c4fb7175ed2709af91cc731790a46cab8b085fe6807cb368a080f925a119c563

Analysis

max time kernel
116s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 933KB
Sample260801-dmancsdl5t
SHA256 c4fb7175ed2709af91cc731790a46cab8b085fe6807cb368a080f925a119c563
MD5 7583e636d8e4d91dcdedfc4164a8a78c
SHA1 92ce1389da4e094fa3a671a07ce9e7a381fd48e5
SHA512 f2ade07b6789cd58ebb22dee06e6287fc32520708039fa37522e9981cc61f5311d02d6d4cd26cd333b5b378c3d28c37b31cce7bf2ae713fb4debc908ef60a251
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gC:A3mnXoZjzyaEFo3+aWiauhzyozyrJC
TLSH
T1B2159E17E7A120F9D126823499E61A12F775BC321760DADF136487262F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4376-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c429-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4376-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4920-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e5-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019840-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-439.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000018a52-536.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-610.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-642.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-727.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-801.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-850.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-914.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1089.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1151.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1293.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1356.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c429-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c2-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e5-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019840-220.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-439.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-493.dat	aspack_v212_v242
behavioral2/files/0x0014000000018a52-536.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-610.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-642.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-727.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-746.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-801.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-850.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-869.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-914.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-934.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1009.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1052.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1089.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1132.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1151.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1176.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1293.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1331.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1356.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1403.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4920	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4376	2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
4920	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_7583e636d8e4d91dcdedfc4164a8a78c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4376

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 c4fb7175ed2709af91cc731790a46cab8b085fe6807cb368a080f925a119c563
MD5 7583e636d8e4d91dcdedfc4164a8a78c
SHA1 92ce1389da4e094fa3a671a07ce9e7a381fd48e5
SHA512 f2ade07b6789cd58ebb22dee06e6287fc32520708039fa37522e9981cc61f5311d02d6d4cd26cd333b5b378c3d28c37b31cce7bf2ae713fb4debc908ef60a251
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gC:A3mnXoZjzyaEFo3+aWiauhzyozyrJC
TLSH
T1B2159E17E7A120F9D126823499E61A12F775BC321760DADF136487262F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 f60d9d05d1e5909bbdf476a07085f53e21ee4d695a7241a0773502e95c6864d0
MD5 ead04676ed7106284abfc7f7b7102ac0
SHA1 f0bf76f9271d8864516ec2cdfb486b4218c3bd62
SHA512 f66264064bf982ac69f2abc2367705beefd0e41519c56edb173c78f67969bd69ac78302ec1551ec51797bcaa37a41fe4e115bed7ca8eb8b254d981878bd2d127
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyozyrJC0Le5ji0hmxNrM:A3kMPb3Pji0Aj
TLSH
T1E7656B17F6A402B5D033C179C9E25A5AEB7238521B308ACF139487792F277E19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 948KB
SHA256 9c1172e7ea52ac49e7aa15ca24ae4e7f7028336d1b70e3e04afc373fa35495c9
MD5 32391f4d09f78c5d628bd26c1ad7b645
SHA1 e203da63e7b6156bd933bd439346f274393b2ae1
SHA512 1713c900951c928e3e2af173b4d3fde85be6fd6b82d699c34499a51a6a12f99a2d3dda634db7803994547105b5292b172bb3ffc1c77bb5ee2822ee5efbacee5d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gMa:A3mnXoZjzyaEFo3+aWiauhzyozyrJMa
TLSH
T15B259E17E7A120F9E126823499E61A12F775BC321760DADF136487252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 957KB
SHA256 2c7c9f13792e30ecd9d2d324427b0000a863836642b996903498bde867798ff4
MD5 8c540d4bf58e037a2973645cfa1d59fc
SHA1 b5a6c8610de0f434a063a0d0325ba03ff92d5c2f
SHA512 c19b2565d00a926e1bca1c253bd9464344c2e1ae7516cf84a73bfe6781559b689fb3ecbdf5224e8defc37c560a4f2ca1756bd99ceba06519e902b17d8062b4c6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gl6:A3mnXoZjzyaEFo3+aWiauhzyozyrJl6
TLSH
T1E3259E17E7A120F9D116823499E65A12F775BC361760CADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 957KB
SHA256 d9012e33abb61e27addbe79c76d3e65d51370f9c1531fb88a68f0f66172eaa8c
MD5 e2fe7d6039ebd64f9ab5c1f792cb9ba8
SHA1 340db3fe2b2f09054a6390bdc8bbc6ba4ceb66db
SHA512 9698039a7ca8fcffead4290b987d6aa3e3abc447a3971879e7252ef68f8bd1b586071bf23ac8816f730207159f50f7f15e61b222672ca9af4a7dc8ffdd06d55e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0g7N:A3mnXoZjzyaEFo3+aWiauhzyozyrJ7N
TLSH
T199259E17E7A120F9D116823499E65A12F775BC361760CADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 957KB
SHA256 862b140605f4aa91a61207617542ac76b92d21e08fd1adfa6738d9d7674a0f17
MD5 4ffbc87c0a1e31921d3da4449e9f1e4d
SHA1 80b63477e77b1261ba21a246e468e9292837b0ef
SHA512 ee363b263c8eb6bcd8bfc82b65633fc7b6287cf19e15ccc2d33284e71d048f345bc1a583ca7e9a8fae1014ac143d6ee7de6e5d18ace7066510c7f36166b17c0e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gZf:A3mnXoZjzyaEFo3+aWiauhzyozyrJZf
TLSH
T14A259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 957KB
SHA256 5a8035bd0dbba88cd2ca20de5fa9e1a88cd7d1866734604a6361328904cf4ada
MD5 7368c672fc2843d1a950d8a2291713bb
SHA1 0bcc1b9c12504eae1d12936ed7952725c3bdb0c5
SHA512 9ecb510acb8a4273cb8166f9db514b882c678cd5ddf4d7b4420271fecf781ef58ff2d3c5a7a18fbc961fc8572e00ec7b56476435557674db8df71a37e37424be
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gbo:A3mnXoZjzyaEFo3+aWiauhzyozyrJbo
TLSH
T167259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 957KB
SHA256 e8657984ca6f25fcb709b56cec2797ec1b9354780a2353954f054b3bb63b3dc9
MD5 4272df3a50fed09c486dd38f671fe73f
SHA1 be86083b8e0b28ca6d40835db454664fdd8221bb
SHA512 4c49979f7692678fd013b3e4e52aac3df865443834582871478eba198f424d7083feed7b86c3d448f01db7a51c748b17c0f989e7917a97551dcf07d8ba8a0312
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gPu:A3mnXoZjzyaEFo3+aWiauhzyozyrJPu
TLSH
T1E0259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 957KB
SHA256 d719a1e2d6a7221818b4dc759ab9d33205fa13e2d2be322fac2e21da7872b831
MD5 e89260a176d6b0e9e2a84de715b0d3e4
SHA1 604f72e7cb852ad56446bc67afb46657680398f1
SHA512 be426bb11f60c515747bc9b490b44ff6ffb1042effb25c13535818b00d15b63c4f96bd0e8d7722181301e46a0b30715f30df928df20e85e5f2720a7fe31fe68d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gd9:A3mnXoZjzyaEFo3+aWiauhzyozyrJd9
TLSH
T178259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 957KB
SHA256 c514cb0fb70c47ae67f4612f8541bef9ffb8e096f8f8ebc5eaa6067463143864
MD5 a2b55dfab6a79e5b3c9916d511a306b9
SHA1 a9c4cf257f23a40ba7c081ce1ace635c96ff6a1c
SHA512 557e06d02faee941314d1729ce8779a65275e9ed6f5b76501d160a0f9d3225b8b346efc40162f8eb3df310304cb9feaa9d3837cf97ddc8d6497447cf669a4b18
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0g5c:A3mnXoZjzyaEFo3+aWiauhzyozyrJ5c
TLSH
T1BE259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 957KB
SHA256 95d50cfd9f1904ea4c07281bdce99184d6fed542a5b6b4b5b8a02b7f752b6aba
MD5 550897318fa9d616121cbc06514bb68f
SHA1 31cad81970b55806387061e3950ba6fbf773e865
SHA512 9f1616c84305204c931b9a701bd9919de4184f8a5c543950a25cbc88f2d875f5ae955fef93c9a055a084be035b424165c3e0b6b4d5f26ef72e5c6be50253f55d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gyp:A3mnXoZjzyaEFo3+aWiauhzyozyrJyp
TLSH
T1A5259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 957KB
SHA256 0ee53fad613f496f7a5458754ac4dedde0cdb1a9e4ab90659fa41a73a27c7d5b
MD5 95b658ec98378f56e4e8b1137f6730b8
SHA1 2d5ba6c288ecce6f0c02e80367bca8f3a419cb4c
SHA512 97ce4f56a5c8abcd30ed03c4914879010ceb3cb298a179ea24fbc4fdce766344af896fd88d0f06907b4c49f40255f56df1d4e598a4fc5460a836824d8cc501a8
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gF0a:A3mnXoZjzyaEFo3+aWiauhzyozyrJFN
TLSH
T196259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 957KB
SHA256 3f76f9007620b5ef76a370790c6bb4a8db2b5bce84a5cb2184db0def1ee0ba41
MD5 6ef560ab23f1d4c0545d7719787df168
SHA1 abc72675111c26ad6a0bb102907559dfe91f12c2
SHA512 671f56e9f1213386152aeff1dc0f45a0f67a3422d333fa7703ac06c94a529d61743df9fec59ba35e194e3a6d57685a507c624f5fcee7770860101dc487d0fbc4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gXF:A3mnXoZjzyaEFo3+aWiauhzyozyrJXF
TLSH
T1C2259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 957KB
SHA256 40e5c01316bf36edff997b46d26ad4fbd4ca785a9356837be7ecea97afeb6ef4
MD5 92dec62b6fcb578682f37a77ddc80d07
SHA1 ed7a56f51104478559e589cca49fec5fb1655d1b
SHA512 6da9a011b28f44bf57c8db0fd3fdef030b5235d8457a28da3d7535684d79169fd7961125c4ad6ce903290bb21f803686b8fe5fa88b9c55c3777b6b73daff8656
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0goC:A3mnXoZjzyaEFo3+aWiauhzyozyrJoC
TLSH
T146259E17E7A120F9D116823499E65A12F775BC361760CADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 957KB
SHA256 e13802138ae5720204320ce438e75430f66a9dce14220dd3f6edeed3397e1b55
MD5 11961774cf297abdba07e41b8dd46e12
SHA1 e885fabd4f08aefff5eb5632b8d6ad33ac00d767
SHA512 3fcb9e5dd575e55307b65d8207ce616115fecdd7ccad342f47e2b779f12c6b60c2aab386562fc3202c7543f7ca3c3178b31b21bd3329592e38972e5fd801fb5e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0g7w:A3mnXoZjzyaEFo3+aWiauhzyozyrJ7w
TLSH
T128259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 957KB
SHA256 d97310eb070071c789850945060061018557a39ffec286c22dc327fb1ff02296
MD5 1914c446ec32923bf8b92ca16ffe5e3c
SHA1 d6d6b0a13c7e6531788018a9f75308ef7303135a
SHA512 69e8bb6978bd694bc4f59333bd0a5a14313009fea0d00c601c9a95f6066d51df7c8cf0c6c4174bf89763de180b3f57fdd998f031538d0fbad1c2d2675a2d4f49
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gCT:A3mnXoZjzyaEFo3+aWiauhzyozyrJCT
TLSH
T10D259E17E7A120F9D126823499E51A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 957KB
SHA256 662aac165c8ee0911bf8cc17fa6c81413669c73b2e9ad0aa425fd8adb47b6eac
MD5 5b1c462bd4c749ef8895e42a4dfed9c0
SHA1 600046829e057465201be9ab0134682ae4b5a74a
SHA512 e779faf46f2d598ced673c24f4583db6818fcb6fd67463682fc1a6cb5f9a0fd079824b26570ec933e6bf8f9d0472a47aa708da5adee89add74f87c5c8cf9efb9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gSu:A3mnXoZjzyaEFo3+aWiauhzyozyrJSu
TLSH
T1D2259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 957KB
SHA256 0830a28fc76a0acb52eb7daee12a1ac0d3a075178a4c614b1b781cbfd3cd4403
MD5 4503a17946099781a6730233e4f1c189
SHA1 1df6bfd915e96a6e0d6a7b4f256fda2ec46294b9
SHA512 8b9c6756bce27360f4b1532ed439093982b646b4cf94dfeef2adba70bc67bad8bed21bd184708b0b4da205a8d4393e2654ef29f3f45179eb2af7f7a545385a7e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gMb:A3mnXoZjzyaEFo3+aWiauhzyozyrJMb
TLSH
T195259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 957KB
SHA256 3dd70d8646f66d77e2e3fab55d7fe7d3c04cf1afe5610daff6e4fa3c0bfc59fe
MD5 7791ce3bca2dea6e6be05f214d71ccd4
SHA1 fd8d17b7b3646665f2157e0e8b8b86fe21116f2e
SHA512 a054fc9a15b8b040e6aefaeeb23ca073228e2185c80e2c4ef11e892d16ddf915b2018d337b4bfc4075b5b9c9c34daf01cc9bb1f1baa2d5bc12eed53d204a3fd2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gyf:A3mnXoZjzyaEFo3+aWiauhzyozyrJyf
TLSH
T1F6259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 957KB
SHA256 a07d88fecb29fcbf7eafb4ed6b4ebff89452abda9a0a17d02a7eb64ca620bbfb
MD5 099e8f0f42e0f5e952036ddd6a1a26e1
SHA1 eefe6247e16ed624577a76979b23fddb5c526aea
SHA512 90e3f11db0b92d067cc77c131a99b64c39f6c8ee4a622980ea20ded4f4ecd971bc8311a3423c2031650e6306132c341cc2da49acc670afb8dd36a44f66dad342
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gfK:A3mnXoZjzyaEFo3+aWiauhzyozyrJfK
TLSH
T154259E17E7A120F9D126823499E51A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 957KB
SHA256 9f6cc6770e9c30a8702472cac6da0a63c5158c0ff5952c40c8d59aa87bb32327
MD5 a93ecbaf769d5f59a0341a9fafec6e05
SHA1 15f099807c543087ad3858887e4e5c1363d2291e
SHA512 61940c4343f7dadf51c0347137a04c2de41595058c7eec6be0f4b91d39e8f6ab34c137b6038c5a2c76fcce91cecfbe0b824970b73db9057b391814c9cf0ec518
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0g4k:A3mnXoZjzyaEFo3+aWiauhzyozyrJ4k
TLSH
T1E2259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 957KB
SHA256 fc69a0109aca5bbf8a03beb9fd6adcd7df8f416511b66526004c9208b6a15c1b
MD5 1fa439563d7620423d114df2e15a593a
SHA1 83322eddc9aed178b03c5e011de8b210684dcefd
SHA512 f6f3c5c04dcdaf71f6afb0b89db7cdbf3177b6c0b037dae8dc08555ecd9af15da1e6e493a3e50a07fd965a73370e3a0e9a73ea6c300b362fbcde9825bfffdbfa
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0g50:A3mnXoZjzyaEFo3+aWiauhzyozyrJ50
TLSH
T127259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 957KB
SHA256 e1e0b4072599ac74fbad0a25d5157a51fc2a6015d611a9907c3d70af0205f04d
MD5 73f49a56b68869663a1f94d408132170
SHA1 b12e0affc9d858c4e1987c85d9c9a83af677b5b8
SHA512 7fae61d7b2401ce4112dddc5d6d5bb8a4580c6959d0de601d628ce734d872fd0895658fb5091478b8ab685c670b5f347a4fab56cc0b9aacef0df84b1c8a865ad
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gs70:A3mnXoZjzyaEFo3+aWiauhzyozyrJsg
TLSH
T1A0259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 957KB
SHA256 13c02ca3bae8dc491a504c30f68cffba0985fc4a1a8fd3454b5eb6431e37c8de
MD5 157775bc84acc341a00090664e05fa27
SHA1 5a0f1199452324b238fcbfd29f654a893f9b83e4
SHA512 839abca16a39854c7667cae4cfef43a92708c33788615a92476a727ceae2b91baeb3bb64b1fd5e4b91ed1149c315968db772221c1d8802b6a20ead2441462e1e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gJr:A3mnXoZjzyaEFo3+aWiauhzyozyrJJr
TLSH
T182259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 957KB
SHA256 8c96bc514fd6355940e321aa1fc17034dce99661b72efcb662fa9edcafbe1155
MD5 d4172926552401b704131b60f3b18ecd
SHA1 cf7fbf3326b1c6e4c79a167bbb24410ab3a81964
SHA512 8baa845a9d3e42be7cc7b6cc8263135fb816e4cfb494f8211844bb5aa55273e5b3404d759a6e4470c316e7c28c524bd28991232063b4419687647ac36b8c38c0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0grn:A3mnXoZjzyaEFo3+aWiauhzyozyrJrn
TLSH
T1C9259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 957KB
SHA256 f2a3565d62460143ce7467132b78e78f1dc3d17cb9b69ec20644b4e8a32a768f
MD5 80d48b81428b5d56fca6719b05f268e2
SHA1 b1ce859d5a46722e70233f4fa3dff4d2c6bb4c30
SHA512 80ac26426004c283514eda969344b32381eee38b99331120bd9b8a256e277377b68928adc9fa692ef890cef2735315fa17bfe6756da1590516d2e75e8cd7373e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0g3x:A3mnXoZjzyaEFo3+aWiauhzyozyrJ3x
TLSH
T17A259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 957KB
SHA256 a4d5035da62e9a42afafd64522335602f717b60b7a7dff3dd2df62e51ea3d45b
MD5 4a8177528a78eedd1716a3eb1a5bba08
SHA1 38a56efe9528a84a183eb7db34189832b72513e3
SHA512 d155da715bd4e8c933757c87bd169c18a96c52fd3993f5aaadf4fabaf7e0011bf9a977e378ef6469afebf74400f1d5baab0645cb88f3ad5c96867f85fbafaec9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gtA:A3mnXoZjzyaEFo3+aWiauhzyozyrJtA
TLSH
T1A7259E17E7A120F9D116823499E65A12F775BC361760CADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 957KB
SHA256 c8cd23dc90017866a1451c739a4e13c33f25e97926132209ff8f22b340599fde
MD5 2f0d605fed9b8a57b78fb8f7362d5647
SHA1 e925fe01f96d99fe14e075c67ce1ad5a37762325
SHA512 012d35bf4f67a2347bb62651b7507ae3ee8db89457ad2166836f4002a2814bfa203d09b204849e68ec37eef05c66054f621e9399804fc2b730d3d315b213201d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gm9Q:A3mnXoZjzyaEFo3+aWiauhzyozyrJm9Q
TLSH
T120259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 957KB
SHA256 434e82198d28c7c308d11559e9b0f9615788cf99e64c4e0ca74cd0261eea499a
MD5 9783d181f7325dece1bb666ba046e326
SHA1 cdbe372a49b7343f501f042e6b9135feee40b655
SHA512 fe6736973c13ce13f502ddeb987a04aba125fb0b1c43ce1469dd603b5c9a29c91e93915677cef9f5271e797234c0ff20fc7beeec6274b62f5c6b15c1fba5e282
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gD4:A3mnXoZjzyaEFo3+aWiauhzyozyrJD4
TLSH
T1F3259E17E7A120F9D116823499E65A12F775BC361760CADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 957KB
SHA256 3037dcdc3bda3897247655f95db63207e9e727586f8f36ddff3ef5859d6f7a53
MD5 f3a8fa9d197a9e24655332cd54cfb260
SHA1 9ef5880251a7e4bd5fd08d99cfd326b2295e5aa7
SHA512 2cea81031f69b5969e20e78a61fc06743e32e2f79c683f088ce56587874c42c07bfd996b8bf88676f2cc180e48680fb4c8f0e1fd8cb93385bd9bf6a13d3f3de2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gqu:A3mnXoZjzyaEFo3+aWiauhzyozyrJqu
TLSH
T198259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 957KB
SHA256 1953819597e2ea677d7d0c95dbed184abdab7c6d326cdc1c8711005b2ce2e6aa
MD5 1cac8d8f9244181045fd464305eef09d
SHA1 acb9461249cc534cfb36cb10543d349d4551c08a
SHA512 2cf472140eb5bccad0a87673793e1a6042da4f7e117061aff66b37f42b41532159335275495ea1b901a4213ee7eebd2ab9bcce46c72aecf5ae7ee5cf10de91b0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0g7j:A3mnXoZjzyaEFo3+aWiauhzyozyrJ7j
TLSH
T12C259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 957KB
SHA256 93dcf36e2025e4239695e3ec95d69dfb8f2b9447b1ff4228ef3ef070a728b7cc
MD5 9daa1209ea0ddb71343e7a70e0d7700d
SHA1 a478357d15b3fee3162f619de12cc69488e04b0b
SHA512 be78a7d163c7a69bbfb5a0082c3bd921cfc5adf79ec89dac045d649b99add3a3123cb6ef0c46fb16ecbcb8c36b40bd134b86746c459fb48f1141e7e7d7f62f4a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gGg:A3mnXoZjzyaEFo3+aWiauhzyozyrJGg
TLSH
T190259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 957KB
SHA256 341c7e8dd984f7d7ae74addc2d77ca93c00240d0c9072ce8d3d3365732f50f39
MD5 d7e319062466d956fdc6f6c25ca6d482
SHA1 041dc5f0258b3b2b8e4de58284ae8b25b2d6826f
SHA512 b224733d6742265e02feb3559b4932f37da585a0a5cdafcf00611da03c2b9262b9b5385b334d2f28a37e09ebd19947543bb1f40de1c3cfdc4e3b4ff9ad76bfb1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gpI:A3mnXoZjzyaEFo3+aWiauhzyozyrJpI
TLSH
T163259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 957KB
SHA256 ae6fcdabf6a4bb0b6d329a69839ee5a079a08f87ee2fc7b135532cc605134066
MD5 abc70c74be0dbe9c0bdbaf05fb5ef774
SHA1 044ad7a7fa7638240c4e4f18546e7eb449b32cd7
SHA512 db2cb377f6ac1fbe3d9442714260345cfc68978885e8e51ae3b23ce0439fade3c08297573e117eb6e64a55f63ce575f304dc46fa4b8ac6d6f3f93c60d83c5b6e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gLo:A3mnXoZjzyaEFo3+aWiauhzyozyrJLo
TLSH
T109259E17E7A120F9D116823499E51A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 957KB
SHA256 3153acb158ee01cd9c5682d752b8ddaf7b5c536a3bf06de0b79c7049f9b01606
MD5 67d1e0a35f3409f5dcc0c16605b89f9d
SHA1 5d6fabddb914520d3c72f1170556020f1df36e73
SHA512 567fc91cc6d610e5aa0499e6363c9b94c7b46229e41133ff663200336a76cb27765a635ef9feda08d37e4bacfc33a8f0f767c70763592314604bdbc9f7bdcc42
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gw+:A3mnXoZjzyaEFo3+aWiauhzyozyrJw+
TLSH
T166259E17E7A120F9D116823499E65A12F775BC361760CADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 957KB
SHA256 d5275baf4a4ed36897408044754d56fd6fdee445036e58ac953c654db3a81805
MD5 d32d81869fcc8c6201ee3c976be3b44a
SHA1 650d9aa17762646e778c340211d34750c5a006d6
SHA512 e87aeb3cd4bcda2934f0c444e75c8b6ce2b79842eda34c1aa66bddcae9c443879e8766f13d50f5dab9f5f65f4b05d0d11bad89cff3416eba2a36b2ffaf131cb9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gIQ:A3mnXoZjzyaEFo3+aWiauhzyozyrJIQ
TLSH
T1BE259E17E7A120F9D116823499E65A12F775BC361760CADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 957KB
SHA256 5e0d1cb95abc8a5d34b7bdab420e68bdf7cd04b9737c7dd078079a66b70f4cac
MD5 49290ca83c91c343383eb444994b874d
SHA1 2474716f908f7cdbc0d245fb7352f87efdfdd857
SHA512 ff5b0d436451df4e98245ff0d4480dd85b78b962fa8b3f816fa49cc4ce6b74c43dffe3c46228e60182fc8e5e31eb6d7ef881ffeec87f8146727b43b734019c9b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gBX:A3mnXoZjzyaEFo3+aWiauhzyozyrJBX
TLSH
T101259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 957KB
SHA256 c744b5d8d614955acd7610ca061d491da8b7f0bc980012e4d29bf1705eae836c
MD5 0e20b7ccff4eab2e261727d7bcd72fe8
SHA1 9caa89194bd63024f196fda6c7946a334ecb439a
SHA512 a8be4d60537885b2bfcdd011880c5790a5bdf39261786c7a55c20d783aa515b232eb87c547bdd2575793a4677088cdcf64d8dfb5524fd339e1e7610df9c4f612
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0g7L:A3mnXoZjzyaEFo3+aWiauhzyozyrJ7L
TLSH
T1A5259E17E7A120F9D116823499E61A12F775BC361760CADF236887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 957KB
SHA256 bcfa661d35275ace10c2b2e7282cb089c2214d132ead80ed8defca8bd50b5e9b
MD5 de9792e1961f70bb2bbd460e998da76f
SHA1 30f44dc00277281626b60b0c068f224770ebd381
SHA512 7c57038462a8e6d68adcfd857baa8d441d4d3e88c14bec411d8ffadd1493cbc491574ef34c0bee4236d8df9dfaa05502686a211201f6a77a0a787dd988af10fa
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gBFC:A3mnXoZjzyaEFo3+aWiauhzyozyrJBM
TLSH
T165259E17E7A120F9D116823499E61A12F775BC361760CADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 957KB
SHA256 62499e2bc5f71c29c90feed0d63c37cc395123fe6a61d5c1d5452cfbdf52d316
MD5 b0999b8f83830a1a30f34582306e98c2
SHA1 d34984db9f86ec3d09f6fcfd7c7d6f1efbbab006
SHA512 ffb8f4c9ee07b3e37cfc015575e6bd938b9cd85167769b021adf76a08bbf3e23bcfbbc64fc2ffa5993deaf92aaf1adc279679e9cbd98c081c8433029252e4315
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauQyPz5L8JyPz5L8r0gqh:A3mnXoZjzyaEFo3+aWiauhzyozyrJqh
TLSH
T198259E17E7A120F9D116823499E61A12F775BC361760DADF236883252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4376-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4376-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4920-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads