5db6860aecb8f5fc807217da7c8bd55a7da64741d3f6653c8f3b014eb2fa41b9

Analysis

max time kernel
99s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 942KB
Sample260718-ejrm5sfw7n
SHA256 5db6860aecb8f5fc807217da7c8bd55a7da64741d3f6653c8f3b014eb2fa41b9
MD5 4d4bf5d7573f8f0c38baa3998f1b1014
SHA1 446ebddf57c5d7d7c97474f0bf766fb3c54990ff
SHA512 4bd678dbd92e06d5cd1df49f8c058e8b6d654fa575b02586da5d8b3ea311691fc16401a0b71d2efd4245050483170c0ca1e7fcda631b37f240c9a9a6c709b346
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKp:A3kMjKw
TLSH
T1EA25BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF232CC2152F627C07F3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1308-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c469-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1308-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3508-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb2b-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-570.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-662.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-974.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1099.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c469-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-224.dat	aspack_v212_v242
behavioral2/files/0x000400000001bb2b-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-570.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-662.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-736.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-974.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1049.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1099.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1136.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1180.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1217.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1320.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1339.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1370.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1377.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3508	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1308	2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
3508	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_4d4bf5d7573f8f0c38baa3998f1b1014_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1308

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 942KB
SHA256 5db6860aecb8f5fc807217da7c8bd55a7da64741d3f6653c8f3b014eb2fa41b9
MD5 4d4bf5d7573f8f0c38baa3998f1b1014
SHA1 446ebddf57c5d7d7c97474f0bf766fb3c54990ff
SHA512 4bd678dbd92e06d5cd1df49f8c058e8b6d654fa575b02586da5d8b3ea311691fc16401a0b71d2efd4245050483170c0ca1e7fcda631b37f240c9a9a6c709b346
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKp:A3kMjKw
TLSH
T1EA25BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF232CC2152F627C07F3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 235db57133b188ab4f935b148674b74db77af7d810ccf9f1aa0cd198348617b6
MD5 8c124c70f93facc996cdd7d40d17a45a
SHA1 d36ecf9496c4cdaa606bbe1f74b8dcddbfa4f67a
SHA512 7d82f3326548f7214462e7f3f258bb7bf736d42268cf90bdbe8f0cf797627041c142b003744aaeba71262ea69c74b1751df7d66c8b5b75f0d38246af700451f4
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKV0Le5ji0hmxNrM:A3kMjKIPji0Aj
TLSH
T180657C17FAB406B5E027C174C9E2965AEE7139821B30C6CF1359C3282F63BD19A3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 956KB
SHA256 cd7c4211ae0ae49cca41b6dc2711ebbd7bdcfa5aef0e168b30680b282b22d07c
MD5 b19f87ac3e69f6a8053f6e2707e47996
SHA1 50f3580361d69ecf509501dddb21d7afcc0ba28a
SHA512 8ec0c4f7efe34b54b31660db3d01db75f7f08e650f2d76e8f9e23c37e829c1556d51bb75b60fa48789110c6c3ea63b7f7dc27ad67d0fa633fb54ea7ad4f50965
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoK3a:A3kMjK
TLSH
T14E25AF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 966KB
SHA256 623969f01defad43997e0431b7cfc654c86723586bdeb56d8b9962a03aa72bef
MD5 1c9d207d1f14f9b126bcd5b725afcfda
SHA1 8f6db42693cef35dd1f017f59498fae6436d3055
SHA512 42da52fcc8c322e08746ce2872b15b1099e54ea630ecc81ff57b644c8e9f336db574e54edf5e21cece5e7daccf7269bdf335864963aca88c2ed6330178b01749
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoK26:A3kMjK2
TLSH
T17525AF03DBA404E6E51A8630A9E54612EB75BD576B60C3DF232CC2152F627C07F3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 966KB
SHA256 d768542be97ea2a2f6d7a772102e9863cfba76fa90f18af1758a33bc68073fa7
MD5 9efeac5d7cc5522b965a3e9dfc77114e
SHA1 6279b27fa38f7fe5c457049848812993a478e43f
SHA512 703c9164af1b98fe2570f1ea888508ecf0e32680b845c9c7026fa183703d04d72e31930e96dabac08de9661b904790a0417cf50089e64395cb21d8809525c5b1
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKmN:A3kMjKH
TLSH
T15A25AF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF232CC2152F627C07F3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 966KB
SHA256 cfb4f027f987696adbe1bdaf77893aa7f6ff3d5639821b51f0b082cb901f8db3
MD5 9b747cd0222b96462b497d74bc4d29b5
SHA1 b63c6af972bd0790088367f2b0119949112cbbf1
SHA512 d482a6b69d841678f3e1f29b6d3ed3e011c2bafc6604cc1e0c568bd5131c11fcaf31ef9e8b8356cad9747211d245677b58cf4c086f8629d00318b7f3ada48702
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKkf:A3kMjKj
TLSH
T12925AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 966KB
SHA256 8b803a23a246bf68125ac1081e774de2cfbdd32ca9769bfb785d586fa17ac3e5
MD5 89d1a0690853ab73d5eb69064ffa190b
SHA1 131ccddf2ee3ea3ef53c047a5bb76cc7174edee7
SHA512 448e8381389e89f2246dfaebea608c288b1a37ab76ed1ab45d210aee9267fe7ff93bdf8c35a9e5b07b35e1b96d2e256af0b24c8ce737d3b2482300ffc23813dd
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKOo:A3kMjKS
TLSH
T14425AF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF232CC2152F627C07F7A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 966KB
SHA256 9d244b869d088ebbac0871f9a37ecf34aad69f39711f0b3d7cd7594c734de08d
MD5 7f40d71d6c6512842b998ceb9e4079e2
SHA1 ed963288991a782e4e7815a26fc0739d0514eae1
SHA512 f5fb3378011f00e539ccceb08bf6cba67c01074539de748a4c7ec47a39ea420fe5d4da8f3fdf14afe3df2e49e4df7eb493884696559f00d219e0c1005f4d083f
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKiu:A3kMjK8
TLSH
T1A425AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 966KB
SHA256 01db337ce49d3ba8831ac1f70203da956b98bda578df06b42cef635a9da29da1
MD5 7cf4d19dd07441aaaf5eb54b25dffe16
SHA1 7e06d30ff7cbd85e6f8629d40021a62c14523248
SHA512 c56136b2ab3dc9bdd91f85e74e0cf1592d8700a6481ef381e6c88088af35ea6fd36e48445a5af03b5d5ac2875e6ffc2cd8eb8d1270ac9ad6bde5f64da4c93021
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoK29:A3kMjKh
TLSH
T1CD25AF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF232CC2152F627C07F3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 966KB
SHA256 246a85fdd89740a252c7866c1d0bb457cdca23f518ec4a1daef51a614405aada
MD5 92ccfb35b33d6bfee9f1f1aa712bb94d
SHA1 ab6c3bdf6d4e58ec0998229fe425eaa87092dee0
SHA512 e529726c51e268f8ab53f262f71a2be4c1eb420fb2dd89b4c4e36c3d8b3719bf521fad691d98dbd4e50072e712c3410fd0b6c553bc1cef18b664e5364ff73037
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoK2c:A3kMjK0
TLSH
T13525AF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 966KB
SHA256 3603fa5550ad7c2d7e66d541658550c2fa603dc4ef8a6b98a8a079cf3b7d0fa0
MD5 460541cb7d7d2553dbae76ba69bc6c47
SHA1 6b9e1f3b4f25d848f4c023797b5cc3a3bd84749b
SHA512 8abb847fd504a99d0f2241e277e3287568784ac50775c57e32c9b87a9daafe5bd6a083b9a6f9fbde660481386899a381aee211f333ab0880eb3d99e323b21ff8
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKvp:A3kMjKi
TLSH
T17A25AF03DBA404E6E51A8630A9E54612EB75BD576B60C3DF232CC2152F627C07F3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 966KB
SHA256 7cdc38f13ebffae87b177c75e8df6c79ca4ca60e71878a12e1d030ccd55cef41
MD5 bfc070fcdc167c5b1c92a9709eb2ba47
SHA1 c8c50c7009f496798b0adc6bb5b69d64a4f83650
SHA512 e6af01b876f7ffba04b4cd9fee57516448231f754aad2c0eb9623fa5fd295779f1dbb570ec047409f7126a4b58eb981441fb0cc9113bca46c86adff88b456b30
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKQN:A3kMjKF
TLSH
T1AF25AF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF232CC2152F627C07F3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 966KB
SHA256 db4f706fe2ec31e5697ca2e603c8f105d8cfa100475d48daab90dee7c3a9c793
MD5 e29a9484f60a8bfddb4351825b2c15db
SHA1 86c977f9a701ca1019c20ebf149a7910ee289449
SHA512 40437f29fffc8aba390b26c0867ef0b9dfb6b4c8ffc325d0c8dd5de8b4644661777cce4dd47751bcad31c807ab9d3a4323edb408b67f9170cc9d9b8600828235
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKYF:A3kMjKP
TLSH
T16125AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF236CC2152F627C07F3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 966KB
SHA256 12d4bdda609e2145b3566e5a37a577caebe3a82a7af37499f2e6c39380a60e7f
MD5 ecdb9e6825b3aa6b87be5a65328f020d
SHA1 e718127d82154aaac551ce8f50057468933d0705
SHA512 6391a62be4028997ed3ff99b8d2ccb5e9c9f6d6554053226a20362fef3cfafe49f9659801081cf15436f1e91d495015d62d12d59166c48061c94bc80580084b9
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKNC:A3kMjKD
TLSH
T1EB25AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 966KB
SHA256 8f490d52468c7712cc0c666604d8b075eee2c2a78103f0796e3555a6d5ac7e1b
MD5 41c6f464cb2363dff13ad6f49a15b36b
SHA1 b4e42f3a005cf5fde820150991f2f5f9c0476f26
SHA512 956e31b09e219492b3a8915754f378c803f9653595d401fbecdc9b264dfc821fcf75962a3a8015a14d57111f5e077cce02c20c4f9dbf90e6166e1d05b5682268
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoK2w:A3kMjKG
TLSH
T15825AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 966KB
SHA256 f8f785457330e776d98af37600ab03726dbebc9363c0c6c98763b2b1a229c2e8
MD5 3d6c440039148ae6bac011af48787c60
SHA1 704c5a8ba09f73900a4abd553a1c4a03420e368f
SHA512 d051c737a14496bf521e96edd7cb48ad28085b4ceea6fe04ed617f32822dcce39b9bf744ae8bda3b5868543afc35845b1e84bb02421ce9642ebafc169652c8cd
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKlT:A3kMjKG
TLSH
T17D25AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 966KB
SHA256 e1a412b47149e49929fb63dff0b2b2425c56212061cf54c892b00dffcce0c231
MD5 01b780f5737b6f327995b8e25188f169
SHA1 b68224109d15875d11b52d2523f3a58c217a42a0
SHA512 1ec44d0b471bdea01297df5adcae1888aec88975842fefa6ab395f5681e24249d10bc9dd19a4988820348cc6f6fe2a196d2a4e2d457b87fc4c9c02710daa6cec
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoK7u:A3kMjKh
TLSH
T16C25AF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF232CC2152F627C07F3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 966KB
SHA256 fedd4af6b16f1d47586523fa912915c8009492c911fd152e1b8f296d2d4f4459
MD5 eea6d5868b2fd0ecfeee6ca836eb334c
SHA1 9320fc6bf328baa60c49ea4c978c84563ab7e5ba
SHA512 6c200d59428dc1a141cce43c8a3d9fa4253945c58ec11884f22f828e40d06044362fd1be01f51e8f9bb2c6f2d488093988914f44d7cd5e8a0fdcb01128f3329e
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKfb:A3kMjKA
TLSH
T1D925AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 966KB
SHA256 d77a4684eb3186f7c56fdc3b8f1bf784ec2826d47cf0f950eaeda6c2483a5fd7
MD5 fa1fee0383eb35bea3eee4eaa420de2a
SHA1 7fa9f2c3922406cc83f95e6faa3a52916562070a
SHA512 88c88251e24e10381d2125a9c5de7bc823c1f0b2d1c71f79d73d41094b3b80cd702838c06babdd0b386e6d8219b2d3486ec6de8c74e455641d9cba7484d551ab
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKbf:A3kMjKw
TLSH
T1C625AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 966KB
SHA256 0e0dbe805ed9cea4b32567fa8d668ea34ab8fd1668f431c9c143cd42643543a5
MD5 8d66741fdc79832dfd8438820e2e1c4d
SHA1 ac00edc69bb43ae524bd624cad455cb7e9718d0b
SHA512 cc0a71f29852bd0fb3cf6f7ceb5bb18b5e6a71ed894952c1b0ca840e6aa304d5b12c7820ab7665a073054d4180f7eeaa4cef74902980552b9f46d584601e1788
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoK0K:A3kMjKQ
TLSH
T18025AF03DBA404E6E51A8630A9E54612EB74BD572B60C7DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 966KB
SHA256 41430700f8ff0582b120d2f8e66d50c1281578d26196d37d6b42fe2cdac87935
MD5 dfc5e11027ec51d756c6a57f996cd2db
SHA1 be643a6dc7d3d5722d29bd685569dcba3eba8a0f
SHA512 dfee811cfc6c33a854fe59538308dd7b31337208e7bb35f842e3a8b9ba2842a02f9ea42943bdce8a120b96e9276e0390367e23a6ccbd1c9c79866a24732a0656
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKpk:A3kMjK5
TLSH
T14625AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 966KB
SHA256 314d41021c5715647ed454f0fcc6ade89e5c232398fb5724b09926465a8d569e
MD5 98b7ace728d54aca833d6fd09b6d7f43
SHA1 586b2055da43e139c8b1abbd6160163574df5d52
SHA512 0049d05812d7f9ce3a38c5f42e1847920f1c27249042eb6a6bbe6f79014c75d58f1384ece6caf916f7c21c7194d2892fe1e71e8698c1a01193e49aa721b5a201
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKG0:A3kMjKM
TLSH
T1CA25AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 966KB
SHA256 9f082c71a293d8c71bc95742b0fe72fbbc890d296997f1b17664d22698621f32
MD5 6efa7c7613bc042f641b5ef28cac76d0
SHA1 664b456eafa70eeb70c35cbeac8e8c42ccd90fbb
SHA512 6e73c09989ffa1096236c3f60a6703b3daecd7746f3eb01d308ec153636866e32aed6ffdc1ea81d6cf3eb35183f82495cccbd39dc548f3793e39317e64f2f6f4
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKVg:A3kMjKx
TLSH
T16E25AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 966KB
SHA256 89a533e41b337ba97246f811e72d2e022a46dd777712722251403391b756d5f0
MD5 c1ac56b8637a0e0168f5971237a91f7f
SHA1 40457e6bce6b5399d77a5974b68a96dc5c8f8722
SHA512 7c84efea7c60ccebc8743c992b397da2930087e60412a8c4856e7816822cdb923ba62ef1b08b814f82a11da98d9b2cd68a93242de98163cc069e421597c688f1
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKkr:A3kMjKb
TLSH
T17A25AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 966KB
SHA256 05f4c5741ec43776f47e4ec34e631976b6c0e2f7849b27d94d597b3c33c0ea38
MD5 67050e95559053f2594948cd7dc59c7b
SHA1 86a0eec2883bcc52ecc57caf0997db8bdac7df1a
SHA512 ebc6ecd0250bf38a0ac231823e30d38da6f559d68befbb436e3d5c1277a254cdd678e52c96936f10785a040aa421de038c27a5c34fdb6c6c85dcdc14e231f9fc
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoK6n:A3kMjKt
TLSH
T1D225AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 966KB
SHA256 39e57293c6e426dfe45f2861aad77a9f168e0eb5d366a17f972b71591a472aeb
MD5 edf4cbc9b7321f873e6e62a8debe4168
SHA1 873b8418c2de401657f53577eeede58a4e597e0b
SHA512 4f2f2833dff4064b0a0318ce12b25ae9cc984decb5bd5576f6eab474352175e37dde67d139b7d282434ecd439d66f1833073f381be1c39b3fb6b180700d7b1c5
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKQx:A3kMjKT
TLSH
T13725AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 966KB
SHA256 814e3685b4fadbd83fafd210138162dc5374b92293875e76e1fbb671ba39bde2
MD5 1ebb84677fb85cc7eb158936551028a3
SHA1 116f21eec5aa2a972d5ebb3ce5c14d999b5a4853
SHA512 3d40516cbf5b031de9217bddf2951c0c15383b01c74aee7cab039eb0d8216e76fe0c1d1289fe5d5a09fd765a305abcb94eb1b4fb35da9e7e60d57abdfb7086a0
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKSA:A3kMjKs
TLSH
T1A425AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 966KB
SHA256 f7cc54a71782eb087e85f9855dd71b86fb2cac568c5bc0f0ed34fcdb66ae5b47
MD5 2a2e182cfc01a376c5023c9b2b7b8a21
SHA1 baaa58598db058cea013ca18d1cc85997c2402a9
SHA512 ee3c2d1945566fa1a5d163ae17c3c195c4272bd347ba5e4214e0cca7b172edb68c81b13dba026fce9d6d73f98fd34e1cac8fc7c778f2806d708207a22d32ca56
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKr9Q:A3kMjKN
TLSH
T10425AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 966KB
SHA256 3f92a82377de36edd905d3265ae8e9a719f091a1aff386fecb881672d606b707
MD5 846ed7d5e0c4cdeaa95f50ea004ce9a9
SHA1 ee253a8c2808b4b3e4a5f6273a289c9a6f5fa966
SHA512 bf0570dc2a703f4baf9cd0942802c9f6e88a3f419b04f53972a6912fc5fb4abd1e9d7e2d0168390904010b27bb28add4225cc047f04a1ed818170ad95ad7c2a7
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKa4:A3kMjKS
TLSH
T1AA25AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 966KB
SHA256 7a8f4e8939ed8b5a4a8355c942cae9732f906e4801367a9d2281c95eb659d067
MD5 e84b1f2ad86134b16fe2444167ceb966
SHA1 46a3474d6d3099de61ca6feeb890a14b902da21d
SHA512 1093b65efd9dd7ce882b3995a2645eb0e1ae8df573523c5fc4ae804647fcd80456ea5226d6a23e0f12dda032a12377cfa90fa34875053662a21e05d5f55e9dc9
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKBu:A3kMjKD
TLSH
T1B425AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 966KB
SHA256 97f91f3e81051a7b2f3496177a03c89a90f37311a7a037f273d6ab3cf782bbf9
MD5 d7bbd913538c0cb687de5d3186d6f6b7
SHA1 1de898dfbba002f8dd8641a4e15ef843b6e34dfd
SHA512 c20cca35aa3caa0035c8e6d16820e927fa8d3a8d11d7634e430a75c57115890cdfa3533ef547a8d9be2b075838aaec1ab3f70ac07ee7f4c9e911ca1461109258
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoK0j:A3kMjKt
TLSH
T1C625AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 966KB
SHA256 4195a8465ad3310949d92ea936637c3d25f5b2e6500875f061f1925a5361ac48
MD5 7214d71fa703400a3c72ca808a31bf67
SHA1 04717c776dd98845035e26464518bec7749292c7
SHA512 7869b941e33bbf5c46ddeda453de7bdd6127cd736ad9f37bcd39195f69c225f71917502ff2abcfae5e9feac4bc803895ea434a26fd0426520f6509db8af3aaea
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoK1g:A3kMjKx
TLSH
T14025AF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF232CC2152F627C07F7A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 966KB
SHA256 823e1e5ed696366a06edd490f019bb39a2c726b97eee5f668832fb3b3bf2f276
MD5 b34978c640ec1e895573bc10b0390399
SHA1 1c442f5f75b31b48711c552f2760936d31ecd68d
SHA512 044e055b0ab1b7281be747363fabe30d7bbb1b1d6365a2e3c93142a2a3bb7238b6bfbde5ed6ff37f8b9b48ca9868c68756ea8e2bfaf50e8eb66d290f4d0221d6
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoK0I:A3kMjKg
TLSH
T1F725AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 966KB
SHA256 52126f3a273d5d762f77239de9b068efd623040c3aba8a9b471e123314480a8a
MD5 9905cc1a3a67eb4a3b5d73a2ea5230d0
SHA1 cab16083bffe7c633cf914f00c02eeb084fc9ab9
SHA512 f18e9a7bc26c5857a282ecb3ff515c8e51311a24ccd1ecac5d5a2f72fa8eee7135ce1b610199d59ba69f6533952bafd395f41c6cac3de769f8c77212c99585f8
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKmo:A3kMjKC
TLSH
T11B25AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 966KB
SHA256 cfd68d0c16c3a4ba284618a81d6ec29b3a7134c603ed94c8cde3885ca72d1462
MD5 13c85186497cb03868ce3865225f23cd
SHA1 793388895f87716c5be8b17ea734e88980aa2732
SHA512 1fc500aef8ee5bf855c3a9ed776699b57813178c613d47f2999ab666a135bd5bb3b2e07d3cb28e940adaa4f8702c5846051cf24b200bf4a263a0e9da28bafc4b
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKN+:A3kMjKn
TLSH
T11C25AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 966KB
SHA256 3d14f7979d4b102144314e06e9816d6e6908a4b2cd37c74d138da3e2013a8bdf
MD5 4e59739bdffb74e2be98c258b2e1acf2
SHA1 de4695606bdefd3234202f7ba5da9bae9a37b7fe
SHA512 6a26f28f323b3803a09c550e7ca720420e51e517f8449ee46777b2d57c1b1869b7f19f335be4003b1c5eacff0ede975f1982571b9d5c2c53c116d0c044021bdc
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoK7Q:A3kMjKT
TLSH
T12225AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 966KB
SHA256 bee09ae41cfe9495b9cedb2a9275bbb89b2ecf2efad2fbe645c1449d30cc4aa7
MD5 6f16a727e74f769786937445b4583377
SHA1 24ce02b642417481224daa500060be7d183287b6
SHA512 3bb7e7354c4de4587928fe5bf83679c8d7ec83c9091fbb38ef6731df6da56756552997d46a9098f48d8c217f007e206330469d77f449a29c27040e3684c7afa3
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKwX:A3kMjKH
TLSH
T1A825AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 966KB
SHA256 61429120b10963b098008c2a83a104faaa38ebbd96fbfca108c040704ef10bcf
MD5 3a1370c742b5b25a57278050012825f9
SHA1 1db5f2811f7be1e7f370271ead593ede536aa101
SHA512 269403623c6f002b52baf9f16558286924a1b430035a921c0dca75d3a2d3f50a45cbf7d93f71b46be41144386b7a34a39805b7c9bd2e454702d785a05e3f22b5
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKGL:A3kMjKp
TLSH
T15025AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 966KB
SHA256 5f6d906d13082828e8e2e36bc23f998c1ac1ed89a9a358407714c686b7688a98
MD5 39b74110cd32ef53d20e29c575c98c4d
SHA1 0de08df6f6875463dde39cc7839b11b8ab88c26f
SHA512 a94a8bc9047a4d96ec42a7e681949c1d1845a0f94b6d83ee5cfcbaad75dd04b609ba8505d393bd7516758eeab441abd457ae99b9e66ced651b075af6ffea5901
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKaM:A3kMjKQ
TLSH
T18F25AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 966KB
SHA256 06563d2fbb3ad7b080da7212b77e592907b901cfca4c57c0404d7131d1743d82
MD5 edbc50ddfeeda1aa5300720cbd836793
SHA1 20244efa486e9d5ce8ec30f78fe69489611d9bcb
SHA512 426cf0c913719c553ab92b2e27fbc2250e8d3d4a3c890336c36f36b42b028233915abd1dd0571a5d7049bfa29613156b743d9db52ee4cd22dbabe3034f4abb89
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/mmoKLh:A3kMjKC
TLSH
T1CD25AF03DBA404E6E51A8630A9E54612EB75BD572B60C3DF232CC2152F627C07F7A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1308-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1308-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3508-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads