e90faf28c318d9df1ab95abca91aaaf81830baf82491aecc649ccab5127f07e7

Analysis

max time kernel
103s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 919KB
Sample260715-pn3lbact9j
SHA256 e90faf28c318d9df1ab95abca91aaaf81830baf82491aecc649ccab5127f07e7
MD5 157cf309753a7c25e576e1804affa5e3
SHA1 6021f5cc524c55d7454041637f8e3dd6a88e636f
SHA512 bff48a58b2ce57a6bb38b8b741d5d5984ba5547ef76aafa9a59759cb1989925863e4ece6ca47aa226903b1e6e084683cf0122b70b4377a626f87095c933615b0
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDI:A3kM3T1LljB
TLSH
T17A15BF13E79014F9E9178134D9A54A12EBB1BC261760C7DF236892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5108-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5ef-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5108-27-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3592-71-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-558.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-613.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-638.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-866.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-987.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1073.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c5ef-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-40.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-491.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-558.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-613.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-638.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-866.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-987.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1042.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1073.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1130.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1327.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3592	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5108	2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
3592	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_157cf309753a7c25e576e1804affa5e3_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5108

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 919KB
SHA256 e90faf28c318d9df1ab95abca91aaaf81830baf82491aecc649ccab5127f07e7
MD5 157cf309753a7c25e576e1804affa5e3
SHA1 6021f5cc524c55d7454041637f8e3dd6a88e636f
SHA512 bff48a58b2ce57a6bb38b8b741d5d5984ba5547ef76aafa9a59759cb1989925863e4ece6ca47aa226903b1e6e084683cf0122b70b4377a626f87095c933615b0
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDI:A3kM3T1LljB
TLSH
T17A15BF13E79014F9E9178134D9A54A12EBB1BC261760C7DF236892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 b5fc4593da5d2c510bdde3abfc8d0d54796f56165a3573beba4729788aa49338
MD5 dccd7214e131890d544741225b3704e1
SHA1 e2810a9baa957895b3a0f5701ba7aa2523ae5dd2
SHA512 baadffb0c90ec489303918d5f7020719c7ce50c3505bf3427b163c5b0fb85b654b9a4618ca2657834d8917468c233cc13d6d716a202f1c1b4023e21a69f3e7cd
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDQ0Le5ji0hmxNrM:A3kM3T1LljdPji0Aj
TLSH
T1F9658D16F6B406B5D073C179C9D29A5AEA7238421B30CACF1398D7292F337D19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 933KB
SHA256 dd94314c757b14b8ab73a918643ce09ae07b7c24fe3956a4fc7dcdcd1df83b57
MD5 401bc8920ea595d674dbbaaf8f289fb9
SHA1 7d4661935a69267ecfd323c6826f08ea341a0a09
SHA512 cdfa53b0c5afde9f61b321bae53c39e4c58a41de74a85e94f66395b53daca7e9b8bc14818ac12ce8356bdbff7c5f5380fb9e74d18f3eed1cf7bdc952ce03d99b
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDqa:A3kM3T1Llj
TLSH
T1B815BF13E79014F9E917813499E64A12EBB1BC261760C7DF136892262F337D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 942KB
SHA256 74356342ccd49eb325b303f0e5e3f76cec9e0f77b209b24d98f0742c35c8c0cf
MD5 8aae56048aca754263cc22c33411e462
SHA1 54deb8407426804ae710fdb2a233ad7303ad4e91
SHA512 4dd9d001bf09a7235e79e64ca8e821aa560da9f9ab5fb6778bef7db90472d91baa00749ff91e4a74daf048d5d49d4def87d3792d98417bf58cd306d44dd97192
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDb6:A3kM3T1Llj5
TLSH
T1C725BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 942KB
SHA256 4f804afdfac6a97345129ff2b80170070ea25adf1d2f2e1eba0e13d2c8166611
MD5 5edbdb2802a5747114864e194b269257
SHA1 50fbac6290029b1a1b9d71ad7991521c58efc12f
SHA512 7b53c64784d95750957564e43a2561784fbafd0a2cdf673932ad94f62ac509f214fe42a646b3c750a836628d0a0d261030918c22d31c6a47337ec8ed21fd2d2a
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDFN:A3kM3T1Lljg
TLSH
T1CD25BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 942KB
SHA256 eb4e3f53b115a928e48aa19e18e92b6cdaa1c6186995c5e14e896f32e2177212
MD5 d1c4f5c40b5d9ae97c0284ff8a247ad9
SHA1 043f22a2d668130c630d6ce86ff8b04766df2b82
SHA512 89cf6ac7ffe0615310caeaf59065bc58f40aa07fc899fd1b1052aeeae81bf39e04c955db6140bf1f6eae57dabd550fc085ed123c4b0a071fa9dcfed3db1c9c9a
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDDf:A3kM3T1Llj4
TLSH
T14125BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 942KB
SHA256 ca34f3929b88fc83b5cf0515d758147643e8ad26741b044e79fd3bd22f27ba25
MD5 05438017fa19d4591a060718c5fb7a8c
SHA1 e5485b13a012d5c3c4323a4e27789e6f96ea8eda
SHA512 197953c0c748b6ec7753d99bec0d9f97c5332a4fa8ec747e1aa64f6ebf3636e39cc4c4e5cefd7a418f9364e97314d984a363ca4c4bb1c8a8f72b5ce8b06ec9ca
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDVo:A3kM3T1Lljl
TLSH
T10C25BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 942KB
SHA256 9c5a11ea7404cee6ad8a32e7eae755b7a04c2497f483caea3face1405d9ea2e5
MD5 9ffea0447ad5c0612cd7931ebd8ecf99
SHA1 b42bf0e3d4cdcdde85881bab5638ac362ee2bf48
SHA512 78c2a8ba96e0fb5aec35f5e04a8f32b869e1b851a04aca36bf98da6634a3f292c4ea70fe6e4b094314798d23d97a984839be7bd206c3e35df2dfd1511484c86a
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDVu:A3kM3T1LljH
TLSH
T1B625BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 942KB
SHA256 15e4b7794afb72870952b1bc501ee16860143b55cacb2836d4f189dbd2f5e1b7
MD5 09fc7fd5a8b0f72eff3c4f96fdaa1ad1
SHA1 8687be3f451beb92a68f0bfbb2449dc162b81389
SHA512 adcfecb32624cccd94f3f3ffeb47167c829606479d696d370d5599f0af1e632adbaffcf5b7ff713ca85a300475ef645987c173ad6c301b05db15384305188111
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDL9:A3kM3T1LljG
TLSH
T11825BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 942KB
SHA256 71d482883efce3b52a3f934deb1ab1929edf7d92e0cdc312f88ec8a6ddc5a8ea
MD5 3b00dff88ae1865b5c0ea8d6d54d272a
SHA1 0d0e04e46d909813ed66bf5a8324e75cdd00799d
SHA512 5114bce11a45de13d3470246fbf58e8df153ba4b0d11b0b848c0e3bd557bbd0d6d860a8c4fe07c6384f26e830669542650c05c460c8f02a7731f6f787ce983a9
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDXc:A3kM3T1Lljr
TLSH
T14D25BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 942KB
SHA256 467fcf0d3699152cb28979675f361da50f610b910afeb2b2341e91bdeaa00a8a
MD5 5a2d5aed0380790ac98b85fd65fc0fbc
SHA1 f2533331d6af14b2e0504d49363c05f1e05353df
SHA512 11e2193331bf29172be4ef8b05741b86041765b5c524eb9814514fc26d862c2b48e8d37b5ba309cbd96a2ee522c4d6cfe39310f90d3eb6773054b1f2316fd9e1
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDgp:A3kM3T1LljJ
TLSH
T18F25BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 942KB
SHA256 4a2f5430c63bc435284f1b4330ef52182a31a84de607ba28f7f44f514b950d67
MD5 88ad62db54f075ed40e07242c26f8e9e
SHA1 dc451b63d9fdfa3d9cb281595bfe687fa47c7021
SHA512 a540b9ddaceb6533224bbeba0970895a245e66195b8103d0fac572c8267b2e6f1a8a28b1a3c8d6cd13d9d017ede7b21cf5d563a56bb975e7f762e7df4aae24ea
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDnN:A3kM3T1LljS
TLSH
T15C25BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 942KB
SHA256 99003c08614d883cdf45dffc2088840bcc11f57541a395ed8be9f56541d401b5
MD5 330f2d4e6c91b8663413e1b7215ebc2b
SHA1 bed7fccf637c79cb48f648eb5f2742ef979987a6
SHA512 14a19b2897b43d16bbc981120e939ef8b2443fa3b7a0ac8e689b26da1caf5c42635446213db7051bb980f3f728d7c23091ec3bcb2b7c2cc3b59bc0881b92b750
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDFF:A3kM3T1Llj4
TLSH
T1B925BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 942KB
SHA256 9a6ad289d5e5d58996be15080b5d021258953c629779cc4509848c02b8ac1856
MD5 8472d57e4a9340be63c412a97e4b1a00
SHA1 0dd64fd9c778f9b1a81064813d9216f3057edf62
SHA512 da147f40915111987125437cd2fc612161287ac6efd3c3fe78838f0c455bcacbfdf8049f44871b184d105a2c3fe3b249c2d19d42065d32c0773f9cc81225d5f7
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDmC:A3kM3T1LljM
TLSH
T18F25BF13E79004F9E917813499E54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 942KB
SHA256 64358498b6a965c1c2c960a9ed4c51592926a28b4eda96a5b25dc0de46e17a28
MD5 97e6f4e06eeb27fe32fc64b007a0c4d5
SHA1 ee8401cc3a834b5de215a30725380cfe76886605
SHA512 9bab6340ba4afd40d63c4379121cfdf487d10dffc4f33824b9238a79dba4bac8e8cb1891d22597639c28eaf4e3e878396a296e469070795886b18bfe4ca09247
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDpw:A3kM3T1LljB
TLSH
T12E25BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 942KB
SHA256 88bd143f022af7249c2c4fd49174f30c589f4f8a0ed09492b9117669c8035b4b
MD5 d2b8c5bf37604bc75a0520b8460c111c
SHA1 31058dc9554a3bd8726a24482a054e9c550cc429
SHA512 5fb8f4babfdbe624da0ce9bcf8491da64f42fc81884c2ca6cbf33ca60f4af95a26c6690cc4c6861505b4a18f0459984f0b8056fba531e54721e4834f00ecd5b2
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDwT:A3kM3T1Llj1
TLSH
T1C925BF13E79004F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 942KB
SHA256 c21b46d8f13df5fa29b02e5930b9c281906f6d73a616e69396419e481ea62abf
MD5 59e3d925fc9efbed0ce7cecb33d74e6e
SHA1 6af5922560ddda2d28e0d2ec2c12ff814a2ab11b
SHA512 286c6049fd2f751d5231850ad7fd4dbc6586f4fee557b7419dd28b869deee6af35768402ed47e8599332980d6d879779611ab01fbe3f8375b900b40bd2cd067b
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDcu:A3kM3T1Lljq
TLSH
T13C25BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 942KB
SHA256 55e97f36c59cb355a6470dafd69c5a603d7eb7ce247bf5c8c68b33743dfd7fd6
MD5 67bafb068eb077e4b12a5af8f2406f3e
SHA1 215fef657f8537386cc4ec419a088f0105925a5a
SHA512 b0ecf674a9cb0aa209dd24d3a09d3dde4dae00b89090529af8b92c08e771ac92a8f46d77709899c7b1835703b03c5c4ef27a136d7ac32bea7f94348c1dc7cbb9
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zD6b:A3kM3T1LljL
TLSH
T1B425BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 942KB
SHA256 10c31eadd60adbeab09d40c783a326bd32eba02ffa8b7d1efce384147b360c01
MD5 b75df525d32c355a049986f24b08eb3e
SHA1 73885c989efb6f3fdfb2577f2a3d8aaba3fe27a7
SHA512 58a1dae0f4c209a7fa2ff8e66a97ccaf662d67ca7db547fd19f53ba0c4f2afe3b88053805b5bd6298b5c8e044ef0fc6a864f1ca5ff04023d13d6bd1139f6faaa
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zD8f:A3kM3T1LljT
TLSH
T16E25BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 942KB
SHA256 536463c72ff853dfa3165f63b212042c16801178b3409f2e782600106f87d89e
MD5 61876fa7fdae754a3177d7eb25fd0b7d
SHA1 1c28303563767acc9d9e6b68741989aad35549bb
SHA512 6c7c24ecd9406f71ae63f5b08e210a09ccfc443119b8f3e37467e136f240ef54bc176e722300eb2cf90327b675b633a4216bf008cb5f59de0b301fc39ecc2ee9
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDZK:A3kM3T1LljD
TLSH
T19025BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 942KB
SHA256 f15d0d27278bb43ef171fee1092742b50433bead8eeaf1d9201b522b58d2f190
MD5 25377805655dda51f893f3757106461b
SHA1 1279a7cabc221b1ccab479f745c5dae3adbe7811
SHA512 36da4b2b71f9c1b5798141f4c3dcc7fc18d42a5db2c8853717e56d12c90b4dff924e971fe8aad10e2d42ac9c7f1d3d9307c1895297d77a2ae627f4340219801b
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDCk:A3kM3T1Llju
TLSH
T1EA25BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 942KB
SHA256 152aa1fdbac7467e28fbf1344aeabf329a03fc86d2bcf48a80c80bba9d5f730b
MD5 ddb681bb71c071c91055cd0d916433eb
SHA1 82b62f3223e3f66c6c4ff53585c048dd65dc6421
SHA512 c6ed5b1985aafe9601912e6aa7c8d6b2986836a737e9a6e0554d0a175f99f869d1afcb82587f1fb7d3b6a91350518e69f4e44b740aef8a2e730f064bcbb8205d
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDX0:A3kM3T1Lljz
TLSH
T17025BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 942KB
SHA256 8819009ac838899aa225dffcfefc2971c1bf9419b298fdc330a8a028d0a42205
MD5 ff760b8e72f8d0b9ada3db4262229009
SHA1 5052e09deedcd151a28e891dcd89f25930e557e0
SHA512 ef4fcb52c492a17ba0babf7e092f68528c67c823b0e46e8730ec48bfde46e41b6b1a3c8715f8a5edc53a165d8d11141af457e02e31dd86f879dbdb954f2c22cf
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDGg:A3kM3T1Llj2
TLSH
T12725BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 942KB
SHA256 bbc0b3030b481afef00f556e9b46c02c55fc87aff3bc3456ba6a649ba222db02
MD5 4f6416ed85bde88a214da619bc096692
SHA1 f6acbbbfe8e0d572175284fa892d27b28471da12
SHA512 e43368f47fc256656373668bffc773937258cb81db613375f4d2c4c77e3dee9d69b719ea632daa74dea97bdcf21364cb6bc05e70eeee7e94beb92bb0151d24d6
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDPr:A3kM3T1Llj4
TLSH
T1C925BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 942KB
SHA256 feb65d89159414cb2756c5d033a0ae853d177fea260beda3d60ae70db59f142d
MD5 21c4893ddc928553c1cf54162bcfce43
SHA1 f39c1baed2741eeef924aa452034aa658b7dc754
SHA512 e3e54ff96dbe078a52010d0742ad9376788ff7a1cd739ad14b54a3f63718551acbb81e8e285b52b1b73dc367dbe11f3d25056f3cc3e4647c730c54998a9d8537
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDZn:A3kM3T1Llj6
TLSH
T13B25BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 942KB
SHA256 cf159ffd09cdfae9618de048851d3092d5ee8cae04065d3cc464cb2b146ab87f
MD5 0c0ba3c54764a572a3e393a065d03a2d
SHA1 47a061ca5f5b96786981be2c6957d4fa6c1242c9
SHA512 a2b6aa01de5fa4840c91e3a56aa11ab5fb9595c7958785f38dc87d0ca59cef8cdf636e6c22e6a3c349f83f9a56f6c599065981fd113c52f1ff2c1c419586de9a
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zD1x:A3kM3T1Llj4
TLSH
T10925BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 942KB
SHA256 772bef9aa73b6b04b54e5375b33df3f11644eb04e32a568469295e8d2a24ed92
MD5 1ea4131d28a9c2a4e2e1b7a32ed4a78d
SHA1 afac26ce5aa2f18e87ff4b7d6cd136ea20b6dd65
SHA512 7d21f16fc015204aa0144714ffabca21c58db16c7eb9ee738fb7a9adccbfae33922e51995b8de3c4ca9a55085a8982ca0b0e011089bbe2a7aa3cf69ad478d729
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDrA:A3kM3T1Llj7
TLSH
T12325BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 942KB
SHA256 6dc84dc3b6e538b0c72c14f0981821c44592f58cbe4604f3e9cea7e1d6682e18
MD5 d80a5f3b43625f324e4c3a44c22527df
SHA1 65fe076960f1088ac428c918d75129f503f53aca
SHA512 349ca879a8c4fedef0f535a94a997ebbeffa89431dae35706aec022ccb0f8897071a0cd55e07709e5212fc15c84eb717802dd89cbbf348a3ae413aa2bee940a3
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zD89Q:A3kM3T1LljW
TLSH
T1FF25BF13E79004F9E917813499E54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 942KB
SHA256 bcc3766085edd55175c65b8acd6cfcf2f3001de7832adc84f34e9717dd956bc1
MD5 103c9059de19378dfe99b2f595251736
SHA1 46474894b5b76d47f5519b8f5d95dc999848c221
SHA512 166ca786518740ec9486f02773d222e1ad0161b04da8929ee96f368b739e2d74e822d8b87c62420a639cb9095ce52b94567e07a5b124e34237fa549a280cec05
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDl4:A3kM3T1LljF
TLSH
T1E725BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 942KB
SHA256 902ab0ef223208c2b912ddfd4aa465342adf34a0a59f4ae8682de57665a91489
MD5 002de768ea934c729ca3a71b56d364d0
SHA1 493bc9bbd3ed28cbc4b8f51e65ff220ed90635aa
SHA512 0446401ed62c408baa91b5ca025746852e9df04ba0537af87701dd8037daaa18c1c476ec6b3749c445a4bbaed322d1c61142eccbabef7cccd24b732d12f0c268
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDwu:A3kM3T1Lljw
TLSH
T19625BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 942KB
SHA256 59c1cb06d92d109cdb6380edb0f140747b258614963bc5bc18105e54aa7e6fdb
MD5 13a16c61e4f5b83b388751bfd22145f8
SHA1 c00cf702afa926bad12647d1de264c9c88fc2533
SHA512 4b1bee9661f86bd061dd924d51db665e679d8c243b4acce4d7c0161f01163e7c3a3977ebd6d3e47259862c1b1c4987854a54b1893c1725b4340403ef654ae0c6
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDxj:A3kM3T1Lljq
TLSH
T1BB25BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 942KB
SHA256 35b25fb2b5336f6a6fe61065d7147e80752a25a74fd8c2d0e8fb15697b4b401e
MD5 93aadcbd2407a24b2081a60d3a9fb5b7
SHA1 d7ea9ec86b292c6e2b01d4adfb49cdc45914e8b5
SHA512 56d1e546d85b3cc81c8f1b6b07ed3932b7e51329ba84fba8e610eddc44a249276c3559abd007ff3e056a9caa7f1cce86ae6d9a5b2836f4a5f81db31f0f18f4ab
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDYg:A3kM3T1Llj+
TLSH
T1FE25BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 942KB
SHA256 7045c2a32ac4b578869d0a4253c16dfb7edf6e909d2b03efbf3457100229db8c
MD5 c7b1ebadcfb99924c9fc2a31f396d341
SHA1 a0009a55f8f6748bfcbfe744995f59ca92c6e2dc
SHA512 f92085254ab9311c40ca03058d8bb516fde7e3696d1eedfb9bc8c15125bfec5bc32d0d4ed9749b79dcfdcf91eaa8fe4e226c7ecc1bf64bd4e2b0716fb07ad6f4
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zD3I:A3kM3T1LljX
TLSH
T12025BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 942KB
SHA256 1664dd4f6ce2e1994db67e0a57e7c74cefb75d7ed5ade4a6f6b36ef861956224
MD5 f37bfd73073bb15f245a1aac80da575a
SHA1 da8ceff188bef37d246d3001c79c2b936b800d9c
SHA512 fd4fde73d1ff0ca2f364b863fdbc7d6786bfb34716edae46116601144ece01e128b932900e3d5ce391950fc7adbd2dae665c956cf4a9e29ff023868ff5cc8665
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zD9o:A3kM3T1LljR
TLSH
T1C625BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 942KB
SHA256 0a13607aba6a5297d170857f8dc20d109b0c3d3b22eb507d5072dd499db8738f
MD5 ac7f5121ad4e7e529dd58ad75abdf693
SHA1 c177ba7134eb13cc935d6f617f4972499f8d40b2
SHA512 859dac32d10ef48663cc780ae60106e0dabecb6756dd85cbf20455109cb2eac39aac192d214c8c34db7ac5805eb2ef67a91266644bedf37fcb6bc65a1aece533
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDu+:A3kM3T1Llj0
TLSH
T18C25BF13E79014F9E9178134D9E54A12EBB1BC261760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 942KB
SHA256 63991df71758c192f259213c2fb45e74c08743eb679745b40bf85c85920f23c5
MD5 7b53555d4e98b49a2833b81356f2e8a8
SHA1 5484518f0c04a3ba7517eded251dfc4c4ec239bc
SHA512 9462b2e8fd22eceffe43eb179f964ed543aea7839f5f8660338717dc419651f13b6e88b4b05e5c88aa7c51e447acc058fb2b2b8ef8efae545d5b917ee0bf6333
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDuQ:A3kM3T1Llj8
TLSH
T13525BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 942KB
SHA256 dfe04331b3707abe0443dd7dbf7ef8c17e7122cacdb66455f64e0a529518ba0e
MD5 8e969a75d7b7c41dd6ba7870a44cea2b
SHA1 e7898f6c7c324501d1a9092184031438077f725f
SHA512 5b7ab5d2c44593b51dc3e1c703b02eb0c293de30ee46efeeaaf4f3131110c1ded1acc90c347796df67f971b7d3e42a920ef5b04a606377b64ad330944d0dc1db
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDPX:A3kM3T1Lljc
TLSH
T17925BF13E79004F9E917813499E54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 942KB
SHA256 b10e13cc126fd713d5d1655a30d013203b98bb780c6f18cb27c2bae5c7c676ec
MD5 8f2221727c1e0c7fb27842c2c885836d
SHA1 e9804dc2be48654e3c548347acee003862cbccbf
SHA512 027fab5e99214e2a0583f3d85be0c958a84d14e3325bd12c0fdfbdcc496a1649d319cbe8e5eb65e802acebff1c670f2cf815cef4a7eec1fa04048d34ec90b198
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDFL:A3kM3T1LljG
TLSH
T1E325BF13E79004F9E9178134D9E54A12EBB1BC661760C6DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 942KB
SHA256 267a5c428533b35eca4df109408c0a7396c928cf90f2797bfd8655ab07c615fe
MD5 d8dedd7c8b2f93fa1f2d453648007638
SHA1 3264beaa92a1e703478c61f92b227b293503988d
SHA512 95a77106aa92b4f61379b7802720bfa2d4b2bdff099e3bd4ce50adfd94ae0cf7dfd6dfad8d49d8fd08450fbd223623d5e955dc4209cff3a753fa26773b63560a
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDjM:A3kM3T1Lljj
TLSH
T17125BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 942KB
SHA256 81025e36f45426b7209e27cb31dbdcb1ead55d09eedb6de103e84a807d746512
MD5 75b0f6cbe6a5ec991f69259255fc5be6
SHA1 58def280da7a61241106f65484d11d3a1011d6e9
SHA512 4c511f4bf05f68c6f3517e5062cc13177bdb0042c1028ee2a3a586d6beb66205165cf3498c4423913fd61cd20c541344976b60667a287a89b4ddff157a91ad6f
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoEkoTWaLl3z0zDkh:A3kM3T1Lljd
TLSH
T1B025BF13E79014F9E917813499E54A12EBB1BC261760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3592-71-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5108-27-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5108-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads