635e4c2775ad39
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOek/70:A3mnXoZjzyaEFkR4ugsOek/g
TLSH
T1FAF45907D69400E9D11E8134DB954A12FB737C6257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 763KB
SHA256 5e776a6476120fbe0999adc5e586ee95f5c2e63d3faed73fc0a425f5a9bfe2e7
MD5 1ad04aa1999a6be467b17c02e7a5fddb
SHA1 e357abebe61b62102c2cfa86384b8af10fdcbf76
SHA512 f614d150c4dcc19f3cea77309f2b86626b55604af9e40925ff97da9b90aa134fe747b2652c60c59fca36f6ad31455fee8add209ed8ef68b1cd600bfa915e61cd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekSr:A3mnXoZjzyaEFkR4ugsOekSr
TLSH
T14BF45907D69400E9D11E8134DB954A12FB737C2257E096DB23D8E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 763KB
SHA256 73fc5469978399a2e79939bf13fe1e3bc5f42765b233ab3b6824abda44831f0e
MD5 bc511d7b58bd68ca2f33f166f2a23cb2
SHA1 4c750733859ec0aaf8d1e96ec73c923f3d4f91d3
SHA512 2020464317c963a8ef221479afcfc353016984a440d5f10ee0096794cc8ddc7b478f0c6a278072f6036607e3136d5c0228b6aed4eadd95bddc2de7092d127098
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekwn:A3mnXoZjzyaEFkR4ugsOekwn
TLSH
T16CF45907D69400E9D11E8134DB954A12FB737C6257E096DB23D4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 763KB
SHA256 8284efdcdf6e2dd02e808422db38348df620575e30115446047308fa565b7773
MD5 0d44f9dee13954c8e46a8530838343c3
SHA1 84ffceec1976433b2f369c00af5cf8227acab473
SHA512 8e6497bf841bf57c23858bcc39971da70b1e9ee6d05ace72c91d673c97f81af0a5569f80268907edd39d942241f4251362a2373c253c853554647e76f341f409
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekOx:A3mnXoZjzyaEFkR4ugsOekOx
TLSH
T1B8F45907D69400E9D11E8134DB954A12FB737C6257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 763KB
SHA256 c687d6060be1da8969f65f7e5a7b8cf586ee0ed508de5b2e5b4a76a1047e3234
MD5 d0b422f3b093d24bbdcf88cc5cae9bc8
SHA1 130ce21668b40081ec2d1bf4cc27c3a3a87fb154
SHA512 94fcbada081004016470c2d6c7dc5a62c054212215f263adb1e29b9dc3a7ea9600f8670d9fabdf2cb29bce46da4c3da6bfc424f3036d34b2df982463303ce708
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekoA:A3mnXoZjzyaEFkR4ugsOekoA
TLSH
T1E8F45907D69400E9D11E8134DB954A12FB777C2257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 763KB
SHA256 68121c5af2558833fcf4d5c124f1fe18bff8cf79237a29902e7fa996a09c07d9
MD5 9a528336cf2bfc250613aa061b08f734
SHA1 c997c4f89498689ea1950d8e865eefe577c2d8ab
SHA512 8a2f03fd4218f647d5444c3204292c61430fab2a825adc1d37d980ad6574be4dbd513cba8e2227419408608354f4f6ace2ebb364c4a1e46e8a3000d372cc86d9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekB9Q:A3mnXoZjzyaEFkR4ugsOekB9Q
TLSH
T13EF45907D69400E9D11E8134DB954A12FB737C6257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 763KB
SHA256 9d5277bdc757a282c0345ea1c67fe132a5e31aa397a79b3a14ff2088fe7cb638
MD5 c045a3423c5a5d9511466884b4aba5ad
SHA1 690c11c7de38f54dd9d4abc8ff0cff8141f1ef17
SHA512 5d943c094b534d472fbe0552b3d7e01545d3a1bc41ef2635bbc004a5597bd0222ff7fcd70a7159011de80f60d1dbd142bdb8deec73439623a04ec3365fbf8b72
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOek04:A3mnXoZjzyaEFkR4ugsOek04
TLSH
T178F45907D69400E9D11E8134DB954A12FB737C2257E096DB23E4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 763KB
SHA256 72d14321ba8ec8187bf53ed0df9c1cbf4f74442a51077bb7716bba092c081859
MD5 03498f28d366063b2ab84a1d64dac8dc
SHA1 d95b7f74eafe3e8c582f1ae6b4d6c7f4063f432a
SHA512 c5f801c8eee2abcb052d687c662fdbd5324ed9ea979468fc2f439245ede757787ee8f3eac4a03135a21243fb48dbcdfe304ee94dbeb37eea18436cdf3f89871f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekfu:A3mnXoZjzyaEFkR4ugsOekfu
TLSH
T140F45907D69400E9D11E8134DB954A12FB777C2257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 763KB
SHA256 1c7f15ff98c2e6acda745c862418f7bac123d0e3eecdf3d1e3f0dc319f2fff04
MD5 8f620fd65aa2a4f6e17dab31e79a7497
SHA1 ce812c7a8578a972693dc5ab1ced426402cde6c6
SHA512 dfbc9950129ddb0170d01324dfab4a092c5280c625926954d943ed74afb1af9b2c762c348f079c414e9bc72b1e5eb026788c88644f3b938987a770422d558d1b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOek6j:A3mnXoZjzyaEFkR4ugsOek6j
TLSH
T107F45907D69400E9D11E8134DB954A12FB737C6257E096DB23D4E23D2F32780AEEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 763KB
SHA256 d802449105b8f086c51930a59749b59de225e849ee7e1c52c8f50174729abe0d
MD5 0cb3b1cf8f490e69fef3d85b3c6fc89b
SHA1 e8713c56e9d6d03e790a8a3b23941b9442a98f23
SHA512 139eb922a1dd812b55ae75dee5c69e94b2c24b94559b60cd6b82920ec55d622d64776d7363c1e514c62fec7c8695ce86fc618aeaea86b526e732912c969ac207
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekng:A3mnXoZjzyaEFkR4ugsOekng
TLSH
T18EF45907D69400E9D11E8134DB954A12FB737C2257E096DB23E4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 763KB
SHA256 2bf89b2e401d3b856af0ddbb263e063c62856e4bbf37574d116e6708e78c720e
MD5 d7ed85abad5df7d1e2f9affdd745e937
SHA1 b2bf52ab696ce89aaad0778a0a088c3c3f53622c
SHA512 eb1ea92da91c086d67ba06d9afef5f821c58387ba069dbd39ab50c8e9d6ba10c1e6e95b0d0aed7becc579341dc4b273e73ed65362a3138043f1af55919fed000
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOek6I:A3mnXoZjzyaEFkR4ugsOek6I
TLSH
T132F45907D69400E9D11E8134DB954A12FB737C6257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 763KB
SHA256 bbe413160030dc0f4156f0f4723f8b671b10595ee3118dfc74a39e27bb54ba11
MD5 c42f9a5f4a80b13f0f9e1366ed75b37c
SHA1 01951d2b1a54451260540c9bcf250fbf79dca759
SHA512 e47da71ac65176c3a6a001bf0349a2703d52826a20af53420d2b2e5e74c19cdc9d85e32342e41d807ac7362ef6098040a4dd16854f008d20237dcbee9d807b09
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOek4o:A3mnXoZjzyaEFkR4ugsOek4o
TLSH
T19AF45907D69400E9D11E8134DB954A12FB737C6257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 763KB
SHA256 0740b2c4422afff1afd6991d11c8baa32537f052b1b08a70512331f7ecc8279d
MD5 85f100517e3b604e603615ac2fb1fe54
SHA1 e92961fc7f8adc590aa9202404d9adc1a1a2878e
SHA512 6fd1f26a13092e7d9933d66eedc3c70c47bcba08cae22f5ac7effeb88fe167c4f4b2480d1c2bca1064d4d1ec1d03bf145256b9443e8486d3e186916e30af3a39
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekL+:A3mnXoZjzyaEFkR4ugsOekL+
TLSH
T181F45907D69400E9D11E8134DB954A12FB737C2257E096DB23E4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 763KB
SHA256 8dd1c364b834f9c1c08d808f6521ed2ded2474774a3c339789d3ef654fd4e201
MD5 22d8e07b32afae277dc01da4fa563882
SHA1 1fe71fea7499bfab9a3b4d6e664b472032a83b3b
SHA512 882e982a21b93b03a9d8cb0b840e8af08e0cd082a1cc6aa2d963e59b9fd3e651bdd423331082e8c3f6c6abdea17e37b0459a75407b8139c802e744c564009029
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekBQ:A3mnXoZjzyaEFkR4ugsOekBQ
TLSH
T131F45907D69400E9D11E8134DB954A12FB737C6257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 763KB
SHA256 9219f6aed30558d761ccc93cb85ea9242640ed775d82f4022cb7a578a512f20d
MD5 dfe22713c14e1fe185bd5c7a80ed7a9a
SHA1 4a61e694ec36ca1286ec56a682f29e796c7ec21d
SHA512 e20319e74cce1359765df9187530af237ab37299a717d274b8f1c942d5b081bbae13f2e9bb71ec2bf1c23062cfff96fea7c5f73d6d3ad468613fcd51903651c9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekGX:A3mnXoZjzyaEFkR4ugsOekGX
TLSH
T178F45907D69400E9D11E8134DB954A12FB737C6257E096DB23D4E23D2F32780AEEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 959KB
SHA256 7e294ce6aad8240015147a1c0a7a6fca5a0936b5dbadb5b5c80efc3ac93c5ec2
MD5 fae637be08f55bf65456c19e22f2ff98
SHA1 31255838cf21d406dad0d4abb0a76f4e0a764319
SHA512 2a0489151fac6ddcda5f66ad37b81487b1e19804d30616545a4f740412b270b86e9db33df363531b099a4ed33255af449d5ce4c92a6f18fa85279137fe1dcfa9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekMQ0dWCXSyCq7IwZ:A3mnXoZjzyaEFkR4ugsOekdjCXF7IwZ
TLSH
T1D4255A16D69400E5D16E8134DB964A16F7737C2207E096CB13D8D23E2F227D06EFA7AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 763KB
SHA256 3b81ac001f7db3fb51b295ffd608c400e1caaa25a507548e5bd035f6a97933bf
MD5 4f7aa0a331249dcb2b02d5208c4a6559
SHA1 d46532b36866309fa197fc39a746c3edc0e6e163
SHA512 48c50bf3f1ac65be7b93d197b927a0d2c8f65c509d640a1d3ede310c00936c46bf2404813ffdcc9038b2d862b79ff376f6c0834bf95eee4426561a763bdf4f70
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOekAL:A3mnXoZjzyaEFkR4ugsOekAL
TLSH
T149F45907D69400E9D11E8134DB954A12FB737C6257E096DB23D4E23D2F32780AEEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 763KB
SHA256 8347ec842236950e3db8ca971b39fe531c6175eff954cbdbd7fc8383af378440
MD5 f3f6d145cc0108205a888a8c24001dc1
SHA1 145c2b15ba4c020a6eef1a92653ee04dcc63f58d
SHA512 5bda342ccbd6a4e0f98d54333301da6493ee0bcb7f84ea58a543260e78d6e7a91cc3a1e092e2a29c899b9fd8d2966fed3c783a909943119f8e8bd70bee15668b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOeksFC:A3mnXoZjzyaEFkR4ugsOeksM
TLSH
T17CF45907D69400E9D11E8134DB954A12FB737C6257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 763KB
SHA256 a39e4da0d72e4ed33288a5f572c6ba21b9f76069574bbbf9546b1eb556743e12
MD5 587f1e15ff4655aed43c92ce4c318e43
SHA1 7eb95a1c6a09dcb4f703adc7f8add58ca21252eb
SHA512 32cdb080c58e6aabe38185275b1c8177518d33c6cbd738ac95b5f8bc4451e2eb88bfaf9ce5dc3ffa0368e39b943e7eb08e2e90cd2057e317dacc20ccff9aa760
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsOek1h:A3mnXoZjzyaEFkR4ugsOek1h
TLSH
T1A4F45907D69400E9D11E8134DB954A12FB737C2257E096DB23E4E23D2F327806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1380-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1380-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3056-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads