14fba6e8324a978f334792f09d5445093c28c46d77d4fdf6e38f543a44aa107a

Analysis

max time kernel
93s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 946KB
Sample260731-3ewnasad32
SHA256 14fba6e8324a978f334792f09d5445093c28c46d77d4fdf6e38f543a44aa107a
MD5 a57bd5b1eb294b33b12fc27b9c661860
SHA1 769f587e98b6a65675ac45efc640cb89a7aa3dbc
SHA512 c09a5df6b32f0c582afa7b4146f4f2275fcbc21902c3c00faa555aab6ece8d457d2c6668053e0655f391d9c89780687162d8f044c78b97b61be2a410f80ac6f3
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVF:A3kM/56rsA
TLSH
T17D257C07A6941FE9D11F817499920A62E7737C265F2087DF1364AE253F327C0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/4992-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c557-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4992-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5024-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00060000000198ec-458.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb2b-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198f2-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-708.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-978.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1065.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1245.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1350.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1397.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c557-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-57.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-259.dat	aspack_v212_v242
behavioral2/files/0x00060000000198ec-458.dat	aspack_v212_v242
behavioral2/files/0x000400000001bb2b-495.dat	aspack_v212_v242
behavioral2/files/0x00040000000198f2-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-623.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-708.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-883.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-947.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-978.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1041.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1065.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1127.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1146.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1171.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1178.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1245.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1324.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1350.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1370.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1389.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1390.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1397.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5024	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4992	2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
5024	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_a57bd5b1eb294b33b12fc27b9c661860_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4992

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 946KB
SHA256 14fba6e8324a978f334792f09d5445093c28c46d77d4fdf6e38f543a44aa107a
MD5 a57bd5b1eb294b33b12fc27b9c661860
SHA1 769f587e98b6a65675ac45efc640cb89a7aa3dbc
SHA512 c09a5df6b32f0c582afa7b4146f4f2275fcbc21902c3c00faa555aab6ece8d457d2c6668053e0655f391d9c89780687162d8f044c78b97b61be2a410f80ac6f3
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVF:A3kM/56rsA
TLSH
T17D257C07A6941FE9D11F817499920A62E7737C265F2087DF1364AE253F327C0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 d0fe4eca9cc0e4e134014a835472056c77858be474f8152d9f6a960a4fdab9ca
MD5 0542ea3aef1582ca7a6bad584bcebb98
SHA1 2190ee5aebe6b89400bb620854454a53b821a398
SHA512 f3a909af770273da87a5f54686b3a752310750d7c83e967b4e6c0db91a334649b316ff0edbad9e3ccc3fa6bee4ad8773ea87ab9f8fc032e0e700521882f34a5c
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVY0Le5ji0hmxNrM:A3kM/56rsBPji0Aj
TLSH
T194654916F6A44BA5D02BC178C9D2565AEB733C520F308BCB13549E293F277D19E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 961KB
SHA256 cd21048e08c4525a49b17098beddbff219469db2448768e9445f4bccdd2a1436
MD5 56a9604fba8f175d70c952fbde0ce738
SHA1 118d67962de4d3e63ba2442307932ca0942f1822
SHA512 ae011231e50a245441bd426eb21b86f79ecc93456a25db889055a2e009e3cc9e97e5460157b2576ca6b54e6a0ba5404a098607f4121f0f26dd849ac66318a476
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVia:A3kM/56rs
TLSH
T1CC257C07A6941FE9D11F817499920A62E7737C265F2087DF1364AE253F327C0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 970KB
SHA256 bcac780d0d8343d61fa65e03a9fbd9a98088e3ea3a4073cba78a57b24a4429a7
MD5 21d32c846969afcc6bb1ab7199ed9f37
SHA1 8cad374943cca124c7f42f0efcc95efcd2ac4e40
SHA512 dd7b2bd580705ecbb7fbd309ac4543fb46657bd0d677dc4f30a7312b583238693dc8d2f6d2be6d27cf887c78ca1f7064cc42c53bc0ce9906326bd8658a65c9ff
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVT6:A3kM/56rsN
TLSH
T153257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 970KB
SHA256 43abbbacc187f869b674435c7592aa1d9e50a9676f81fa479438d1075592ebfd
MD5 3f35be84d9a902a8c66de20641f6de67
SHA1 550a2ad74f573ea39a24c287bc14aff3aea6bef0
SHA512 d99f0cfb7b10483577cf71fc8d1feeaba887b1db719df62147d559be7cd9daee3966d850c8598293c438bf74fb8e0158d87bba4a292cc9fa4e556fc873229d2c
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwV9o:A3kM/56rsB
TLSH
T152257C07A6941FE9D11F813499A20A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 970KB
SHA256 f525f61e1f155a2d20b4a00f6cdb87447188a1b057cbbe5fed39bcd390fe13b1
MD5 4052365c8e3b2bf6de13cb8fc765b5c5
SHA1 4a9cbb83266ea3f2fb0f4f2b7aca3bca878967fb
SHA512 ad71093b241421b3ed560c225d41babb0260c519ddce1800578cc5c2d01119fcb6e312c643b959238e5cfc86b5d4d29f17db82edabdc608a1bb7e7867cce0b6f
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwV9u:A3kM/56rsT
TLSH
T186257C07A6941FE9D11F813499A20A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 970KB
SHA256 24e9043d0f86d7c6462f94dc32bc7dda7d2eb5b9ecc698c649c6ee64993e9716
MD5 39446dab2477dee2c3bf2b71286cce59
SHA1 b776e4c62c4f405ed9c0ea086c4b6b84656737e7
SHA512 2d2113f62bb27564aa6c00f25f8efb9eaddf9a07118e658acd575a5ce3314fffb2e77d9afc8745a4d339f5aaebdb8ace60c615367028d52bc1aa4a3bb18cd255
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVT9:A3kM/56rsS
TLSH
T16A257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 970KB
SHA256 9f72f859ba234c397c9a1a1ab0cf2fcb89b463cf85c82d7a36056c9b07e94d41
MD5 4b504cd845582507a2f0d9b5789a6712
SHA1 25c3aa429494a5aafb4f0b08278f26c60ac3bf6d
SHA512 be24bd46fc7940f569b592a12208d757e74e4bbe390eea07395ecc9b78459c6730029c241b5a0aa2bba5a09c771b7ff14b56d1cb6064dc3c6b957a90221fa496
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwV/c:A3kM/56rs/
TLSH
T151257C07A6941FE9D11F817499A20A62E7737C265F2087DF1364AE253F327C06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 970KB
SHA256 82f21a4657be7b581a8a26bac739601e093d5f9f25d54a7e8f71877158a54078
MD5 b199223c4ee4aedd1dd1e927291b394d
SHA1 aa5b2a12e5004f1e9dcbaa133cecb4bafe17207a
SHA512 843867e89845a90f697420fbdf03df5f6a90cda71f15e4bf2e5a17540bfef894beabe8f499296ce2df9f0a9f53883559469285e5a40132a75ec826f138b4ab2d
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwV4p:A3kM/56rsV
TLSH
T1C5257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 970KB
SHA256 03646a0eec401e4d8193b8deb4d23ec743f9f0759c50af9c5dde0ef99539fc01
MD5 c81acf3cebec2718e1e80678b56570b2
SHA1 3173f9cb81ec975069320f404251c58ffcebe7c7
SHA512 653fd8431edc306af48e823d72251d17759b5d85c956efb4f80e1ee131b62ebf47dfae69bf2f8620443e3d0282103dcca3c9fe5047bf498ba3336f159d9bb3c0
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVPN:A3kM/56rsu
TLSH
T126257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 970KB
SHA256 e1f1f633b719717175f3cc7b65f1592f40b67ab703be3e463b02d27d5763a6c2
MD5 f92b56bb81ab9612f95594204f6b86e6
SHA1 97642ccfd46e178dd8eb0f31f6c098984d77bd90
SHA512 3da1d4afc171bba230455f924bc4d5f2c50ee91168ecbe85e99f678a8c2aacbcbb20f90ffabf3b342e1336525946c3b9d8ed0350e7c9cde4a9a8b0048919736e
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVNF:A3kM/56rss
TLSH
T18A257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 970KB
SHA256 e8e3f464e55605d1d978cbb566966562b27fa67c6be769ed50757be90cd0d064
MD5 aa0a473cfd5eab53eba0cee7594d814a
SHA1 7c0a7eca98d46a2a8def8559373a5245dab237a1
SHA512 45176134ea7b566c385504a23cc88dac4622fc671f2b7068aea0028b1b0f7aba1cbce80e81de6765c32eca0242eb0f1a7470fff4f7c7723849108443ebcdfd74
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVeC:A3kM/56rs4
TLSH
T113257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 970KB
SHA256 e1d8138ad39ca21c621e8b67740071955bb29976bd201d97a8aa0f78fb818734
MD5 d328b6811a8567333a63d3a702094df6
SHA1 23411514eb2581f406467112fdd74438f76ad31b
SHA512 7a58a7b9e14fab836ea9a264df391a2db72fd64c6eed15345c29e19ba91003c932a14f1c61a823d06ae70978691f0563e663b8428c8b5867b278dfedf46c6951
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVBw:A3kM/56rsV
TLSH
T11B257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 970KB
SHA256 211ea791b717516b35e35f79c2c52385c6427f08321e9ad8d592963c7589cf18
MD5 96872a5b4f15a1a6d87f03bb727d389c
SHA1 c155606611683c5bd47bf2e818a2857eef0b5851
SHA512 026bc2c32bd8d85b854e178e4156b41a36c4104d613b40789f60be67f00712a635ce4cabda797e4882cfd8a39ac81dea8765b44ba20ba441e584be1030ad16b6
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVoT:A3kM/56rsJ
TLSH
T12B257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 970KB
SHA256 bb11f6c26d1824b8e1548aa685c63a0f2004ca5e40c6dda47e9b6d8b066e2013
MD5 cb00571612fec887f8e7e7bd2e722620
SHA1 92e1d652ef8210621b2f5ca884894df573a1ccb0
SHA512 d0be65c4a98f4598e5ce79e47634d8a62eb814d0d6a38ba8adb6185052425cc7c40edc3fc6831c15ece5b3559e66c9fd8ab33cc350d4f4f16404700dd5fbcc86
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVEu:A3kM/56rsO
TLSH
T111257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 970KB
SHA256 9ac1423fbe986d5ec6dd6ae382e2806a3b6072c990482c6e0140e5575adfab63
MD5 6829bead7d430e72f58480d912efe425
SHA1 e76e149989e89ba4cac073d93eb9859f1ecf2a35
SHA512 502129e98db465b9e0c00f962f045f9d95d27ecdbdd836460fa1fdb8e5748f4317c237664c34d11ac4225e62d904a9669b7ab346488bbae0308624f196c7bae3
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVyb:A3kM/56rsP
TLSH
T174257C07A6941FE9D11F813499A20A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 970KB
SHA256 3c9e7f3393f91c2eec74fc66ceb52f8e9825ae94356bc0203831de8d110917bf
MD5 5015ae19d06fd7ca0b5485edc0afea36
SHA1 62cd51e9090de4fe0908cf71f6dbae49be8869e5
SHA512 9704a2fffe1ec27b51b8ff2d14f0db397e67a2fc3128cb36ca5d0cfd4899e913144caad7a19dd84b6c107716ef23cab1ea3244fc9f3aa552d2342eac182b24cc
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwV0f:A3kM/56rsH
TLSH
T105257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 970KB
SHA256 d561c7bcc6b79a731d11aece46c59d72a2194b01a0d066837adacd87ee9e5986
MD5 015238d7b21e93f50220e1fb93d9537e
SHA1 f40b39338a0b915d1e15872bccabb8ff7cc63f45
SHA512 7b3813b0bf07f3cb46f806b642459aab68f131822c7f56c758862f1db8793f020836a2e28d56349f3f73111acf3077f98a806d6b026b6a07839d8ddfce9521d2
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVxK:A3kM/56rsH
TLSH
T1BB257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 970KB
SHA256 576703f9a22bfac30e6f7542a0dc826267dd0bb5b8e2622231ec014477eb3271
MD5 c34df2bd28ead092e1eda784e15dece6
SHA1 d7969752e24b22500544fc5072b0b98964dc83c1
SHA512 e818f579a12e05cf924b3075f87147aea27b123cdf0b04e70148d05a21e6a1a88d34c1f680d1d4a8048e34b33c63f5f5695b85f4a1fadc16f1bd6cf9a2bcfc1f
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVqk:A3kM/56rsi
TLSH
T100257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 970KB
SHA256 03a7a8f978fc1a569a9448e18d186ec6e98d2dec491875fbc44be686afeae65c
MD5 0322470adfec265e957d6786d9e7fb70
SHA1 5b88f08701942a1eb3be5288c2d7951c55917353
SHA512 da4f89f3953bf880dc5d5e19e854dac6d0b11d5039e59d51056b9463a63e573dd579f933a94e8a4955501d22b550529e47751ed51474f84c4fe5a0774b52f872
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVv0:A3kM/56rsH
TLSH
T135257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 970KB
SHA256 eb892bed1257f6131555913f71541dc4c0735c408e63fad7c8d8ba6f0a5be9d7
MD5 626d385b10fa887df24d7a0511265034
SHA1 69257c67d4ecd95d8be5431f81e416feca8a743d
SHA512 f7ce0b0ee1706e5fd9dcb8ae36b4b3d7a50836a08a00d2b69df04be0544923f19a64a6892189b4ec60e10e111dbe7573738dd20686952099a8c5a619942d6c9d
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwV+g:A3kM/56rs6
TLSH
T14A257C07A6941FE9D11F813499A20A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 970KB
SHA256 ccf473e170f52bc9fb21559a67f5dfb8fb0fc04fc9354b7d8bab4f4190abac58
MD5 474567a63dea877e786270e9e60e2b47
SHA1 a42796a75603e54be50f6c26da0e840e6a6b1a48
SHA512 6b3bff8d6059bfa47c0a1875a7ad61fd050e86009393af0d19cf19ba3d760c7f7bb69de0ef3e4e25db7ed34276154a15519528ae398f7520469f5090c1d6d214
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVHr:A3kM/56rsE
TLSH
T1B6257C07A6941FE9D11F813499A20A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 970KB
SHA256 fa06e9f7912ae28b85c0aa1f3292f84d84a778513778d449587fae7af816353e
MD5 ca7c4dfb14e4d0177dc6f77eb7c1f298
SHA1 2a54ebb857bf19c8d2b1446e0fc94f62744c337e
SHA512 046836ffcffc0c415a21f7df2675e33b876bfd316c456d893a9c4db88b72ce528d81d8a85e4ee9b3947fc09e3f6af3504eafdd3898634db5b380f5787d9ea5c6
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVRn:A3kM/56rse
TLSH
T1EC257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 970KB
SHA256 fd74cf39604427e1fd6ec50f9c58a20e542819293492309fd4943fa1bef2eea7
MD5 0fd6ec4d4515bcb4af57fd9b8bb9596e
SHA1 b9d44e725adb71b508d1b49b777f2c3e8f32d627
SHA512 e053384d0c91e555c2c9be4473378d111ada06cc61612b17303b6325c419879fee704993530eb91c12bd95327192062eac4f54cc22af7e4510146f683d6496cd
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVdx:A3kM/56rsE
TLSH
T11D257C07A6941FE9D11F813499A20A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 970KB
SHA256 ee53ce8321d517b01b999ada84e00dd78d9292c7411c7787b5f61617a41531d8
MD5 6f300ec2770bc6facf0c4d9a83a9f84d
SHA1 750373a9e9f109fe9d9c79b2581d4d5d026ae418
SHA512 af67a52c68df6f9dc44f863c40bbb885f04874b0baf3fc408ee8be18c6dbe8900813a742bbc88dcf58bf2f640dd0ce06156ae5274c65b9e5979a51a27ddd2222
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVjA:A3kM/56rsv
TLSH
T1CB257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 970KB
SHA256 e1b757c2e4967fa59be26287b92b466dfa01972ad993afc3ce48fda0f812f2fa
MD5 0746fcebde0f9ecd33eb7580b511b210
SHA1 d52b6b9aa8d972d491809fbf6389b3548fca0251
SHA512 5a858ca3183247cb42cd79825e80614b4a1b531fb1bd27f777c8a8d621da8b8b628b52c0e627c7cbfa579a0566da6a58406ac1eb042b16d6b0378b59a25ae13f
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVU9Q:A3kM/56rsi
TLSH
T19D257C07A6941FE9D11F817499920A62E7737C265F2087DF1364AE253F327C0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 970KB
SHA256 bd33e4c8ef03dc5f75bd623b96c6ca3cbb6367335e98b97ff2cb857708f6e522
MD5 630445f81cbc8d45af4c0b3998866c2e
SHA1 80fe7b01524c4eb7ff93e7a785961f390f41e201
SHA512 1ffbd74c84c32ffff488c3679063ed5345cea8c3621425431430c04292d3144ddcc00096de53b51e8f9f932d6d9768360d5d4b5ea216e19f9fba05d9455750ed
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVN4:A3kM/56rsR
TLSH
T1EF257C07A6941FE9D11F813499A20A62E7737C265F2087DF1364AE253F327C06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 970KB
SHA256 c652b1565428164a2a74ee9bb2118ec06c8f534aaa87c216fd15fec8d5c17eef
MD5 e3720a5a50629951104c75f0102f1c92
SHA1 dc1e9292438006edab128feb404f86a0a368dd9a
SHA512 c3eb16079545930a7148aa76fbb1ca417e22a045e375ae38fad2f663d600c2621449abc22382b54e9db2a9b964f5b4c966b004be90a3c8fa50ffe0a1bf7da212
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVIu:A3kM/56rss
TLSH
T1C4257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 970KB
SHA256 abc64ee8d4cf6700909d671fbc085ab041e86f6650e9043494ccb920b6a172bf
MD5 77ea344b515a489a9fcd5833beb7842c
SHA1 0fd320ce10e6f7da32db836b23401697cfdf12b9
SHA512 058a45d5bed6c0ae4c1a2d1c064411681cbba79499d96f7bd2d5de2e48c933a72a9f8136db8a5f503e659358d33cdf1a4c0c636ba8a7a0df992d507ca5b2052f
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVJj:A3kM/56rsu
TLSH
T10B257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 970KB
SHA256 4f23ce3506af52cbceded8b8ca36970684db7647f17f07eb1225e2f34eac3157
MD5 78d92f18e8cd51a2772d790f145a0856
SHA1 22cfd42a337bb429443e8e3e43dad446e9a8e470
SHA512 e22f6f7028cac7839b4b71472f06b52be661f0ac53784afaae77d80a3a23da577793ec0f704606b8c2a8930bc466de2bf17b39fd844f47e462a8109703c128af
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVQg:A3kM/56rsi
TLSH
T18F257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 970KB
SHA256 be3c0e25b4e2d8791b40b783188081cad4aaa13bc64542ca64a180d62cffc706
MD5 a98deec7562843ebfcf4dab30d832fdd
SHA1 f51679d402f9c7714cd72bebc56381543864b202
SHA512 eb794611ce352f5ae11effe61c3ca1109be668609a56075052ade4b9c0237aaf1230dd30c1c0b3ba7a2fca14ac9b874d198ec956fa428a343e07bd523655c8b5
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVfI:A3kM/56rsT
TLSH
T1C6257C07A6941FE9D11F813499A20A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 970KB
SHA256 a74fbd12a9ba02f764ea7d290701e4202b4a79a8f26c495899f09ae200223d7f
MD5 966bad477331166a51a6470151b3a7f8
SHA1 0ae9a4738b7b40cfb9c33818954480ef7a194e5f
SHA512 a775dca58f17c2a2624970aa43ca32ab5d52341277d592e33d5ff695a49f165232da7320d40929df258c7f5297a464734ae69e17e5a64ef72f3ac3e991876b35
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVFo:A3kM/56rst
TLSH
T1FC257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 970KB
SHA256 e32a09a16a61a0f5e12bbee397e4a5f721d4b01151934a6f20189a0e715302db
MD5 043142a90b25606e23ec5565811b1474
SHA1 ae019c39d4c7eb1c33f4c807c9d71e9667134afb
SHA512 31b79a539b8563c36a0346eb343a9c06f7872dee91bee2bc9e7e659836a5aaba0b3817d1ee4b1981d40169ff0a2c6942ab872e4c85c139b2440c100425801c1d
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwV2+:A3kM/56rsI
TLSH
T1B3257C07A6941FE9D11F813499A20A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 970KB
SHA256 a0ca980179fc4736afc19708733d1f7badccb2872bb810c21cd91a899d10a4f0
MD5 eb4284f82cfd64ba34b8c5b5e3a0caa4
SHA1 2eb67c95aa626013f7d0251a525058a50a9fba47
SHA512 987333f47c579b6f5247846159b34292335c26b659ba8dff824536daeb6852fb74c89c43555d3251f2ab979d8bc0e20d6a1a60e3544e487ffae74e360658e28d
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwV2Q:A3kM/56rsI
TLSH
T1A6257C07A6941FE9D11F813499A20A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 970KB
SHA256 6572962be8b4287d9a400f7917abda0efb5cc389fa52af77ea7d4fc6489da287
MD5 7272ce7c5c73d47b64837fafef7b6b26
SHA1 e41f4e5312315df1cb1b8ec3ed9b88fb6bdc0495
SHA512 3228a1b9547973691271aad6015f5c2bb0729cf3f6104de3ced9140a3b2c93788b18aedb8ad4a918a7f1d725e36fe4e12b92328e4cdb04cc2f40aa0c951737e8
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVHX:A3kM/56rs4
TLSH
T129257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 970KB
SHA256 f7fbb8dabee1f2fd9bf9296b1878917b37d8b32792307f34fe33b7702c8c99f3
MD5 75c0ffbd55b41778884777b527645bca
SHA1 5c9098cb9519f55d8737d029dc279fb4e6da72ff
SHA512 14859d461ecd4a08552dcb7468966b8da44bf31719933e9d7ff3367b84130913952d22d66fd37a082e646f172d2c812c639b6157f9a30872e654d8198285280e
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVdL:A3kM/56rsK
TLSH
T152257C07A6941FE9D11F813499A20A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 970KB
SHA256 18d2bdf5aa7ed0ff99e146bca64b71338b1b634a4a6875724ef83872a22c52b2
MD5 988668da5637367e7eac186e14e94ce3
SHA1 e8929f954865cc5fcc05c7ddbe41d8854637923f
SHA512 a5f4eb53ec546d221ae7be61b7e4536533cbad748b6fb3567a61af1eedd55361150a57b1b47fbc5e56e6bfe4770078959757ef95dad127a99eddd0d6b110647c
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwVbM:A3kM/56rsH
TLSH
T116257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 970KB
SHA256 9d86db77e15530648d0587805307c722124664e3b06a429d6372a266b0c8c248
MD5 1d66db26d699b7b10b6eaf637b435e45
SHA1 1c789152e3e6fc2b6b0deec14ddea7a0f75a51fe
SHA512 7e9939ca0b68c67b43137b3e077e33eb4d0a6f84b97a62c084f626a9d7a72c0b402fc110a42ae32cfd76414b09a642ebc09b7fc2e23ba93122c69820b7d14c3d
SSDEEP 24576:A3mnXoZjzyaTfBEFMD5TvinrmVzyfqwV8h:A3kM/56rs5
TLSH
T160257C07A6941FE9D11F813499920A62E7737C265F2087DF1364AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4992-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4992-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5024-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads