1262b2e35b1c2bec78474d3b233c206710337cbf7488d81006c986a891685222

Analysis

max time kernel
116s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 861KB
Sample260718-hmv2hsbs9r
SHA256 1262b2e35b1c2bec78474d3b233c206710337cbf7488d81006c986a891685222
MD5 a19ad96371b7cd0c4e0d2a1fb74134d5
SHA1 675a0a4783fb58f972f8b4251dc1978f36448fe7
SHA512 1e84b0b7c5c2858272b69fefe59d4c5daa933ff928e07a76e9434297eb86347f08897d51b97ce50d89e5170057b1e847fb57f379cbd648f0272a28b3e986f836
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLb:A3mnXoZjzyaEFyKUluzyAZVS9lLb
TLSH
T1C815AF03E7A410F9E52A823499E54A12FB75BD621B70C7DF235882262F637C06F3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 49 IoCs

resource	yara_rule
behavioral2/memory/5924-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c56d-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2bc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5924-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4588-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2de-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c7a-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001896c-198.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001896e-211.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a48-212.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-231.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-244.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-251.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-252.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a4a-266.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-316.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-329.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-348.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-367.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-458.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-507.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-562.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-644.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-760.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-803.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-969.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1024.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1061.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1141.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1154.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1192.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1199.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1309.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1347.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1361.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000066f5-1858.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000006502-2011.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 46 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c56d-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2bc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2de-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c7a-60.dat	aspack_v212_v242
behavioral2/files/0x000400000001896c-198.dat	aspack_v212_v242
behavioral2/files/0x000400000001896e-211.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a48-212.dat	aspack_v212_v242
behavioral2/files/0x000400000001983a-231.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-244.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-251.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-252.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a4a-266.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-316.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-329.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-348.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-367.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-458.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-507.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-562.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-644.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-760.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-803.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-969.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1024.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1061.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1080.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1141.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1154.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1185.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1192.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1199.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1309.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1347.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1361.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1391.dat	aspack_v212_v242
behavioral2/files/0x00020000000066f5-1858.dat	aspack_v212_v242
behavioral2/files/0x0003000000006502-2011.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4588	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5924	2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
4588	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_a19ad96371b7cd0c4e0d2a1fb74134d5_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5924

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 861KB
SHA256 1262b2e35b1c2bec78474d3b233c206710337cbf7488d81006c986a891685222
MD5 a19ad96371b7cd0c4e0d2a1fb74134d5
SHA1 675a0a4783fb58f972f8b4251dc1978f36448fe7
SHA512 1e84b0b7c5c2858272b69fefe59d4c5daa933ff928e07a76e9434297eb86347f08897d51b97ce50d89e5170057b1e847fb57f379cbd648f0272a28b3e986f836
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLb:A3mnXoZjzyaEFyKUluzyAZVS9lLb
TLSH
T1C815AF03E7A410F9E52A823499E54A12FB75BD621B70C7DF235882262F637C06F3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateSetup.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe
Size 960KB
SHA256 dac041466361971d05ff0b2e45d862451c3607ef785688de8574fac5e0c9eaa8
MD5 389dc7705cd2aa43b5243568b5b7bc31
SHA1 5815fd147e30c0919cab8a287fc1b3fe72c6eabd
SHA512 d5a42080858f08917749ac0f13d746e9fa9a87588bcdba8ca827d89a2eca235b1c160a89c3a97814b236bb0dec16e645fe2b5342600dc06371b57e543545a5d7
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZVS9lL02MqDBxc:A3kMjKJYMqlxc
TLSH
T1FE25AF03E7E010F5E566863499E54A22FB75BD621B60C6DF235882262F337C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
Size 962KB
SHA256 25f93884195ade2ab4d1f81fe29456ff61ba8907864427197335d75a355cbc09
MD5 8e4da4f47bcf0fb9c633beeb012183af
SHA1 b2ba1b6429afe02f4a1b7526b8a8e61b0cb1c276
SHA512 450e13e27f5ea79d197ff4cf84e0a6174cda257ea18ec34dc49c532bd4b714bedb63222107ec100f733556dd2a6b51be575e23af4920a0951cb56601c269f154
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLKTDUjD5FX9r:A3mnXoZjzyaEFyKUluzyAZVS9lLKT6Nr
TLSH
T10D25AE03E7A010F5E566823099F54A22FB75BC661B60C7DF2358A2252F737C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 3034faacf69e8270dde2ab48767fffb05ff2ceee725e36cd36d103ef00db568d
MD5 f2eee2d5b44432f26fe4ea9f97a6f7f8
SHA1 7ced4c5c575b069ff491828e1e79d2a1a4304877
SHA512 3e7090968bf0ab16766e4a1a96a263e33fb04a29a9fdde856f1a9d0c7180ed6c5650cd884a64acbacc7cdd67e613ba08c603c6bbfba91d15eae51095f7e0f042
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZVS9lLH0Le5ji0hmxNrM:A3kMjKJiPji0Aj
TLSH
T1F5657B17F6A442B5D037C178C9E2965AEB7134921B308ACF1399C7292F23BD19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 876KB
SHA256 9ef6db4db8f8a7a6f28370d556ce44c5670de517602e5253746041348443fa7d
MD5 bfd264a69991242358bcc0cd28d67e80
SHA1 390344c9a75c7f585ef286ce6a41ed36a7e1085b
SHA512 84ed652f90d06e43a7c02e3c6dee493b0b27a51e1d66d8f9a496a6c436acf4977c414861712d7e866cd5e1367ae02fae8cb6fce3d6f000c45166fdfdb6c295ea
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLZa:A3mnXoZjzyaEFyKUluzyAZVS9lLZa
TLSH
T13415AF03E7A410F9E52B823499E54612FB75BD621B60C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 909KB
SHA256 52233fcdbea540a5dbd9077276a30338f8700228674c94a3d2e2710f07f05129
MD5 d22f1f51945a008914ade78929d3efd3
SHA1 f41c6a76ccf2784eb657a0285fc9df3ff964c726
SHA512 c2a5758281922ab78220bab1d03479bf403f9c28673f4a493b403a95e50aba124335a2f7b20bcb47926fcc6a7e294ff29f4346111d81bbf05907601acfcc1789
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLKb:A3mnXoZjzyaEFyKUluzyAZVS9lLKb
TLSH
T1DF15AF03E7A410F9E52B823499E54612FB75BD622B70C6DF235882262F637C06F3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 905KB
SHA256 54bbdcb7c23d5c346ee4f4cef493bfe12b132e5db5fb5333c44e06f6cc55331c
MD5 c89b3beed3af19b290c1fc88310f2f58
SHA1 ef4614304697205e7d0cc5f2d37d78808ca91bc4
SHA512 ddcf78a29eda40105592342ffd9caefb9ff0dcb3ce996712ea7373f326d4a2502e5aeb608646e053ef2eb7c33d26accbdb06ed59b5cc12807b41a7738aab6b82
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLTVc:A3mnXoZjzyaEFyKUluzyAZVS9lLu
TLSH
T1DE15AF03E7A410F9E52A823499E54612FB75BD621B70C7DF235882262F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 885KB
SHA256 9e386970bf11fa774d3c90eb0dad6e0ba6cead5d6192983752b1bd2024c357a0
MD5 c39e5b24e7844af8dc5281f147379a1b
SHA1 998be8928d72ec8a983f7435e66776c1a1313501
SHA512 5bc9c65ecb0caf0351eea33d1b9bc1c13a1d52f9ce579fe1e14681d58380b06b5f150d0c895ff1344bf5d498ff36ddcd6ef9e33804d9316ee847c0ef2da87b9b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLxZ:A3mnXoZjzyaEFyKUluzyAZVS9lLxZ
TLSH
T15615AF03E7A410F9E51B823499E54A12FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 885KB
SHA256 a91bb88feb180ff48724499037b08c1c4d922e95723823b70f4c213eb906984d
MD5 c1be096d0f05147463b69d100876c854
SHA1 2636bdb43c4630286bf0bd0ee0a0db3f64e5601a
SHA512 41a7262e800a2ac0f81ca39e66167691f8e9261194274c673e47fe65112f467c2fdc0b49162df979265d0c5cbfb030cfba124870cbfff6358d19bce4bd544a35
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lL61:A3mnXoZjzyaEFyKUluzyAZVS9lL61
TLSH
T11115AF03E7A410F9E51B823499E54A12FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 885KB
SHA256 201873722990e92587dd13a389b67a3ef6541ea3c52a05c1296860455dc67135
MD5 4707b1e2dcd72eed7142e31cfdd055ae
SHA1 d584e28909c1881a9c10974aece396cb06ee3391
SHA512 6942ca3d57b843282da17e56c5a258865ffd3cb4f705bf91764280eeb071b6f327120c998581ef6277ad4c05b618358071d31436334b765726dcd4502af08524
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLQ6:A3mnXoZjzyaEFyKUluzyAZVS9lLQ6
TLSH
T1B315AF03E7A410F9E51A823499E54A12FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 885KB
SHA256 6fee7e3641b1bde82ad354ef8bbfc1043add67bb97eb7eddf7c62b365f594449
MD5 b8ec83929507f5a288aade02dba568fd
SHA1 f37019d18f84b6faced0ff025694e1f4c35507dc
SHA512 7a16ce92859eaf756d023612b8448d01bc5aa20556132f1596f4dbb9fba088139ed7b71d900d411c22f3a8f94cf7dc67adfcea2adc40150ac79f166beb60b0cb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLUN:A3mnXoZjzyaEFyKUluzyAZVS9lLUN
TLSH
T13015AF03E7A410F9E51B823499E54A12FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 885KB
SHA256 6c4f78ebae8d049c705398d241a99657aab62b1b6d6d7d5574103f969d955316
MD5 6bcff7901a32585fa70305d6a29dc664
SHA1 dfabee83e094d1c0a54ed658f11c25b85624a908
SHA512 47a32e22c4dd46f56b1fd5dab472130caa5b6b4c718414a6fa12b81f024444dc8991babc8b3f6ff844320ee332f32d16e6d831fd478f64b1fc11da4d6c266c9c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lL6f:A3mnXoZjzyaEFyKUluzyAZVS9lL6f
TLSH
T17615AF03E7A410F9E51B823499E54A12FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 885KB
SHA256 0a21a09b5cf6fcb4326eca5d593f0cce11cb6c2dc4004cddc06d2dedc769a638
MD5 7bcb17558bc4944e9da38485fd29d569
SHA1 21f0f41d7f5f303dc49e5ffd5a39311c9a0cce5b
SHA512 005fddcea6dcbfbbe22f2234afcb3dbadbc10f10290a407cf7ba9a09d6c2e271310aa8cb2215de7d7355dec678c09fe1be20e6c94b53762814818292989c50eb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lL0o:A3mnXoZjzyaEFyKUluzyAZVS9lL0o
TLSH
T1BE15AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 885KB
SHA256 32510f38f801bfd5a1b618bd1d6128228705329f666fa139632b7b003b7826e4
MD5 d67a5017be8290810514c477b5ac8881
SHA1 8aef14e499517191a47cc781926a4ba23d67b69e
SHA512 f4b17f210af093dea1005fb0462f3515358b974ab58c34e4b1b428c15c53153250a2a80cc73ae35bdf803cef29fbe85b817ca64d07a441aa3b6b509f8afe60d0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLUu:A3mnXoZjzyaEFyKUluzyAZVS9lLUu
TLSH
T14115AF03E7A410F9E51B823499E54A12FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 885KB
SHA256 ebf4165a079c77648492650e0c7b268ef0c40fcaf789eacd0143484b96ac4f07
MD5 60f5719ca7f9be453500297035bd5e65
SHA1 9d9392a9897f8e48a9965756a174a44a29814d4e
SHA512 e3c9398b364e99ccfc407dd62700fea155dcfbbc702da110d895e173a82978136f39aef1490975e4e9c199ef2053208f167d736c11ef1fc8b9f867507833b9e2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lL49:A3mnXoZjzyaEFyKUluzyAZVS9lL49
TLSH
T15515AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 885KB
SHA256 f9d18e7bff803ec7e9db9f070018b888da64ba175513a606ab4a1b8395b91b13
MD5 f494dcfcb0347cc7843d4480e9b60ff4
SHA1 38f85faf93175fa280e02e932db64c02c5a4b3c1
SHA512 14ddd41a051ac36080b9858d5558f9e9a5c7582feb4d00ba60f2da580f9bc7d7292d5a91d4d983b264922ec0a0278775e8729051bb252d86371aa954578ce7a2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLgc:A3mnXoZjzyaEFyKUluzyAZVS9lLgc
TLSH
T12415AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 885KB
SHA256 41f86d54ce52d77c59305d2e5b529c9a4bb279a2ad2d7447156cd47f14ee205a
MD5 d2a2eed57a71a901590f0f2888c350cb
SHA1 e475df91377102468d4b547552cbc6ca7df69c87
SHA512 22955c29022de082080fd7679ce6b81e56e7978d730fab2f217f3523e7bda2dd34c3d7499fa17f2514cb174baf72dd3db72419f5deb223f72d3ff2f521d6c88d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLJp:A3mnXoZjzyaEFyKUluzyAZVS9lLJp
TLSH
T10E15AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 885KB
SHA256 81f3279ecc79f771b144bc896dc02de7006260ac91372543ecff2ee019dd96b1
MD5 e3dadb2a33ed9ccb1b75ed9fc4366b38
SHA1 9470013ca1604929f2b64774397102e8ead60a72
SHA512 780bde6ebd0edc01d1232a70b3ac69183c05f5f947f61be32e681fd5db61dc3cfed08456ec5cefaed6580714b794454f681a858a00a5fb01b055fd3812d4c260
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLO0a:A3mnXoZjzyaEFyKUluzyAZVS9lLON
TLSH
T14815AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 885KB
SHA256 6b8a3500a6721c4f00f73f24a42b513bd4e45481a1ef443bd899d30440b98caf
MD5 4ada4b91c2e594c2e05781d71eea3ffe
SHA1 ec4b16d65c6a31d0311c78686e951dcaa8bd1f44
SHA512 c4517e9d2269b3986e0b71e7ddf287cb07685dda8a1794065a7d015f4f9ca58b4e1f284420fd7e5e7ae7cb080b6c6c45d8e29104d224b1c985eb30e0560e637a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLyF:A3mnXoZjzyaEFyKUluzyAZVS9lLyF
TLSH
T16D15AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 885KB
SHA256 993b152d897c34a71951939026938fc9aa80ba41d79362cab9f949e078b0e5aa
MD5 68990cfe5c35d2c2bdad5d7b4add4448
SHA1 4f156b6a9f88587ba6559cc4ccbc4f91f9ecf7cc
SHA512 14259ffad5f0e9f88c2900feba82a7881d4036b05446b2c80364e8ea7eb25d27e6c527b44991aec77a0a6e539f9aab0d17567609bdd4491433885157963bf3b7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lL3C:A3mnXoZjzyaEFyKUluzyAZVS9lL3C
TLSH
T13715AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 885KB
SHA256 34c8f490b5306e57a24e7d2ca186ff1e0d76b40bf9ff266a2ec029db7b0944b8
MD5 c5916a22a46e909f3efe252157943b2e
SHA1 e818506286a1416458ddb25d977d947a4137a59d
SHA512 6ea325f8b7f62888b74b937646941f9236d548a6050651ea55ea0ed94345e70293f25a2029892a3e7c0c75b3b278f8dd7715a40cb055f83991c05a6c5ba5685e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lL4w:A3mnXoZjzyaEFyKUluzyAZVS9lL4w
TLSH
T10B15AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 885KB
SHA256 1f420e7bdf1ba47189241a85436e5e0b71b71ed978db6704b81c810da39302cf
MD5 1c8a450d19210d4eddac042e6557809a
SHA1 3520bc9c199761c5994f9a8ded7005d9973aad2e
SHA512 dcbe0590bc12c592704cdc9fae8cc13295bb7bebf31d96d5eab4ba3b9a157102dd66a6997e486d6bcdac300f7f9e658abff8bebe638b74ef0501ef99bfde0c97
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLXT:A3mnXoZjzyaEFyKUluzyAZVS9lLXT
TLSH
T1CE15AF03E7A410F9E52A823499E54A12FB75BD621B70C7DF236882252F637C06F3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 885KB
SHA256 cca472bd3af884d4e4333e7e26bb252b5e6090a9d2c3bcc201d30e69b9b879d3
MD5 cdcc795fe42b6bde7b98e38edec2dd7c
SHA1 3741d7834a0913f2113f5bdca791ddf3d92b31fc
SHA512 768c39abb427143cc95afa437e4e2c26ad52c1b9f19d2fc3a7632bfeee74359a7bf1b47d0f78fda153da2f35e18698a340bd86138032b7a224df8c4c596f97df
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLhu:A3mnXoZjzyaEFyKUluzyAZVS9lLhu
TLSH
T18515AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 885KB
SHA256 5fa3f3eb1e08008b92f5591c815c5ba3ea4143be1df38698295429b049b4b676
MD5 215e21b954b90c64b59ad4ab4472acc8
SHA1 c71574823c48d6fbd9381e0c4232ffc25a6ffed4
SHA512 d303130cdd427111dd49103e75b24e691196052d7295b8bf7313952d74719e4abd1d8c34b5ad854dc0e7c80162ee3734aa4acd5f2f0245992d8480ab8cdc3fde
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLJb:A3mnXoZjzyaEFyKUluzyAZVS9lLJb
TLSH
T16615AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 885KB
SHA256 7a3b606c194297b0144a27bf9c515f10f45237de4b5a3d43bd6038f354fbe378
MD5 4c3d35d8b6637565d0607b768383d1ab
SHA1 f957ac6f1e6d38c425f6ab2a114522b62c221df4
SHA512 8c31c7db64f9ba61a6afd116a28f9991db30ad8068c69ed7d21bfbacec65855925e267ef8de7e8d99d968344afb02c3002613bbc790b1528cb11b69137b33547
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLxf:A3mnXoZjzyaEFyKUluzyAZVS9lLxf
TLSH
T1DA15AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 885KB
SHA256 9a43a2e075e12fb78b02916ecd2db5f0c12f1afeb84f5c50098017cc1b1f7a2a
MD5 da0b2583778cb3136ba0459e91d80597
SHA1 e36801f11096e6ba8b8735ed4f5bf44bc22cc666
SHA512 35d826825b7b04d93fec122521c2222bd5abe97764cb985a6cb768c714ecfff7aeabc3705ddcfa3800b3e2d24fb1737f15d0e5fd99f5d4ab5c4085d78f3a7a7d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLaK:A3mnXoZjzyaEFyKUluzyAZVS9lLaK
TLSH
T14E15AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 885KB
SHA256 d67c5f2eb8779244b4c314a416c7710ed3029f971fd2f8681882a82e342fc9a3
MD5 acf32bf44dddcd9d11dd0a630f2bb019
SHA1 f0eea819300f75881250c94cdafebc586a8fc2d8
SHA512 62e0c1b99e027a592db4368148643086a15015d9fb36a32976e4e1cc0b2942ee3ff9ee2ff4d6641702927b410e7e746a9b42432eae26a519aed035d07d1d9aff
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLPk:A3mnXoZjzyaEFyKUluzyAZVS9lLPk
TLSH
T1F715AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 885KB
SHA256 7588399114592992a9368405fb8309ea1d397148723ded283af8c2611cf9ba52
MD5 588a565d9454ea7c6b7597a54813cd37
SHA1 ce8fb1ea0a3ea81d9fdbd0aab11eafc5ffcbf02e
SHA512 811dfb251e47110d312dc314f66462b7eb2baf17c7d8bb910207fd6b1a33a514a27ea657387c310ea13cb9550bc0754eb08b87e0158fc3aabad6611783ea753f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLI0:A3mnXoZjzyaEFyKUluzyAZVS9lLI0
TLSH
T15815AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 885KB
SHA256 4498c633883f8e149447b5e5edd8c057a83772d23bb3e7d3ee4a37c3c7c65a9d
MD5 3be9bcc03a066e1804a89c9be1ea08fb
SHA1 fa47b789b637e11c9f31bec987fce7a6bd0e50d8
SHA512 65f272566bd662eb321eb27487d7bc0313d2f1c98b66e90c3ffd633dead776442166cc36fbb7e70560a5f8650c2487e495b47ee89dbaf62c70a0667438784a79
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLj70:A3mnXoZjzyaEFyKUluzyAZVS9lLjg
TLSH
T18515AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 885KB
SHA256 851ced1997dd10cfdb8e6346d926bb90a2777c252a0fcd454f15338166db1cb0
MD5 8af3fa7de330b7383a1af0783b10040c
SHA1 96b1d4cf0c92a65b9a6ce37b548674d8b090c363
SHA512 2d8771940c2d7abb69c57bb106835dd5b3b2ae8304ed2a94dee1d17ca4ca7ba3265f38647ba6ed719fdc631640a30760453272b42041751d3e708cd76caac6a6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLer:A3mnXoZjzyaEFyKUluzyAZVS9lLer
TLSH
T14C15AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 885KB
SHA256 759dbb38f69cc105f756b31ee23c68d2f6531b3efa552497487e51a3260f3fa7
MD5 8767fb861004741ca0b9a4bb479605c9
SHA1 57b2cf8ec91a215841184cfa47796bf94814bde0
SHA512 bec1dd0d0a98b2a4286f42e062bd713f08db7f31175e3e840c41eaa9228412b521828a35e82e8231c154a4b895092048080040bb4fdffe1938d049f3ad5c23bf
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLEn:A3mnXoZjzyaEFyKUluzyAZVS9lLEn
TLSH
T12A15AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 885KB
SHA256 81b9534864e6dba30b01a665b9f1d752ca2ef8ecf81ca6ff09e8b0a5ee9c1447
MD5 c4bae042f012d0ce9ea4159a96ee13fc
SHA1 95b89c511c2d5f3b833eb573950b8b813fe8d35e
SHA512 7372547f61ed3ff4942c47a63b0b133e7418999e1bf029e45829a0a2a57285c726c6e3afff084d86624bee88b71baecb8f0d5d1825aef417113a4ecb57d20217
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLSx:A3mnXoZjzyaEFyKUluzyAZVS9lLSx
TLSH
T13015AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 885KB
SHA256 4485571f160805eefb07abab67a305d6d62d6713d5d191e6b11611ab7761143e
MD5 225f840619ed750e05efd2c5f533a9d4
SHA1 bcb2dcc82a90a20692656be33cba8a4b123cbde7
SHA512 354eeb55c84cdb4496a321faedbd1329d06e8895cbe6ff20b5ee74eccbca4d200959dcb0a19510b3758fe26e13b501f22ce27e7ee187897417a85e673de0119c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLkA:A3mnXoZjzyaEFyKUluzyAZVS9lLkA
TLSH
T15815AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 885KB
SHA256 3d06d05a8ab15a20f5f0c7d8096261be53d2584c292c7232e49ed5de91a5aebf
MD5 03e1eb064e3bfdb662b541c82e5ce040
SHA1 ccb35dc155f0f1ed27b74c7cfc98d890da214381
SHA512 17307920c77eb0be126c7371e3804fdb77af93b98ce6a8afea1cd047a5ce92b7da246733b9ae873f7e378b9d01e59ff65550b683528a2275fd217b2f47b0ed98
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLN9Q:A3mnXoZjzyaEFyKUluzyAZVS9lLN9Q
TLSH
T1D915AF03E7A410F9E51B823499E54A12FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 885KB
SHA256 540b878adcf27f6ea2bfb258e1671fcddc337951d2d940bf0377a0a3a854e2d5
MD5 ddc9c14973da0225c01f12da191bd751
SHA1 a4d1b94dcac1b5021b491913cb938432d7538b6b
SHA512 f8a64e08ba08030cf23735abadd3baf5aafcdba5c8a38d5ea3d8c0539ecf6b21eef32aa92c3919411b5a09a0caf2840dbbc9f877e5aab5776f5b7f565b37da5a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLo4:A3mnXoZjzyaEFyKUluzyAZVS9lLo4
TLSH
T11D15AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 885KB
SHA256 2643c3dd73773338fc77011c491b8f7e42b2c852b134327dfce0b7eb16015d0e
MD5 4a3664f851dec67b851486144257fd9a
SHA1 e89026db476704517d2f731e5dafa45646a9fbf1
SHA512 bcae19fe40e81550abc593fca823b05470b45adc1520d43ce96cf0b77c0e3463da2e90ee3a1713c8c064a770b6f871d1d67d0083adb063f1a1a37101d71f3f0b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lL7u:A3mnXoZjzyaEFyKUluzyAZVS9lL7u
TLSH
T1BB15AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 885KB
SHA256 c62bbd1b9900f980387afcb66bd987475819784e3ae4cb99b46d218f8155607a
MD5 671080fa53939f5ee025f88ea8d186d3
SHA1 410190e1b536f9fff1ac3ba8c7bf224919d18c2f
SHA512 793398be9de57e1cc05eb58aece8adf07c799d422a8b71116dcfaa4963de1f80f2b1b0cfa39e6ef63018abc6e0dd058e8af4ee135b23bc8835f10e4db20bc8f7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lL2j:A3mnXoZjzyaEFyKUluzyAZVS9lL2j
TLSH
T19715AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 885KB
SHA256 342f28afbc3c704b437b093f30baeda3e1b402dd7b477d133a4b29251d3a77a3
MD5 6efe73bc306657e246dc88cbd8ec2e5e
SHA1 8bb76680a8d7fce0b822369b821dffcfc1b484bb
SHA512 59283ccf84899ada4cc719962aea30aca3e1c983954e2dde553f8fd6a8c1c5e79f7505342f45505776623638a432ae143775deeeaddcb5baa87a129a81e0b72c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLjg:A3mnXoZjzyaEFyKUluzyAZVS9lLjg
TLSH
T12815AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 885KB
SHA256 bb14ec1891bc3edcb78892537a472596a29337895e8dfdd5eb25bd1ff81834ee
MD5 539f229f6f97a3e9d61c3c5395fe0f82
SHA1 26c289e79358469187d86d4623c974384372d700
SHA512 322ae09992994624f81f81daafc6cddb27c001a9d984eeea174046c85e570ee86fa815c915c388baef2c6230f492a2df6e8ff2b0354efae5c36347834a27daa8
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLeI:A3mnXoZjzyaEFyKUluzyAZVS9lLeI
TLSH
T13E15AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 885KB
SHA256 50acc9b230de1be4e27b7f2beac99b26e240560a2c11d86634aca33b01c289f5
MD5 275d526baab9e8085d84df1feaef46f1
SHA1 c19dd6b1f7eef5c4659e64e66e8882fa6e6edd65
SHA512 5dffe0163cc3bf992b041bb69786a33014cb1f36c023b0d47deccd81137ed0e6f02c0c5baee0426fa52b039d3702019ecf88a5691ee907d1083d78e3b88ab8e9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLso:A3mnXoZjzyaEFyKUluzyAZVS9lLso
TLSH
T1B615AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 885KB
SHA256 5c7453dd18804d299bede22d2c69066cfd467a413110b25d3ce2e1c7efdcf747
MD5 6373647c104525186239d4401989f094
SHA1 aef9d76e0613827e18a749ee68014062ae368d91
SHA512 5327fe94c0a11d13778cb06d5134d6231130d43fd107d05d19a62fa5be51f5382ddff36804cbcb8d368f2077fd944eb988557f47742ea246a261233d4ce482e0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLv+:A3mnXoZjzyaEFyKUluzyAZVS9lLv+
TLSH
T15915AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 885KB
SHA256 ac95666ad3b835ee6b9f6378cede9b5e7040bf019fe21ddfbdbce957ea2b5dd6
MD5 6e2c3273fb43cf2adbd88e20ca33924b
SHA1 39f25d9bd9481596e504ec7bd26a018be9dfdb93
SHA512 b7cf18a29118f4ef6c75616da3da4e5f3e31b0041e876ddbb81655992724023c9371f28be992c3e2d3fccd99abfb8fec534dab0aff5290a85cadcfe17b66cc13
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLFQ:A3mnXoZjzyaEFyKUluzyAZVS9lLFQ
TLSH
T18015AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 885KB
SHA256 aac88eb73344e6fefb5c45e2668729715a931cdbc42379aa8b1e65fea356d7fa
MD5 c4a96cc5cbc39ba5ee41b938c35aa5b1
SHA1 61f896de428b66876261e01d21b2ca1087ae585f
SHA512 245526aa5cb29dc6e9391f18e7978355d25f3d22c712a7e7e4a02ea50f70941c51c070f96662ef2b6d59d9fe6f0a4c226a66cb3b519b3a197f3c66f5b137da9a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLKX:A3mnXoZjzyaEFyKUluzyAZVS9lLKX
TLSH
T15515AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 885KB
SHA256 c679ebac548ea8e1a2546a27c3f01e22ab35a5974f0ad6cf23f380ce569b3a20
MD5 c096ec85ecb3dd79abeca5f8b3a38dde
SHA1 9121bf23476583c34ed52749a19c8f890fa6fc89
SHA512 4ef31954bda35bd627ec30df3d21d17e7dea50e79a98de30d42377acdd91096ad8f2b4cbc2214de210a00aaafe86c3d0489ef90e57f16fac929e32c21a63d480
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLsL:A3mnXoZjzyaEFyKUluzyAZVS9lLsL
TLSH
T1D915AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 885KB
SHA256 38194cf1684580f632dc6c8372fb7f69775b0c0b1d88e70830f6f1d2e1a028fa
MD5 bc21ef5e537b52f4049aa3127ac7445c
SHA1 2712efec290880209b6b3f411bfbef521f0b169c
SHA512 5191b7d7b354a1db20c760f92a4e07b04f968d5f9ded61cf91cb227f7967e5f0591de97946a920f164581c9a8fc1fd97d884b7daa3b3e46921b5717c23e6fac3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLoFC:A3mnXoZjzyaEFyKUluzyAZVS9lLoM
TLSH
T18215AF03E7A410F9E51A823499E54A12FB75BD621B70C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 885KB
SHA256 2c98e35e4dc13e2b2677a77df246fe8e1bbee178ab27cf3b1997f478a0a4aa66
MD5 853209a774251c8fa6185e31ee60c49f
SHA1 dd53238acf2658930198c9fea57e29e8f080221c
SHA512 f263410524db9902152c8a4d0ba38ec80e0ba7f3568f0e66bcba768e8f9385099aabb99ed57881cec8c396f304dce6d8484a9405de055dfe05b6961188cecee4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9lLJh:A3mnXoZjzyaEFyKUluzyAZVS9lLJh
TLSH
T1A915AF03E7A410F9E51A823499E54A12FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4588-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5924-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5924-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads