e81b4ec4e38a953feb0b6bc7839555b9103a0854b1cade9860535a2548eae4fb

Analysis

max time kernel
110s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_9dc0829f637fad498c6b36c55092a1d7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 919KB
Sample260715-nsxp7aew81
SHA256 e81b4ec4e38a953feb0b6bc7839555b9103a0854b1cade9860535a2548eae4fb
MD5 9dc0829f637fad498c6b36c55092a1d7
SHA1 451fc11a05e58e9807c45282a5c4a94636b0b4dc
SHA512 96ff6cda92a9d64788b068082a43ca062c00ae6b95116873a8c901c48784a760b67e0f0210d144a634dc5df0d4df938bf547e27c8b90d718e1af9188bf851b6e
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTp:A3kMGT1Lljt
TLSH
T15D15BF13E79014F9E9178134D9A54A12EBB1BC261B60C7DF236892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/5612-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c531-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5612-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4600-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c95-59.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000018498-106.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-227.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-447.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-563.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-612.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-643.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-734.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-765.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-803.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-859.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-878.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-923.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-936.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-955.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1010.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1054.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1092.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1141.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1406.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c531-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c95-59.dat	aspack_v212_v242
behavioral2/files/0x0003000000018498-106.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-227.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-264.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-447.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-496.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-563.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-612.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-643.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-734.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-765.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-803.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-859.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-878.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-923.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-936.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-955.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1010.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1054.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1092.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1141.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1185.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1210.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1325.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1338.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1369.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1377.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1385.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1403.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1404.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1406.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4600	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_9dc0829f637fad498c6b36c55092a1d7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_9dc0829f637fad498c6b36c55092a1d7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-07-15_9dc0829f637fad498c6b36c55092a1d7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-15_9dc0829f637fad498c6b36c55092a1d7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-07-15_9dc0829f637fad498c6b36c55092a1d7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-15_9dc0829f637fad498c6b36c55092a1d7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-15_9dc0829f637fad498c6b36c55092a1d7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-15_9dc0829f637fad498c6b36c55092a1d7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_9dc0829f637fad498c6b36c55092a1d7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_9dc0829f637fad498c6b36c55092a1d7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5612	2026-07-15_9dc0829f637fad498c6b36c55092a1d7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
4600	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_9dc0829f637fad498c6b36c55092a1d7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_9dc0829f637fad498c6b36c55092a1d7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5612

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 919KB
SHA256 e81b4ec4e38a953feb0b6bc7839555b9103a0854b1cade9860535a2548eae4fb
MD5 9dc0829f637fad498c6b36c55092a1d7
SHA1 451fc11a05e58e9807c45282a5c4a94636b0b4dc
SHA512 96ff6cda92a9d64788b068082a43ca062c00ae6b95116873a8c901c48784a760b67e0f0210d144a634dc5df0d4df938bf547e27c8b90d718e1af9188bf851b6e
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTp:A3kMGT1Lljt
TLSH
T15D15BF13E79014F9E9178134D9A54A12EBB1BC261B60C7DF236892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 5cacf1fa31334da69e56fc744215710b2179c532790d5bcd3b60de1f9b8c4430
MD5 d55ab8217efc82c1abe6777c8ee935eb
SHA1 819a0e2a63d87446326f9e9f9a97828b1a4eb51b
SHA512 ce79c058cb066843f72e1637f843c96c7de4e20849e3745167637b903cf06e8cde8d70aa0c6885bc67f6f61a8895343e434216cbc6ecb27765feb30659126a21
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTV0Le5ji0hmxNrM:A3kMGT1Llj5Pji0Aj
TLSH
T1C4658D16F6B406B5D073C179C9D29A5AEA7238421B30CACF1398D7292F337D19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 966KB
SHA256 c52c0b6416898b2a1f26608d813ba5e675f856055340105ce7bf86b1811d3f68
MD5 d5e11eda0260bf05b2f7a82a81397978
SHA1 9638b462b7816ff4d0bbba74a61cfad82af05d20
SHA512 eced7a96a4db7f45daef995f4e0ce75f3643d0f2b7dd937e5057a957d1d52b2ca596118af00e7f1ddc333c60675ce921971c4b06a2dca013479ae18084596920
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiT0b:A3kMGT1Lljob
TLSH
T19B25BF13E79004F9E917823499E54A12EBB1BC561B70C6DF136892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 942KB
SHA256 33b4b6ecb9cbcd49749a0772510eb9f92a8af0355e7bcf12987238296950a0b8
MD5 7994da32b29127ff62f599af62fc1f31
SHA1 03536c71e4a91df0a36b0c551fd6df3db663ee7b
SHA512 15c8c723308e48cdc7af85f47717c381b61aa7b542ad9580fbccfaf25057a72ec3af9252c2a508c4cfcf784b57e573709cc6581b2c4095c953d5f700056a0fd1
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiT26:A3kMGT1LljF
TLSH
T10625BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 942KB
SHA256 0d729775a6a956e61561e66f5e3945d98da559f695e69cea0c07cfb42a3aaae9
MD5 19941e2917fc47375f441641532f67b8
SHA1 0a00e020e33fa5613bd9fac48862e2470f992739
SHA512 0d0587fea8581a7111211ca7735a86840c6aed236cbbf1e6f565a9e57732a6f140fb3b9fe3d5966c731f4a5b9cdbacaef39a756b3d7340413801f13419ef9b7c
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTmN:A3kMGT1LljU
TLSH
T13725BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 942KB
SHA256 09a749f4a8498677d5933b64f90a1e9c23a60b57dfd924db45a48510da0644ec
MD5 e65c89291b991b009990caf929efad46
SHA1 d5204c81ae9ad1e827c20ffc651f9de71ceb5b2b
SHA512 5d1239b9d56b31897db53dbab2788bd346b070840173e8dabd5e08caf3f78d6939f9f5f1e088fc941cfe2ffca05b97b835379f4213b2a2ce340a8f274af47860
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTkf:A3kMGT1Llj0
TLSH
T1C725BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 942KB
SHA256 a4c559639d2e5ac4518b39f99ad74c384d7934654ca86b812857143ccfda0003
MD5 07f13d5266f16d7ff10720068ac4a11b
SHA1 7257890bf7a5805a579f4104c4c31b2c71e6f3a1
SHA512 5930835426567f84e0c2eec2d9bd6469aae8550d726ca59f569f54ff94caf2fd19b7f6a89e74dfd843e61070925b857d634d26e5a0b0280d6dd9e66f125e3a24
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTOo:A3kMGT1LljJ
TLSH
T15325BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 942KB
SHA256 7de8f86b9cb40a059ae1cac8c50d7620ab08f162c67caf4c7ee36dbadf5b5ed4
MD5 5e9e86aa58c06747ae054a86e2487d75
SHA1 2f04b883ef028fe152bf5d5580ba4ef8d308a846
SHA512 da87ecb3d27bb075cb048b4b92d9ee90f431fdb4dc6cf884ebc899b48aa25e02be54b463fadbc8720d342bcff7d5cadf794b2160718176540baa078f2bad9d15
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTiu:A3kMGT1Lljr
TLSH
T11B25BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 942KB
SHA256 69bb6d694269a1213f14398273de18559f8d36b62bb689a7f458ac6cfb6c705a
MD5 bcc87af814a55a73642e9fcb77c25c72
SHA1 dd78c93170ca779f7916d27a392bf52eb2635cd0
SHA512 42c1b0dab8cf45c96c3a36ca4bb91d2e076a4fabcf399fca56c0ec5e4e90e7ec60fceb61221860ecca9f7ee9c684945c87f4f83230280b139bb69baa17db3769
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiT29:A3kMGT1LljK
TLSH
T10725BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 942KB
SHA256 c2c9004c1ad65ec7d15643b5baf415dd2d8396f2718b110769b7030fb071fde3
MD5 61aef34d13d82b737d4da8f810f86339
SHA1 9a7c327d77297e56a7bb45a95ed83e9b57071592
SHA512 0d4ff3bfe7a5fa9427716fa45deb129145020520bcd36822baadae5332b2b924bae61000071cb77119c38f0c81150671814b07e9223d5d2ce658bbbd60be161b
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiT2c:A3kMGT1Lljn
TLSH
T18225BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 942KB
SHA256 63d7de0e0b631061d1630053a947529f619eb991690770bb626e7564e48e8316
MD5 92fa97c919b3729b7d896c2131783de2
SHA1 4d554dba6178467a3406d8663cc68ad9eb89e9d5
SHA512 d52eddbd418e0c273565b1b4ba41f6d8d20fbe1d085c215bacf3613273a82f0002b72172df784c160f25b148889bb1527652f562f4db637d01e13c8463c5ddae
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTvp:A3kMGT1Llj9
TLSH
T15F25BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 942KB
SHA256 2050ed617a381a2410caf09ff56414eebaeb8f5c6323d49019aebee4bd374e9f
MD5 baf09e66523201a029235e2354f5f825
SHA1 092b7a8f63fd9b0b4e470ca9a4363dfab0c1c9b4
SHA512 fab174beb12d9a3255ecd497a8a77b018e92404c3e8c1c4001513f5bdcc25cb75d04aecbbca39579fd0b741d261087e54ebf13a7621e0733bbe0d1f171adf71e
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTQN:A3kMGT1LljG
TLSH
T11425BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 942KB
SHA256 da3564459ce7ef88e81d59ebeed329667fe84adcaf2c69182070088202fc0dc7
MD5 1bfccca8548c63b2369c382a03a6637d
SHA1 f4f2b661264a372f8eab22330428bc758ab22900
SHA512 aa77cb76665459e60be7c069030a5561f615aa7fa94bb8b1292854555a2258e81fb2e365c52e1e92be4949ea6ed2605546bca9182d6897d900054dd1d9f1b418
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTYF:A3kMGT1Lljk
TLSH
T1F425BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 942KB
SHA256 271202a7dbf3bafb98ae9fce52621952274de0341acaafcda7a1bd54db87684a
MD5 468e67a8f5cdb6d46e6d798c09d53f88
SHA1 e9236531933363f6b93ebf1befcc8fe7c02546da
SHA512 455a062b56e120d3c21a1a2a8bb5e457d38fab0e2caba497ecd7245e70f45e5f7aaea737877816fcf0e32793ab67c0457e5d14235b10a56f04721164e2b91158
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTNC:A3kMGT1LljQ
TLSH
T1B725BF13E79004F9E9178134D9E54A12EBB1BC661760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 942KB
SHA256 1b769b162d4208e5460758241c305e8945b73c31c8a712a30cb51d2ec6a8e9b2
MD5 c5637ff72d5f7fc65625398755e352ab
SHA1 ac4ed40af8dceb71120d9e30a2dde1e535d8a423
SHA512 5c37a65614f7bfc562ec6dd6dd7ae19f4cd60bc7be33cc49e0584f7f7e658c30ab75dc2c1df3ddedfdc1a39f6e3b27147c2a31f82cf3c9dd755b02fd67b68757
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiT2w:A3kMGT1Lljt
TLSH
T18525BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 942KB
SHA256 70433f6b00e8463c2b5fb81c01bdfe8a3934726df4413fa500fd0e0ebc2aa954
MD5 368c292ae3eec66a2121d361f689f092
SHA1 45a09b08f09530a6d55bf63bee0e853d0b3cdd2f
SHA512 318819a5191c37dce9e5df8f25739c8caa0b58cbd3cecb295afdb644d7d57db53cbf49071f4e54e7d46affc82462b708ce75076877b1ced00b5338a1b35756b9
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTlT:A3kMGT1Lljh
TLSH
T10525BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 942KB
SHA256 27cee01ef0a5daf1ebbb273938dda19c5f217902f0775e0753aa961c826b2c48
MD5 06554c2b0ba0736389ee124a30f7b2f6
SHA1 fdac28c1f17d34f8d9bd2f8a8bfd345ab9502434
SHA512 6e9b2577709e30db478bf5bd87f9552f7c1fe33c3a1d33a0f15d27c46e492eb7f37aaa2609d5905cb8a2e4ab3116747ac19360e3d9aa947c2e04d3e4c690ff44
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiT7u:A3kMGT1LljW
TLSH
T11425BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 942KB
SHA256 4d83539629edf930cb9a5ce18eaa53c78063cb927cb1fdc5a2ea675fad826e47
MD5 e413deddba2f93e54aa58ae1b318645c
SHA1 aae39f70d4e4ff657255ea9ff4e72b698eefac5b
SHA512 e0aa86b7370106fa731f7f21cb63cd26623aff7311b4268f31ce56f37fc13e1ac0d2a2773bcab5874455d3542034bbf9ac1f627d19fe2defac4b907d6c8cd539
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTfb:A3kMGT1Lljn
TLSH
T10425BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 942KB
SHA256 9272e5b09b245862c34c3ab73d0d109b54f8ffe54e22a192ad437e396b0e1e16
MD5 ed8f6e6e61f84022a3c3f06976d69ca9
SHA1 e790890e7c51884bccd00c7d74d25ed5f9f07de0
SHA512 c0b52eae4b1642fb96a628de28f7d8d4c13c4050b7ff77ae50ee7c1c7b7a1d77548d2c295f7982f5746ba1b6193200b1a57287d3b9518c428acc1b9d69fd4297
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTbf:A3kMGT1LljP
TLSH
T10325BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 942KB
SHA256 f4ff017d518e94c050a6674ce1ea174c0cdd02bf8526e4b4c9bd46048fb12ccd
MD5 fd61c73a2fa39efe92e3a280f2faba48
SHA1 9a7d25cbaee4dd43b2efa58a41bea0238cdb0b6a
SHA512 a9cf24e97c6ad5a8ba222ddd9424054112305faa472a3516b6befc157334fa99d18af6506891c80f2d36e836df91c3b3b1190674bf5c5c87ba89a2fd53391dd9
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiT0K:A3kMGT1Lljv
TLSH
T15925BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 942KB
SHA256 9734629faddc4f056c010f27f390c12a77d61b3c196f24eb1f4f40c562ab1097
MD5 3334c47ff4bedae0e9d32ca2673ce66c
SHA1 1c15849030dab2602afaebfd9f244f4ac15a53b1
SHA512 f19c6e1c5c2809073a85289cec962183ac8f66bf1fa8f091481a65f60f705d08908861e1567a0f842c6ded546a86871305d4a7e7e8610fa52992e33d80ad034b
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTpk:A3kMGT1Llj6
TLSH
T10625BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 942KB
SHA256 db3dd3a900b435d7b242a35e0327d1d0f5e7b34c36091d7471bb01128f534d0b
MD5 2aca32f2c86ab6c88aed1687c63ac82e
SHA1 d07e1253d3a0c20ceffa1f732be50d915d8231ed
SHA512 8161421bb6c01a03321287cdf869c9ba73e94d54cf3d463c1352e38828703adddcf2e5135c84fb920f05d437c85ff0582a90e77721022bfb51d82b8391c1d48f
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTG0:A3kMGT1LljP
TLSH
T10B25BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 942KB
SHA256 8081d27b130b66dc8f3da2a8334beb0ac228156dcef7b0cf7c5ce04b428dacfa
MD5 6fd731ae0d1a0a37c9a0cc68b456bc30
SHA1 5ef3dcfd03eae7bbc32f6fc056c4818f8b483c91
SHA512 1300937e5baf85effa50483a7ec197eee626ffbde41d11cda6adff44436beec92fb75b4996677d93e82b758ed67c5c1f530eb56fc9b31c885be7046a8bc9e01f
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTVg:A3kMGT1LljS
TLSH
T17625BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 942KB
SHA256 e4eaf34ffb10b22c0e0310f2e052cd921942c726c85c15d0a0941b37998aeb9a
MD5 d2e31f8c127708a230226ad9d08f83c7
SHA1 4ee0e45677e62e70ea0c47f030e983e153c14308
SHA512 c19a3332ad7d1868f372988c7abd6b90ac472f08136fb25769a621904634320a6cf959a3f1e8065ae19d3c6ff8eeef4ec97859ab0c147a30437c1ba170bad788
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTkr:A3kMGT1Lljc
TLSH
T15D25BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 942KB
SHA256 569b4a57ebf14bdf741bf0185e86d5f250c459db1382d94de7a1a9f6e403d76d
MD5 292b59c246c002b48702c42d4a2e8987
SHA1 fa370e8e3e202215adf4e9540efa5ffb34ff3863
SHA512 5a72c09da534d7c9911fb6bbcc20f26916ddd39cc619c6263725f54b6fd51f427a67769c85a9bd4806d3d1876ab88d9af95c389c7dbab02e7a1892620992972a
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiT6n:A3kMGT1Lljm
TLSH
T19225BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 942KB
SHA256 84a3af2196acd5cc077f4042a08de8ca5c043b71588c67e1f9edfe6e273704d7
MD5 70fbc8619ed5ff22e2351e8e1ba2e892
SHA1 02970aaebb1bae010dbde53601b01327597c570c
SHA512 46b994d1e6aa0054ef867e061154631885aad77068e6a34868858e639476834cf7dd28ea15920d33185ab33ced5083d4dbb796a8021d15f92ea59757dd30eacf
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTQx:A3kMGT1Llj8
TLSH
T11B25BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 942KB
SHA256 c65c3e85304985ad5455ae8185fadae25377c769feca42750482b296b48752ee
MD5 30318a53b76500389e27aaf83b08f693
SHA1 5e30c42d74dd3a637d35ddadc42fe807932bb658
SHA512 ea44192de930f9fe7ef34d9411cc590df4e4df87ca4cb9cc1d96f40f10627299bc9d59c9244cd2504ac884804e5fbd1b6bb7e7265d76a6872cb06c8621b229cc
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTSA:A3kMGT1LljH
TLSH
T13A25BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 942KB
SHA256 cb548b79d678330e1a2a502878818f490e8bb2d0450882af57fefea1bf73302c
MD5 3c86d3d3d6bb44b0c5467957d0b96c21
SHA1 44978db61086c2c9c247c473265c83b89077e01e
SHA512 e1d38c9c3627c03235f6d9b616740900f120f18a04b5443b0fc51c030e181323cc96131df2737bc8b379d2f427ccde1e6c1d48460c787a8d3829d75d395be30a
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTr9Q:A3kMGT1Lljq
TLSH
T14525BF13E79004F9E9178134D9E54A12EBB1BC661760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 942KB
SHA256 000c08f1580f1e8f4e7ae9d85cda6d56266721bd2f48e8c723033fdc5f15e630
MD5 5b5efcbd61363311a14ab083af6e4e16
SHA1 2cb01db012b574024af71cdc07b3bae1f91b9c50
SHA512 c6ee6578c6de6d074264401e8d5fb1a9982c296e21411de2532cd80d640f031f0c263a10b3f404b5e368f42eb699f7b0359bed9cb1937b79af29f998b7b51a8b
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTa4:A3kMGT1Lljp
TLSH
T1F825BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 942KB
SHA256 b561e058ab0463ac5ad1514c3b8b375e07a439abbd1992ba641b65ca2db7d2d5
MD5 2b8d26b9e3dc4993856ace37a66e982c
SHA1 ded0cf29707945c2e64742a26440826f37a6c352
SHA512 ec4cf1b831cc248bd1d5bb29854881461f93bc8158688e0a079393dcdd78686b39289593cbfbff421a04f8d5f9ae64da809e2b110bd5f0e5a0de265c37439ae7
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTBu:A3kMGT1Llj0
TLSH
T13B25BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 942KB
SHA256 a2917807d5e645ee37079c17dfbd781662763ffe9f74a72891af370883d76335
MD5 71306b806164331d13066c73d5a1b3d3
SHA1 feef028433c03e4ba7a167c9ea10b450460e83dd
SHA512 dc69ab363b840b41cdc57afd6e695a26a040ecd49e454fff995bc31e7af5acf05299d4058cd6dde372d3b07421c00b009d33fc5bdf84d9ac86955efc5ed63b41
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiT0j:A3kMGT1LljW
TLSH
T1DE25BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 942KB
SHA256 289b8cb6a62c2a634e80f217d9bf003af4836ec101f7d9e5e020e832da55f5ba
MD5 ab7b6990c7139da70cbcddc115b09c16
SHA1 79dac9b1eed6f4b17f1a6eaf8d9efa11f223e57c
SHA512 c07595229ed44bdef564efcdc9f831b9f293901a4aba7ac3405f9f89d3cf107064c859dd86a0b64e46b55bcee13a5daaad598ed469b6a62c0af0259b2971a7c8
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiT1g:A3kMGT1Llj6
TLSH
T1BD25BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 942KB
SHA256 07d69877f82713615904812e2435d53e51f324f8c5f34cda563d38ad0060f795
MD5 e0e7fd41d4e3d6ffd6112d6834e06990
SHA1 bcd5a916f712de19e48fa3ba88a7a624de3a3ec6
SHA512 d35bf4d1dea76576cabe6aabeab62397836180017808df79067118d4b534e480f709eeace2aed4c58430cf77893c78049527dd31da76f5a5180ff530fa59817e
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiT0I:A3kMGT1Llj7
TLSH
T13725BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 942KB
SHA256 a03919f81879d2d8055b313115329bedc06742a7a4c28ea861c9bb93a2cd4295
MD5 9e44c5f9b53219e9149f8cba3016258a
SHA1 89e0aafb578ca8cc7a659d76d1a3820024f5330d
SHA512 254eb3118da3df8daf541294f616c01870ac0ce9509cfea3083c3d01a100c22eaf9b0f65bc9497e8055dd9aac6b6c2623f75ca88cbbec3b967b24166f6be2227
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTmo:A3kMGT1LljF
TLSH
T17D25BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 942KB
SHA256 53cd8f2f9b9e778c916e03d1f59e85e2209c74bbacd0b709b7a146f660942552
MD5 91011b465cfbc0f58b908866dd833162
SHA1 b710ad8b70d415b0e34809f6b5cd710f90ca9203
SHA512 0cc796fc6f10000b0f527886e40eef887699ebde0c9a95c126d17bdded31122b2c7bb41d0c691d19fa0c54af0e228c44d31a03b8fa98f78f2703fa7f8a12571d
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTN+:A3kMGT1LljA
TLSH
T1D325BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 942KB
SHA256 c2b0b6db64f0ad540d114985449babc93ca6835813774fcd0b25a8a4f6f8d466
MD5 9b3277ac471fb36728c1fa67666b8452
SHA1 8bc31c4922fe16ad9ff56d5d701dd4668a3d050d
SHA512 1bb932140406157bbf12c225ece2636cd9f7901c6018ed3d77bb1eb8814f7e607a6c41d67058a57f33992f1394922a3cec34c642110900137c8384bcbda94aa9
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiT7Q:A3kMGT1LljQ
TLSH
T19825BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 942KB
SHA256 2be3c9962fafdb9f8a951459c5faf303b84c650a9eaf2d6eb717ef6ac858a90c
MD5 9ef72ecadd46093dfd7d343fa810a5ff
SHA1 b056ec0bc0d959befdcef2d9ee7298356daa91ac
SHA512 389bb017589585ad768ed7546a1c25b704854d9b328095ec6b8624dd9f1f7145e383d73af3ae82b078b7a5eb855784d161fe969b0a275099f1bec7db18bcab1a
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTwX:A3kMGT1Lljg
TLSH
T1B825BF13E79004F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 942KB
SHA256 123677b9897208cd4675dc5782b1c3b92b84156dbe1b7e4792dce570d2834dd4
MD5 f583f20b79f1eda3a2dbb96e290903e4
SHA1 d3d202a784fbb9a4611ee1558e66ee2e7dfa1c4d
SHA512 d390e71ef0897ee5f22d6123983c1ed0fe5cd78c2d107ed129506ccf3f5807dba96467ecdff56c1256315d03b4434443be489e3ba8f81617a7eb307838882b53
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTGL:A3kMGT1LljC
TLSH
T14425BF13E79004F9E9178134D9E54A12EBB1BC661760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 942KB
SHA256 a9e60b4c6c9ee2b980d324fd423f0d2eacf3129b518d56f330a3937f53033d87
MD5 a17cfce2aacd726079f4f0b65dfe426c
SHA1 41ff00e5d35dc9466268b155bf639312acde04c7
SHA512 544ea4ded502613df579f42ee183d0718a80d4cb052feb70996f2f3f83b268eb55efba2e6124ca3b11898c8d5a4308ddb5906b2b6660139b40e517d34b92f884
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTaM:A3kMGT1LljP
TLSH
T17A25BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 942KB
SHA256 b8ab510db802afdbc170e55c85c3a70ce3dd347e12324557e0a42a263182ebbb
MD5 623a2115f06d62a8b6b6ee6571fe5d76
SHA1 48b8c24c6315ff2b80c776b898f306e97871debd
SHA512 002dcaa79bc1ae460cccb890123279737b099f0f3999a144e4949b9757fde658e859c3cc774eb4c569274d0c55ec42969e28470c738cdb8fb51b6f5f3b741698
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTLh:A3kMGT1LljB
TLSH
T13C25BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe$

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$
Size 979KB
SHA256 0fb6896d842da7937a3a31c26956d3d183f31e450254bcd91a8d3f58d301fb26
MD5 bde43d49ef4fd6a489c06e37e7d8a8cc
SHA1 7c26bcc8d85e85a0538df569233dca58050a69d4
SHA512 20cf4308d0e155bbc096bc4165be600caaa0d2afa5815aab8b5e90a5a35ef7bed28180f2df6fe7d6f7a144e1c6188a6d8985ca2f4e77fd1902c1e6434c3a4fff
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDDiTUjv:A3kMGT1LljoD
TLSH
T15725BF17E7A004F9E9178134C9A64A13EBB1BC661760C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4600-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5612-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5612-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads