d36ec938ceaedda91c9f84824fe1b36e62c5eefa0db21fed902f0353d0b78141

Analysis

max time kernel
106s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 19:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 876KB
Sample260712-xvmgnshx2v
SHA256 d36ec938ceaedda91c9f84824fe1b36e62c5eefa0db21fed902f0353d0b78141
MD5 a71942cac35bc9c32ff41588f239953e
SHA1 180d5e8234394d43807e9861c2de1ac7a6985532
SHA512 5ff406b29143514d29bb52e45d6a98f67cd40f2ed96177ce0ee4cfd407dc19eed403af5093cea0bf27a45c29bcca46785e8cff7e19b5d4de082c8ea89cee8cb7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxw:A3mnXoZjzyaEFyKUlEi/wzy5ldxw
TLSH
T1C515AF03E7A410F9E55B823499E54A12FB75BC621B70C6DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/3776-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c584-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3776-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5000-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c8a-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-238.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-445.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-567.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-610.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-641.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-726.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-745.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-794.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-825.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-857.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1083.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1152.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5b2-2151.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c000000000138-2153.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c584-6.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c8a-60.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-238.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-264.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-445.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-494.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-567.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-610.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-641.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-726.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-745.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-794.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-825.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-857.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-877.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-896.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1009.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1052.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1083.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1132.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1152.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1185.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1325.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1344.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1376.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1383.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1401.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c5b2-2151.dat	aspack_v212_v242
behavioral2/files/0x000c000000000138-2153.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5000	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3776	2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
5000	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_a71942cac35bc9c32ff41588f239953e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3776

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 876KB
SHA256 d36ec938ceaedda91c9f84824fe1b36e62c5eefa0db21fed902f0353d0b78141
MD5 a71942cac35bc9c32ff41588f239953e
SHA1 180d5e8234394d43807e9861c2de1ac7a6985532
SHA512 5ff406b29143514d29bb52e45d6a98f67cd40f2ed96177ce0ee4cfd407dc19eed403af5093cea0bf27a45c29bcca46785e8cff7e19b5d4de082c8ea89cee8cb7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxw:A3mnXoZjzyaEFyKUlEi/wzy5ldxw
TLSH
T1C515AF03E7A410F9E55B823499E54A12FB75BC621B70C6DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 0fb6e3c0bf1120f169578fb2de0563e574c186980bedac0027f9e720ac1d5b79
MD5 c086f9f174d87812dc4594b5d06cc0e2
SHA1 1697edda75d94f9f95939b6067638ea173205da2
SHA512 73ed35eb31672496c45df537273c33494bf3bf76fa34997b5695008afde1e022aee2efc2b013a1048264031df83ca7259706b0515ab30b4da944d60f65364d8f
SSDEEP 24576:A3mnXoZjzyaEFyKUlEi/wzy5ldxI0Le5ji0hmxNrM:A3kMjKRHPji0Aj
TLSH
T1B4657B17F6A402B5D077C178C9E2965AEB7138921B308ACF1399C7292F237D19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 891KB
SHA256 4055f8b7cb4649036943043238f706ca08ccda5f44e96397855f8a52f2fa8cdc
MD5 83a50828a523ed6a42cc052673f443ef
SHA1 1a2c334de44806cb419f4cad4b807b44a01e22ca
SHA512 f31d0f79c6ded0af2b17f38e00a78e0630a6f217e177017697871b4f240257d2e58bcb7f92c16fba1445de7a7a165df7af4d6d0553c608dbfe6ff05b0a04d997
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxya:A3mnXoZjzyaEFyKUlEi/wzy5ldxya
TLSH
T1F015AF03E7A410F5E56B823499E54A12FB75BC621B70C6DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 924KB
SHA256 ecc693ccd7d651b894cef4f1e549c67881023242a6e12fa8263b3d0c4f613855
MD5 f6dafc08a0c59b9f287411b195eb620b
SHA1 ac3e4e0c9a1b43f0b8cf80a109e10d8d3829f2c8
SHA512 3da6058ddd4594a3724d9d9293332cdfad913056d93cc48a2cf1050823a070a84ff53a222f5b72042671b01ce97a22bec0dbaa9dc45f36b7d4d91530fa83ca6c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxRb:A3mnXoZjzyaEFyKUlEi/wzy5ldxRb
TLSH
T1A515AF03E7A410F5E56B863099E54612FB75BD622B70C6DF235882262F237C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 900KB
SHA256 19e04178858092d1c8500bfd97ab71861f3be007b58495287edcf7a82fac8416
MD5 82dde849166c02da63ec904364a5af18
SHA1 b926b71cfda8b33725a9c7f21455f102c7a0626f
SHA512 b91b2f9c5ea4825f40e749e7bbd9f28edb474385432225479ca7c6f83b87fa1e8104329e9a09de3da085822540740fa8ab620d66474e6c6ff1ebf6f474e48b99
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxD6:A3mnXoZjzyaEFyKUlEi/wzy5ldxD6
TLSH
T18D15AF03E7A410F5E51B823499E54A12FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 900KB
SHA256 c434621924e74ba3ee712241ccd4a6556952ec947342a3c65673d93423379863
MD5 80dd57da2e8562a657af251955fbd5fc
SHA1 28294dcebde76c548b54b81bd3a2b173d9f508de
SHA512 fb37431a477f262cd91ce0c1f7b1aa146ec379883f6638181625654f49116b3ed8a599cb3765c47bd7632c3ecc9d577236e64e8ba5b1f44a414158cc41f58abd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxNo:A3mnXoZjzyaEFyKUlEi/wzy5ldxNo
TLSH
T14D15AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 900KB
SHA256 12ccf8c76836022ee30365b48de3fe6e53b9647d085a0249705c6e46e63758e2
MD5 b7590a00b9660efe3b906a7722e6a583
SHA1 607ef3cf534d4cf9db661c71333cfd7faea24c94
SHA512 89c89dfbcd557c386e9947027ab8faebc758ca927aa6d1685b3aa4d2dadd5f6823ab797f94a723b5996b420806abefbe920f93269d3f4e55a745efab813ccde6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxNu:A3mnXoZjzyaEFyKUlEi/wzy5ldxNu
TLSH
T10315AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 900KB
SHA256 737cd2ade404b1b9f9e7f3fc6e9d70e73dda7fabd95ab2f3e4086492fde1ef86
MD5 50f412e8ab37fa040a89824366dedc3c
SHA1 385f490f014a8be396a718a309a4e11a9f71cef5
SHA512 53aece883042ee484c5f626ba3379d13046b1a4610f27c7ff2e676dadfdc4364ca22652ab7d5cb652aa6f0e4449511a6bc5da429bd0745de0483c260ef032d1b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxj9:A3mnXoZjzyaEFyKUlEi/wzy5ldxj9
TLSH
T1E515AF03E7A410F9E51B823499E54612FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 900KB
SHA256 c6d76a47d831ad60d3a5ec880c77b84d17b8391db42a2f368ace2710bff55969
MD5 e0b40e8548bd39f43cdd749750be66d2
SHA1 2f646a913ca140a326ffbc3c03750540687e1828
SHA512 c4eef223f338808a83ec4c4a41f93320426c68e192a86e906a1bbbe98efd01f313a5c48a558501c3e5318c95afc1a82e95c93d1010e5d8c54898c7eb31d11b1e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxPc:A3mnXoZjzyaEFyKUlEi/wzy5ldxPc
TLSH
T14615AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 900KB
SHA256 95467928c673b432779b25d43f525bae0d9bb3cba15ed2166ac04bca6189e3f7
MD5 46486df6210f9f53b49b314544abbbc7
SHA1 4b40c427aee11dd4e08bdd57de9afeaeb7f15a9b
SHA512 b4cc119e9f2f60893a129bc5149944a113094d32a37bcfebbaaa19f7863c1a8cf4d2528d9301a491d318cb1c15190335c8344d0840c7d0e79da618e46dc2a877
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxIp:A3mnXoZjzyaEFyKUlEi/wzy5ldxIp
TLSH
T19015AF03E7A410F5E51A823499E54A12FB75BD621B70C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 900KB
SHA256 ccef4a30e77e8e4cc7f19eb0954ee15af56728ada83faadd152751345b9fde89
MD5 c754f56633f1a3eccab09aba054a1317
SHA1 c29264fe0a87d8ca588624d02cf4091369441f49
SHA512 94d625d8af9871af4a7a0375e6fda2af1de5afdfca7d364bc09ebbfd904a9f9c45978c6960ec6f4066e5708585ee5fd601de3c6c3581570a9a7d88574a0b7cb6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxf0a:A3mnXoZjzyaEFyKUlEi/wzy5ldxfN
TLSH
T1D115AF03E7A410F5E51A823499E54A12FB75BD621B70C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 900KB
SHA256 f939159b892e56fd18448b1959c6ae38d425072ad87de11952dcaf22985987c6
MD5 7582a561d85266b9555961315203bc88
SHA1 66ec82ee5bff0b52a19234fd9a532657f0bfa20b
SHA512 9282deac7edb7cc49f9d840f4c44bf07068832c8edfd3a72f541e4f74d11e64f9d8e4e262090ba432f6aef7ff78de75bc2cf80b57235ad56e62e80f63a8a79cc
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxdF:A3mnXoZjzyaEFyKUlEi/wzy5ldxdF
TLSH
T15715AF03E7A410F9E51B823499E54612FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 900KB
SHA256 a4405183558b01e40f32533cd57356f08350b9bc84824e1775415be724f55f7a
MD5 df0bb06802336b67a5ce33d8a9f50b8b
SHA1 5116a9a675b76aa2c4ddb9bbb9e1f7c32d38d6b7
SHA512 6b4ad3d0b9832a8560d96a6f4a6bf86a8f39d1306878399b36c4bec59edc74a30d1e07dd11732d53b57009cf71eea18f614bb096c5964553a7368132db3ee916
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxuC:A3mnXoZjzyaEFyKUlEi/wzy5ldxuC
TLSH
T17F15AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 900KB
SHA256 bc7112d5f27e5ffe9741ee470251e17be158b39118c6fac1c7eed33b079dc1e4
MD5 d5b2744abf25718c6655b76a44b21b51
SHA1 bbb4d1be366c45466f95e569d792278db840a5d5
SHA512 650065cf7a2c517a0640aa0b47518ac6ecde44ca8c7de920ffe672cc4ed6bceb58a6b1b1bd98141212471711a4395d70c695da9a3b6ceb8e27197fd739252c24
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxxw:A3mnXoZjzyaEFyKUlEi/wzy5ldxxw
TLSH
T16415AF03E7A410F5E51B823499E54A12FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 900KB
SHA256 cc9d621d77246712b647dd6204966a292fb3bde598506f0e48fcf3cf0b39727a
MD5 323baf0e4c9d29e3cce8af1ab87c4a08
SHA1 46b565212a8cbdd61510e29dd7272b0341e7dfd3
SHA512 5c5466c208885450aadb38469823f29a65099161609b8561b1164b021b1202567e472c230fd6b6bd99596edaf3d5ed53c00bcc11cfc943e339c2ffa485a7b629
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxYT:A3mnXoZjzyaEFyKUlEi/wzy5ldxYT
TLSH
T1EE15AF03E7A410F5E51A823499E54A12FB75BD621B70C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 900KB
SHA256 f4f7a75489fce6b8bfda18839709b70c6c45c9478b2fa42b9b8fce0911e1ff60
MD5 9a5e5a65bc1f5410a4589093f134f2ab
SHA1 c426053bed0557ba8e08e379d42fe7424cfb4fae
SHA512 5fc1acc70551b5e9951fe0e7b005d90581e5ade7a9e62f5c2864310b84e07eb67028f9bb006aaecd668b48e8fe71134731518c34764e3c49175c45feedd9ac7a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldx0u:A3mnXoZjzyaEFyKUlEi/wzy5ldx0u
TLSH
T1B815AF03E7A410F9E51B823499E54612FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 900KB
SHA256 bf394f1c67c568d1acee4081801289a775a54512a464a15b1888dda6326a829d
MD5 9e8caa3d39b7dc07b5480ecc299ce483
SHA1 fc81d0553a6ee91f7e84d82f4ddadf7c57c0e6a4
SHA512 a300e5cf141b04e334b08f20f2d2285eeda8f3bb299814d88d80f7908c35bb1364839c2ac7374a6037bdc15215cb0fd7e41cb9381f6aadc9a9d01cfcb3a6133e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxib:A3mnXoZjzyaEFyKUlEi/wzy5ldxib
TLSH
T14015AF03E7A410F9E51B823499E54612FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 900KB
SHA256 4b17ecd3d52e8038618cc0eea88a2ed86cdad0e27eeba0011033bc3fbcfa3499
MD5 2ad1ef8f084d8cf13adbd4ea17c83c8d
SHA1 1f909eaf7ed66fa832917dc7a95fa8ea482c9774
SHA512 e4c03284e470acbf2d5670fa966ebce1d5839a9e39806c410fcc891a4a5c648d16af6fd229ec50cb53897e7469d84bab399172e559dbdacdd10af8ef514db3e6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxkf:A3mnXoZjzyaEFyKUlEi/wzy5ldxkf
TLSH
T1F415AF03E7A410F5E51A823499E54A12FB75BD621B70C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 900KB
SHA256 2f5155a21f40b6eef882aae65c1f2edc307adfcf17bfef6f3029ef68fdc5ae35
MD5 24687fefff8cd37176254bebafae8193
SHA1 5f07a16b68baaee7cfd6c4df0bfb604b1b0e1469
SHA512 7bde03b6e40664849b3fa21d301e4924612bd38f6ea1528af6e61ee4518e3999a5536cf028c6ebcb1f107e21b0a49dd76520c1f16c6abf53efcd53bd094251fe
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxBK:A3mnXoZjzyaEFyKUlEi/wzy5ldxBK
TLSH
T1E515AF03E7A410F5E51A823499E54A12FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 900KB
SHA256 7037245f4b6ef87a3f6a1f48dda55640af502c98d2e3334f0689bc59dd4311c9
MD5 51c6339d0053e65613e240b4040f738a
SHA1 e12b467aab2746f731df999e13cdea910ef0c51d
SHA512 740a4f9f261b030fc01da88b754c9a9361f154106f184e7ef879ae958aa504fcea9993d4352ed7a26db02ae7a77f967f7eda1016614b95b6cfd3c69adfc2555c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldx6k:A3mnXoZjzyaEFyKUlEi/wzy5ldx6k
TLSH
T1FE15AF03E7A410F9E51B823499E54612FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 900KB
SHA256 e8125c466499bbbb5e6c8cf94b8e3a574e63aed9ed12627dae627c44e19a4d97
MD5 13792ed65794140f9183adaaed9d3849
SHA1 2ebb49d7427ec878410560c9a73b19c9af09842c
SHA512 2160c877f2ba0e1d4df22a44b3e85ecd4b4a2b41c00f6502a31de6bbadcbd7e10786b66038246a062ba18fda57e23ea9da52859da6e5147753bc8b13ee1892ed
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxf0:A3mnXoZjzyaEFyKUlEi/wzy5ldxf0
TLSH
T11615AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 900KB
SHA256 b0a17b6b40dd1906424c40f26bae07106ea3cb8ba4436dcb39a3aa58dbae0077
MD5 537b158104154efd9d53d1f49371f9e5
SHA1 f68312af817fa7f083d7f54e1e86ab232a3a172c
SHA512 17dab38efce632326c4996088054c043ba29666d0835953fd9c0b0990dd0849ca00e8ddff0218c0d18aa3f440d851ff68c831920f94ea6ec5aa1b274c0e8c6c3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxu70:A3mnXoZjzyaEFyKUlEi/wzy5ldxug
TLSH
T17115AF03E7A410F5E51A823499E54A12FB75BD621B70C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 900KB
SHA256 0f7645f83591988289a3b1813b437817303eb078719eb434043cc17daface57a
MD5 49974d3f22b968baf637d7f3c6151d6f
SHA1 41b97bf6456973b2fe521c4c7f0db3aef85801b9
SHA512 39f78ee943b7f78df19584aab0a8dbe5d975d10012dc9ba3516f866a69157567086d4795d75db1354a3818f7a68ddf1125baa507e4d6d695c1accdac51bcc1bd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldx3r:A3mnXoZjzyaEFyKUlEi/wzy5ldx3r
TLSH
T1B215AF03E7A410F9E51B823499E54612FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 900KB
SHA256 4682eff173e7c1b2b0271c661831a7642b67494fe6e95b92337cf95c003fe004
MD5 410cb8965960f912d1377747a91ae749
SHA1 95a322ee2d42be14d6af63fd7656ffaf9a266b9f
SHA512 97701b7ffec5c1efbccba50acdb8d96e46929c90e5fee9c1c0b5f0f91036c5125184042db6f741b5ffd691fc1e4aabcaf67f88a9a47ed6f46865eb66c84f4dae
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxBn:A3mnXoZjzyaEFyKUlEi/wzy5ldxBn
TLSH
T1E715AF03E7A410F5E51B823499E54612FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 900KB
SHA256 6f26c49095504b3fea84e525f1ad5bd59e5351bf7ed4f51a397d9802c5f8b1bb
MD5 eb0805e420d18bd1aa0bd7cac61413ae
SHA1 4242886fbeadbec3fbfcc566df0792a2d2c978ef
SHA512 a6e705d9596ad4b889b629f232851479d710f1088bad8fa3126aca8edab36ef0e422379293f899d66704b439dd46c36293e471370c891e73d22198b2ab5d6b55
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxtx:A3mnXoZjzyaEFyKUlEi/wzy5ldxtx
TLSH
T19915AF03E7A410F9E51B823499E54612FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 900KB
SHA256 495c3735564bf6a31a8e540f2647d2607f88d85f1e4aab808630dca9a1d07d2f
MD5 6d51ba901ccda60a715907e27bd3756d
SHA1 4b6b6fd27a20c9c354b124709f907843a5d6eaa8
SHA512 9044e46c7323fe3b934efbeb677c5bd992c6496174fdb239a0983b5b49f585141e237da92b9a4ed09173400cb18be684dd02669667f5afa7d8db85d660690704
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxzA:A3mnXoZjzyaEFyKUlEi/wzy5ldxzA
TLSH
T1B915AF03E7A410F5E51B823499E54A12FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 900KB
SHA256 8f4b823698fc7250c937174e174eed28d9e975a3e8bdc9f6ff72988f5d241435
MD5 93589d99afcbdebdfa7dae7b14958c01
SHA1 69e5dad231ef0de54857644c7bbf46f524e9bbda
SHA512 1da984edb9646ab98f68e75ab5a34a78cc5dd4861b002516edf379e319def1372525888966122ea3338d4f312b174b8cf8d8b1d95b69213b46dd975bd7f0c03a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxE9Q:A3mnXoZjzyaEFyKUlEi/wzy5ldxE9Q
TLSH
T17215AF03E7A410F5E51B823499E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 900KB
SHA256 117a58ba02e7aca25d600365e8ed7e3eb11ae47c73e14d065768e5962642893d
MD5 c986e557f441c4fcabc3e5188007d831
SHA1 8c34cbc927733dd6b7ac3c0718edf43691371eaf
SHA512 98b0d79f81709bdd5e4506d9352c1b116ac477e541059530c76fe17782a469c0eefb4a93eb2678131833af18cd7f1003333506004b45d96c37a29d8457740dfa
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxd4:A3mnXoZjzyaEFyKUlEi/wzy5ldxd4
TLSH
T15815AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 900KB
SHA256 f958b6b001b1e27b7f87df564de50003abb5bdfb39a46f08fd7f8adeeddc4b3e
MD5 f1a9e2fb842344f6229cef8328db1384
SHA1 7963b77b66af0d35736090a1ce7b64d13639120c
SHA512 e7acae86681a20f170058e91f9220e4c0dbfd9d968c8388e1fb995586a78f92f63b0bcc32ecaa6b87821a7be2371c86c00013917ff96c0f91a0a935ea91519ff
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldx4u:A3mnXoZjzyaEFyKUlEi/wzy5ldx4u
TLSH
T1AA15AF03E7A410F5E51B823499E54A12FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 900KB
SHA256 8bee5ee958f7482799bb1fe13cdb4ba78ce2432328aa0ec5edfdab8acc5edd0b
MD5 330103c5b5d4f6d4a264e03bb5fc9ae0
SHA1 e50a4214e5e218fd40ffea18fd9fd75b80b63161
SHA512 2458b3c568e44bb2d88f75ec96e79e3bd391484bb654e233ca69e333053bc248b10a46a6b69bd0f592541b765f9ada753cb2315ed303a3e94a842f062e82af7e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxZj:A3mnXoZjzyaEFyKUlEi/wzy5ldxZj
TLSH
T15F15AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 900KB
SHA256 8f2268488f5d9105cd27b917190c5223e55d1eea1f9517e90b9c34794c615b5c
MD5 253e6eb6e48d9b9ba30217dfe4c9c8c4
SHA1 d187fe8426ef0f51b5f031a1114dc0d4d0beb900
SHA512 fafc098a12539b51350c52eefa21f92d4615d0056a811c3112af80d16b176c8add8074ee12c8368302bdd88ba51bef2c8da3f645b108a7f117c76d4e40771421
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxAg:A3mnXoZjzyaEFyKUlEi/wzy5ldxAg
TLSH
T11E15AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 900KB
SHA256 e8f18f5793d323287695a6e44c586e729bf3e00bcbdd2b82141d0409caa76b42
MD5 e1af23678463db21825a0fd4b32cbf39
SHA1 c1c1b3dbefeb73e8b99f058d382ec560c5df6251
SHA512 3869f0d26fc4ee5e4cb2b70f065ef58019d5fc6a7a6a01fd3691e98ac3488a91051f5a794f46540ae11087dfe4ce39965eef3438fcf4cb43b79bf2027df33922
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxvI:A3mnXoZjzyaEFyKUlEi/wzy5ldxvI
TLSH
T1BC15AF03E7A410F9E51B823499E54612FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 900KB
SHA256 a67969df3dbfd8ffb4732473a6ce9583afb761c3883606afc19290b5960706b1
MD5 dcb20d27f1058210df2aafc5f81793bf
SHA1 da8eaed5a0c12f60e88ef852fc8c0a739726e20b
SHA512 d5dc2e3f5385b77fbbd5c9328eb10cebe547f34f18ed60f266290af042b5287b81f62b32caed1c787f37f0f5eac586605df6fea95767ff5ff96df9e63b63747f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxVo:A3mnXoZjzyaEFyKUlEi/wzy5ldxVo
TLSH
T1E115AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 900KB
SHA256 d6b49a3bc7cc91209e8feb90d2965e6a08bda986425c0e24c23c52af0a5829aa
MD5 9e394ff0275c1d8767c4be24e6995325
SHA1 538c3ecd2ad82fc3ef0fc64433d036a009c5d7ab
SHA512 abed6ca64f53a8004033199df498abaf9ce744face696a0eb15e41aa4c0b84f96d83cc6ede96c0855801868bf21ae8dfa68af3b1333158ff1bc7b2ee4dd16feb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxG+:A3mnXoZjzyaEFyKUlEi/wzy5ldxG+
TLSH
T1B115AF03E7A410F9E51B823499E54612FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 900KB
SHA256 49f46b850047c0cf960069c515702e4c685c7039950f36ca66408ea4031c24ed
MD5 eb01b63a9b2dba9ab40d6a7cb54effac
SHA1 6005544d7ee7f82c1a9a3f1bd23612aa6b339184
SHA512 34f6853bbad97c63808d0869c1e785bb387ff0415092b4ce693c55290d230f23c9a21a1b7618ff22e760cd3e9216f1869e15833ceb689a5caf12029a36e65b87
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxGQ:A3mnXoZjzyaEFyKUlEi/wzy5ldxGQ
TLSH
T19615AF03E7A410F5E51B823499E54A12FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 900KB
SHA256 4505fdf06ec2488ef55b023750a82dbe885e4b28ad1b1a1586a38cb346d3bbe0
MD5 1cff07f43fec3b96fa72c8baaeec8e81
SHA1 5e2c0f40d1037933d080796db7c2234a2454ddb4
SHA512 2ddfcd2d7c42ea84fa0017276ef1d4267b4e02a3b2d39daece57589fa3d2bb64175b4f3122feeead4030b6b0470676fd27a14df8f1cef065da8529bb39d53e53
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxXX:A3mnXoZjzyaEFyKUlEi/wzy5ldxXX
TLSH
T13615AF03E7A410F5E51B823499E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 900KB
SHA256 72809255ac0e29b9682eb07072e4d5488f3ccafbc415084f793e616f827925ff
MD5 7ea1df3904b1ce679753df25364c6a9c
SHA1 8f18ed61c989569a48c73a455f29807379b854f9
SHA512 f9ce7baf496b076cd77c2e15f2a73afe1b61fa903934ae7e8b305de7bdc4a059cc0b713fd7b89718a2e9eb84a420edcc2377420e92b630052e691843dbdae061
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxNL:A3mnXoZjzyaEFyKUlEi/wzy5ldxNL
TLSH
T18815AF03E7A410F9E51B823499E54612FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 900KB
SHA256 0c5b6109956c41d435625920fd76b95299513655c51e504609dede390c527177
MD5 5c2336971b3a67eeae1990994f3fbb00
SHA1 4c3477ef64ac715d0ec3a32e0c85e2062e9b6525
SHA512 0e60ab06dd0bcc1f47f91c534a59559df6bb120c62049b0ec295cd7c790581df6f2d2d434030bd0ffaff5e699a64becdd3687f327b48b4a2fb42e011c8d22e6c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxLFC:A3mnXoZjzyaEFyKUlEi/wzy5ldxLM
TLSH
T11E15AF03E7A410F9E51A823499E54612FB75BD621B70C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 900KB
SHA256 e6656ac1a46de6f8af00ab3b72d8c259dfec1f3e26e23dd2cd4cd71e29ea6558
MD5 3f8661fefbbfbd68461ad37f6c893642
SHA1 8019780b9c9781c6521be470718ac0e007a2d43f
SHA512 6bfcb148b9785917809d7eac2c8f05a5ae36ba8ed6f742a0b72da0a70d9e06d233eedb8bc07d2b09c1327565bd1c9cd8d962c0718521b726572416a88d79efc7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxMh:A3mnXoZjzyaEFyKUlEi/wzy5ldxMh
TLSH
T16215AF03E7A410F5E51B823499E54A12FB75BD621B70C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SMSvcHost.exe

Path C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe
Size 1005KB
SHA256 c2b89cf1ac7b4487f0dea0d1e7c9ea98bec624212cb5e0a230a9d2861cff5f7e
MD5 96fa0ad288066978695bb2d230ed2f99
SHA1 fdf5e02d6977ffbd0722fe9c195e459863b7fc48
SHA512 c7823e4314f5813843088a28787a79f077a262d1ae90a581668eba27c6a64b0e131d040f3fdefde61259d26cc2d902d3a3c0387135b51a5c35aac56ae7149bd1
SSDEEP 24576:A3mnXoZjzyaEFyKUlEi/wzy5ldxFccx2w6:A3kMjKRAccow6
TLSH
T1B325AE03E7E404FAE56B823499E54612EB75FD621B20C7DF235882252F637C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SMSvcHost.exe$

Path C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$
Size 1005KB
SHA256 aba2a6c7ee6cf829a5a2b0bb95918f070d7032b9bfb6d1c2f286be9472cc5aab
MD5 66a66c503eb4a5f9939a51704b02e363
SHA1 7828f6f0c4cef1d61eadea10c4d1befc7634d019
SHA512 40fcf58438aef8054165d5c4dd587f83bb2e1e1560b8559e9a2260521637459432bcb4d1a0fece829ab461b03b8499263a35a7b2fd9c605003dd1ec69db2725e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlEi/hyPz5L85ldxLbW3:A3mnXoZjzyaEFyKUlEi/wzy5ldxL6
TLSH
T127259E03A7E410F6E56B823499E54613EB75FD622720C7DF235882252F637C0AF3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3776-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3776-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5000-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads