fd2988b8dff8f0a55d64671c6537595cb9008766947e7076104cd60e69c5f2a3

Analysis

max time kernel
107s
max time network
102s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
Size 898KB
Sample260715-ssvcaaft8n
SHA256 fd2988b8dff8f0a55d64671c6537595cb9008766947e7076104cd60e69c5f2a3
MD5 90750b13d6d1a178ba7a7006496da1c5
SHA1 0a68469ab34f52be59b5a597db35ea4fa4d90bce
SHA512 f91050960b1cd025eae0c0aef5b906bc6a510fdd6fe3161019cd34a4709c502c178a2f9d045e450a469e4b923cb9bf918649821546227afb1bcf7e7ab6ee26de
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3c:A3mnXoZjzyaEFo3+aWiauoOas06zA3c
TLSH
T137157C03AA9000B5E11645305AA5961EE7357C15DB638ECB23589EDEFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/120-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c000000019cc9-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/120-100-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1904-161-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-253.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000018a6f-434.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-483.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-538.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-601.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-620.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-717.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-834.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-859.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-881.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-927.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-946.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1001.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1089.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1163.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1207.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1316.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1335.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1361.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1395.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c000000019cc9-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-57.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-253.dat	aspack_v212_v242
behavioral2/files/0x0006000000018a6f-434.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-483.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-538.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-601.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-620.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-717.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-736.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-834.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-859.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-881.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-901.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-920.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-927.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-946.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1001.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1045.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1089.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1132.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1163.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1176.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1207.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1316.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1335.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1361.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1369.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1382.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1389.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1390.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1395.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1904	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
120	2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
1904	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_90750b13d6d1a178ba7a7006496da1c5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:120

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 898KB
SHA256 fd2988b8dff8f0a55d64671c6537595cb9008766947e7076104cd60e69c5f2a3
MD5 90750b13d6d1a178ba7a7006496da1c5
SHA1 0a68469ab34f52be59b5a597db35ea4fa4d90bce
SHA512 f91050960b1cd025eae0c0aef5b906bc6a510fdd6fe3161019cd34a4709c502c178a2f9d045e450a469e4b923cb9bf918649821546227afb1bcf7e7ab6ee26de
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3c:A3mnXoZjzyaEFo3+aWiauoOas06zA3c
TLSH
T137157C03AA9000B5E11645305AA5961EE7357C15DB638ECB23589EDEFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 99884d4ae74a98351a935eee7cd2c50f594a8cfdb4f1b534b427d42fede859ec
MD5 48199628dd5a883c2946ebee8041f009
SHA1 e496434fc90e699e8c9cce58d02c79bedc77fbf0
SHA512 d754c73b346ff386bb1fd14a024d4cba8b3b79d3114bcfa5b9b8568b2f5006f22344d6138a3a392da00c9182829895f39be591727bc89d30be32116eab9bebb1
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zA3k0Le5ji0hmxNrM:A3kMTPji0Aj
TLSH
T124653916FA644275D022C074C5D2A65EEA313842D7338ECB13949EEDFFE26D19A3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 912KB
SHA256 9ab205958f5e10b95f7f890b334d2589353bc7d697c0491e3e215ee3000fc447
MD5 7b094f96032730b1f334ab4b945a06e6
SHA1 2d1404711bc0f3880cee149076de3e4eb64193c8
SHA512 bf73456969f20e22519f091a1885efdca49046e31e1ffe0ccbbcbbde7627491e9bcdc2084b5d83d3c7574a927e205ab56c7f922771f5d1d2b76a677d3503efc4
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zA3Oa:A3kM
TLSH
T104157C03AA9000B5E11645305AA5961EE735BC15CB538ECB23589EDEFFF1BC0AF293B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 921KB
SHA256 4be5c202f09b3033670beed15704307f6aad2643aa6502cef835ee63755765bf
MD5 e8ebe82183224eaf042c9437898ed92d
SHA1 8de66dc7e2badb5039e8187ac2cecef0cbab4085
SHA512 f53267998256a459472c9c4bf1ba1cb22ea1ed3c498dc0cf55135c3e2bc318952563a90dd94852b6cd126ba7c6a4f6f0e1b3a92ae8d2fbefd1032cbc933065e6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3v6:A3mnXoZjzyaEFo3+aWiauoOas06zA3v6
TLSH
T154157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 921KB
SHA256 8810d804304d9dcc3787986b7ae035b3dd8960e52971063a1cfd77e84e0d4b05
MD5 7745f8868fe075e2bbb886784842205c
SHA1 0cf9146661889d63dd529cedd43b5aec9c6844f4
SHA512 b285e13bffe021b2813b02fa761f587921782ea8f5844bd2fd18eed2847672a6bfe47ee4ef7b524b3f54a06a79c0adf98cb928e6908611cd6370d1cbc203b51e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3xN:A3mnXoZjzyaEFo3+aWiauoOas06zA3xN
TLSH
T165157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDDFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 921KB
SHA256 5a77ff8d57d07c83b31097931c2e9624024143df2c0f27e84fbbfc3a0bbc48be
MD5 4aaef2deaee5c6d3cf8d477155a9699e
SHA1 19e4afcdd9657e40e663553c4720c297151704f1
SHA512 0f869e3caad4ec88a37e7d7785c3dca42cd57f380ffbdfeca8223e36bbf7d7ed8d3f1c88ab769cea2a32de5494014f8ec0aa707563b5cb35294176bdd915a496
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3nf:A3mnXoZjzyaEFo3+aWiauoOas06zA3nf
TLSH
T1A1157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 921KB
SHA256 38ac7cee9410e51e475410ee893d9759aabd36cf1b4a261478f67aa152bb3a01
MD5 9ea67d5085b8f70ef984f27c7b24e19a
SHA1 d30c3b6593a193210c635bf876713b8d9810c280
SHA512 a9e01588fbfbc7c16383a264290a8ef9c8e897191ec851f840af09c8a9609aabdb15cd2665aa98fc990d4738ebf34a2091fab1286d7ad9f87ce13c3ccf41a6d2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3po:A3mnXoZjzyaEFo3+aWiauoOas06zA3po
TLSH
T171157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 921KB
SHA256 994e31bed181cb9147facb8f748d8162070ffab4757d9abe329239eb1fd1d3db
MD5 901c6829ce48462626f6aff23cc2798f
SHA1 b7f723ad722fcf387f07b3a1c6096167620eb02d
SHA512 5b29a1902ba682679f9bb6f093c1f2e16e92c22ba99622981d3eb4a2b74a2169aa9e6ee9391e73a2eeb1a7583d595388f96460aa0b5300435eff5df392f505c1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3Zu:A3mnXoZjzyaEFo3+aWiauoOas06zA3Zu
TLSH
T195157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDDFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 921KB
SHA256 ad46e3bd496f03946dec1b0d5ad63bc2bead597832aa6681244573441e5de42f
MD5 7c7427c326bbbdc282e7b4f9b0858570
SHA1 7ed58d76351d037bb6259c6f2a2d20cdd25cf9cc
SHA512 585e283724ee39077613fc5093a8e2b9c45fd4e484773e032d6d9ecef5d187a9570eb9e900962d7cfa49bf423c15977205985ffd989b13f0e40d567cb2ade3c3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3/9:A3mnXoZjzyaEFo3+aWiauoOas06zA3/9
TLSH
T114157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 921KB
SHA256 22ca01087e1c89f1aaa0648070e7ca320d86c835e64aba76dcbc5fa9a8df70c7
MD5 33ab25154a97c28978184378c102160d
SHA1 e53ac7810f9aabdc3e6be5067b5fa3b6655b455d
SHA512 0e84ac174d1f8e5feff2c82f6a5f16200705e1e79447b5fd69e35f77987ce6f505a44addb47204af25e698f679b590d13a1b65fa09e1cfae63f9ff7d77685507
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3bc:A3mnXoZjzyaEFo3+aWiauoOas06zA3bc
TLSH
T1D5157C03AA9000B5E116453059A5961EEB357C16DB538ECB23589EDEFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 921KB
SHA256 6a99719c93f225f350d4f92ebecc2ed33cc443ccaaade4c7120f0b0615298dbf
MD5 0c7a65e3baa48d02175f367ae9f056e5
SHA1 ca21b0edc2e815c68c78543db41bae7aa39dd34e
SHA512 3333d65b13a04332587093802a9f4971a012810ca4a2fc3e6648a2a1cacaa15521d064d040db2b110f0549ba1e9b5119ac15b58e7c3e4cc4f6d3d784738b38b2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3Ep:A3mnXoZjzyaEFo3+aWiauoOas06zA3Ep
TLSH
T1CC157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDDFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 921KB
SHA256 3f0d81a2506e8f8ec9f5a942819239ae7740ebb48718588a20759425e0fd0743
MD5 d812b200a90c8f8993049f30a62beb34
SHA1 9176c676309fe5386d47c5541b0441c59f0701ba
SHA512 088b6910be7bb55023d99f81da20f7a86905ef2f99ccfc28eae3d85129b96169a3ff119a227f94482fbe57fe1d13646e95ebdeaa36f6887b2dbd8f140b9063fe
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3L0a:A3mnXoZjzyaEFo3+aWiauoOas06zA3LN
TLSH
T1F8157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 921KB
SHA256 4d3c9cf887680491905fd97f59a21d28188593c4f628bc52213dadec76aec6e2
MD5 2cefd481f6f25d4ed3fd047a211a0581
SHA1 253e9e706f0ac1cbfb109a2a9d9dac0accb2c7b1
SHA512 346ac13f0cc41c46b0d59181840634d0d180912117e2a66515ed73d2d338b893e42fe5530365472ceeded21f5875bff9d10312e68583f3c2f0b595322cd6854f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3ZF:A3mnXoZjzyaEFo3+aWiauoOas06zA3ZF
TLSH
T1B4157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 921KB
SHA256 8097c564298f8343aa279b9d306e7222d60692c0808c79a70b4b17a8b0c89b23
MD5 b7706cebac7c224c509fa6a01f79e819
SHA1 8e7812a1055948ae51ba305fb6b85845a7c4d990
SHA512 b66808f66491098e2e13623d4645f1c2d2baf03e9c89c78493ddf0c5ffdd0aef6b84fd9015aa890aa99ee59fb4532213838d5e6afede4ef2677085f15c311fbc
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3yC:A3mnXoZjzyaEFo3+aWiauoOas06zA3yC
TLSH
T1E8157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 921KB
SHA256 e2e5f747bb293c66505dd88b3ae1afec26c42eb06e90cfda792dff77d71a2a04
MD5 66f08c25eaa256148d78a41c37dc99e6
SHA1 b1388abc2228092748eb849acb76582dc6cde14f
SHA512 351b3af0a970cca89a262fcb1230e9b5a43a8470d455e23559b75e370160815bbbf937b44235155eca29cf9b0dfab399441290557041de771d2c3bfc8e962b20
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3tw:A3mnXoZjzyaEFo3+aWiauoOas06zA3tw
TLSH
T1C1157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 921KB
SHA256 5a7da70b8bcacd941780d301c98217f6fb77bf5b97cbf39415c94ea5130694dd
MD5 51bd351abef6680b2968b503cf3829f0
SHA1 d2ff8dee5dce6e6b04022e6db136b044d76fbe64
SHA512 b5a065cebbcaff8221a045f839720593387b0ce8919a4f9bbe9c84b41a687b5d48933bd0b49695ab75fe08daf5571229908d8bf5af07e36cd82f1b1112baf9c5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3cT:A3mnXoZjzyaEFo3+aWiauoOas06zA3cT
TLSH
T125157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 921KB
SHA256 835e98d32966ea0213c38d49e9f7b3c1b73b47c58ac4378fd3e686c4c3ba6c71
MD5 edfbd73f699a112244c3c3df6c2abaa2
SHA1 497bdf816e70d70ea7c517adf190b8c47b65b5ce
SHA512 33216a7e2de0aae9e5baed55acdd7edda6d8e8db14ca235b47d74c807eb87ec142b38c077b6d286bc700c7a90fad58d218771773a1a25527b03b6aec96c78f53
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3wu:A3mnXoZjzyaEFo3+aWiauoOas06zA3wu
TLSH
T197157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 921KB
SHA256 6eb23f3df6ff99db7770a06f8c8d8139f5dd4ea62c774b3ae78432ea3221e6a5
MD5 288148da6877d622bd66813f8e8afb8b
SHA1 90cb77ba133d66766329471a7adcce9f3efc1730
SHA512 9be64a2d7a33e8e8fa6c85c9a5d114ea0f8ec684d01e78b106e5b66ff4625e8c7c8e689580053f0d3eb1e8e81fbba1997ccbf9f75ab448f74fc5fd0dafe394fc
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3Ob:A3mnXoZjzyaEFo3+aWiauoOas06zA3Ob
TLSH
T12C157C03AA9000B5E11645305AA5961EE7357C16DB538ECB23589EDEFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 921KB
SHA256 c221fcc9a84c45e04e985ab3c7dd0f7fc2da961db72fd4a934d584aaca1a831b
MD5 14383283f2f695a2a86eaff4b407cf58
SHA1 8983db37ac892d86fb3ffcf9a463cda5ed6ca7f4
SHA512 babe2ca3f8ae647a294a46b2543381ffd9f3e8006f82049e4f283dc839f903f7cb53c76e749024cafd775369f6164ea3df74e3b6b35056f203963438b8e0cb33
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA34f:A3mnXoZjzyaEFo3+aWiauoOas06zA34f
TLSH
T1B7157C03AA9000B5E11645305AA5961EE7357C16DB538ECB23589EDEFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 921KB
SHA256 3c6a18e278db44caf4ae3a040b7339362826ef8dafc117d5e2fdf5b733414f44
MD5 eb334996dd512d4f8bb26d11c020cf82
SHA1 0a8f3043122360f0e4b5247844ff845a32b2a4b6
SHA512 ad6e1a3cbcb02ec683cf096e028852625be304f9597a0de3c25e585cca0161d5da0c816d2d4c1758616dfe11422a5e38b85664f3e659538e58ae21738d1a5f03
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA31K:A3mnXoZjzyaEFo3+aWiauoOas06zA31K
TLSH
T197157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDDFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 921KB
SHA256 af61744881eca92714666f127b4a6ec43e7b6b640449e6a482b946e2016a714b
MD5 83fc017913279ae9ec2b8eeda7cc90d1
SHA1 ab8451f9609ec6de15d2fa22f1a816b6eadf2ef9
SHA512 b1131fec7cceea79f6b392f12c49ce5e524d10eb5690a169de285a9f96a297c65a0c7049cc77255594597e7383b4426b4d717a704bc5a56c49ec4a55636280de
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA32k:A3mnXoZjzyaEFo3+aWiauoOas06zA32k
TLSH
T143157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 921KB
SHA256 8680a5c446346238f0ba2bd64ddb3c72b7a50dbee4dc6485b6eb4b97d2239148
MD5 6e6de5db324013615d77a210dc2a1b1b
SHA1 7927666cfdd0908802c345132ec1103993ad4854
SHA512 e266eaae8ef5188e13d1a94e83ba8ff379959417a08807f7e6fa23d046af9403cceb5928612d2f5d68d0bc4223038df2fac4c9cdecfdbdc6fe9f2fd66b385673
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3T0:A3mnXoZjzyaEFo3+aWiauoOas06zA3T0
TLSH
T110157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 921KB
SHA256 ed0df9cbd6e248437464d696652f70f94f576d020e19bfd72c1cf4c0cdb6f277
MD5 45649a015c68a4b9c269db8f0e4f8352
SHA1 9c2c5d70ee84ec895ce986d5d320738b86820083
SHA512 dfff6a614a60a7b572e4e9815d2a75f670e25fc7e4a6421269ce4f9294e700b326cdc0e0ef1dee54f3c69e964e2382af15f1cc734d4f4b30208054ff52220779
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3i70:A3mnXoZjzyaEFo3+aWiauoOas06zA3ig
TLSH
T1A8157C03AA9000B5E11645305AA5961EE7357C16DB538ECB23589EDEFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 921KB
SHA256 b7764de4bc1d1fb81ded2f1225fe94a94fe808f50f0fdc24bc0f357bd32f799f
MD5 935d6d96d528c80fa9af2cb10ee14b4c
SHA1 5259fde77a93154147f16df4498c6bdb4cacc5e6
SHA512 7e2d0215ab767cbc831a1f38227a74e0bd9ca0d3dafb6d199d054a72bf0191facbfdc91ffa551fc1344f4b377095656ac0ee66897a8a5a12af873989fe42b9cf
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3Dr:A3mnXoZjzyaEFo3+aWiauoOas06zA3Dr
TLSH
T199157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 921KB
SHA256 82e03eb4d4c1a132f3d48fc3d9c729857d5f4999e1d613d7c23562bfa6eb0758
MD5 796be48a85e5fb83389c4d02e95b5489
SHA1 638ad0a607df0488e2e5249996049d60bcfa4c60
SHA512 bb600bbc6a8b1ee72a9f1536b8fbfdc3da5721367db2e98aa0506a2ef25e7d190d854ded04ea957493fe505eb73b223040b96fe9bd34652c2f88924fd3ea2f7c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3ln:A3mnXoZjzyaEFo3+aWiauoOas06zA3ln
TLSH
T119157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 921KB
SHA256 972c51764da956681a0ada5acf9ccdf80f34983d7afa15d57a3e430dc5916adc
MD5 1e0d92c0fe37ea88afe5f68dda553902
SHA1 bc24c9585d7d1558148e1e852b8020b4e1b3c7ef
SHA512 1836f22a0ac65d8676cbdce166e5e8c3160b0b0f3149a603f19c5a15eb9b48f040a62f40d0b45cc19a11d1f8e862364648345ff9dee42a32094c409dc92d8f0b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3Rx:A3mnXoZjzyaEFo3+aWiauoOas06zA3Rx
TLSH
T173157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDDFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 921KB
SHA256 9fef8588d7107fea7ede5f12f67abd7ad19675d969ea95bc48f938c6720a9410
MD5 d2493fe4c35a7a05498b0926b41deeb9
SHA1 e1a811af6c43b8e5388d36ecb08b66f09c6440d0
SHA512 d0a5fd67b9aeb986935f9a0e855f7ed8687a6723f612e2085f2c81560863e66537b05e6f509a2fe29ec7b78548c677f286d7f5569fbc05ef1c39dd2d1989b9ab
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3/A:A3mnXoZjzyaEFo3+aWiauoOas06zA3/A
TLSH
T1B4157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 921KB
SHA256 33b0a8a6c100f85341479a9efed1cb7dfd563a918410f7159bfa782df88c039f
MD5 47c15a9bc50e8132867f902c678c29e0
SHA1 a605b85648eb0930a4ae2563afce29470306ef24
SHA512 52b94caf24b7e3656c9709497303fa4012973c512c109f9f7df54aae684fcee6edc542406ffa090c688eeb6702777071d40d855b98b5641a9bf716e9fde534f0
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zA3Q9Q:A3kMQ
TLSH
T176157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 921KB
SHA256 e5b60905b70d5f51065cade529e930c8440dd03f500010315a9989153052b587
MD5 37bb3fbeb04cabf62cf9cfbb4dc06a17
SHA1 f2cd192cb71313564cf0b632d9e67e0349f6c8ac
SHA512 3060a54efcbc6ee9c359bdcc00f04fbbb71b9a4f7ea496e35c7ac1391984af8fdf8f7563806d9cf8d378cc3d0df4fa4775bb7ff62c120cf55282f759952592c3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3x4:A3mnXoZjzyaEFo3+aWiauoOas06zA3x4
TLSH
T13C157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 921KB
SHA256 f3a810dea46a60a14c67e1ffbdf06ea7e73d456e4508866ef7091bc031f0438c
MD5 db785d52ba4823d0b0b4c5b0743f94bf
SHA1 b83f45edab32b1b6909a30bbc4265d5f148af228
SHA512 0131152bc7f4b8bb8e4d4e858250e9c59a192dcf3abf675360b474dbcb1cab3c6ebbb352ec034c5c6d24c2148d8749c15d9f3fcec110a28f3645ec397742b299
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA30u:A3mnXoZjzyaEFo3+aWiauoOas06zA30u
TLSH
T1BE157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 921KB
SHA256 b16f922f8cd52186e87c649bb73ba1429df4826b5b008dfbbcd4a36b2c202f7b
MD5 4ef4052729a8f122af0d1781995598d9
SHA1 ce1829821a7a9d2ef7159bd62911b87307e10ddb
SHA512 c3a73f5a8d5ac8211033c25004bcdbc02774532edd8afa03100aebeb324e2cb999f8d0ce156f74ea4f60ea8d47a8ddd9af1e637e93f65bad83160da04f97aa8a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3Fj:A3mnXoZjzyaEFo3+aWiauoOas06zA3Fj
TLSH
T195157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 921KB
SHA256 447bd0bd5734913c0d25c2df72c5447ea5b5ad90e18110e22b176787a49e0a7e
MD5 c847e944c01124e4622dbbd6ceb1b3ac
SHA1 eee5d9b48268d72284ad08a93e6eaaea4e087dee
SHA512 47250ab83ce19291a83bd0e8438cf1454e0292375619a5fefe5627ac1d107dfef0f4e5de9ed86347d7c1ae1b969496a2b5e2a4bf346d9c26fd42ed3fea6789a7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3Mg:A3mnXoZjzyaEFo3+aWiauoOas06zA3Mg
TLSH
T1DA157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 921KB
SHA256 7ad889356f9be5fc35a7cfdc890c744157219f88ef0b63186d1d3978d579dfaa
MD5 5ce3b8185cae53a7b3a44c34ca01978e
SHA1 d7c16564fad497e5620146a1b869a53dfb0f691d
SHA512 b0c5a0e303322a52aca1947e48c93d0216487c8dd9fb261f1d770f17e6365ae70094422b554c4cfb532e26ce1be4b9766fd7fa110bbcb9c0570be54596a1ac8c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3TI:A3mnXoZjzyaEFo3+aWiauoOas06zA3TI
TLSH
T109157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 921KB
SHA256 e6edde80ca700e47ade2aad990b13c4370fbaa9166ed6823f83faea4e45bf448
MD5 ff5138c589a8126249dd5622281165d1
SHA1 6556f5490823d761096a11e6a7d49bfc717e7f2c
SHA512 a3ef5cf2456f979d2096d12dc4234c311ad29f881ebb33c010524d123f038e5497de25f6dd91571b40cb9cbe641b144203f63f965b610a3886a7e5f7d911e6c1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3po:A3mnXoZjzyaEFo3+aWiauoOas06zA3po
TLSH
T1A0157C03AA9000B5E11645305AA5961EE7357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 921KB
SHA256 f7d75ba46312beb1fc66fdb0f5b9a01ced2e079f12290573c4fc52f665f722ad
MD5 7ebf0c09111c143c9296cb0468b835f5
SHA1 e8bcbb8a8fee4c223fd8829974adbb14dde0e343
SHA512 a95bc1c8a2009a35733eb9d716af311c7c30329cf992a2e0b10f9c026c205766e80c187d0d4bfa9579bd40885be3e0aefc37e38d41826e9810ed386f28b74a6f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3a+:A3mnXoZjzyaEFo3+aWiauoOas06zA3a+
TLSH
T1F0157C03AA9000B5E11645305AA5961EE7357C16DB538ECB23589EDEFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 921KB
SHA256 36edae2e4d4503b1c53d1277a7a01cf612ffae4c012f854ca18e545ddb8eab3b
MD5 bc74d7c5cc944ff1c8ac3b1b96c8ea75
SHA1 230821608b8218cec59e62664572881e3b66fc79
SHA512 9df32731479a04712552bc30e77f26979c5774b87579e7a68b67b9de66941d06af9e8852554aaaa066cf5553994e7de9d5fd947ca1ff523714dd164c371321bb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3aQ:A3mnXoZjzyaEFo3+aWiauoOas06zA3aQ
TLSH
T127157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 921KB
SHA256 749b06976ee465e9a8ef64ab7fe7575e10741748277dcf5124ae7cacd09be77f
MD5 7987c8232c453c06d3b4a136ae4d8d1e
SHA1 9a3c81b2fa4c40c494a6bb52abb22aa17ff05753
SHA512 d45594b4d2b9fc2836e2dfff555a325b784c2448a57b37764a378cbbb0d40d7c93adb884d4cff7e58be5c16c0516ddd6c6e42d40cd98989d4c81cb1e2e03da60
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3rX:A3mnXoZjzyaEFo3+aWiauoOas06zA3rX
TLSH
T176157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDDFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 921KB
SHA256 2e1e6ff7f0ea880e89a5419a4ebb739790d9ef25bb3a298d1a1afe50d2e82931
MD5 2f4ad1ffd7d530ff4b3744c5b967e3ea
SHA1 5ef6eb7c64bb29705405321719f4e67408f2be78
SHA512 fb10431dbaf217cfcdebca71e4a1511038d4118abe2169c9df18853280a809a318357458436dd2b34f2705fbe649de09e082dd0c9c5b5db9464190a3a7a8b871
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA35L:A3mnXoZjzyaEFo3+aWiauoOas06zA35L
TLSH
T1CC157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 921KB
SHA256 f9b52b7f4f6da2eff8349ffdbac1b68e32e0cbb05102f58dc1404823376be819
MD5 5b4f706f7e24ad0b20ce6325853717dc
SHA1 54f8b3787848eddfbb92bb0515ab0b39434abc44
SHA512 dae8a2d0c138b1da7fbae579ef6e2e221c4fa1350b7e4f99758aab347dcd5c190362939df593346cf28f624f9c036e782c7f150a734a794ec932974cec25f570
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3nFC:A3mnXoZjzyaEFo3+aWiauoOas06zA3nM
TLSH
T1A9157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDEFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 921KB
SHA256 805089735e653feec3e50502a90adcb05aaa5f1da6dc91eb0691e17651974840
MD5 b6809b4276515357b0beff3a1960cdc3
SHA1 a8cffabe0e6baf9b12f9f3dcfcdc2fee4e452351
SHA512 84f1128f24a85308240b43293621382a9e27fc8594a1daddedefe363a3e53a9833ec23c2e85d1c8da6f32fc4728e272a022c520a4f2f166cf2ed3686e7f6bfcb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizA3Qh:A3mnXoZjzyaEFo3+aWiauoOas06zA3Qh
TLSH
T153157C03AA9000B5E116453059A5961EEB357C16DB538ECB23589EDEFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-100-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/120-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1904-161-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads