0184a0eb904f21b4c54af0f1e6f6f0e74a8569f79092387c4afe3a64ade7da1c

Analysis

max time kernel
104s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Size 754KB
Sample260731-vs5t5ayvcx
SHA256 0184a0eb904f21b4c54af0f1e6f6f0e74a8569f79092387c4afe3a64ade7da1c
MD5 a40299cf70d22d8bb056f72228db4037
SHA1 34c25212e539910e09339fede971142c18b96e0e
SHA512 cfca827dfa5cecc13c659b349ed70c6d0824e2fa719307caa1b519bdd24f79c5acf95c1b03c970d1521e58a8bdeb4ae6879047f166ca8bd3def068bf922625fd
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtw:A3mnXoZjzyacNVOE/ZxUiKiYQhtw
TLSH
T1AAF49E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 47 IoCs

resource	yara_rule
behavioral2/memory/4292-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c43b-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4292-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3292-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c95-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-360.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-475.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-501.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-587.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-643.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-747.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-790.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-827.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-858.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-938.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-957.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-988.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1025.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1056.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1099.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1142.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1155.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1188.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1329.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1342.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1361.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1406.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1407.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 44 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c43b-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c95-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-226.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-360.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-475.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-501.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-587.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-643.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-747.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-790.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-827.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-858.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-877.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-911.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-925.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-938.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-957.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-988.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1025.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1056.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1099.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1142.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1155.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1180.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1188.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1226.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1329.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1342.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1361.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1380.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1387.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1404.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1406.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1407.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3292	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4292	2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
3292	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_a40299cf70d22d8bb056f72228db4037_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4292

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 754KB
SHA256 0184a0eb904f21b4c54af0f1e6f6f0e74a8569f79092387c4afe3a64ade7da1c
MD5 a40299cf70d22d8bb056f72228db4037
SHA1 34c25212e539910e09339fede971142c18b96e0e
SHA512 cfca827dfa5cecc13c659b349ed70c6d0824e2fa719307caa1b519bdd24f79c5acf95c1b03c970d1521e58a8bdeb4ae6879047f166ca8bd3def068bf922625fd
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtw:A3mnXoZjzyacNVOE/ZxUiKiYQhtw
TLSH
T1AAF49E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 ccecd6084f331361d4359cf49415ecd71695185c69ed4f8ebe21e674920df0b5
MD5 80d0c396040c1be85a4334f3b5069790
SHA1 7881ba6bd7aa96b3904dfc6ec46698d91ff6645b
SHA512 3b253898999ffbbf220257cb50392d6c8660cee60b84c0ca16a0ebec5b3301041c23e7f345516f96180b608f5f67881bc9138ca70378c2b612045d7a765a8a5e
SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYQhtI0Le5ji0hmxNrM:A3kMLPji0Aj
TLSH
T134557C17FAB446B5E023C1B5C9D2969AEE7134825B30C6CB1359C3283F63BD19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 769KB
SHA256 85cdf419fb5dc6c3122863d655a0b55850a8f3caf958da50e9b8a06eadddd70a
MD5 764435329f30737f16ebdcc608c5236b
SHA1 15416f3321cf5db246bd4738f4e586a0971ca148
SHA512 537839131095a853bde173414355ed30a96731e623da1148a3f6bce5d4dc1e30d777d9f76b168c0104fb5c7bdb577603b1f4f4aebb46268c19a0bbe84c4424ce
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtya:A3mnXoZjzyacNVOE/ZxUiKiYQhtya
TLSH
T1B2F4AE13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 802KB
SHA256 c6b74d26e9d34c19fccc9a3529fa9bf81232467c59eb196ff87e4bba2dd9f074
MD5 0476ae283f31719998183285ee737dfb
SHA1 cb19cd86f77b77fbf0bb28be30856ff7a5fecf63
SHA512 c5cf337c1e5b85d453209003967247cb00508838b44be44d89bbd69f945d152e98b440b6e4924e54fe66b4420e853ff1733e8ff78a227cf689abe2a828873b72
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtRb:A3mnXoZjzyacNVOE/ZxUiKiYQhtRb
TLSH
T15005AE13DAA004E5E50A8670A9E54622EB75BD576B60C2DF236CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 778KB
SHA256 9a811540a9391e3049f08e46373d5445ce3ca0c82f77caf41ddcfaf5169920a7
MD5 a6f7b7c2b61f24b17091f78d53d25860
SHA1 92237b7007308cdfece964597cf2330a903f07e7
SHA512 15e3747de56940460296ebcb02fd7d24baad6b32231f2e6f19bea18ccca59a2f893c3f7e4d03d5f31fa039c3b7986d37be97301f7aca7de5782c2b8c2c82642e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtD6:A3mnXoZjzyacNVOE/ZxUiKiYQhtD6
TLSH
T105059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 778KB
SHA256 02dd41d4f764bb2c575d3972cdd9576a6930dc91672d5305ea949e8102e7d5f6
MD5 02ef5b7c191390bea302cbea3f56b3da
SHA1 536f135de2795718914f1a6ed3c0584531f18566
SHA512 07cc1100077bbd507f2837fa6693196ca150284c0f24279caf0dbcbc6a7d9be1573e5867d69ddf7165d07c647726d34b26e58ea1682c2536c1dee75484648f64
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhttN:A3mnXoZjzyacNVOE/ZxUiKiYQhttN
TLSH
T16E059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 778KB
SHA256 4eda73b872034e242f7f87ab161ef65cca17aace76d2b2a6cb7a58610a41698d
MD5 2bfbbed88aa115e2eab3aec2880f55d0
SHA1 b5f57fd3a371e363ee8f0365bee23a1419ec4329
SHA512 24284548973fdc8f10effa7133fca1a05fc9721ff422f574d3cba3e06e9a4592ba8771024f892650821b9f871a0ef898ec2cfc48ff640904ae93d02615e776ff
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtbf:A3mnXoZjzyacNVOE/ZxUiKiYQhtbf
TLSH
T1D1059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 916KB
SHA256 c32ef630dbebc2b5b04c3821e00c7befa4f7d938f5141be5074a37ee86561bb2
MD5 2f62e430d4439cfcb0e7746e4f666bc4
SHA1 a2f9533ddbb8e294b2d8717e3b6887efecb85ce2
SHA512 d3c2fb8d65ffbbab881a6ceebd16bd98ba3aabae7d8da496bd2249bd5ef3e4a934937ce6c8d328cd4444f09d398a00adf69c0abfa969045b447e3e4713687868
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQht3yPz5L87:A3mnXoZjzyacNVOE/ZxUiKiYQht6zy7
TLSH
T14015AF13EAA114F9E516813099E50A12FB75BC675B60C2DF236882252F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 778KB
SHA256 3a30cc44efe43039e1d49d6f03f99b4d3d51f28ca2260f502e443b754fd8604d
MD5 32ffbbd4c682f7f413bf2ebd12104c7a
SHA1 1a45df4acee5b3ea3a5947478d599e606934633c
SHA512 d283dbe02e3288034e1a572e5ad7c03797c16fb3ecbca569000a75a1392a7517bf583f83c62dfd135efd255aa6a6b047e9fd092db8ce312d8720c3aba5097715
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtNo:A3mnXoZjzyacNVOE/ZxUiKiYQhtNo
TLSH
T18E059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 778KB
SHA256 69f6514bf9be428302ec7fd9d230b608523017d40f3c0a3449e4f221e47a3c3c
MD5 aadbc677bea1dbc60b1134c1bbafee84
SHA1 36c76f4ef25647af4d8096871f98086356532598
SHA512 f1ba7b06321b755c8074001aa21a263c586cc9939a3182649f6f7e174b50ca7260d8f72395fcff950e6209b311b29d7de75ecb05f0df8258a9590f5ffd631ce2
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtNu:A3mnXoZjzyacNVOE/ZxUiKiYQhtNu
TLSH
T119059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 916KB
SHA256 6a2c73b0d7f2ba8f9b7cda15f0a4306fd484804b111b6e458fa378d02f9cb0cc
MD5 c931f328ed5645ad3fae88ad28d76d6a
SHA1 2f351c8aa3eb02932cbfd98cbfc5497ae1016acb
SHA512 4ad85fafc3cc8f9101f04233608bda03a1df1ddf03ac63fd90048b80f63f8d6a2a579e5689b75d39fba953cb6f3bd5f7494df0f634de3658dfac44e793d967e1
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtayPz5L88:A3mnXoZjzyacNVOE/ZxUiKiYQhtHzy8
TLSH
T1E515AF13EAA114F9E516813099E50A12FB75BC675B60C2DF236882252F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 778KB
SHA256 19be13077a3f33c805f02eace125bdda5225522dbcbefc11ec9f57ecfebf70c0
MD5 9237be0ad81fc7005867fec7a203f98f
SHA1 29c2967adf244720b4710ebb760d836b8d8ec878
SHA512 e9a5f3d19b90e5fa8ab0e97d5bf346b5a3830636a48ab8242bf53e882c8c5f28cbf26479fbf3d3231c03d155bffa67dc6a5d626cb09ce48a42949f7cec05af97
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtj9:A3mnXoZjzyacNVOE/ZxUiKiYQhtj9
TLSH
T1D7059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 778KB
SHA256 2af0c66661cca7e7d51b45035d5e3f929f7397b92afa1cbb020283b8cd1cc4cd
MD5 09fb10bab694d5592b5a22b31cd02727
SHA1 571229fb0980d639d0ba7c33b256ad0213076a29
SHA512 27fab65d8914a34dc25a41772bb2ea3406993ac82f823f1afed98aed17f716e0ef2122b3cdba1554a56b975a571bca65f52aa73d755a7cf33326fb0041ddc73e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtPc:A3mnXoZjzyacNVOE/ZxUiKiYQhtPc
TLSH
T1C8059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 778KB
SHA256 f7deafa32ea8551ba51c37925290d1f44a001182ec9654c562bb290513f03858
MD5 e90ec2134faaee9996c2c0dd1849e8d0
SHA1 99335c9c8f4dea76233912ce972b2506ca8acf0f
SHA512 0af4dfdc2073728d473bb8e206d74816a0e35fef6e6e05bfd0a771e120103cc324a9b6b86f3b794a0351e312bb9969d92e5adbe64baadf1f9a304fdc7390096b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtIp:A3mnXoZjzyacNVOE/ZxUiKiYQhtIp
TLSH
T191059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 778KB
SHA256 cd1f3c7ebdce855cada00397116aaa9eb150dc02859013858cee442781a371ab
MD5 548240fadb64a8b4a13e2a47ef7a5381
SHA1 d855359d3f20dbad5803708ee020060c6caa55d2
SHA512 de48bd6fdb7578e9077ec5b8353216a1484939883298041e39f6f3719f35ab843f52f8c24f8938e02ef74cdc93e3f469069ea50f3efb70c6e5701f92548b6a41
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtf0a:A3mnXoZjzyacNVOE/ZxUiKiYQhtfN
TLSH
T14B059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 778KB
SHA256 c8b29bc83031fe9f67c4a1fc44892f9af034ef7f42af02f6d5b13bd1895aed31
MD5 bdb24794823c283b5ac7c16aeceb0883
SHA1 8d8638cb738a66ae95ff60e4687f1e99a9f83d9d
SHA512 5ef9adce6a7b26a087307d0f64a9c758161a3f6b80903f6ee1fdc895e44a0501486c5920f218255b3256693e13e95e15981762f6bd8476ca002433972fa7d7e3
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtdF:A3mnXoZjzyacNVOE/ZxUiKiYQhtdF
TLSH
T1D2059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 778KB
SHA256 d0085600f9643c4c3575c09b78177f16a67986174dde247ce1f2962f809bd14f
MD5 e66b31ad38208520d5317a2fccc483fa
SHA1 349abd7f58424859e3dd7a630a6e5cc31c99ec61
SHA512 0713f949c3633638226da67200a6c7adb0125dafc6269d6ec003583112c035cf191cb5723fad3b16c166cc6b45355f1ef4cae0e4a61356b48c196155ba4560e1
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtuC:A3mnXoZjzyacNVOE/ZxUiKiYQhtuC
TLSH
T1B5059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 778KB
SHA256 93253e1473be0c19d126a2da27162d662f9de8fd984562f67235278f555de9f7
MD5 99ffc636e73cab5015c4cd6b1b32843e
SHA1 946a1082ffd0ea15b18209bb9097ab33b7b6a926
SHA512 fc108d37da21e699db210a56c10409cbe05a68e04e0a19be75003f05a8ff53e435be46a5e2e0e4ac86d7fe9ae51345b4f283bd49c53fb7470d7ca2142597a63b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtxw:A3mnXoZjzyacNVOE/ZxUiKiYQhtxw
TLSH
T145059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 778KB
SHA256 6310aa3e4a3ff705b8f3687a6d3695e2fda969840321e078dd40b1bdf2da1c78
MD5 b14fa662bb9bf192d2e24ee500b7fe18
SHA1 edfae6c84b203cde20088d0eb0b8fe87655676e2
SHA512 22dd3b3910f09b1f148d010453401b44211a0a1f3cad7b01f6731a65f2eac47bd63349945d15df7ea3a55963385ac26ce4fe1b6c1e2c9ea3584160fc33cc5286
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtYT:A3mnXoZjzyacNVOE/ZxUiKiYQhtYT
TLSH
T157059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 778KB
SHA256 b117297cc0338cf6081b3aca57d6235ed559510bb60df2d671c6961ee80326fe
MD5 919ed3385dd4d86226363bf07e40a744
SHA1 1bb5fb7dbceab18ae07aafda37c4f5feec964d95
SHA512 c8407c9345928d6870a83d2d22a23dc88110cb9840f8477cdc17a2510d017ff7a849c8dea3c688793916ff8964321aeba1464dadd93024cc39f1103225fd4f32
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQht0u:A3mnXoZjzyacNVOE/ZxUiKiYQht0u
TLSH
T11E059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 778KB
SHA256 b95e24eba974ad9b9dd2b8e6935fffd0d3277799dfc1da750af39a598aca7b55
MD5 d89f2efb40809244f62a17cd5634c3c4
SHA1 54a22ccd702e44733571aa9f0d694620a65bc5bb
SHA512 05f366e2263f97ab8a7a7a31a496412baf544f42f066dc9af4b167c276494f150f55637480f40dea4b7dc1102c6b4c6af37df00623725b688b26c61b589ae709
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtib:A3mnXoZjzyacNVOE/ZxUiKiYQhtib
TLSH
T1CE059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 778KB
SHA256 4f24b52a9e0f2dd533892f36cd3518ec599ddef6427aa53abafe56a844552550
MD5 5b973dc8bea2f213bee89416f7891c5f
SHA1 51f4633f0697c5bd30f88c5ca594b5b60001d4ab
SHA512 e6c6f388ba679c5fb009db05544c02734d347003b3b1b1278eaea2ffa720d0872a7a0050c57be14a98e59b2af046a085e47d4c560087d8d5672cc5631d7e2a1b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtkf:A3mnXoZjzyacNVOE/ZxUiKiYQhtkf
TLSH
T187059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 778KB
SHA256 a9270a84817ef6a0cf1b8778800c86a6e643bba1aefa43aca8d61d74a4278ecb
MD5 1272070c42621e24f5b1c9a65aa8d628
SHA1 644ff746e3cbc3b63b193c350895f504f9789d79
SHA512 896c9bfd6940ceedfdbf38890e40fdc5835ebdae34dada5e0471a6590135828dac08bcf8be0465c45116d9ed4f99c6fd285d5174fb264ac21c03bdddbed4c797
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtBK:A3mnXoZjzyacNVOE/ZxUiKiYQhtBK
TLSH
T1A7059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 778KB
SHA256 d25a41fd01bd0b79731962a99bcc8a83224acadb235d1dcc108507c872156231
MD5 2ce1b7c81189dfb1ebb23ec6ea5213ab
SHA1 520828eac2f0efceefc5a535f3ca7b858c97601e
SHA512 a1add99ab05ecc11f7abf0ef7b9b9e863517b07bad6a428543c379f94de7804a8b06c8120553f46014d06f2cfab4a5e5c7c79bf01f02d37916cdd30d2abc1996
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQht6k:A3mnXoZjzyacNVOE/ZxUiKiYQht6k
TLSH
T1CF059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 778KB
SHA256 5fa7245de4447a42be9a413d65bd45f9306506080a58ebeb5e6d1d5b808b831e
MD5 1d1f89853a5c50599d862946d06e7df1
SHA1 408945826b9e154062c1ec1ae720f74cb1d90a89
SHA512 e35e869e331b99dfbcd21cede28ba6081cc2e9b01368411061a35dbe138cae0c39c7062c4189c95ba702f0011e962829e8ad986640a8d279454fae0c5a199870
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtf0:A3mnXoZjzyacNVOE/ZxUiKiYQhtf0
TLSH
T113059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 778KB
SHA256 acb3e814425530f7b4f182afdb7f68fff9ad5619d29b66d6dea93f5bb80590cd
MD5 7c91af7847f72f34e36bd9068c544446
SHA1 66db987766b54d9cfe6037e10079babe80f67335
SHA512 5fa6c3daa984516d15c6e8cc79c897df3ff9a3ebd79be808a13c223fd789d9f97e3272139faa7fcc35982fdb0a40a3727f324c541764cf8c068c863e90823a27
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtu70:A3mnXoZjzyacNVOE/ZxUiKiYQhtug
TLSH
T11E059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 778KB
SHA256 a255521776ab657fff0983dd1f0f729604d2e8215658c88947be58363a569eae
MD5 d762d6de37029d13fdf862548c082e58
SHA1 82a92e8dc1394c507e5f2568c804e851259e6630
SHA512 c01b532820f61cf213995fef79c361edbfdc0685a6894eb9b2c6cabd9b3482e888764fe97015abe4808149743c3ba856f9a4a14eea3360aec1ff80fc7f2ddeda
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQht3r:A3mnXoZjzyacNVOE/ZxUiKiYQht3r
TLSH
T129059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 778KB
SHA256 86a54586572e91ab101bca3a6cf228bc89875fc87edbf9f4a03cbdfabb20099e
MD5 1f840535d31c3cafb9625fac317490b2
SHA1 324c1d70fd152be0a42984dcf665f0a5e051c6d1
SHA512 33532ff112441a697708558b4eea1948ba7fe332944b3333de152064a54a929e1353a567abbaea4d99736c82f1e7a5757d15831f9cd3265a6e4e672506f7808a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtBn:A3mnXoZjzyacNVOE/ZxUiKiYQhtBn
TLSH
T1EF059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 778KB
SHA256 285531152af07394aa9f8bc46d51fda6a19eaa23ac7d2f2c93f3d34b079131d0
MD5 26f08fa96c3e613d99e6a368bdd312f6
SHA1 87f449a9e33ac94352bf2c8ca80cad90c3476209
SHA512 1ea6bac0526ebbbe8194493bd9efc9355535a3971cf133b9860b1e057205a071a13c669f0769760b80c919e63b52ec4a3c96f44287cfdbe1b639538f198482f6
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhttx:A3mnXoZjzyacNVOE/ZxUiKiYQhttx
TLSH
T177059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 778KB
SHA256 162c8266e62235e8ea681196c6f48bcff1767949dd071a6d5955b908376fc70a
MD5 20635fc4546e4d6935741fea5bc05b9b
SHA1 8b11a5eeb2fb24353ab07f746fe85af46dda57d6
SHA512 cc44c18f7e910b294b6916585bb06a62332ade123552ab84c8b82be03156cfd24280336ee8c3c56407dc0001d200912c6702708af92a8dc2728aade1cb2b0def
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtzA:A3mnXoZjzyacNVOE/ZxUiKiYQhtzA
TLSH
T10E059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 778KB
SHA256 5968c0bece0158ddf575781e4ba0d843db5746be25f77ace3ea511605634d6e8
MD5 900dcf7d7d26b73e4f28024594230c21
SHA1 4f212dbdadcbff0fbf96e239b82bfbb39a8916d7
SHA512 f6c550b14caa7d89b9326bf837dabe9ed5d92083a938ff9e13fe74a3a5547a35cdef9064d8a0eb87d928f09849d2ef5a97f111928f64721d0612dee293c99a8c
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtE9Q:A3mnXoZjzyacNVOE/ZxUiKiYQhtE9Q
TLSH
T1F0059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 778KB
SHA256 e8ac538963f2e9f999c15742681bab82750bee060ec7341f68af97c62792f2dd
MD5 32f706e1998780c7dcda6f4f95df12fc
SHA1 64bb0829823cdd871312efe76320e0b82e0bb16f
SHA512 f77ca4a88e85814bf345900de316940ecda3da9bd585a1aafd5f6aaab2fca864f3b26c7af2d94b6ef28446c095d8e3d97ee603c2edadb61612b2756d8179b509
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtd4:A3mnXoZjzyacNVOE/ZxUiKiYQhtd4
TLSH
T18C059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 778KB
SHA256 29788d83c5e54b28651a9e3d405d223dd7277002f4e2e3c81370368462b781e4
MD5 5d97bd12aeb5e1f4b477c621d0c4d297
SHA1 5f63ace6d634391085b36e96a2f27fcdcdce3ee8
SHA512 139a28dca48232f9553198c41b1bad87444a425f75ec883750725519a2214993cea2d2f60eaa483acaed22fa40624e6984661d4e50fb62bc37eaf442c3f4fbf3
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQht4u:A3mnXoZjzyacNVOE/ZxUiKiYQht4u
TLSH
T1F2059D13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 778KB
SHA256 7d9f9979453072560a58a2adbfd74057d8ef778e0e6c4933b7fe73bc8d72982a
MD5 f760f011116f740fbc748c409e43433d
SHA1 07dbbaa35fcdf6157ed4e7d53ec0299078828f8a
SHA512 a89118274c49733271c21925a2b6808babc2716be2fd3d582f9da62810a27526c1ca7dcda422d3564ff0d203da6eb9d8b7fda871add3b9a9a78d0656f12bab5f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtZj:A3mnXoZjzyacNVOE/ZxUiKiYQhtZj
TLSH
T118059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 778KB
SHA256 2ad97f22c57311d09fc9a2996c95ecde833c67b7a0b792194e5d9cfa25e266cb
MD5 8b8018a5ed66ff69eff70424201009ce
SHA1 a76472fecfa322e16e11ba3154c80a53ad62b3bd
SHA512 ed3f0215944ace1c9d55fd493182c317d64eb0ebae93fa75ee177e95851375eb639175e9c74c4708d7165f63f48afd15a5b2da14dc65194d23f4a00b54074b50
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtAg:A3mnXoZjzyacNVOE/ZxUiKiYQhtAg
TLSH
T12B059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 778KB
SHA256 55dfc1111ec93fef5e3cec49549ad7194f228ab1f02fa38b1fe920eeb8028ab9
MD5 a1aca35ecd3ae0682c2b81f122260d6b
SHA1 9a37c5788617fdfa8e0ab9e684545c82dfe6bc29
SHA512 4fe9b1b0cff13dd931b3aaaf15814950b6df7bd99b9babe4f44a6d96541ade7b8bd0a4ce4c175c8f703fc4c58e1df8cc2055ce884216a95823b5281fac072f3f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtvI:A3mnXoZjzyacNVOE/ZxUiKiYQhtvI
TLSH
T12F059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 778KB
SHA256 bbd5a072f8bd75b21a7ff9e245a18c3e73c18862bacb879efcac441ba30095e1
MD5 abe1aadc1634cfe0b915cfd47631f71e
SHA1 ccf2c7f4833fcbc07bc10eca68567b4e91463c61
SHA512 60ffa827ee165c865bf156baddefe0bf10167a2f07904f1f02eb14ec51eda89e978a73ef48c31de354e0574d385a4b8456389902641a41ed3df1a412f847d415
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtVo:A3mnXoZjzyacNVOE/ZxUiKiYQhtVo
TLSH
T15A059D13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 778KB
SHA256 3ab8b67e684d9cdde125bd2459ca7e68d8374efd4cf434947a48a4c5ababd9f8
MD5 aba87be200612e38ff50265bf7faf6ea
SHA1 8d452d40636679937d8fd825a42b9cc026849427
SHA512 8bc3589b3c003d8edaff7101ef049e6aae4f8b2ffc872e16878a911ac31aeb388542c894010c96b01ef7469d28598ce9170ae7c7a1b5207b1d0f381a6f4904d3
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtG+:A3mnXoZjzyacNVOE/ZxUiKiYQhtG+
TLSH
T1E2059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 778KB
SHA256 3bd240642b9739e4ae1e66008ea2e551f1c422603078721c03f21df789a78035
MD5 f06c4cd3666816ae44dc13043fd643f4
SHA1 717110f09a671afddb00185a166426538f04061e
SHA512 53b3391c7efa48b4c353809b5860f2d18c6cfe15c6d16ac6581cb6c4e720a7c7880fb0592b37f567779f9cb892e8be26d39cbaef75fa45c7d8580e6d81c4b369
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtGQ:A3mnXoZjzyacNVOE/ZxUiKiYQhtGQ
TLSH
T1B8059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 778KB
SHA256 d983478b37502fc581bd2c866e3dc1d932191b64cd3b2638b6b0be2e75ef6f77
MD5 d1df6a98eb9df13b4ad78ce1129dbe87
SHA1 45e34297fcaad111d64b5b3de33c6e44f3ac9aea
SHA512 c726bb4a316a9b67a878c4a01b3b00b5536894abfa6251a68c78d76001ebbe18cf58c10ee7fd459183c05d1037481cbb402c1251ad119b0cb81f14c9ca403a47
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtXX:A3mnXoZjzyacNVOE/ZxUiKiYQhtXX
TLSH
T12F059E13DAA108E5E50A8170A9D54626EB75BD576BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 974KB
SHA256 65839e5ddbda1971936f1df937824eca83378d290141d53c44ce5b392c0ba299
MD5 df98620759e96be3623bc00f77391b52
SHA1 86efb5111910ff9c7e3686795fefef65f48705e0
SHA512 050dfc7f1d1955288253f3862c4610e41f442bced70a09cf2275ed386ba977c07f15158031bebc8d37256ec3de2bd95e2008678089832c74d6a82f5a71bb0264
SSDEEP 24576:A3mnXoZjzyacNVOE/ZxUiKiYQhtsjCXF7IwZ:A3kMhC17IwZ
TLSH
T1AB25AE13DAA004E6E51A8174A9D64626EBB57D6657A083CF635CC2212F237C07F7E3F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 778KB
SHA256 cb2a6c77d3ae7259c3463b6777bec738ecbda5c7c513d4de073235f174bd1002
MD5 d22dbe5a17989c254c8dfaa28930d1f4
SHA1 d85d9ed0b925259cf7d136f8d247132e34ff0555
SHA512 34bf0f60ac1ffb9d2ea2ae126823cedfc57e78193638baeba50de98182c2b0f269dc53a1afc402c2b4f5c4d49de88b780e50601314ff32e8d8c30d84cae0356a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtNL:A3mnXoZjzyacNVOE/ZxUiKiYQhtNL
TLSH
T135059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 778KB
SHA256 77c09a5cfd4a6d33b3caae56619cfb07c786f29f454d0fad9192a680d8ffdf36
MD5 07037a1430b4b82494bc4b63333729f5
SHA1 f50500dc2850e53f8a28a0b0deb29e06e8ad42f6
SHA512 fccedf221e4e58d9fcd8ce280fe9066f176efb831be6e1c241d2e1a0935b5f48a5c23da8652842d769c484941522af30f8b1b7711a49ea21e6e02d1a317bbdc1
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtLFC:A3mnXoZjzyacNVOE/ZxUiKiYQhtLM
TLSH
T1C4059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 778KB
SHA256 8058eaa394b1f56c334fd6a3cf86ed556d6041737f0464584bc0f8c70218153a
MD5 5df837315adbc11c36dd9fb6f1e35194
SHA1 b61de8140077e5d3be92cdce441ed5f4ab032127
SHA512 52f9337db1a2de6531dc63a8c4d84f76268c7bbf344229ae0ab110585c19ff80b73d6fc15872536ae4bcb7d912389643794ce116d40e88142ec3a0b04e8c8a7d
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOE/ZxUiKiYQhtMh:A3mnXoZjzyacNVOE/ZxUiKiYQhtMh
TLSH
T1FF059E13DAA104E5E50A8170A9D54626EB75BD676BA0C2DF232CC2112F627C07F7E7F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3292-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4292-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4292-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads