95ae4e1fe32c357004a78992247800e06a29fb666c88fba278f793e0137cf23f

Analysis

max time kernel
120s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 871KB
Sample260718-ms5v5ab14w
SHA256 95ae4e1fe32c357004a78992247800e06a29fb666c88fba278f793e0137cf23f
MD5 9dc89a7e2e5a0f18e4dbb49d41bb79f1
SHA1 6a4f989710a6751de1b90ef91dafd5ef918ad7df
SHA512 b8a83223a028898df827d6f542ab1162fe4570fd9a0ff523a9fb39b2500bf07614d59f18b40750b56ccd65c6dcb1d4db2fe38a111b2fd2af31e55edd99d50a1b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEsK5SqV:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqV
TLSH
T12215BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 47 IoCs

resource	yara_rule
behavioral2/memory/4220-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c405-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4220-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3872-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb6-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000189a9-203.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a83-210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-231.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-244.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-451.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-500.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-519.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-604.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-629.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-654.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-734.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-754.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-804.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-835.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-866.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-937.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-945.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-965.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1020.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1057.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1076.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1107.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1120.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1151.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1189.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1196.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1345.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1358.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001b826-1678.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 44 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c405-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb6-60.dat	aspack_v212_v242
behavioral2/files/0x00040000000189a9-203.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a83-210.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-231.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-244.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-263.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-324.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-451.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-500.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-519.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-604.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-629.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-654.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-734.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-754.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-797.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-804.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-835.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-866.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-885.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-898.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-905.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-918.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-937.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-945.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-965.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1020.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1057.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1076.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1107.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1120.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1151.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1176.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1189.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1196.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1234.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1320.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1345.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1358.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1383.dat	aspack_v212_v242
behavioral2/files/0x000400000001b826-1678.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3872	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4220	2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
3872	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_9dc89a7e2e5a0f18e4dbb49d41bb79f1_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4220

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 871KB
SHA256 95ae4e1fe32c357004a78992247800e06a29fb666c88fba278f793e0137cf23f
MD5 9dc89a7e2e5a0f18e4dbb49d41bb79f1
SHA1 6a4f989710a6751de1b90ef91dafd5ef918ad7df
SHA512 b8a83223a028898df827d6f542ab1162fe4570fd9a0ff523a9fb39b2500bf07614d59f18b40750b56ccd65c6dcb1d4db2fe38a111b2fd2af31e55edd99d50a1b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUJqogiYi0djEsK5SqV:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqV
TLSH
T12215BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe$

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$
Size 1.4MB
SHA256 e532b78fe17721e5b52cf3250f3e34a1ad719e06b15228d72bf73d17b9760485
MD5 5ceaadd6c69d9860585f600a80ee3ee9
SHA1 33a74f6e032aaa880dacbb643039c3268afc199b
SHA512 e00aacc3324089fc9e6bf3375165bee6b39c7276f7149ab3d8d51541c2182463e5b4294115f719441977654425367db301d942687b67b23c4b77bdee0c28398e
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqPk9mR4qYbTM:A3kMjK/mWD
TLSH
T15A65AF03F7E404E9E06A85309A964612EB75BC971B60D7DF13A8C2292F737D06F3A764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 1bf2788edb1840ccb4445ffd48dc843611083f2f458f8b1529e39966743d1e81
MD5 69a4d0b78f06be37c179e88cc220c318
SHA1 bf4ec869d78b7221f80dda3560c882b4986bbd89
SHA512 a463a725d73e0a95f4626a2e2f3a166912fec4ad7ef4fe1221b59d43b7a13db08fef1808f7699444c0b8501ed74b387eba5e5c26d583d8c82bdfaf235c4dea28
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqR0Le5ji0hmxNrM:A3kMjKyPji0Aj
TLSH
T1DB657C17F6B446B5E077C174C9E2965AEA7138821B30CACF1359C3282F63BD19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 886KB
SHA256 b89e22e0f432f2d8a1bd8cf8c2329c32380b2c83aefd9292ce70eb8b828778c6
MD5 9ab376286908ab234dfd5550e7a6daca
SHA1 3b14138e197ba8298e8aa1d5dcbec45743ae706b
SHA512 ff3752b00ed371eed88a19108360b7114c2738745ef6298f8cc9e6af32893088023ef2361e7e44e7d159c5d22cf58ea25ba4ac5beb34f8b7743e9be56460b591
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sqza:A3kMjK
TLSH
T16B15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 919KB
SHA256 b60afebc6b962c3cfcb8e20382a77d93876878575eb14dc2a0b2ee655c161d1a
MD5 21cd58c1077cfb1051d315679f65e72a
SHA1 95e8c552799dbc3c5eb0b8c5bd2e77e161eb57ea
SHA512 2b33f267cabb522d536128cab0aafcf1303cf1f5bfdbe66247b70511e22421245cf68e4ad72124732ec359190139be9a7be8416f04af08aafbe86d6cd4c4fba6
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sqgb:A3kMjKXb
TLSH
T18715BF03DBA404E6E51B8630A9E54612EB75BD532B60C6DF235CC2152F637C0AF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 895KB
SHA256 80e2818becf0fb292e1627164ba13971750dafc95429e05edfd515d03a43d745
MD5 693aa494917127afdaa68bcc6d91b886
SHA1 000e166c4582b770c0b07bce7ff2d6e4a117431b
SHA512 a28d1227acd28e7ecb46256079aa7b5db26c73d1ef52df56a9c01022b36db1e4a3990c02a1c42038fe223a86c67fc7876f737c72d7d13322d978b5d8231d5905
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqbZ:A3kMjKA
TLSH
T12C15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 895KB
SHA256 a5e8139241cd118dc194a46bec5728b53eae7f614e86eda6d633d34bb952d81b
MD5 337b561cf278d8d742af277ddf3ae8d7
SHA1 3777d14e7e077bb5086a976b3056e1d69b2091c8
SHA512 f95ebfcbc8c9a526130da9c4297bf6465d86db5716b33cff23b2790e7b37824033c6662f5e70c4980eda12e258a8ce99122e6879a7ade03805d5cc5b17183d6e
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqA1:A3kMjKX
TLSH
T1FB15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 895KB
SHA256 fec59dd448b91cf1d34901f659bf3c70ee3e09f7de7201495f78be2cfa44b65f
MD5 26e6133627f49e4bf092a37dbc42224d
SHA1 79efb477e1035b33311f90861f3afca7bc35e075
SHA512 87ea006c788e9360d7a573c4708ff49cf257d9f37180dd77e2f8287a9cfd00f1e8206bf556a6769effbaebfb726e7eacdd381ecbe31afb5c88d14c82cc1e166e
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sqy6:A3kMjKc
TLSH
T14C15BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF232CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 895KB
SHA256 f66879ac586a5d003bd2449bb1d00314c55edcae090167d59bd5ae5f334fbcc7
MD5 06cbf9bcff9fa46e8c18d8c68f304dbd
SHA1 4aaa05f1bf0b1a48cadebe3149f7f01f443c9f08
SHA512 45415b1aedd29bb408cf32b9b264bf224f184571379336500962698756c03b073ed169c0e262c22430bf070035029d2bd76c5d0de0a69ffe47e9f81fc36eb18d
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqqN:A3kMjKB
TLSH
T13515BF03DBA404E5E51A8630A9E54612EB74BD572B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 895KB
SHA256 024fc2723095832d7d07b0b91f959487c9cf6ac5c6f1aacb87f0003c2b515518
MD5 2f40852368304f52fc8825811620516d
SHA1 3ba4709f1d899d286687a50adbf697c7da64a157
SHA512 15edc933688d86075ccc67c1f47cfcee04b9c6dbf643d5ffa214c0ad9d5121110dacb7c34a843312343a0d9add58b2606415eef90a90472bb4105629214cd764
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqQf:A3kMjKh
TLSH
T1FA15BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF232CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 895KB
SHA256 ffa4d5e2e6f7008a76925a86d65c1760fb8b499fd4bbbd25decdd8b73db1f367
MD5 74b04b1ae1cb0bf13d6ae3bb58e64a39
SHA1 7cb5e15a5fd8c0e57ef0861943df867e18d91145
SHA512 18d96eae044d70e9a1c0b4d468c03c24b3ab671940b87c7351e1139cfbae2d51ab8249c388e354a0b7ae6e526d6e116ea03e33e2b0d8959f7728e30b0fb11554
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sqqo:A3kMjK0
TLSH
T1E215BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 895KB
SHA256 9b42780f98a4c94242897f52649bb593f73a0822b32fc5b0e370bd938d01f8ac
MD5 71c737703d1a762f322c412aa250351d
SHA1 d9d659277f64b993a12a379a7bb510f369301c0f
SHA512 eac1108b84f934fbed7b3f06b94fc85617026a8fc68d9ed7d673cf28b8e232b817973c5802a5c0c2237a099f15c78079d4bd58e3a788fd6bfcf9f901781cde52
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sq+u:A3kMjKG
TLSH
T1DB15BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 895KB
SHA256 e48b654809c1016830738ac46152797db0629f863b9f344a86fb8350755b6992
MD5 50e8ac01a04231014c5aadbf613d457a
SHA1 c7f4ff0d0f86c9e38b344751ea87007b65b6c1d1
SHA512 751ff070950ce2c73ce73c8c4fffde87fe8b20c3bbe276ccc7e5679d7395100b12f7e05cf7878d515b2c2970af44a83c7bc431509a517ecc79580531223e045f
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sqy9:A3kMjKH
TLSH
T19415BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 895KB
SHA256 d72fdfbe4452ed43415a7b2f9709afe3562d97c655a5c9562f095829efe53d64
MD5 d0bd7de42374e62ff35d92edf79b4172
SHA1 21ab899e7d667555532f93e6a75a95bf7d48a265
SHA512 de8206cf6260c919a3e6ad52381a58afd40221f23d7118719c32d8a62d7c9f5dce4e2201127d2cf0f6d2922a7485e43a8f271636b55049a9f25b00582a20939a
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sqyc:A3kMjKW
TLSH
T18515BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 895KB
SHA256 878f9479dc1ef96913b21fd4fa6c537b0519cd589173accbb72236cc5955301f
MD5 d7b6f25a0abf0271811776310a78d023
SHA1 b6599899b320b5ee059f74c4a52dda94fbcc758f
SHA512 d57ea22032343c546903ce25c7fad06dce275b5eabb236075c54631dab31a7f6fc1ff770bba5433ec00513fd02c80c230f080364053be229286db9a1288598e1
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sq7p:A3kMjKE
TLSH
T1B815BF03DBA404E5E51A8630A9E54612EB74BD572B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 895KB
SHA256 562f7850379a82680b26fe3380ab93bed32906bcbdc808db4626518d734986e9
MD5 8d1ef963a429bc6faa073c82b7a46591
SHA1 f291ed70a9aaba4b890ab5e756fefe1fce49680e
SHA512 ac43401f29c7b04450ab20efe6d6b5ef4b41d6f7fde9950889a6f56ff45344ee1c8b4dfbbd53e72948621a0f8297fef1f42120b6d80777c4357145fd15bc8859
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqMN:A3kMjKz
TLSH
T1D515BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 895KB
SHA256 8800e2e71d986e8f05014bde94884b1922bd28f657bf11e355029e567bc8f324
MD5 3ea71dead5fbf289176a60dcc0b0f7f8
SHA1 40c4018c6eeb99dd10d212eea8f15e0343361769
SHA512 399861b70d06ea083d0be871332e8c438dacdd8d0399a7062d395abb1aefbe5c4cf2d39a44df8d0ff0e263e5e72855b6329c582b6f94cb24b0bb19065bf70d68
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sq0F:A3kMjKF
TLSH
T17115BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 895KB
SHA256 089763d883985d1564cded7fa4235d030417718f3fd3fed2c9ba50616c5e43d3
MD5 0788f0e67d5f656608accf940469e102
SHA1 d5d0683f4027785b50e12f91e1366b70a663c900
SHA512 fcc4db46db8034362e7be0569ea2a8d6c778a525a0b48695bc9d839481952ef2fb9367226215f6f79c700f1a7e838d7c9a8b94f6c6fcb1330870417e184d052d
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqRC:A3kMjKp
TLSH
T1D415BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 895KB
SHA256 862b39432a48af0409c702e2635f594ba11fccc8cc2574129b95083ddb064e71
MD5 04f4181d0f2afe78309133bbc80742f9
SHA1 0f3b3304857d2a63f5c1a537b264cdc2eab624a6
SHA512 c7208219039b69a3b52543c48f18212a32965398117901c8c29b0046fb673e504a43fefafb0533bc3d2496681349a22ffce79ee3cdf47894705fb06925f383a9
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sqyw:A3kMjKU
TLSH
T14715BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 895KB
SHA256 4d28de96093da34f4302c14d2f2329cc1dbbd1ffd5e5d8b6070d2a516c4de51e
MD5 f8d031cf7321b81b1d8c20dbf98d9ba9
SHA1 b51d720ff09319d0acce1688f967a10f0c29c52f
SHA512 ae87680cbdf76d8ce4b0fa16894688c327886923106d6fa919c6d4109e42164351552b94f39d78bc2776cb4510b07a846a53c97a9a8ae75552c80c5191122746
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sq5T:A3kMjK8
TLSH
T1C615BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF232CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 895KB
SHA256 5063007efe7442194c01038fb59719241efc6a7cd513449268e3451a3853f4bd
MD5 8bcc2a22b7c6139ebdd433502489e321
SHA1 24937c6570f35845a904381fe2b4aeb2361ed9b0
SHA512 365e1e21d399e48e2dc75dfd45c460aed5a5b29b7517030e515b6f64e713563048a464d32ec3a5d7b6210a6fcd19347ec203d133fb5bd0a48ab73c06630f3fc1
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqXu:A3kMjKb
TLSH
T10415BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 895KB
SHA256 e3efab52473628a439f9f80ebbb33d29daaddf43c1b23891f27b7acb41201bfb
MD5 c9ef33ef6df7a4f558dfc6ee41c6eb88
SHA1 ad67d18a4b3d658fd4ee2e04c32e814739aca43e
SHA512 4e2fe4c1402c030172160e39d943d2413736e722cbb1c95bfec7004b143fd622604a67bbc7a694ea492d8b7afecff0a1b9862dc2b5dea598937bcd07d21a62b8
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sqrb:A3kMjKy
TLSH
T1D015BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 895KB
SHA256 1834e978bc3e0f0ef48bde0cef6d74a5c73f4cf078eecf65a9eed1633b610f1a
MD5 2b1f6dc54af18a3df1bab29e36ea1988
SHA1 24b562405152c477c990e53f5dacf2ae1f3fe4d4
SHA512 6c51c50a7c347775d1ec156372f07d98d7078954030961fe1371eddc6614e57e751409843537e148f417f32550e5e7398bb8776363c0fefe0fd1af7ae910aa29
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sq/f:A3kMjKS
TLSH
T1C015BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF232CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 895KB
SHA256 695b487c126d1afc741275ba41d330d7bb9741b78462867502ddd0eb7d928b22
MD5 5c9a86fac83b7a8a0ae104a5324bc52e
SHA1 9a9ef1bc19e5d1bfe6678880750b6076c847126a
SHA512 b9ad34176a8dab2cf2679ed35158c5144d1887c12ba90c5ed9ce46cabe27cdc8e1f29b919562d3bca083f430a84e56bcdc4e0f50128e185cb92941ae541f83e0
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqoK:A3kMjKy
TLSH
T16215BF03DBA404E5E51A8630A9E54612EB74BD572B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 895KB
SHA256 62f43aab017b0985b87e03e742efb722a7b247ae8d841949c40e4e1c28eb8fd8
MD5 f5624bca6c4b7ae60c403c795e84fb9a
SHA1 f1022e8c5272bd1769f5414e82469fd0ace220af
SHA512 d4ce0c6991eba8385480184e32d71fd497d35b7b17f3717e072cd9db41f31e947985858d809f5bfa9e7ac8fc2140c7c916288856f925cc5f7431da8729cd9b7e
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqVk:A3kMjKH
TLSH
T1C515BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 895KB
SHA256 c770e17abb23637e2261531d7378e3c3aa188838a8d3f500f37167bf6edaf747
MD5 90b86a1af81ab9e784b1e3d0b267d5bc
SHA1 03342674503ac1f885eeeb352b2d1ebb30953e02
SHA512 59824cc589173e3ed296c58804051cc4cb3ca3073745e78c950e6334b152aff52e2648463594994c21bbaa8d6776779a07bfc028ee4d3600f4acf4c825f6db59
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqK0:A3kMjKG
TLSH
T15715BF03DBA404E5E51A8630A9E54612EB74BD572B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 895KB
SHA256 92112eafcbc2f0b92f0857776217ea9d6c6a7b11dd19281ec92f92b3111ff7b6
MD5 302499c76ea8036a9fbb2becec6004d7
SHA1 5eed3df935896b95f42074d77bfef4d230218201
SHA512 f8242241c04433ab6016b1a4ba747ba056b535ffe45d4aa29dccedb2cd86199064599b2c18378425971d21aa057eb59ef39025d477586f4177cb7f772e9e7d05
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sq5g:A3kMjK/
TLSH
T10F15BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF232CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 895KB
SHA256 9a3e59072b7a3099789ce92d7ce4f58e855f48e7c5fd431b7063b7423b412bc1
MD5 ce34b60475476c939451257ef764b758
SHA1 2402b6b83350fc038595b08e3fcac7f462aa32cf
SHA512 b82a139db9599f75ab99ae89ade93b0d430548779bb177998437724fe244bb2cfecb0c5afbfbfb07888bf925909c7ab41ae20411466131463940b9e0cbba28b7
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sqgr:A3kMjKZ
TLSH
T10F15BF03DBA404E5E51A8630A9E54612EB74BD572B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 895KB
SHA256 a77504d9b903dc9a3b848c4dd70eb3d5e8e8250d49884d2ffaaef1c3c35d6ea9
MD5 9b8f73a1d892815a71c889ec4d6e57f7
SHA1 7624d51b9ed30aa26810ffffe5275123cab09834
SHA512 2657bcd3816c5b48ca5587f77e0b6725c3411c0240c3aa0524663ad8205d217d83e1ca6c8db02166c92d0b9f8e1afd8d7a85ee6560aaad470f277468f2e1a50e
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sqen:A3kMjKT
TLSH
T12B15BF03DBA404E5E51A8630A9E54612EB74BD572B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 895KB
SHA256 5af07e2d890ddb5264e9f6195849eb20a4f7eac5a79f9974c4aa1abae59b5d25
MD5 3b32adee568cc5da43e0dd9a7a3c9cf3
SHA1 22c22153bece4533146609531282338bb2a225ca
SHA512 01414d14aaf59ce6358d8e4e028459a33fed703a22892037b9c4f7047c47ae0c85f57effca689dec7c8855d1b2b2171e03bcadc1e38ffa0d280f64cd78064c96
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sq0x:A3kMjKR
TLSH
T1DB15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 895KB
SHA256 73e4ea691ae787c7905eb721175e94001408192d22c9c0689099b843305253a5
MD5 ca87e31fe5bb9afdbbd70954d96f7c4b
SHA1 59f52b9637ab899fcb26ee174b2444e72d2723af
SHA512 3d2b6de8c7e47a23f7e0121f8a13513f7f6973cc24b1fac5782e09cbf429eee88fc8d339c1ba27c3b8fe34a8cf719e42a431bf61c307f10915dc54465c0eff02
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sq+A:A3kMjK+
TLSH
T16B15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 895KB
SHA256 be3c28e236e03585a2cead40884455fb0e9e234f31117c5ace49075725cca452
MD5 0c832025048c54ebff045823eabb826f
SHA1 e3c242c7fa71dbf5f1b2f8230c3b270587abafa4
SHA512 1f6b9e739724633b9cf6e783f469ae1bf36c313db413a0755c707b4c4f9f5d8f7e1b4a2f194c3ded9c4b258982ab8ea80e3e01bab5c369b49004735e4d81eed8
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqX9Q:A3kMjKj
TLSH
T1B615BF03DBA404E5E51A8630A9E54612EB74BD572B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 895KB
SHA256 c1146f6d7434be37ed59484a9851fdb099bbbab1118b00e1aed5f92049e7038a
MD5 369ea7e010c5e82d95f05138516c650e
SHA1 bf5cd8a356cee10a90468678d4859cbe75af81f2
SHA512 511bcecb51fe321ed85e573859ccd2b73da8441a6f7f8955a59efa287d18c4a7b1c07338855227900165741287436e21980de4e4754912b4e127acad366b8ed7
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sq+4:A3kMjKE
TLSH
T1BC15BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF232CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 895KB
SHA256 af8c84cd42c6c0b1c3cbf53722cd84443fa1c62051a96141c698f001db55a17a
MD5 96a50f813c97908e28601058438667a5
SHA1 7215be29ebec908367fa4b964d8c7dfc8f143538
SHA512 40c28553e7caa121354d7006b5e1643b14ce33906bb9a70c5783db768311acd978c799cab8e1fba3879135a44eb8d018a85c2c6430394caeeab60a1b4f6f6f1e
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sq9u:A3kMjK1
TLSH
T19315BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 895KB
SHA256 808ce698d2144b836a1abfa891fd5b077ec7664a6dc265f01d7c94bfb3c13107
MD5 9f7e8f3e711127ce96697185d7d73512
SHA1 239166efb03b03d87ac6fd0ed53b698bb0246e7e
SHA512 b617c2931b0e7bf0767a6194ccf2078501493cc75935201c2ef2716393abeeadc8f8cb8b05f1f58d8f8f3e34a8d4a7e9382be6133723863490e299023aa64c59
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqQj:A3kMjKX
TLSH
T14815BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 895KB
SHA256 4f37b1256fca3660baf0e977bcdc85440a1809c3b2d467f1732a7bac943b5dab
MD5 d7a7fd09f9d84259ffc0dd60889e58a6
SHA1 44cc8a54bbe806de01e9dbf691c76976ae759ee4
SHA512 f99a78fcd949535c0212b7ad173ba39a15dcc8c49d4bf00b600d8c031fa5ebdf237b709ca61461b1b49900cef8d0963320ac0678c7df1f622ddfb93ec71d4c0e
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sqhg:A3kMjK/
TLSH
T13F15BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 895KB
SHA256 a79c9117a630f89c9466f1f35a293a7eafb2570184d20ac53936b7c1c2d4b264
MD5 619a005c5aafa61d2175a16b47c8e0a5
SHA1 482f25c527a068eb3a21f41537684d9107241e3b
SHA512 452afccd57ae7c248e74d1ca19356d652bd3fc7be946b31d508e7614ada76312e194ba4196c2996564d15c7f54ed7579e52369900cdea6e674b7be6914e38628
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sq4I:A3kMjKu
TLSH
T16E15BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 895KB
SHA256 2cf48329853c09b49b157a3563f34a2ce568804e382d6608a8db1e18de932dd8
MD5 e4b6735b25935c6391f3e92bfc63e2a2
SHA1 357f46ca40e183b3ee43e2c383a13261fd728169
SHA512 45653a20abcb23bc716fbb598d68bb7dbc72a9d20d311a805f8f7f4ceacda9cdf403d52ad9565d3cf24e5aaa9d86d5800ebf53932fd33f64a101f1b9225b595a
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sqao:A3kMjKs
TLSH
T17115BF03DBA404E5E51A8630A9E54612EB74BD572B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 895KB
SHA256 02fb5f63dcc84b4900c0820643cd50c892b3766036a656ba3dede0a9ea29c6e2
MD5 29ad9a80794b8a0e559af4e8ea90c245
SHA1 53d13fd4c14a748de6ff56dd771843c54048fe39
SHA512 b68832f6196ddb80696a92fcd9e04e3b4d770fc48470ff2465bcd5fe0c3e09f9daee47405a0cd56acd5f668b5d58960bc98df1deea38dee9a90413370b4d4942
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sqx+:A3kMjKB
TLSH
T10115BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 895KB
SHA256 30524616f748e4a29c04ec264b3c9e936a1abf1f63b7e4f0b63719f46881df63
MD5 a6dea8df840dd4d307796964b4050fac
SHA1 fdd9c6bc132c5f9d705d8bfc2c219fb5ac047850
SHA512 45c1ae7933d00052ba511bf8b08e06a6aaaac2fee0f5bb10a59361f65071df4203bbdd0d945b41b092e9bd2a1ef89c700dd5949a04956fb0948a7accd71362b2
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5Sq/Q:A3kMjKB
TLSH
T10E15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 895KB
SHA256 4e5ee823606288a4cd9ed14625451539d2e863a425b549d536ee454d2788878b
MD5 bea2eca965d546388e097eed51549d29
SHA1 95be4d43d41d80d6bb7c615ccd8e058eaf4860f9
SHA512 9818d2e302651bf4ca706512be2432db59a3bf8af2c15dab55f3bacdc3ee1bdbd1d25f611ba459b4b7d60eb09f1f8de189a5289177e6a304274fe82b38f3f78b
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqEX:A3kMjKt
TLSH
T16D15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 895KB
SHA256 19f9bc879f4aaba866416f693db9ae3a795b0b3c0bef3446d03719e30ff2b46f
MD5 a3542b6db0422bee58152c8e7249791d
SHA1 84f62d2a39f9495031ba5d5fbf0966bd200fa643
SHA512 2f5cac03fb18390fd743b6da84e149aeef9974d91230e954b4646ed019eaa93cc435b30f36cc6ea0168a1274607dae469fda5b09c2238b43d54e621c70e14351
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqCL:A3kMjKv
TLSH
T13915BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 895KB
SHA256 0d8f66fb429c8dc22ee158247a43adcdbf238f7226421c24de04869b40ec5c8f
MD5 bda4d9027b3ceeefb10b2f6610cb202d
SHA1 010a0adc0fbaae66564f2d9641798b268d3438ae
SHA512 840e0e24b69a32bc6a106ddb31828309432d1daae492d87523fa52aed77d9eb4d21cab4b2d40f8e778ca127ce695470dc0a1b4436a8980b1b77ef1ab97c514e8
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqmM:A3kMjKa
TLSH
T12415BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 895KB
SHA256 c6000b1f86f64796d0118e8de191381f07abb78e574491daa7d8833cda73de1c
MD5 04e29cab5281c46135d34b427caf41d9
SHA1 23851c844c7af558099f99addca1d6d5cfc4d997
SHA512 b52360f3e49a5006d1d712485495b0ec15357d65cc1d48fd33e5d41ad280c1ca192212fad29aa7196c46fd9372b0145e18646435dafedca20c8cb4ecfb630473
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5SqPh:A3kMjKU
TLSH
T18C15BF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3872-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4220-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4220-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads