7b0cfb2a9e6277f7a20e2f7ad5ae4389a53fb923a12bbf483d8b1ab68d0da99b

Analysis

max time kernel
95s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 918KB
Sample260718-nec4macy8x
SHA256 7b0cfb2a9e6277f7a20e2f7ad5ae4389a53fb923a12bbf483d8b1ab68d0da99b
MD5 56562c165f18def1f53f6aee78db945c
SHA1 835828b0211812f8056d8a14220e4405d795c705
SHA512 5d262cbbddb4fd876293a6956013d83c007fc7a5d3efedf3a34d9524bf4259f219fcabbad1eb7c342abab77e3e0fb94482d0f9a91aa1d3f451936cb0def0b128
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZF:A3kMjKu
TLSH
T16415BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4120-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c560-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4120-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1196-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c95-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-536.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-609.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-653.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-770.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-801.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-844.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-908.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1008.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1089.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1163.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1292.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1335.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1354.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c560-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c95-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-226.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-444.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-493.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-536.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-609.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-653.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-770.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-801.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-844.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-869.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-908.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1008.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1052.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1089.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1138.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1163.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1176.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1183.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1292.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1335.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1354.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1374.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1382.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1196	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4120	2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
1196	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_56562c165f18def1f53f6aee78db945c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4120

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 918KB
SHA256 7b0cfb2a9e6277f7a20e2f7ad5ae4389a53fb923a12bbf483d8b1ab68d0da99b
MD5 56562c165f18def1f53f6aee78db945c
SHA1 835828b0211812f8056d8a14220e4405d795c705
SHA512 5d262cbbddb4fd876293a6956013d83c007fc7a5d3efedf3a34d9524bf4259f219fcabbad1eb7c342abab77e3e0fb94482d0f9a91aa1d3f451936cb0def0b128
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZF:A3kMjKu
TLSH
T16415BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 c47a817d0d9d6e7e8ccabfdd384abf37b262b5a618bd6b5ac4286f799d7151f7
MD5 c759aefdeb458168ed1ba6768c80d629
SHA1 977e1dd82c0ca7e2547bc3a545eedc1d17fdf442
SHA512 c232e40ef8922ba8e89a4a4c51b657f095e9306e1e8a11edaf9109907a169cb20bea18221e35ac26dfc0642d9bcbbf6d0723576cbaaf998411d0879b938db4ff
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZB0Le5ji0hmxNrM:A3kMjKePji0Aj
TLSH
T1AA657C17FAB446B5E027C174C9E2965AEE7139821B30CACF1359C3282F637D19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 933KB
SHA256 6d5eafeacd469fc3543d0af13adc3e8b12223b9c7a12913b630c97924ecf829c
MD5 815faa3c8cbdef7e9fa39c12b5c6123a
SHA1 dc9372b283e1be17624c49656a52250a749d0e2b
SHA512 22687d261432b795122f8096de9a1e661d53fbb4351db270bdb1fa338e3cbb100e7243a389365b0707033b2b73aea0053a4c627725d6320e476109e9fa374487
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZDa:A3kMjK
TLSH
T15F15AF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 966KB
SHA256 b87b85b217bbe44f53cab5371ed6a36799d641cfc6298023838af0faffbc1b83
MD5 22d4bd741b9c19477f22f84d4d6eb24b
SHA1 e6edd484d4c1f675fc1ddd7e1ef8ba6684473938
SHA512 d037679c8da7874de2f391495448ca07e145095d125d2cec6154e7dba397ead0595ec219dcef8209ddf36f07d4d716f4ed1ca6d77face2c196d72be330cfc7b9
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZQb:A3kMjKTb
TLSH
T17D25BF03DBA404E6E51A8630A9E54612EB74BD572B60C7DF235CC2152F637C0AF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 942KB
SHA256 aa40314b29bc1d9e80dca9e6555b128faaf85e1749e0e3ef6572b0ae841fd0e6
MD5 015a0373d87aad8a5a418a49fb87f3c3
SHA1 16da85ed4f622ae1c5ca2bcf831788f9bf3f846f
SHA512 3111df310a5639024efd50c63b5623ba87fa38d8a417f4204b67cbd14361b65d788ab1dade65bed7dc086f2aab3f606bd2fb20e6027d848ef0634a5552308c43
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5Zi6:A3kMjKI
TLSH
T1FD25BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 942KB
SHA256 67166901bf6ddef377c5b2feab4e2aa0d2b0a0a688bbe29ab627303ebf367e80
MD5 45701b6b7e468fb439a1ca6d37d3d394
SHA1 74d3ffa6a971668f56fc119f4a608366bd2cc394
SHA512 8f0d38ee5bb9fb08a946fcad84c1c29ee970b528342279dc9443c83f5e698e4e30ef217f1912ea79bf2e2f6864fd3951fdf6c63022b7735978ff59ba317f9938
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5Z6N:A3kMjK1
TLSH
T1DB25BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 942KB
SHA256 e6713cc32645fc7a7576831e5db75ad6cc2f09643e32ba6ec0b364d62a2200ba
MD5 52f9bdb5665940b9fd8d2d904498c96a
SHA1 60daf2130a0c24e05451139ccfb542052762b56b
SHA512 3074a9c6b14c4a96b69e1212cd547b3ec029ee82d2ea2cac4c2d0aac04a6b7805127b809a1fac0e159719125fc8f340fa0107c1a35e8bd6c16c5d1421a2462bb
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5Zgf:A3kMjKt
TLSH
T17A25BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 942KB
SHA256 ec432c4e8690558b06e6d8dfa465882cb692ac1e051926e5589e3b92f3dc19dd
MD5 e9dabab36cc52ff707290ca6d8da81d6
SHA1 1187922ebbef55f174bf9a90fc71b967cb0c5eca
SHA512 8e5ec2ae84d1b1adc09d950763d42f13c7fbc4e214ff832ebbbf78a74d2c7f8484abc1ea94cbaed28bcaac7117054df0e7de8621e6c9642f611a69ca6fc5eae7
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5Z6o:A3kMjKY
TLSH
T17925BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 942KB
SHA256 1caea051424b22d2d2139938ce39227a86cda4698b0b1a7be2d44f719edcdf8f
MD5 6d5726a45ce255c67052e4a9c71269b4
SHA1 50a994aac90f54fca4d9f0c82b988cd679ccc7f0
SHA512 3d35ee7ad20ffe5900b6a3c203c44be269395ea9bca73804b2c2c169df64ed8715329cfd90e6ea1b47c26e4487b2ac13ceef2a8db28ff347535d14afe27c2911
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZOu:A3kMjKq
TLSH
T18525BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 942KB
SHA256 7d97ee2ba7b8d4cddd2c1dac5286fee7b3aba1b3cda7943a50288d188a8e146f
MD5 5f6acb4ad73a4023ce820b0cdcf6acb9
SHA1 b9c66654c807623b71a124dedda5a2d0050ab043
SHA512 fa43df9afeae7607380efad3485daa25b7a2cbb6396d85326e1f789a640cb8a8938faa207d5772a93e8bbfed76621f6a81664ee2aa2aecec7cf83656dbd450c9
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZC9:A3kMjKL
TLSH
T17025BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 942KB
SHA256 3cfea2b56c32858e7aab953c1785013b84810434aca71195c32a025eea19622e
MD5 f8b1b8f64299b8d595acbee0c06797c3
SHA1 c6897181be30542b6432806489afbfc4eeb23186
SHA512 12069ebbec61b2ffc6eaad365f4a6ce554d23d6eba220953aa6f5a58e0e055aa214e17537f14e0fc64f55adc52bde8b5db3bcea8f4b0a02867339e4275fa011f
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZCc:A3kMjKC
TLSH
T16125BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 942KB
SHA256 0a828f5ab77165d791c4edbef37a9f65de4350a334a5fb6ddbdaf477058d26e7
MD5 9e260c5764536bed0a615ee6a111ffef
SHA1 e3f71b6cfe8035ae09c55a35a92a68b5e85fff16
SHA512 173995865be503262a51b47f99e981c24d3f758f194f4f14ed468632791ab2273072e5abf8b19df027c4bfd627c9f600560a97cefc8f94e291e03f62c3832429
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZLp:A3kMjKo
TLSH
T1FA25BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 942KB
SHA256 63535e8230a7a6d7fcb867444d79c11295b9f36059a6f37d002de47cfbe667ee
MD5 8ee84e74645b6f2e2dac56f9c95c4d5d
SHA1 8a7c0837fef98d203f1b793f1fb16fe56b3e013d
SHA512 6303b35209df312fd0bff99af72f2f3000d2ac7ae82ae3376e066e291aa1245dcc7ca140395a67228c30d3661441212ed6fe7109ba4b693f8b6f3366052b97d4
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZcN:A3kMjK3
TLSH
T17225BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 942KB
SHA256 1f18d75a2a38da0cf44e629df4b89cc364cdb6e529b60cd9817d23922f7455e9
MD5 fcdbbcf675d92c1b8abbad676612a29c
SHA1 5caac3a3e8538602f493e8505df55d20be204547
SHA512 c0f2c1449d611ebf748f76d87fb4f027b690d9fca233cd4651fc17c90524217b49d2645fa1b53d2bd0061493fe067b594514ee7bbd8b9e1256fddaf486fcda54
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZEF:A3kMjKx
TLSH
T14D25BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 942KB
SHA256 d544779579c6afe332059f47d952910e032416f58f2a28ff1bf98d93b2ed6611
MD5 ae8769695538d5ebfd8405f78bbd53f0
SHA1 5b73e295becdbcbae267638eb18cb0df13eab951
SHA512 d040a5bfee76b6158ae83738a2e110e0d1f5f8e0b1d497d7ca729fb70e6c92d5f5a4b7a28297e27891eefbf908d6e965338ce090490ca3463ba0b0379035716c
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZhC:A3kMjKd
TLSH
T12F25BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 942KB
SHA256 be44a299a12922268556a8d6d356f519686faf5c3c6249f852a4c7754d1fd3fe
MD5 d43b2746dc52306d5ffeec5b1c6a5552
SHA1 48fa22b1a8d68e3655d625dc9d3f18de1ed59555
SHA512 e7dbe2b0efcf17882e3548aaf3736e9555f860c6bc23987964e0faf39bcb215b5c155974edfcd224556973313a92e6883ad5a615692e85c6f2bd02674b360707
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5Ziw:A3kMjKg
TLSH
T11925BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 942KB
SHA256 91d5150a8081b9f3b8b86547d10688edbecaf35b26a16d8626addb393bc9b9aa
MD5 a44c0db3b575bef921445518fd26381c
SHA1 f05cb2683362a7d2dedffd3c67934a08566aaa3c
SHA512 8cab0667a0650a73feb63bb7b0244207dfa16e17996199aeb5266be55adddf0daf7188dd866213957eeb181d2241c225ea5636c32f1730cc1e584301310b2692
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZpT:A3kMjK4
TLSH
T1B825BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 942KB
SHA256 9c706e53a3b50f9ffb32b72712712fc5e8c8126c10d9b35670ba9adb6e9f40c0
MD5 e7859746654f051848a1822a658737b9
SHA1 8d487e4db0715cc5863d6054f299d6c8e57b8847
SHA512 88fd461bb0fe29eebebcf5e49a4ef548a7460af6b79341e484eb3be81cc339a5b0d5ee5a8502216f5cbe8e66aefd3bdeda200c2584d196263f6eb6717fb30e4e
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZHu:A3kMjKH
TLSH
T10325BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 942KB
SHA256 3618336a2dd09d7c6d03aeb3d186211b9601d2658a138b7d1d1fa43c38569983
MD5 c8a12b770ded993842f1c28a0b435eb4
SHA1 4dc9e7915bf2faa81b3a7e54e8097384f20ae0f4
SHA512 180dfcb6620cde426e9438fa17a7c45139399e8859b1b2fbf3a505fa485b8fe133ae6b67d008e473956733d1722cf032111f9cce2c6635139a6f7f3a80ee591f
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5Zbb:A3kMjK+
TLSH
T1CD25BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 942KB
SHA256 1818b6a0cfdeec5f5794e841f2c4c601fd0c80bfc922d2058cf648335d28cf43
MD5 35ec557e26fad3da037eaa603edb57f8
SHA1 14942a0fc45ea9f7b2b5d0bac5058f93cda729da
SHA512 5499fd24ff73ab1fcc45804c5b2a976ed69c8d622e56730a7f8d663d20902ed3135ca8a091bdca5da14cc546ad4dff411cd57be4d74f6efeff9fd454330af440
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5Zvf:A3kMjKe
TLSH
T1A325BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 942KB
SHA256 350510a8c1dd7b2aae249ba608f209e7dc5e3c997f30049bc1f0ab2453d14e21
MD5 96084573ff591ee7ed97d823a6809ae4
SHA1 f01c1cea9aeb6af0db46486acf7394420783ee7b
SHA512 9cb08eed8fd8d2ab445ba5713ffd76bd17a9dadefed3d3afb104adcda733a70cbde01a3c24a5c046fca9b23f2ca15e7149f771d0a41197c9d541c50d3b34b45e
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5Z4K:A3kMjK+
TLSH
T1DA25BF03DBA404E5E51A8630A9E54612EB74BD572B60C7DF236CC2152F627C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 942KB
SHA256 8196f26e3172975cd79c71281e6dd4c2a55a3877bd399265c5ab118153b9b3f4
MD5 10e401fbd196707c0be091391b1765d0
SHA1 813bcc96d75e62bce73b0e4bd0aa6935cd8e0a01
SHA512 701832dfbc9baa51d1f5158792ce02407e79b12b81afaa174938f2ef1428ee464976c83d46cbf054c4255a78c21ac6fc0c3e0090d5432f47a17b1362206c5bcb
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5Zlk:A3kMjKj
TLSH
T16B25BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 942KB
SHA256 d3b68aa1456159825697c7a799d6d2fab469907af65aaa05af28ce751f948e10
MD5 dc5d2d88e9203c5639d432513cf398d3
SHA1 23a7ffdf2cac79e2ed3834b874a843145584d5fe
SHA512 eba55b74eb1bc01ecef0b85b840333a812cbff8598e958a69bb0c6203a83bdb3d65eded08ce5237188cc76c2d00258d93d262e4ff3193afa169c4418806d3268
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5Z60:A3kMjKi
TLSH
T1EA25BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 942KB
SHA256 4f1ec7fca22e96fed1b2b61d8a55667dc9a52b8d2568b35d078160ca45885c2d
MD5 5956e248f099614855833819173c19af
SHA1 130e80c5f3f2ee889fc49e98e8f6ec04b7322ec0
SHA512 eb8210402e0e0d538c9ee0bd561f3e8c262eaa4a573fb396e9c5593a80da09aa85f9dc5d7c22755256295e0c7618c2caf844ed6523f46444a16128aa3aff0205
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5Zpg:A3kMjKb
TLSH
T1C825BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 942KB
SHA256 e2f08b0227400b00694590e77439704c33a82745b811256cc0fd493364907cda
MD5 11cc6bf0d10fbdb4a435d383a57bd43d
SHA1 c575798fdaf9cfe0efa7f4d001da1ee9611daa44
SHA512 c32f725867082ebd63cd33f46d1d45e9ec0f3c009f4a4038dfbdd52a1ad3b49b8ff63f72ddda45887aae037df73d735d97fd6038d125ef84d54353fdd75c76ed
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZQr:A3kMjKN
TLSH
T1BF25BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 942KB
SHA256 bdd0eed8ccd4c46fb3a7302db06cdad6188a070dbb8dbffebe6b363612ea8933
MD5 1b3cbe1c0e9bdd428c3dba3b4d3ce039
SHA1 86353d3119eb972286f71613e2f418796ac5a617
SHA512 15c9651a09e23cc89994c1582fc2fa1f8fe05ffd26047b3fc45ce8d22d3a2c33f7449a85bc582712c825d5298eea5f29a3b9a38c0b8e948a26edf6e1a533fcd5
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZOn:A3kMjKP
TLSH
T11D25BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 942KB
SHA256 5c82d811410e9493263fa6b4e1db6e0e6444c60849e2f03d4769ae959fdef97d
MD5 9aeb54a46ddad8925492ff642de23ef1
SHA1 f8c04041d799e8cea7c483ea39cb31f926802a3d
SHA512 4da41592e2afcfe3a331ce1e2c636b1462442abb0ecc2b8e13d1a5bbfa6a7ec3b134a2af7f65df9d8f6a7cf87072f733ba05b0a3b6c7c503223e0cee3c5cd741
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZEx:A3kMjK1
TLSH
T17925BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 942KB
SHA256 4df89ba579d22ca14b7885175dc16d36832c2d51705b503cfcf80e3488e82916
MD5 5d4f66e0e8ac3e03669d2ad54b81dd80
SHA1 ff2b2b1dd4f953e74ac27a1cb7d4c675a9af6b01
SHA512 9dbd9c2c20122f78514dabeeff15bc75a67583d29254fbc950beb4f565665f5e25cac5b2db84bbb45a89c9a0021cfa4ea3710e3d5008b084adbeb11f8261039a
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZOA:A3kMjK6
TLSH
T18625BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 942KB
SHA256 5c8e35540f2664358f924cf3286217062090dc799a2f9255798e2d41371301a4
MD5 de490456c51ffc081e0676a03d5136ce
SHA1 663230089734f7e7ef903ec67b60ad8c2cf9af01
SHA512 3bce8426f3609d492295ad335862707f2f779f83e51997c2cd704e0999301b13a4bedad14e0999d3651a1a5311c6c3a9d06c1144b2c35dc177ddd7384bcf5d42
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZH9Q:A3kMjKH
TLSH
T12525BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 942KB
SHA256 25f9ccf6f4bc64e2ed4e9889116820ee433e207ae59eabc674346e831f055c4b
MD5 27a292c16e794afab3cf63584d34b473
SHA1 4193413871276ec5276a6caf11c86129477db22a
SHA512 989671ff2a4ebb6efb5e19deb28d960d309bc00300de5663218e800e4db60c47cb26f0e736cd4305953294dad8aeb38c4c96071dd0d14072e2dc74f9aff4f655
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZO4:A3kMjKY
TLSH
T14325BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 942KB
SHA256 3cd1249d306bde8e6991a06a684fb480662eb765688d0516ad88dbaf5f3d39a5
MD5 6cac8ca2ec25ded2172144bcef3a42b7
SHA1 0a381c308384dc38d096b18c43bfbaccda177f3c
SHA512 4cadf02c5acc47b56df1f4ce7678634d2cc5ff23e67dacf1501b581d7bafab58eb7bc9b69964bbb64ea105bfec1de300d19bc110cfa25fc649004c56cdce082a
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5Ztu:A3kMjKp
TLSH
T13425BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 942KB
SHA256 76f4f017ca355b3e7dac0289cdce59ebb218b29bb00071344a9d695642b520f3
MD5 cd7f5a6bcdf6b23c46a20911c1a3d0c1
SHA1 f5c788311bb7b572fa0de01a664402a27684bd1e
SHA512 a126a1a9c82833f7e8f14aa5ad1c47ec50005c0f4af19d43262f9da33b1ba09dcd170cbb4c1667830fda6f4a75332306399eb6f2fcf21a45a73dfc05ae44a6da
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5Zgj:A3kMjKz
TLSH
T16925BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 942KB
SHA256 8cae7d756627f609fd52cd3b1c13305261a986937c5a671e7ced929885d870f2
MD5 d1a90bd0a8bf75e81929e69b89352e92
SHA1 ad28ca593a9f049de9227a64c6b35f5ea196f92d
SHA512 fb937b9fda47d6fc469f17e3dc594de71c9dba5438fa0c46cc28df69825f77aec9569f7d6d233565e17f2a98a617db5480172c2091149534094ebd4b515c497c
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZRg:A3kMjKb
TLSH
T1C825BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 942KB
SHA256 e647dc6b4c79160c84c793b1854031e63baad64434b9c1608842a506753cd06b
MD5 6c611ebc79727c8d14c46ec7fa59b989
SHA1 22958e874d75b8431521e687dbff328e703a4ebe
SHA512 7381092d4fcfd69129a735c1ef203071c3e55cc036faffa6285cd0f3780ec8d236b08b92700a1711e688d42d75c8015422995ecc3428441a24e8e0119cb2f4e2
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZII:A3kMjKS
TLSH
T15A25BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 942KB
SHA256 7d7bc98ffee6d05a7234f7c8f26cc0cdeefbe8a301f99f98806d8edd86aea76e
MD5 f13802422d2fa45c6d7135cc00967ccf
SHA1 d1cc792be35dc14d82236c3d580d497a3abc5c05
SHA512 e6a61d5f7c30fe69267359b6eafa4d6d610eb925eca770abe028f2648a17c46ee701a7c3b89b69a9120801401a997e36fcc4b7c27aa889e353efd16e5da9f7af
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5Zqo:A3kMjKw
TLSH
T1F425BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 942KB
SHA256 b85902b25b870c6e704eb84be4dafc7e644c6763e74152ab07762ca2dd8ee7be
MD5 8ff633b2eb695cde58cbfb95c9687c74
SHA1 d013334b7acc58b70b2379e6870a8ec3c455170b
SHA512 4a1bbccba052f1b51e7da67f17ab1979b23ef1d6887e2fd75c945f9bd8f93be1f6a1ffa1e0f750691d09b9b9e652fc306b541bacf31e28b7468c153c0b954ca6
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZB+:A3kMjK9
TLSH
T10425BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 942KB
SHA256 76abe4a1bc9606c50bfcaa6532e78a6c4ef9b1688e753a123604da6c00263887
MD5 1217774f400c6b50b2768d47452002b3
SHA1 3d60344d57afe3228dea3ba29a0faf4d43ff97f6
SHA512 02af62b2e99e432fc6a8d2f1a92e152b687dcf1c5523692b759ebd4b89e34b533e3e29736178ce3a4b9b28f38f970e755f4233f136d37adc34fa30492da519d8
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZPQ:A3kMjK1
TLSH
T15125BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 942KB
SHA256 aecff415440db4f36c75aaaf292d396d86f091d4141700ce7a43e34cca310d35
MD5 7aebd3cc908ee5d950e0d73b45060193
SHA1 84b81e8c008cf26d1f68de7b850303a1c2259707
SHA512 a09df3962fdc016c1703b9a5df698672cbb05440e483d2d88c3a41a5e2e64677845e354ae85251221764d2d922900890e3c049e90e473a703efabba8fe29d3fc
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZUX:A3kMjKh
TLSH
T19225BF03DBA404E5E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C0BF3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 942KB
SHA256 4a96f0bdc89010b089699b705a056fbb6fa18bbce15a6eff047403dd9feaf10b
MD5 3b554294ed2c5f6bd732de72cf330031
SHA1 8a578a0aaaffcdcb5c14d87c8f16ef09bc4bbafd
SHA512 5cc3aa3fa10656099c01bbf86b4c132d58d851c0071654b021f685fe5920637be94c96994550737d315753b49b144d33140a0251ae57a46e2a0b6fadadda368f
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZyL:A3kMjKr
TLSH
T15325BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 942KB
SHA256 0c71f36e847122c45ad440b483cf77cd15f24b3e7c7b0b3fc47a735e5092798a
MD5 fcef70c57980feb539e8261aae54c4f3
SHA1 037a1a7bd04097744714788ad7471c4a5111c23d
SHA512 1b5149f054979f9fa1546ebd60bad3c0db0a4febdea0c3c028d9c6d415a5e9205403030fc9685e46d4c3e42564cf0df6ccb6b8493f022f952d73957bd1db913d
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5ZWM:A3kMjKm
TLSH
T1FB25BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 942KB
SHA256 5db3858cac153c967aa3aca24f3089c690b4bfa02d8580debffeff2a716b3a68
MD5 aac69acffd70dffaa6679f7eca52a4cd
SHA1 a2d72aad67a7ef9fb39694025fc6a3571d6d10b4
SHA512 f0e2e2f95ed642fdac8a437d865f951008bccdc3cbf31b7627d79adfb96b2b79eb2a73e36e0637c54fc72347356467c495cdb6cec13c0b67592448d43ed649ff
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsa5/J5Zfh:A3kMjK4
TLSH
T14025BF03DBA404E6E51A8630A9E54612EB75BD572B60C7DF236CC2152F627C07F3A3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4120-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4120-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads