cd4a962a3dd1ac17938e2df4008afb684d5f3de31ffc7df6ddaab33ef6db4e93

Analysis

max time kernel
105s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 824KB
Sample260715-s8a9cabs8x
SHA256 cd4a962a3dd1ac17938e2df4008afb684d5f3de31ffc7df6ddaab33ef6db4e93
MD5 26704d4e733c6c728addc49a415a757b
SHA1 7b3011a66b387f0d3fe72ecb9839dd5c000bc7cb
SHA512 436e307a15b809aa3b9f21e1df3a51b7f075121ccbb2a447a93f79f2fd54a661192313fd2d5712a97cf897c920dd3d28283efcf88e4a5db0a223f4d005765219
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0a:A3mnXoZjzyaEFyKUJqogiYiKjEo19xN
TLSH
T1BC05BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F637C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1444-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001500000001c4b5-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1444-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2772-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c96-59.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-412.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-479.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-498.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-589.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-687.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-762.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-794.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-843.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-881.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1003.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1065.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1113.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1139.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1170.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1208.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1357.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001500000001c4b5-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c96-59.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-412.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-479.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-498.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-589.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-687.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-736.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-762.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-794.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-843.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-868.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-881.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-901.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-920.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-953.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1003.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1046.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1065.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1113.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1139.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1170.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1183.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1208.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1324.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1338.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1357.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1376.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1383.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2772	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1444	2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
2772	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_26704d4e733c6c728addc49a415a757b_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1444

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 824KB
SHA256 cd4a962a3dd1ac17938e2df4008afb684d5f3de31ffc7df6ddaab33ef6db4e93
MD5 26704d4e733c6c728addc49a415a757b
SHA1 7b3011a66b387f0d3fe72ecb9839dd5c000bc7cb
SHA512 436e307a15b809aa3b9f21e1df3a51b7f075121ccbb2a447a93f79f2fd54a661192313fd2d5712a97cf897c920dd3d28283efcf88e4a5db0a223f4d005765219
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0a:A3mnXoZjzyaEFyKUJqogiYiKjEo19xN
TLSH
T1BC05BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F637C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 ec175ba7fbf2b54b0401c1b01afeebda06e7939824c74e60bae20d2cc87ff8e3
MD5 2d5d00231d8dae1234e901830ebb7f97
SHA1 1e460004cfd27be237e7ee9b1afd4d54e5d9b5fe
SHA512 cbe5afddd8ee23107c8ca82d1b8828a4ea8b0883e835a722fe81abca9b782e664da38cc6c7c631632dac326d3df9b97fd0d9083602b98712f810cee72c73ee14
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEo19xZ0Le5ji0hmxNrM:A3kMjKvPji0Aj
TLSH
T181557C17F6B442B5E077C174C9E2965AEA7138821B30CACF1359C7282F63BD19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 872KB
SHA256 9d00539215c532003a6758b0e6c26503bfa4d6ad1a7e2cc78fa6f010baa8f35a
MD5 2c99151aa4fda1a777f4a1e5f9d22842
SHA1 9376a5a99378dd77afce9ebea231dc173586c787
SHA512 badb179422e185b0f4a4e40c3c8c2b3131019e2020af8be418a50cc396bcc3a93a0ea529f7d88a4325c9cdbbe8eca318c35b65447874073c0fc24ca3a7a1c3de
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0vb:A3mnXoZjzyaEFyKUJqogiYiKjEo19xIb
TLSH
T1F115BF03EBA404E5E51B8630A9E54612EB75BD532B60C7DF2358C2152F637C0AF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 848KB
SHA256 1a244aa5021acb9d75eacc2a3eff971339d6a44c1ca95aab60468da81671c24c
MD5 ab08a3a202f99f9b14021afe4b8dc27f
SHA1 0aa73bd1a0a376a332ea7c95d4ea60dc541dce0b
SHA512 512943e470ac2546b20aaf2fc03c89b1148d22b378796e7af878f1b15d798d315c8749e336debbd157369c168b3cb709c6995f4c75361364dd4ff50eba0b6bea
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0d6:A3mnXoZjzyaEFyKUJqogiYiKjEo19xK6
TLSH
T16805BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 848KB
SHA256 7e55561aaa47841dbe20428bb620f58a3d3aa2ff29d89c58f33d0494789f6968
MD5 0adeaa2d64661b8e7fc39019d6cc7ec3
SHA1 36d500da31d80288e7d493d3890c26e689c5cf9d
SHA512 66dd5da343b145b04255da26d561f9bf0a1485a353a14b271ba5e64ba6f732d3731b12ae1dcc8faca99e192c0e4435bda5d86427bfcd1faa9b5efdaa06c7ac72
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0zN:A3mnXoZjzyaEFyKUJqogiYiKjEo19xiN
TLSH
T11505BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 848KB
SHA256 f94bc10d2a6e3f16f02a0dceadac8b5d54f90e63d9f120b11b4303f8284711c0
MD5 04c1dc81f87585321e3a3c5cd52ad1a4
SHA1 6bc82be377504af17f22ab52de0856d069d31369
SHA512 f273170000afd0c42ab7c0417c80cd62b638100ed8cc37428da3b05d04e7c811f1cde2468e8d0ea08074cf065aa6d9097ddb8625ac43a8b6a116ad52de041d99
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0Bf:A3mnXoZjzyaEFyKUJqogiYiKjEo19xYf
TLSH
T13E05BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 848KB
SHA256 2aaad8f1506459599fc2db9e601e9c08da0da4e41f9296de5180d53fa4c092bf
MD5 9471729b5517ae7f8be602e1651a0917
SHA1 bb796a4573dc5d6a413ad0fd038e3a5d85242519
SHA512 7b8bdd3d656d8c98f824618b2133d0df22a8519810b496cd88b7c61d8631351752c0abf7912a2030b38349f71e498d67b5148e98511fc327b004494cf99c87b9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0jo:A3mnXoZjzyaEFyKUJqogiYiKjEo19xyo
TLSH
T15605BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 848KB
SHA256 eaa4d952aadb030616f8b955341ebf1bd0ce88b7d59d2bf994a2f7770958947a
MD5 928a64859d19ff69bba89eb1c9c3bb2a
SHA1 e53a3c91f9c4d48a57779d6e46233afde6d7d759
SHA512 c9c9bb8e63de507cfba12a391670a287a04d3e69bb79e8d81666057d91874583284ba8f52fd2c717cedeec3e5e3efb268f814ff56599ae688f5887a77023f72e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0Xu:A3mnXoZjzyaEFyKUJqogiYiKjEo19xmu
TLSH
T1FE05BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 848KB
SHA256 532c9c3e386bb03840e6d07221168958eab2e1d7b47c631a5d77c92e7b8377ae
MD5 43c5cd682d6b782d1debb1ad51f0464d
SHA1 a44c91de5f07b7c1fe4c1f4a09ca2780c0c555ef
SHA512 08accaf626b2711cd2c915965b047bb169c39d914ef845bfae6073a1478c26365b2c01e7112502d4fb19fe5d273e130013df4d3bc4c75b5e96ad7744859bc0ba
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0l9:A3mnXoZjzyaEFyKUJqogiYiKjEo19xa9
TLSH
T1B305BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 848KB
SHA256 bacd05447e4586131a7d8d86647a3623cbaa32e7ce4ace36d1ce9f5901f21a37
MD5 1e6b0d8243372fbe19bd602059ff5edf
SHA1 08b9f4032d07f21ce04fdd3b720caea8cc5cf4da
SHA512 acaaf4a31cd2c7b5adf8d07bd10259e2eaf0f1ad07fbb538f6dc812c1e86c3b297780aef2c79f2deef9f6206766151f8de1d24116d74286b4bc0961747b220fc
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0Bc:A3mnXoZjzyaEFyKUJqogiYiKjEo19xac
TLSH
T10705BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 848KB
SHA256 e11b75929b22eedc6601ffc08a86f1343d8205c36a1810f1a9ac0e8f69935ecb
MD5 ee1f8f4076604b4ca028c2261cbfcd7c
SHA1 192c6f87394872c4fbbe0eda5fbcc3cf58571f2e
SHA512 8f015dc52aca8fcf9063c1f9c18837c07ced83689b1e86a62b1b98aee35f1d5a3427829418a759f1213c78d4d66641985eb83f7404f41a8918afb8c15918c425
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0qp:A3mnXoZjzyaEFyKUJqogiYiKjEo19xTp
TLSH
T1D005BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 848KB
SHA256 8feae738d431fc63753ecb4453827854fceaab439086db4574c56548b180c27f
MD5 763d65199cd65bb9d0a14f58ee431ea0
SHA1 f65f703d9e4c7472fb5538ccf82f06648765d793
SHA512 e0d8a94a5eee5faa9acdeb4f1ee58f3b43bcc36928bafa347da95f8b5b600c636219b150b97699d24e15996d602da5ed07ebcf1ba77a593ed0b124e0d44a22b9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0N0a:A3mnXoZjzyaEFyKUJqogiYiKjEo19x0N
TLSH
T13205BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 848KB
SHA256 8970427a49b257127326453255db57eeefa7a37a845532f06eb163cc7d9e6ef3
MD5 1ebea592e4756e7a5f454251e0fa9194
SHA1 78bf5b3a99a4134fb69fd20bf2e770ea8e7123fe
SHA512 fe4c09b13fbd48b990df75b865ee887a7c2c078e5170d72d299ad94096dc71b9261be882860706338d97c2835b21eb708fc5ef8d307fccdab643e98f912664f1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0/F:A3mnXoZjzyaEFyKUJqogiYiKjEo19xcF
TLSH
T1E805BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 848KB
SHA256 6c59d71130fa502f19262c39681e42ba6bc7918d2492b649bed38a9c4e8db89c
MD5 527dcc854f49b7287f72fade6ce99f67
SHA1 6cd53fb83c480fa398ca25b8f45b640afb4659cc
SHA512 e877516b62ee77634acd00bfab424e7bb4e33db7c2ba2e146fc34518172b78bf65f17a6e1f46d22bccddd908642a6589825db4177b7e672d433a52c69e8c60c8
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0gC:A3mnXoZjzyaEFyKUJqogiYiKjEo19xJC
TLSH
T12405BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 848KB
SHA256 2ed7030e5eb9ccdd5e91f8e24e9eb4d939e2dfeff7ec2e7d540bb89a68e6105a
MD5 c88cee753e66324f70db0142a67175cd
SHA1 256be8593dc869a17ae55799d9ab63d385ba6b46
SHA512 a4e48dcab9a98359c2876912fb10015e7e7ec3b6a147266050bd7674565969f2a9752a01fc2fbb0e2b7e1def8e886800512bf141cbaaf8a8078c25a8226fcdc6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0zw:A3mnXoZjzyaEFyKUJqogiYiKjEo19xqw
TLSH
T1DC05BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 848KB
SHA256 66f4f812833a87cedc5766db4ab9079dbfe734ed904b8789b660b3f918411949
MD5 dd9a36120ed872178139e3cb2b30ab67
SHA1 373de0dcb78f9f63e677406069df4fbe40401368
SHA512 08dd54bae52cff9df2edbd8bdf0a52fa55a3c177e6c59c86d57da0fc1cafff8254447fb18445b6035b393f2774c3394597fc64223bff13fad4f2c31046e1cf8e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x06T:A3mnXoZjzyaEFyKUJqogiYiKjEo19xxT
TLSH
T12105BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 848KB
SHA256 edd67f1e2d3128e5c199159998139f623e51cad6d8d8adbe4c32cbda3aabc025
MD5 4654f77e07b10d0632b4a126914ae688
SHA1 74df64b281988cf402033ab5f1ef3e2af8f02f1a
SHA512 26aa4953b748cf41d30e70ae1886bb7e0b058ee1cfba10168bfd08bf1081b35756f7a2dbd2bc637d33776a97f6ef614e2970c825daefde65eff7d6115ccf4f42
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0au:A3mnXoZjzyaEFyKUJqogiYiKjEo19xfu
TLSH
T15905BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 848KB
SHA256 d236f36c8f74238e0527be88742a4ba9bbc33ed94a0a5f8ac3e16fca7d63c513
MD5 8511fd54b5357f4e8fe7f8e569547826
SHA1 b580a33c781db278364de496659bc43751f90a94
SHA512 14f683dd9635ee924908a343add7c532d0883e6b52666bb3da82bb3370803d6330641ab3846d580a7cfea3f1f3fac5228abb2d63e59786e44fcd8a7cccd1db75
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0kb:A3mnXoZjzyaEFyKUJqogiYiKjEo19xDb
TLSH
T1A105BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 848KB
SHA256 9cd062a8229c649de5006845961301450b621124600149be7ae9a48b49997333
MD5 a933de33a472f071de3348a77654f5a8
SHA1 572794614fe220d3853c88aff8d07903b3d9aee4
SHA512 72c6db9283e769d91e8ec6e197c4ecb0bbb6989424e95fdc130cd63c6c7f98c359996772d26bcddeeed8589a927698bd9e8434db1349b770f5c7ca4483fc4c5f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0qf:A3mnXoZjzyaEFyKUJqogiYiKjEo19xXf
TLSH
T15705BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 848KB
SHA256 b81416116e528e4d6a0556a14805e993d310f628c00bdca9d65e9e9a871dc51f
MD5 73369e106a3b8164a7f72c9e0a462d46
SHA1 a6a27d24c87b8a55276eda766d1a6c59b0a2594a
SHA512 98e005e8711be461cf2464163e5c64a9198f4a18b30c944d5ec0a02475464115c27439ff9d41557e21d29aa6ff3eac403df9b8a5326f7b90d755959f1c066c75
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x03K:A3mnXoZjzyaEFyKUJqogiYiKjEo19xgK
TLSH
T1B205BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 848KB
SHA256 d5c3137a12e3276248df4b74608df9db23907439f80c41c9e85acc030fc3de9a
MD5 3c839daa701ea4a36c65dc13704473b0
SHA1 9aa4556d823876b4b240e90be4baddcc5ed6f59d
SHA512 e8586f9dad595bd75d407f234b29461c55701ac8a39b7db02d49168fb41d712c331d618cdc138792a034b16cfd3c6075a9d52fda8e7a22ee9878340f312fdedc
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0Ak:A3mnXoZjzyaEFyKUJqogiYiKjEo19xdk
TLSH
T11E05BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 848KB
SHA256 0a0dce37aabb356c097448de6dff56be245428048ae117963aa4bd2622599281
MD5 2daca2aac92d18c760a2c0a579f30442
SHA1 145399d89b0c53102bf6817d63bf4b8e6cb71ec8
SHA512 b69f26416002f99ed17584f4c97af583edab936745dd17ee07365eafd3312d7aad06ac3ea6f45230192fd72bbeff013847eeebb442b6c882692afe0dacdc34b8
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0x0:A3mnXoZjzyaEFyKUJqogiYiKjEo19xC0
TLSH
T1A605BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 848KB
SHA256 d99ad183f1ec17dc610fde9ff8dbc169ad17b0c42da341b775235ad612b6d856
MD5 3d75bfc2754153b8bfba7e0e4187c378
SHA1 265b1521ac11826d5534463282ff5de4f8392abb
SHA512 4a7326877fbc9dd6944ca49b07bb3794d0b6753ec7a401c5c9f8924291c496c450a1b027cd0d0232b62c1ded46f30c4f6f78c74e9b5e3efadd3aa713eb91cf29
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0k70:A3mnXoZjzyaEFyKUJqogiYiKjEo19xRg
TLSH
T15205BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 848KB
SHA256 5c7fbe01c27456ac1b660b80a985949eb9e540af0635785d003e14a8e9515f1e
MD5 7dda8a27f2db063da91da8681f8bdc60
SHA1 1c57e7d54493b43d5ce2aac9069f54f3a44208b0
SHA512 d142b4ce78ea10536af830ba606995fe007e208a0c17e262d1fd592a38a81acfb518e0161dc55414ab12d28cb2538221826925cfb9e0672d4157d5246412ee89
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0Br:A3mnXoZjzyaEFyKUJqogiYiKjEo19x4r
TLSH
T11505BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 848KB
SHA256 763313bbfa8d1aec4f92faac9f3fb230d4dfe7bc368b95e9cf269f9fea5dd950
MD5 656ad3aa1d1b1f1b61bd8cc3aabc8374
SHA1 b49e8adec935470cf8f3a6b4ed4db86394cc9935
SHA512 982ce7669bdce9156c1556e011a6fc99df3ec2509cfc4ba78d96790dadbdc7ac852733ece826cf5dd4f4e3f6f7117ee002106827bc06cf6f5c56139cca01127f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0Dn:A3mnXoZjzyaEFyKUJqogiYiKjEo19xWn
TLSH
T11F05BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 848KB
SHA256 6f2b427a3308b0d1d20ed82f73cf58f44cf84bac0c86670677ae2c650cec5678
MD5 550c5a8bb62c3ab33cf5afc546662054
SHA1 9c9cf60e338cc3deefd7d3a8c67f3717771e3bc6
SHA512 a3806e9897d1104217614a02ec96278bda56e13dcb8afb1e792f51338026f15c2099aaf83c2db9751356e1922ecf19b18eb0864a23509cc026236c5872137709
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0fx:A3mnXoZjzyaEFyKUJqogiYiKjEo19x8x
TLSH
T12A05BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 848KB
SHA256 87ba96184678970292d72ed1498c9f000da1ec8529fb5ea7537709e73db365c0
MD5 0b218d2097b30bbf1925b975035f6abb
SHA1 733beb1066aec805c4d0defd0b4ea3e1934fc72b
SHA512 db359e0a301eaa16be789f58af5a7b809c960d8a6664ffefd819ee21a46571fcd96477ab0452eba2fa58a4f6a96462f352332198e6aa40b75bff4a5350f72ecd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0FA:A3mnXoZjzyaEFyKUJqogiYiKjEo19x2A
TLSH
T11505BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 848KB
SHA256 db9cc45c58bce7879535e1b0932a73921c63abbce8871af5361c68a052547377
MD5 bf34726bc205f78e38f98dc13c0cbd49
SHA1 aea41535459a87c6308b4f7eb61bc8b6e8250579
SHA512 686725b0029cfaa2ff74ccc453e72aac93a8f85c8e2a0399fbcf4d63ba51505198343bb1f4888f2571467c58b15439f631686b763307bfd6000db6e71b45b94f
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEo19xv9Q:A3kMjKU
TLSH
T10105BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 848KB
SHA256 7505e963ec6de81b474b5f1aa16c5bc1665f142f6ea5257aea8b348b1eb92176
MD5 0add2581cf35a4dff677b3c330cbfb3e
SHA1 5ac140e32b6ac4c2767d14d9a92243f5c084fb0a
SHA512 bc92432e34a8fb4c902c91680a205b3ef5728128103be6951d8bdbb1360a7c1be741da0d9ef646b969f04a0a570dc2f89ee7740385f0316ea64f1d5fa6e0947c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0r4:A3mnXoZjzyaEFyKUJqogiYiKjEo19xG4
TLSH
T13605BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 848KB
SHA256 8be9d5f20026ea660ee94b26f3228db89a144a8fdb340e663d77e74ab8b2559f
MD5 93ee6dc38319c079e3107d30bd53a6cc
SHA1 d22982abcddd5fe1cb47eac1fcce993a523f8388
SHA512 14d3d8e61a9ea6ef01f9a4c8aece36f16930643216a779f2a8deae84b863f1f5de2a481f6717078212d77ac9a57f41bbd94ecd6f03ba0908e8df017a6f4f6c4c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0iu:A3mnXoZjzyaEFyKUJqogiYiKjEo19xVu
TLSH
T18A05BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 848KB
SHA256 f52c9a043e0987845aa01405615025fb57f23732f6f40a1d4a1446b248a7da8e
MD5 70d0ba31b8f23f075776538cb0a8096d
SHA1 a1e9da38364879d492da0da70884b9db46e6802e
SHA512 d4250592f5d56efcbc385a89efe80b91744f909bff93bd8ddd046c4c457e1ba3e63018cc69931989e9336c2fef10c3d32cb9fee6414a212348c16360aa798cce
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0zj:A3mnXoZjzyaEFyKUJqogiYiKjEo19xIj
TLSH
T16205BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 848KB
SHA256 7647b6e91f3495a97f1a6db7a85fb4dff4a1e0ace9142c2814b671733511aa74
MD5 60c3bf600e41545a63c9e68219db57d4
SHA1 3417d72eef33ca8b95fded17dd7583f04263fb38
SHA512 7a245f42587b7f3fcad5bcebde4879d4f98e7743699e32f8464c9caf39bfd69ab921687ecb0a3a1bc8134b5183a2b3401e662ccf68d7e58e94c38ca3b207c7cd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0+g:A3mnXoZjzyaEFyKUJqogiYiKjEo19x5g
TLSH
T1C305BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 848KB
SHA256 097d33ee7ccfaae04b8c93d630a2d4b638a9df73730260725521aa65d81f4472
MD5 5a11c0cecfd3d6d6f696ac60eb672d99
SHA1 70a1f48fa905807d33767333df673f2c008b0e88
SHA512 e76b51a7b195945684a77ffd330e0971582a5fa38c140d5d3a5f9af51423084a4c888e9d0b037880df70bf9bcb6a02b0a447b21fa0553988ebaf3b80aaa7673c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0xI:A3mnXoZjzyaEFyKUJqogiYiKjEo19xgI
TLSH
T1DB05BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 848KB
SHA256 e02bff376545a7519ea7c9ad971c312d7ed97a0456d7f7ec91eca0d8314a79e4
MD5 620cde1cae44613b8d7493a330b11fd7
SHA1 204b89195312216d3d97fac5e4458e8e6561df6f
SHA512 ede9e22ac659ba26efbe69e20d36f76b0b61346f827b90e6ab12af1a048c07af8ed9c93d9c1d4a3ad2e588f819ee9086c3c44ae164b1364ee2e31e779c961b2a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0zo:A3mnXoZjzyaEFyKUJqogiYiKjEo19xio
TLSH
T1D005BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 848KB
SHA256 9a030be34edd6ef50732ab96a87453c2e356fa251f826c17d07872f243a15fbd
MD5 977066ef429fa46d32fc03d382a318d9
SHA1 1774cce8cc3ab00391b1e58f15a171939189dbce
SHA512 ab6e0739f4d9cdb2b9dc85cd1cb278c455221d2e878f24cd42779a779ff8d93a97e23d0c04d3d9a506a46f190d15bb12743818c43cc52c39fffb00577fcd71b3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x04+:A3mnXoZjzyaEFyKUJqogiYiKjEo19xZ+
TLSH
T15B05BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 848KB
SHA256 96d31f2f5f6c3be7ba6bc1949488d6a5197884b974d1fbf04cca74ae780fdbac
MD5 e0105ed1d149f34239b877da4eafa892
SHA1 0bbb15c7fe47dc7378d72eb0b595171b80fce1da
SHA512 956ec0d69a8272f33acc393a348372f86e4000abfc97daedb2439856c46520fd1fc338e8d3bca2f50166955f525b5f30977d1d167d48da489e5209933bebb99d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0QQ:A3mnXoZjzyaEFyKUJqogiYiKjEo19xHQ
TLSH
T11305BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 848KB
SHA256 1cb0d23e6b5d81f86934ba94294bf05c942d228ae1df0d89c3836becb65beb70
MD5 6b86a782d4b1988982125f864913bacf
SHA1 0409dcf5c0dae9e6e537bc89cca926ccc93a7396
SHA512 f667185dcb9f51b546ad7f8de15928b04a95c9a9672466ecf236c32fea7a3f5ea9f6cd31443a683a9161afb0067d5ba475acf676a3a0ac6f631aca4d70dd498d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x05X:A3mnXoZjzyaEFyKUJqogiYiKjEo19xcX
TLSH
T18005BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 848KB
SHA256 49a9919702e632b378e0ddd8c15a00df69b745792ee431c4da66fc37f9dfe186
MD5 53e9f5f20546cd47bc8cefd411362640
SHA1 c29c7d775c17b04e22537fcaafed731710cf86eb
SHA512 57480adcc7f347fa9e1a0e05d69e75128ea2719d99362308790e696e20bb782769d8c908126f5fa51d836e06a4e1397f8d1b14ae01211a8ff43b5bfc48cc4f80
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0TL:A3mnXoZjzyaEFyKUJqogiYiKjEo19xaL
TLSH
T10405BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 848KB
SHA256 4bd8b2fe4c65eec98df2c85a39bd94f7ea6512193e884669735beb33ee6d1a0f
MD5 081ca1f5a2e9a8ed6612608b4f4ca2f2
SHA1 33eb4b21acf9ccc27d65c584f5659fd2b4c0bd90
SHA512 ae3acb780de0f65004be9b8decbda01fd04bce5e010113e435b061d4de14bf747ed268af5c6b508d1c6aa0c6f088d98931776f74da69b82ae4eaa716beca943e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x05FC:A3mnXoZjzyaEFyKUJqogiYiKjEo19x+M
TLSH
T10705BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 848KB
SHA256 63ed1a002705b20d1a9608a010366238e23c4052c5f161f3091f733300f3be3f
MD5 6e22c9b91ab5a035614a274bf269502c
SHA1 cda1d82b3d35e934ab761b749d0e3aa34057ed55
SHA512 10ee570538eab3fc554e818f45d9b316435d98d23047f0bbdabb48d93cb3946d38ec5448bbcee7c649dd3ff8fa00543f1a20476b930c1341258e302910f11619
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEo19x0Ch:A3mnXoZjzyaEFyKUJqogiYiKjEo19xnh
TLSH
T13305BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1444-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1444-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2772-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads