3bce8cd10b25878de2c2be4b7a38ae36c3f29d3d636e7ff93b91f5e738de2cfe

Analysis

max time kernel
86s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 945KB
Sample260802-at49rs1aph
SHA256 3bce8cd10b25878de2c2be4b7a38ae36c3f29d3d636e7ff93b91f5e738de2cfe
MD5 6e9c5af11c2dec077b66b427728c2171
SHA1 dacde83ef0e939c82f775f1b1fe2e29bb8e4aed1
SHA512 62762dcba6f6bac1f5852ea4aa5696813ac60146e8f92e28cc8217c8120167b5601181fd597ad41665d2f9bfc8d48e188afff78db972f57c48e067de52d016b2
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDM:A3kMhT1Lljk
TLSH
T1B125AE13E79004F9E917813499A54A12EBB1BC661770C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4260-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c616-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4260-202-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/956-252-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982f-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-458.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-714.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-739.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-819.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-851.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-972.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1003.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1095.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1133.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1165.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c616-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-39.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a42-221.dat	aspack_v212_v242
behavioral2/files/0x000400000001982f-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-458.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-495.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3f-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-623.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-714.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-739.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-782.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-819.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-851.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-947.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-972.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1003.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1046.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-1095.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1133.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1165.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1215.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1318.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1362.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1389.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
956	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files\dotnet\dotnet.exe	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4260	2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
956	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_6e9c5af11c2dec077b66b427728c2171_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4260

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 945KB
SHA256 3bce8cd10b25878de2c2be4b7a38ae36c3f29d3d636e7ff93b91f5e738de2cfe
MD5 6e9c5af11c2dec077b66b427728c2171
SHA1 dacde83ef0e939c82f775f1b1fe2e29bb8e4aed1
SHA512 62762dcba6f6bac1f5852ea4aa5696813ac60146e8f92e28cc8217c8120167b5601181fd597ad41665d2f9bfc8d48e188afff78db972f57c48e067de52d016b2
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDM:A3kMhT1Lljk
TLSH
T1B125AE13E79004F9E917813499A54A12EBB1BC661770C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 01f9cca7672b27c9faf6b1ec45eaa6e88b6f9492916bd0d1ba445d4e50f47a75
MD5 43b4bd6f6d1140102d0873b5e80b06e8
SHA1 b68a1769b719abaf6cfa72a678a077dfdbd79ae7
SHA512 dc43f03501b021cecd927177e870a2f1463babaeb615ecfe7277443d343d1e8a6a63709db0ab4d2fb2bf3527b7f8665dcebe67fc5c702cbfa61fa9dfb8a5a0e2
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDU0Le5ji0hmxNrM:A3kMhT1LljcPji0Aj
TLSH
T161658D16F6B406B5D033C179C9E29A5AEA7138461B30CACF1398D7292F337D19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 960KB
SHA256 1cb583ab1843a6d7f38a63cf259d2d71e85dfde634202fdd38b7134ad63d4e68
MD5 a7d338d8a70457cbcec59d0796b46794
SHA1 b006b691d74a2b886cac5eaf9da5ea4aca4e43b8
SHA512 d439f1e3715a4b47472d65cac3dc42cc81a1748da4a741164536f1be2be415a3d3fdc8f134fa5016854267f760535d5ce3acd966a71f5a2dc72ba6e2fa27f9a5
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDea:A3kMhT1Llj
TLSH
T1BF25AE13E7A004F9E917813499A54A12EBB1BC661770C7DF136892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 969KB
SHA256 78f33aa68c3605078d28090755345eeee31e49921fd8ae659aebedfd1a0babc4
MD5 2da49656718d1bc8dc72589fe584af17
SHA1 86ad404f39d45bff6b5c316002d36a0a071082d9
SHA512 a700474be9d65bcb10fc16fb16ad4dabcf36928bc615a4d0aca8d7894255357b4fef797895c29e0522d8d9842ec7add3a3d207ed51043eefd779584a6d3f1af6
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDf6:A3kMhT1LljK
TLSH
T10B25AE13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 969KB
SHA256 763544794b20435b38203e99c5406cda4a9e2b3be85b95f767744b968afd21b6
MD5 92da1d9d89f03702b802ce3db983258d
SHA1 af3b2fe48588208cd22602fd6c94c2e4963bd500
SHA512 52718cbbc218dba54d97c448dc6a4ecea3024bc8a81709555a6fd1b3cde8be7fe16ba4e36aaae4ca8eaad8490c6f21628519ebf1927a4a62f2350b24b156939b
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDBN:A3kMhT1LljD
TLSH
T1EE25AF13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 969KB
SHA256 9433e307f6058a9ac3cd1606a25ce97bdf88d5e66cdfc1496ec41b992cd713b7
MD5 3fc296b2b104f8fc6e507c88c3eb8778
SHA1 f7e8221874071ed58c07e89de71469e4f4e57483
SHA512 2ce40aeea3b87b9b611f1c7ff1f84f249c0e135e2b1ee52494d3176064766a7745c9314aaaccbffe07ff11ea53864d6e2aab290350d4f956060d87a9fbfc4e1d
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQD3f:A3kMhT1LljH
TLSH
T13A25AE13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 969KB
SHA256 11cae1048f1a5ae7f0a4c44766042e7fb6329fcb4cdb74a9c37e516b3cc9c3c5
MD5 4a874e015e5e097b36ec0ed807106478
SHA1 e37afcfc8373abf295732d7380e835f9922ee5cd
SHA512 bde718f81034b13a0402234f250eac40618812dbb0ce433442a66e071fc47ad27453b87799c3e15ddee07969d1ee2f833173b93a7d31fdb82eac4b62364ed68f
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQD5o:A3kMhT1Llj+
TLSH
T1A325AF13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 969KB
SHA256 fca8f3b3d78fa77747478b33077a8d631b62bc32c4d7bcd7f4c903ad2ea7d118
MD5 1d889aad734d71b6d0815d225ac9e195
SHA1 ef7a69432b631b861c485abf84d95207bfc4f51b
SHA512 39510b4272fd4d420758111bae588eb08040d25e0b37ca8f23e75eea66e3941648552c5ddd7153ddee0b166cb8f8b1e99fc7f2fc4ef57ce17f01b83b276521f3
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDpu:A3kMhT1Llj4
TLSH
T1F625AF13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 969KB
SHA256 458228221106c74a41a036673ab5c5736c090701d83c1bbce715778d37940ac8
MD5 a3c1e00f1ad1de933ca5e8d79ef6cecc
SHA1 34cd1c690bd25a941c64bcda9d3ae0c726e358e5
SHA512 c27e67ce27a1465ccfa06c0c05ad97da8fe85a8dbb0b19b307e3d47da4fc67cded9d02874e41c4dbbe73b6330905f1c8b0406f5d725a1de8d94aeb857f6a766e
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDP9:A3kMhT1Lljt
TLSH
T1EB25AE13E79004F9E917813499A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 969KB
SHA256 ca1814e19b5f2439677a1cb6fbe0eec63f30de41b5058b2a68e8a768f9b92ca5
MD5 28d1363c3d940358ea826db9f050644b
SHA1 00553f3b97eae27a961a9cf786ff6d592562225b
SHA512 8495fe5ad2440a7a1ec0a3a9c3e74643148fe2e6e672fd5b35e5f218316147c3fbbea046c8e9f952c20db178d5d39d5bef73fb3d37f87f5ee48202bf644cbacb
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDrc:A3kMhT1LljY
TLSH
T17D25AE13E79004F9E917813499E54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 969KB
SHA256 e38d5753a0c58f98b9be2353a248bd6babf36d6b6254f2f5df8750ac86b9e439
MD5 fe5501079ef4945f8867c7b64b9fdcdc
SHA1 4dc405345b143e71bd439c8eb8fa28947a6887b1
SHA512 091e6b57b9e5cd854dfccd3f1b5c5a1ffeab1ba26329ade4bf0c470ef511d91e38070877e1a2fcb29792b70a5ca722478e40be3842e0216f6d9956880088591e
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDUp:A3kMhT1LljO
TLSH
T18E25AF13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 969KB
SHA256 2a2528de45e04c898244bbdc2aa96815c80b179d72cf6ee0e1b5551da5e7534c
MD5 4516f00d0320560a241a46469a61f13e
SHA1 ddb17df81ab843b237d264042eac9ea734903bf6
SHA512 50f614f7b819f6624dafbafddb4d799ed39f2a10c68827c56328848e9494fd115aca449a30456afcf7d91bf2452ce6c55a7528b2e1d620711f2b53b0228952cf
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDbN:A3kMhT1Lljh
TLSH
T18E25AE13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 969KB
SHA256 03577b3f2b163c9e6669ea5d567b563fa4bd59d28cad87e75670890e6c855613
MD5 52ed619d82e1c0776a2fb406dc115c5e
SHA1 d52379ffa2e28ad4c397fa46a11af48ad6d0bfbb
SHA512 309f4dcaf085507b7fed910f73b376e1271052de3789b8830b85ebc510091be1c822027806dfd21698eef264bc0b81d1432f52dfac04a4a98bdf11e49e380b90
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDpF:A3kMhT1Lljz
TLSH
T1C825AF13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 969KB
SHA256 50833f85a67ce7bc3d65bb4d14657ac702295cb8a434c873c1581d01a7a0359f
MD5 480e4b2c76601c95d2e62de50822abf6
SHA1 f9e1742a08935acc34484ce6882f1cad87ade67a
SHA512 289a1909a9c9d038236d622d0c87510e54849c4d8c4335883beeb6223878a1d3e660de48fa356d1e151b5cc7ec76e0f52cc6c223b15ae7771c60b1fcee0b074b
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDCC:A3kMhT1Lljv
TLSH
T1C025AE13E79004F9E917813499E54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 969KB
SHA256 76b3b4cd63b09592a68be78d4d8f8afc1016df33d1dbb9be9b760a861ae630dd
MD5 8a95ebfb6096e034676d88c120d38a6b
SHA1 b1532ebd22622ee76701d360f53e0e968ef4e3d2
SHA512 9e0e018904538f632893e6d7705c3f5bee36ac9ecb3f1361ba5e8e9138f71f080f50c6d53635809bcf6ed65ac0d933e506a9fc6e4887a7c6e7cdbda25a70c41e
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDdw:A3kMhT1LljK
TLSH
T1EC25AE13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 969KB
SHA256 dbe748ea93696c4bdc6086e4a47006da1dff6c85b28469400982bd56ca1fa889
MD5 164bd3584733cde4b32bd73a6fd11906
SHA1 0a495a45bef6c565b12b270041b5c878968efa3e
SHA512 b997aab360fd3071045eb9ea153c3e217a4768033af81e5b9f8e208272c57c9f6d286785e5364e6e8eb824999f0f347036d872cc1688a10b28be9461c719f1fd
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDMT:A3kMhT1Llj6
TLSH
T1CC25AE13E79004F9E917813499E54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 969KB
SHA256 cf8a387ca94c56477f8208320856533e995cc27e63466cdac5417ee65ff46eb2
MD5 f3a60cc216707163798ace6a07a8eda0
SHA1 6767aa7e41e613c67eccb7f3fca0baa5dae991d5
SHA512 6e01c3b484e692a12564f8f60aaf5f5b14edfe7ea140c5b3ddbdd5c9472b7cf402905bf51d63845330281c591b8f25b50fbe43271fd3e9c9974f67f6c0b229df
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDgu:A3kMhT1Llj1
TLSH
T16525AF13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 969KB
SHA256 e8ffe9c4ecc51008babe436bfacfdd158cd14f12d7b750694eaea41e2c2c9ff2
MD5 b587be5edab648b0e86813c94d8357d5
SHA1 d0a16685f25edeb9640fd6c04fb909e1f60a1a18
SHA512 cf4a12603e0c2cd5acefc910597bf1c43211a4357662f0651d428e0536d1d70c91198a510666e92c32219fe0d7998aa5cb4c68b37502950031e433fabe6e54bc
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQD+b:A3kMhT1LljU
TLSH
T17F25AE13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 969KB
SHA256 f4d30d00fef881311152a4b43cc453462d53ac494dca7525414bc64878ba67fe
MD5 cb492bfa85d50c025eba9d1ba95db727
SHA1 cb90998303e7001cbed6406aae88635c6c0b41c1
SHA512 1724be3c3ba640db01eaca217ff01c7a65729705ee884a7a80085d0625e35e10cc7792fe68966554f4c00d9e6432f21ae7a8a9fac0f86ade2218fcd6372df6aa
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDof:A3kMhT1Lljk
TLSH
T15425AE13E79004F9E917813499E54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 969KB
SHA256 645e1f03cb8850f762c632f4c68bd1f44c9971d8e3844432ca7a4caeb969ad0c
MD5 1a5eec33074aa51f3d6331dedccc7b36
SHA1 0f16e882d3035da952ebd9eb73030bbe262fbacf
SHA512 0f6f5eb4914b2cb736d8689029c318e9847d4e2a5b2f4f8f9ded2c2c43d644bd42a10666a356df81cde9f1314c3b3a2cd87d54a683f76fdd8fba529d720adde7
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDFK:A3kMhT1LljU
TLSH
T16A25AE13E79004F9E917813499E54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 969KB
SHA256 c7ec6fddb1e4e923e54eec7559121fa66d569bc813ad49503c503151b46e5e88
MD5 202b72170eebcd054a1e172ca3eaa64c
SHA1 1ac9dc51ebbb08f1b8fe28430fd215e487f8a411
SHA512 4cb3c38b2cb08e1f07b5c2087cc61e2f0b4fd043545d7b712d050d90b17b1edf33e2d8fbfd574d94fceab07e64447f4160e13c30967a2ee535e43b0279d6f890
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDGk:A3kMhT1Lljt
TLSH
T12425AF13E79004F9E917813499E54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 969KB
SHA256 2e967dcde8a7c7fcf1805edbe09824ac67e2ae00caf20b97fc7dfba5117f99f0
MD5 4dc77ecc733c6a33072c873f39df656e
SHA1 69793449dbefdf9c5904a4b5eb40906c7c74242d
SHA512 c9f561499b98614ed1b0e39928820127e0780f8a77a014f84c7aa57210b84d7417ed005e6d4b212400a0c5d83d0a8763fc3c5af551d87eb0d84e2a38b71a21e5
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDD0:A3kMhT1LljQ
TLSH
T12225AF13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 969KB
SHA256 0549f2967fe1dcc753ee938e36ec44f97995a4e6c53a10f0b063ed3a82398990
MD5 5f4ba7c4f9bb32bb43835b813c3d4ea6
SHA1 c60fab461e42e4c9fef6eabe2949056e74beaab6
SHA512 8848dc4441d54296ad9e2d0ac4e70cc6420eb96cd96e181b662bae9056e20827a034944855160c5eecfa114bd4e6664ca4d993ed1fa67c2b296e6fd43d74e44f
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDSg:A3kMhT1Lljl
TLSH
T19125AF13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 969KB
SHA256 e66da3748bb795467d3d472289872cf0b0f141bb6f0f01862ba75a5eed7e1075
MD5 f67b963d89bc53e9a5f0975df415305f
SHA1 dbc719166ab4015cb471b9683499fe4d0977a147
SHA512 8ac84171c719c7a3a1aa1098c8af597300185bb069b2d4e2fb11a1c38b1eacb2b3def4ebe795e7455f99499d586d58dfeb774a4cd28a2e46c57fa934301e3ff9
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDzr:A3kMhT1Lljn
TLSH
T14125AF13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 969KB
SHA256 9b9569a38550e1a3f9fcddb4fd1b64f141d756452d49d6fcbbf855a8d818c5aa
MD5 f6d9cf7945eba1c04d271734811a8a6d
SHA1 b1b55463e0e1c3eabde6a2cf728060d37c73edf3
SHA512 3662d417b2f627fe6d4e90bff546245cfd7c96f3655fde109aed9487f4016c3cdbaab3c3e65bcc19216b14b9e45828baf3f6218bbe9fd5887af04d12a2f058fa
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDVn:A3kMhT1LljR
TLSH
T19325AE13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 969KB
SHA256 7ccb8ab17c049b26a02a0dcf4ac1944a860f5aed1e2624306508d02af489c7af
MD5 c67c2b56a430969c5ad71ecacd94914b
SHA1 0a4ae3b213d4fc5c0a3ce66ac5583c67764852b5
SHA512 61d5abb5cb742d65463c90be4d4d474a272523e06596f462cf25c19753e5c95c9ebc851aaa1a2b94cd0eef0856ae62fb133914ebf38e29ef1a6db7bbc16830b4
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDhx:A3kMhT1Lljf
TLSH
T11125AF13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 969KB
SHA256 9d974c83cf461015c63d0e7b967ec04ee108b623e1e461e90aaf0cbb6d5546d4
MD5 7f6f1a61d9635842f6eb56edd8f45d33
SHA1 535cdd3b843b203cd2ceca669c5d6b1c7eb79416
SHA512 04001b4b0642f370571809b5fb3b8f96c022ed31a4d13880796326910d58ae9ebaaf710af1a0aa369d30967138b38e548d544d8dfff512719e33567d861ac3e8
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDPA:A3kMhT1Lljg
TLSH
T18025AE13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 969KB
SHA256 422198e1e6088e49640803cc6b9145b4f8b67c71025370e2d5a620259993e071
MD5 ad86845ff499aae1eac7df6013845228
SHA1 7da71f8b790957716b59e2e1c4706c3f08d0d616
SHA512 778c0b4c84a7ddaa1163b9a84b5fe7c717456e266aa7604602edd4a8e371ada47c89d5ffb6ef2ed1fccba76e986a0f61e8df31604a776df611f148085a0affe0
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDA9Q:A3kMhT1LljZ
TLSH
T12C25AE13E79004F9E917813499E54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 969KB
SHA256 841dd292347e64989c304bda266a0fa03630188062d9aed78b70643efab1a69e
MD5 7984fb4839380b35e27415ae32223d4d
SHA1 d6c10468192941868a25d9d87de5e5e9d0e386dc
SHA512 1043e1b681baa0cff827928070fdf90cbf540edddfbb30e8aa460d43a53a2b0ec4b13b6bf1c48dbe45242bf21bd0bbec34ef6a364526c747c49ee873fdbc2b25
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDB4:A3kMhT1LljO
TLSH
T13A25AE13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 969KB
SHA256 33a89d2dff35fe7f9b263f2658db429a94119f1e049df8880a84514af1ee45f0
MD5 0b698b526169f070626b6c1f085897f9
SHA1 3273761649f14e71c9476b27a74f54d6af1f3c2b
SHA512 74f835915657a298c9c11632e73249d197d70bb4e6c360fd162da6757735f8e7915939d2150b6314749b692ea2ebf0edd703295ccea3f50a4aa56c2aedfd818e
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDku:A3kMhT1Lljv
TLSH
T1E325AF13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 969KB
SHA256 b28852af6108f9949e4b24d95c37ad773deaebb2c57a0af8c59581812e9441d2
MD5 cb0ce174598b243ebcc1f4357def6e48
SHA1 1c6e75c8b03345ee2b8b1c31bce49a9a96058b6e
SHA512 94396fa4a5d33b80d5307b7ac8a279d19bce8b188eaf9aa99aa7d1c39ea25733356d63feaa32c8a1439ba85616692a3961590b45817c164712f135b68f54ebef
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDVj:A3kMhT1Lljx
TLSH
T18925AF13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 969KB
SHA256 e34b033b5dad3e8a0c89fa85e69ab9e366593348bcb7089e92c5350e61c533d1
MD5 b0e679c2da61999241c16407eae1d327
SHA1 4ae453dab3936d46bd7da9d8e382fff37a09c852
SHA512 04267f73194dae2906917e999b04ca2eebd2973d2e70d20c450aa3e6aba0b9d06c886ce88cd96ce77836f3aa2ae5c978a69adf6f2511964b52b267af3c19f79e
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQD8g:A3kMhT1Llj1
TLSH
T16225AF13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 969KB
SHA256 5805fc44e8d14364fd68e50debe6cc995d62ccc31262cd33265f6ce7b1cfaf11
MD5 52bcca2919abc7cc252b15541530cd9d
SHA1 4f95f305e6499c9dae67b7aa496dfc879f9cd006
SHA512 2d6ed21db0d8f97b477d96b284e3784b4c0b05a4cc20457ad30657b6f2792847159d7f5f72502d3256732effde60fa6d47ecc5c7a9c418911c099a2ec7c8b196
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDjI:A3kMhT1Llj8
TLSH
T1EB25AE13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 969KB
SHA256 23e7c41a9ee1453aac2120f75ac25e336f389b04d0a40327d8982b18fbf18df5
MD5 bdb1e1ff65909edbf822332fb7385646
SHA1 661449812902badc725a3a25d9562f1492a95639
SHA512 e57e575370e0801facd04cadefa3c1a7ccba189ed389c0c17a3e360d3b1a59e18849ad5cf3285b5260d7494681c1a8bbc7d77d23c6599951f8f91f168c50d377
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQD5o:A3kMhT1Llj+
TLSH
T11425AE13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 969KB
SHA256 8f15bb5c82aafd1d6a06375ac3a18c9f5cb0499fc60347d6539405e6a20201e8
MD5 5a3a753cd99afa53921827082d9f1f9b
SHA1 568b25ec32a427182b13158eca57f8830868b796
SHA512 927b9a1389f7b48cb517b8a1aaea370a3f762d49953e0f7fce7ebec0eeeaf82c771a13de430fa2e170a4ff7613ab908459129bada0e7dac6b70f62adf850a394
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDq+:A3kMhT1Lljr
TLSH
T17A25AE13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 969KB
SHA256 73d3e01400416750b36dd479630d47043e43e738774c4fa3e2d931876772810d
MD5 9fbfcc7a5ffb195503eaa1e5e1873357
SHA1 81c3fcb7e1e7120afb2c9e3c93e54038117a7d81
SHA512 7d92cd008d1c48e5febb0277ceadd18da863d54bc36824261713d00bf7cb7379b0da362deace5261972a5be391fc01168bd80c2c4ed2884d780aa6750d7c2b66
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDqQ:A3kMhT1Lljv
TLSH
T14125AE13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 969KB
SHA256 008e61b7b51f30df203a8f79eec1962d82c98265066de52472a6537abc67bba0
MD5 677e350626bf44c776c7aca9cbfc2542
SHA1 fedf83977e960609dc31998b5927009aaefce270
SHA512 71d3bc0217882e048a00821dd630b4bc0149b55c14d0d1087e447326dadab4092857e36430bc6a41801ac43fe06b95422c296ddaef8aced5e739070209f1e524
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQD7X:A3kMhT1Lljj
TLSH
T13E25AE13E79004F9E917813499E54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 969KB
SHA256 e49cf6432391c5c85f13be267e7567e5c33f6530b1173e7e62d8bccb47401921
MD5 c6f028ee18574f8db8801082019ca248
SHA1 3095fdffb30a7d6c4c9967a6675f699dd5438bc5
SHA512 3c1c1652b2153e043ef3892188aee9b4bf3e6b6aff170349d3c5570b836e8103566eaa1bcec946e54d049a1ba0e8db6842e2e6a893eca0ffa5e5e2aa2a5d12bf
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDpL:A3kMhT1Lljt
TLSH
T14225AE13E79004F9E917813499E54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 969KB
SHA256 f3d39d0922f12becf1f8616964e2a1cf7e7db25c32d3ac8fc728e8beeda04618
MD5 aad7f1bfbd75d06ef84d39e8b3752eed
SHA1 82f0cbb451371a6c3a4a5ae0c6809b2b62bd5a3e
SHA512 f17be1840d789d43691d910e03e0f6052481537ddccb88037671672d628752f772e51f1b7a4f7427a42c8192992d535cb371cd380827b1b71d52e6f8d76ac299
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDXM:A3kMhT1LljU
TLSH
T15625AE13E79004F9E917813499E54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 969KB
SHA256 165d9c1fec6ca3179ac62c9408e3145442b912da702ae4515bad4a221c878028
MD5 1d8c4bda82d33f42cfd0a84ee547639f
SHA1 cecdf23105697ebc1594ef3e35f5b5e3d4dc16e4
SHA512 87375566b5ee94f40da17129a06d8c1423793278d44e0e3deb2ba986c6bfd4c404af8307f01d180e628da6853e1ce4ccf10819f2dec9cc801c6e2e88dc08662b
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1aNxhFQDgh:A3kMhT1LljO
TLSH
T10825AF13E79004F9E9178134D9A54A12EBB1BC661760C7DF236892262F337D06F3E7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-252-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4260-202-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4260-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads