33b1599a21c10aa059de30c14b36a739eed538228c9b58aa75c0d6aa2ef855f2

Analysis

max time kernel
105s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 926KB
Sample260729-b5bbhaem5v
SHA256 33b1599a21c10aa059de30c14b36a739eed538228c9b58aa75c0d6aa2ef855f2
MD5 1bdb71f9b398d3543ad57570a33d9132
SHA1 e931bc3d4e75039b1425c78cd5744d34451c2ada
SHA512 de38ad842c04ed9a6eab20b54bf6a7521fee64f3e8babd0f50424f12b05dca36f395557852e4ea1e1109dbb68e39677b5bb9fa73a27fb4b6dc748e00bbc003e8
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGl9:A3kMm56rn
TLSH
T1C6158C03A6940FE5D11F813499954666EB737C125F6087CF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/5904-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c525-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5904-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/292-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb5-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-572.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-671.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-825.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-856.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-978.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1107.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c525-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb5-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-226.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-263.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-444.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-493.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-572.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-621.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-671.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-733.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-782.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-825.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-856.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-875.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-894.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-907.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-920.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-933.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-978.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1009.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1052.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1107.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1138.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1175.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1182.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1219.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1323.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1343.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1368.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1381.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1403.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
292	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5904	2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
292	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_1bdb71f9b398d3543ad57570a33d9132_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5904

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 926KB
SHA256 33b1599a21c10aa059de30c14b36a739eed538228c9b58aa75c0d6aa2ef855f2
MD5 1bdb71f9b398d3543ad57570a33d9132
SHA1 e931bc3d4e75039b1425c78cd5744d34451c2ada
SHA512 de38ad842c04ed9a6eab20b54bf6a7521fee64f3e8babd0f50424f12b05dca36f395557852e4ea1e1109dbb68e39677b5bb9fa73a27fb4b6dc748e00bbc003e8
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGl9:A3kMm56rn
TLSH
T1C6158C03A6940FE5D11F813499954666EB737C125F6087CF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 018918d33b6962914ea792ce602b3216397711a7319b304b48a959228eabf1cd
MD5 5b1744fcb2ca85179ce5a2ed15f28a37
SHA1 d8f5240f1932ebf8091ab443b24dcffb9f552112
SHA512 d00d23b33dc8ca12293c5c37d70c0310897f618eca224f207dc35b7d67497e1a51c63bb07e6468a6d3d36053fa366f4f0bae1a22595da3d11adf5d41338cbb64
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlJ0Le5ji0hmxNrM:A3kMm56rjPji0Aj
TLSH
T1AE655A16F6A44BA5D02BC174C9D2969AEA733C425F3087CB13549E283F237D19A3A773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 941KB
SHA256 92c67356cc920e6b3210c05ee85ae7fcd2a9dc645867c015d6d1111582fde49a
MD5 fcea174472f9ae7c62bd2f3414abc24e
SHA1 a2d367b1eee2c40079f64e8f4b9efb7e018ae7cd
SHA512 7f0af9249ab1606c75d0cb891f92d4326f60ef47310614ce7509e1d3d6e5139dcf773b621f4d433defa86fbf2e1a2585ae8ccafafd2e91b12915bf76814e602a
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlba:A3kMm56r
TLSH
T1D2258C03A6940FE5E11F813499A54666EB737C125F6087DF1364AE253F327C0AE3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 974KB
SHA256 ae08f304378654f9d4038a056692dd9648332b268ed7888ef2577998fe0a5652
MD5 26297c7a74bc8d15cd577e80b6ea0d54
SHA1 f74fa5ceb91b1933b9b5f3fb47a3e22b4bb03e81
SHA512 8163c5de27d073c1b809cb33b3496b00618cb245159bc1bd4532e59104ecfa9ead3d9826b625592aaf916f4b3cfe113d45c6f47a1d12b4d44cd6206324e5f55a
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGl4b:A3kMm56rmb
TLSH
T18B258D03A6940FA5E11F813099A54562EB777C125F6087DF1368AE253F327C0AF3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 950KB
SHA256 373de2961067f42787f1871393ae951fa1eebb1c5d0b4f2c5f52777e663c14a0
MD5 6cb041169551c1b65a43e9f632ef8612
SHA1 7cf4e41787ec89cd1487449b5ed86edb6c32996f
SHA512 14f6acff1e96f5be405abd46028767694456baeb1b8a152e940d1a81ec65d4e1348571f7a44932b6dd7a6696ce181c165ad1d3a26d5c7a185e367f2ef174763a
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGl66:A3kMm56rL
TLSH
T1A2258C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 950KB
SHA256 41787e9fe719eb0a24fdf9caa467902ac23d788614624d6d49b67ce8b41c9cb5
MD5 56920ab5eb2b13e1e01026c9f6d5c4f9
SHA1 eabdd3b41eeb4bedc5f3722d18b9a7ee1500ffe2
SHA512 a8370ad2e34340776170c3702bf49e78ae7014ee5e7d72174b51848b6e6e050779885fd4cf6447282d5ff319e90c924ebf4b9577e64df042e53f2b1bea15c2af
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlyN:A3kMm56r2
TLSH
T1F3257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 950KB
SHA256 df76731f936e4c6e76ed4646b83802def9cbafd2116742625ced9e97fd2f717b
MD5 edba5097098322501bbcecce5e8906c8
SHA1 2a6c78a4b72aa19f02cc67afda07646a9df6dc68
SHA512 20e3e5aeed1de4e5eabe625887d7efef007e35a40fcfe6fcbd8cde6018d7671d65d1034e54e1e0915e6bf1f2a517ebd9045d27c07aa251e10732726b1466f418
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlof:A3kMm56rK
TLSH
T104257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 950KB
SHA256 45b739d1357ec6dc314d942e92ecb0cb79a11c208a10ce190cf269fc5c28fb7e
MD5 6a9cd5fb5d13c80d656b8ca35f15d7f3
SHA1 69c4cd6665fc3df5612f9c881558182450dc6a8d
SHA512 cdab23f6d1056882cb8d1a27470dfcc23371608d224b6b69635253fa11d5b51c711a83a19452a850e334dd0258a9e92fd1177909664fe7a4c9d23ebe871f2958
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlCo:A3kMm56rT
TLSH
T197257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 950KB
SHA256 d5aa3bcc830c607585df11e0ed544e55debb09cba1883f871855f8c59be58026
MD5 6cf66232a2756b446db0fcd00a25cdbf
SHA1 a1caa895157f7aa1fb925f6be3fb1de3fd384578
SHA512 fe78c18a478dbd1b5f68527d270dc91e0e40520548073c321229c121ea2c5fc860b73bb531cb2621fad9503cec75e59d2c4bdedb88a1a491b7bcfbf2a8670ac6
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGl2u:A3kMm56rF
TLSH
T182257C13A6940FE5D11F813099954666EB737C125F6087CF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 950KB
SHA256 c912fa785fb06c908c4adbb96d6934e082057f202d51ba152484e007e9239db2
MD5 5cc7d5c6701d6dca1d90e278abefdb29
SHA1 2143a5d705c01a6e53bf2630bc8a4427ede6146d
SHA512 1d868c54692bbb5099728b1192ec6c018805026f900ae7188e0723d6ee519e136263e20acdf7fe5d6f7eb468f7f3b781491e2fb2d9ce1c0a3f283f493be261aa
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlq9:A3kMm56rw
TLSH
T1AB257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 950KB
SHA256 c1e862cbae440bff8d3b836b6d8e9b657376a557d23a62942c26f7c523dcc685
MD5 58d62c8d28f96c5ee3e6d1c57c3cfb1b
SHA1 4e6ac0f2c0a46c6c0f856c44c739df2be6291a7d
SHA512 a8c19d0a7ecfaa6124931cf5c361c825065085dae1b74c18cf7c32a14ea8c706687ded0decba4f483a57505c00c6beaf91f08ea8334712063ff24995b419dc75
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlqc:A3kMm56rh
TLSH
T1F3258C03A6940FE5D11F817099954666EB737C125F6087DF2368AE253F327C0AE3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 950KB
SHA256 b2bbb4243ce3f1e4f176554d4ec21cab89b0b0958d0fcdb847ca60ba0d58ae59
MD5 6c3868c1468713947fc3903678444d42
SHA1 c89fa6d4305465db3f2bf56f469ffaeed108e06f
SHA512 bcfb178965421c55033110553ba3667a3f5441f9c5044f445e6114f5b04e7486e4c1922272364831d4342229f4d2cef7fca6f7be4247f27f434a4de4599da10d
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGljp:A3kMm56rf
TLSH
T13A258C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 950KB
SHA256 8faf72b951cb77c9a6c702d0b9b0d6d517bd8ee21344e889692cac3637dd6a43
MD5 4f2404c6784c7d093b484037c99aa1f7
SHA1 b0eaa35bf34c6c97729dcabafb3330b4ce1c2207
SHA512 79419728b39f4a969b2f2c6850dccdbfc47c8f12215d47430ccfebdd5fdc94589d48958e2c799b23aaacc93b60ab70819dbccc4e492ddef0cbe32aa8cbb7d934
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlEN:A3kMm56r0
TLSH
T1ED257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 950KB
SHA256 8614ce4270842914a71fbe233fa9a28ad108aa34dff7f7e6b495c938227fddba
MD5 04ec2cf3edbea9394dbf4ff65512c3ba
SHA1 323929f7120dc2954de74ac2cdeb2b7bfb836f39
SHA512 d8a0a3b9e9bf6f670269de53a26b1b891cdaa88e51f0b0fb84df36d83e1b2594524cda79c479d0c27efc8bd395aa156014a55ee3005ed17586023efe66f6e929
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlsF:A3kMm56ri
TLSH
T189257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 950KB
SHA256 dc19d1fefe26e0a43ff1e2b6f3b05239bede0f93e5ca89b5affb8afbae921610
MD5 aeb28931d965728eaf6c659ee6236d92
SHA1 08bcb4b1831dfd782ff9035fe4dbd323261aa568
SHA512 fcef078dfbd7e862a12c12914c9d2818c71fe66aded127b915ba60d00286ad640d3320f6633a716e2b12f4bd63a18819ca46a37d3fab5198229c7ed4b934ae9f
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlZC:A3kMm56r2
TLSH
T181258C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 950KB
SHA256 ffca7b1c57b128f73085054bb2113d7196479376ee91f898dc5e97e5ba583644
MD5 6112c38c8ae0793b8833a797f80071c3
SHA1 74e40b5bca297d915038aeee91188b445171e3bc
SHA512 c18d86025dd8d1bf077fa77f822185555c925b5b71a1a5ef8eb0c75c5a731f849ef384dceee96b317561c653ae8a3fcd70eba839181eb6240ea8a70809aeb656
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlaw:A3kMm56rj
TLSH
T1CA257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 950KB
SHA256 203bebc6aaa3ca19bb6ff70a6cf6561aa64f1556fca289192733d12cde56be4e
MD5 45f910c35e05217651f56e6b9eb77cc8
SHA1 920b8b4d7ff446b41c6f95e1361116bf04e52aa7
SHA512 9ef15ab983d4ee67df7958446c31ca096989fb59a50468fe6cba03f508f18a8178f9aff2beff4c6de4c3da0bb6863da6a6e11324a610736657657dc832704a3f
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlhT:A3kMm56rv
TLSH
T183258C03A6940FE5D11F817099954666EB737C125F6087DF2368AE253F327C0AE3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 950KB
SHA256 cca00e9bb81af71cd36838cd0dad87c9a8f06f3e42b24f5510d271fa0036c319
MD5 82e4056685781d2ba0438753abb426ae
SHA1 c29025e9c0273c63435d7c33a6dfdcad0336deb2
SHA512 3e9e995aaac3c73f1ba9a16fc32c2bbb74efe3a278286fee27e7e191953c5301d1c819d1e7fb053cacd9ba7073566683ebda07b7c889764a480288a923215e1c
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlPu:A3kMm56rA
TLSH
T122257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 950KB
SHA256 7f03db604b6900f78a828e39b8a728b44571ad3d7a1e6ae8526a2da01e88d0d6
MD5 b0be298aea353b86ada56aa53ba29be2
SHA1 52ca5ba00ae86f82342af3bd39702eaab53ff1cf
SHA512 fc4fb08e527856d5065ba98bac5d98306b8c87b52437e6a40b7de47ee596f2a46d4bae70aeaa3f1599b3e3ad8f0c0bd0fd045fce2ec6afc4425d0d2475ca2b05
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlzb:A3kMm56r5
TLSH
T1FB258C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 950KB
SHA256 78a2ee8febaa1c712860cbaecfcbc824441ef49219f5ccd0b9a922827dd295ee
MD5 f702c386296826a1a72252833389baaa
SHA1 f5bd5d6babd32b8e4e63235e0dd2ed7962b5c577
SHA512 2a976c2d28195f8bf5b45b2cada9ef4188a7ed5805a4f53fba3d348e791a7499032e0a0417b99bbf07d5d2c1fb2c09569074b2e5e218a89f67f2bbd360c84273
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlHf:A3kMm56rJ
TLSH
T1B1258C13A6940FE5D11F813099954666EB737C125F6087CF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 950KB
SHA256 5768f9f59c6fabe5941b0dc77f9fa1f188d03f01021df4a620421ca6a95101bf
MD5 6806f428c3483696b9aa2534b0ac65e7
SHA1 64b5448c62102ccfc6daa4a1a97372b28aef21f4
SHA512 004249d053028d79477dc9fa33b56f99e0a96cffe467a5ebe1e6f92afdc170abac7461dfc8305a1ca07606534a5bf8acf5c14a055587b80be58338635ea8735d
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlwK:A3kMm56rh
TLSH
T1EC258C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 950KB
SHA256 b432c37b93fafef9b4394be428f803685f979259853fa0b97f97b57db5a49e3a
MD5 fe3d8cb54c66c49ca7f459f500a5a80b
SHA1 664987559ed556b0d749c52ea9b3205e461cd89d
SHA512 60f8c9a0a843975a5a9d5f7f214b96149482d290f401ee5690672fa7a19aaadd47cc6be8189b3a69de95124d5ad8d9ba70ed8424596ccd81069b259d9bb6c5ab
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGltk:A3kMm56rI
TLSH
T183258C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 950KB
SHA256 18341e80d9a4aac95de573d189697b424e0deea5aa9f22cf1f291a43b7f58d89
MD5 35a0bb573c953af9416bd50d1d54aaaa
SHA1 caa51a5c1e0972e64ccff5b14b6b7e9f1072aaf0
SHA512 abf47c84f4fcaafebf65b74d0506ce3a7ca480d072965387e3ea6851b8aa798e71717af94e41931a28502a1ba7dee0c8ca95ef49c42ed379a0127578e5ea0b74
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGly0:A3kMm56rh
TLSH
T159258C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 950KB
SHA256 9c81185a8ebb1c37f796c4b960ca20e147a92c74d8b4a367a5f670ade8152cd7
MD5 208e371d07157f768ceac817b6c6830e
SHA1 abb7733ec8c434aade365a05cb5c9430da95980f
SHA512 5dbc3345eefe48e4a7c8cf2dd928baa574ebe5df6468a03a151afe9219698a8038bc11f01e310585231c74e096a2af7be3960e3f961c17d14b92051f350db55f
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlBg:A3kMm56rg
TLSH
T1F0257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 950KB
SHA256 919fc9237f3afa0fc5ec3eea9bce9134aeab840505caaa00911c58bc22218865
MD5 103e726ecbd6cc2737d73e31b54befdf
SHA1 1f9e84531d46963a6680694f09eb442e362f0784
SHA512 9b99d4952abc5dca8577ad9ced916877a72d279057ce684979f1bd66ea054b695b841844fbabd2f43f027812678183f219c359313150d9de5b04803a296eac80
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlor:A3kMm56rq
TLSH
T1DC257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 950KB
SHA256 223fc6d807fb5a13038f65b205a65bf57b2871dba63fd0c93fa2e946f675e075
MD5 757b90705bb287296b4d1b80d5f702e7
SHA1 a8fc19e7dde1c790deb0a6689222563c07d68243
SHA512 d749e1b63e79a8a19ec430e764605755dae8780bf65d2da6313ea900c4cb499df1a84c35fbe3a9145cc139c528b0fb36020c63d7105e22ee7ac6d8c3475e14de
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlGn:A3kMm56rs
TLSH
T122257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 950KB
SHA256 006342a8ab8d150116b32646e199933c17b56bb746689f629d3ad4365c0cdd0b
MD5 50021f86f309e0d58cde9e5261b04469
SHA1 33aa8c3f05590b8a944a16a9d11182c34f30eef0
SHA512 4c3b565f2ef3ca8764b261782fc030beaeb75b0fb5da22ca034d6c898ba29f5909908001ac3af0d350a82b60e5bd594726cba55e1d15abc9e984e1970f8d6e19
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlMx:A3kMm56r6
TLSH
T132257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 950KB
SHA256 06d4190b22cd3c3413acef5a13c7681e3876b03570705ec66c7f6d402a9487f8
MD5 24cb0b88eaa9b2f3f10e3bc2f38c0935
SHA1 a176b00ad2b547629fc2f843c123408570ef8d84
SHA512 3a7da177e9d97d9f0eca377baebaca74c3618acc1885b9f76cb9151f3bbeb1e9fb5bab63dc963c9e8a702cd6f68c55d5ce4b055e0dd50de1a2f049b68763e6b6
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlGA:A3kMm56r5
TLSH
T10D257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 950KB
SHA256 aedd2ef4ee9bc939935a246bc56db473a071ccbf9a24afe6bc9b2efd2e75f213
MD5 2685299ad77cc88c595cebd0d1317b34
SHA1 c0fe91aac51021123c53fd48d5f78322da853f4a
SHA512 fa0b793646d3b77e768e43ce2cfe561ad52099c94818cff99ac3ab15ba8f3f4227abf6c594003ddce15728e8aacd8aeb727b78df2d1086a91331b3cef4ddf595
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlf9Q:A3kMm56rg
TLSH
T181258C03A6940FE5D11F817099954666EB737C125F6087DF2368AE253F327C0AE3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 950KB
SHA256 21d8b56d508bc5ba7a1bc0572aba622f8ba2ac8aa88d8b035946617d8ba1b5ec
MD5 8fae49b3b9a6138c613f509e5b04fc86
SHA1 b43e2eba3d8fdb6562b3bb0218b3302a362eac81
SHA512 383a221bd7d7f50714f3386b1595af405f2ebf357a0e200994edb95b1fb10231ad0aec6a63087e2db9006e3f5ac8423031137d89bcc06ef3c60243b62ad76ec3
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlW4:A3kMm56r7
TLSH
T1B9258C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 950KB
SHA256 83f0d3a76147d625acf5dd6fdb281524e68be20241e73d1d7498294b4faefbd0
MD5 a8917dc3d3aa0f78f9c6f069db0b910d
SHA1 f079e61bdfde8532ca6959781c74a98f37752a80
SHA512 1adf4a53618a8d108135d59b239cff48c90020aef7ffeff57f4427aa46a0a9cfb4a4e8877c7864436043fbf0c5340ff14fcd4adef92ae3abe4962edf7ee875bc
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlFu:A3kMm56ru
TLSH
T142258C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 950KB
SHA256 6a9443c5acde863c77f7fd2c2fd3bdd5755826a670c8fc0d034d91febfd6e004
MD5 5ed4c3599fbf27e2b77a64da13a84256
SHA1 57d7bc8fb995f9d9fe953a91605fb0a62bc798b8
SHA512 bd66f19dc220b60d7de6c27c45ad7def7cfc0194406c4a496019acda41fd4076214a045dc05a30adee473f7bbbbd17d8f1e64a72c8fc97e1e663b03ee7cf094f
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlYj:A3kMm56rA
TLSH
T1B0257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 950KB
SHA256 efdf80dcea7b4d0daeb07c5437bde98d0e6f7d04949205ba858cf4fbc5915cb8
MD5 e412ad18c9cc90b41eb3167c798567c5
SHA1 f378ea77095c5bdaeff45f417bf74125276fa481
SHA512 62719ef72974811166a333283dcca78cb07dd494345528f3c6e01bc6e0ab1d2d96238575da42802fb44a5637a5d49d8a818ca6640888e893012ce9fa7e5e1bb2
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlpg:A3kMm56rY
TLSH
T12D257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 950KB
SHA256 4db8ac58d5387f70e37618f0994fcc5a04ffa13dab826fe5c1583d2857eebb54
MD5 cccab899fc2a95389e84f8589be489e1
SHA1 cdde948ec4e7d4acc162ce172698552d3ceb1148
SHA512 863710cf86e7b3eeb7866a126c794ff5f7bfda584ba9e091b52c99441414317750b904b1f655abab74e1b882a1fa46e208c1c2d2d7421df72be8b9699a05c5fa
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlwI:A3kMm56rp
TLSH
T1BD258C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 950KB
SHA256 3b88e88b5214d3c829eb138da5a70e2530f86f1f09a1690bcdce686334495b01
MD5 d94ea129c56bc2437081689d1e60991a
SHA1 3846e1655503f97d1a3da885ed3685dc157570dc
SHA512 7fef49b9a6ef22acc872df85308413f521ac03294c9719cc1c37574a54e295e9b88cfcc9c3edc7e44334315497d9dfa92332737e6a3ecaabeb4c6e99a0d826e9
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlyo:A3kMm56rX
TLSH
T128257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 950KB
SHA256 9ee939075b5c5da32970775f1fce84d40b8a80d6a5469ae7fc8fcf5e2e3b0110
MD5 2299b94c207101174132060b6e150a33
SHA1 d8a32c79b1dbbf701db30dc510334594e3aa45b5
SHA512 b8505ed86c8c1e67b4ccc721f1507663d26784a7f2ac44aaa08f503df06a4fd87b687cb990bd8ec33a56183bcaac232198641bd696082f09323a7b6cef01d111
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlp+:A3kMm56ri
TLSH
T1BF258C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 950KB
SHA256 d6cbf81b5f2558a5fe678d23f2c78037bc8374ffe8578365c9ba9a8a4971e774
MD5 14a308b19cda466fb6771add470e114c
SHA1 6e6136b27a83642c7d6cbbd11a33a9c239682acb
SHA512 dcd2a435cde82376e3ed254b09b97fb9d3883884afa82100517d82fe93b78cbd6545fd05ce72db45a74aee16acabf91d0ca88c81a5ca912b86528a2cb4b5e2ca
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlXQ:A3kMm56rW
TLSH
T187258C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 950KB
SHA256 ed0b2ad57f9b99ebbcf50cf5a021df9fc416f5e42a2881a405a4c2c5a070e0fa
MD5 deca72a21187dc4aee69677b615e5690
SHA1 02cd6d73894d3abf6a9dabbdeb6c4229780e6a22
SHA512 1f7a7edc2b23b5416cc58ae7ed920306a3a99ddb804105bc75f454fa5c96f7388df5560dfe1342c1e735f1cceb450f9011cb924b2203c663f53c5b408c1433c0
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlsX:A3kMm56rW
TLSH
T1CD258C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 950KB
SHA256 992cea1db59da4d22a1fa00a9aaa7e6541e9c6d203bcdf96a7aa4d1b3eb0dfa4
MD5 550c450ea48fa4d8f27dfb00941cade0
SHA1 699a4382ea9878e31f565ca9f4238829d05a314c
SHA512 47e49dc45bd1edbfc733a042d41fcc3e6353431e084896a8505fe78ff4734d4ec0f37b245f86cf0b252664259a143c241306eec20121c91e74f934db018702d4
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGlKL:A3kMm56rY
TLSH
T118258C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 950KB
SHA256 1459f1b8156f817efaea505026a0b084c6a04d659706d0460b3b37e1c82223f2
MD5 b478cd68c1d3faf32e00479bd973ebca
SHA1 456d465f4b2b00d777174ab3e703acf54f3128e4
SHA512 9ad7d779bddcf3cd47df0135192a1699af0bc926f4514fc14f86c4f73dc257ed865557c801d74110b615deedd3a19e0badef40c54d65a4dceef7ba7e23eaab75
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGluM:A3kMm56r5
TLSH
T1AE257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 950KB
SHA256 58f2dc720719f818c3b47c1c6e4070b101687fb8982307fa4acead04c9f1fbad
MD5 0440e4a8e9d6f593b259fb0401c256e5
SHA1 ba81aa35e50aac56f1b732abb18f2f5c3eeb1387
SHA512 a2ec056df5d7747200ad628f889ffa0dce2d8ae999aa435f4548971c7a8518a68da4d635be8896b7d8df73742725e4972dd11e4280bf7dd68cfcaac687fa316c
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbohdkEEaoGl3h:A3kMm56rr
TLSH
T1B5257C03A6940FE5D11F813099954666EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/292-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5904-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5904-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads