428af0be1bf8631c3b74a1b8b20c2179c29d900f99cc77e55df86f6a5bcb7524

Analysis

max time kernel
109s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 889KB
Sample260802-tyjneacf86
SHA256 428af0be1bf8631c3b74a1b8b20c2179c29d900f99cc77e55df86f6a5bcb7524
MD5 e2e251aa2258b827c7a79eeaaa135c26
SHA1 fddb6a60ada1d26465fd464bf56de4ec3b0da196
SHA512 438fac74745819a5e2d3a2f303e502bbc3c34df1214d84cb42f8d1c9b933a7287a92499aaab3851d2d304b224e0af3a0126ae42330011642ce72b4104bc44ebd
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2Rao6:A3kMhT1Lljr
TLSH
T1A715AF17E79014F8E927813889A54A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/2448-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c429-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2448-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4920-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c81-59.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018953-203.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001ba8f-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a53-313.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019840-475.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-500.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-591.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000018a52-622.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-678.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-771.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-802.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-851.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-870.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-909.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-928.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-985.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1054.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1103.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1294.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1351.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c429-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c2-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c81-59.dat	aspack_v212_v242
behavioral2/files/0x0004000000018953-203.dat	aspack_v212_v242
behavioral2/files/0x000200000001ba8f-257.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a53-313.dat	aspack_v212_v242
behavioral2/files/0x0004000000019840-475.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-500.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-591.dat	aspack_v212_v242
behavioral2/files/0x0014000000018a52-622.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-678.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-771.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-802.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-851.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-870.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-889.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-896.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-909.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-928.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-953.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-985.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1041.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1054.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1103.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1140.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1185.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1294.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1331.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1351.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1384.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1403.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4920	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2448	2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
4920	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_e2e251aa2258b827c7a79eeaaa135c26_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2448

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 889KB
SHA256 428af0be1bf8631c3b74a1b8b20c2179c29d900f99cc77e55df86f6a5bcb7524
MD5 e2e251aa2258b827c7a79eeaaa135c26
SHA1 fddb6a60ada1d26465fd464bf56de4ec3b0da196
SHA512 438fac74745819a5e2d3a2f303e502bbc3c34df1214d84cb42f8d1c9b933a7287a92499aaab3851d2d304b224e0af3a0126ae42330011642ce72b4104bc44ebd
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2Rao6:A3kMhT1Lljr
TLSH
T1A715AF17E79014F8E927813889A54A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 f220dee7d1241f92e4aa0612c494665886521521d0202df15c7f8e2b958b4d6c
MD5 3554d1bfe0467f6ec150b32d9102d526
SHA1 d0bc1a5b7d01378d0012e0894b1990e1a8392704
SHA512 bd8431511501107f5848ca92eb16ba5bdf97bcb82bd9894c0aea2f200dfc91ca76654dc3fe71be47329c67a20d9a6e590b65f7160ceaa24032a93482fafbd3f7
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoK0Le5ji0hmxNrM:A3kMhT1LljXPji0Aj
TLSH
T166658D16F6B406B5D073C179C9E29A5AEA7238460730CACF1394D7292F337E19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 937KB
SHA256 4bbcf59fc731a1bc6243e9fff1a71150fbd7bc6b1d27938e5bf6812535327ac0
MD5 aaf2e53b9a1fde1d02e0679bc411b391
SHA1 a28e0b2f344952e3d0d2dad6ea2906095394d072
SHA512 4893cd30d9374befd55a19fa8ab97487e9d86e02194bfc2ced39bd8fb82fd4dd7d21685247a3419eab1ed3dee01357865e53efe52db47f528c095976d1764122
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoPb:A3kMhT1Lljab
TLSH
T1C615BF13E79004F9E967823889A54912EBB1BC661770C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 913KB
SHA256 7a3c67c2b5bae4949dcaaafb4a0e339ccf4c576f01a3fc8ab7d40fd89296648b
MD5 d5fe2ea2d3e1d206f228c6262b3355da
SHA1 2951bd5d27616ae08501ae3cef71552d7d30f55c
SHA512 492efabe28a8bc214c66670e3b169aaa658be42e8d8af7bc796f72755f27459389f7f891c996e522cd6b6475dd7a677ac2bc81a1107c605ce4770ddf55424b37
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoeZ:A3kMhT1Lljb
TLSH
T13C15AF13E79014F9E917813889A54A22E7B1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 913KB
SHA256 6d3609cbee71fceae38a6411d4c8ec27ec952298ba5885e19c21b48dfef85c4f
MD5 0153d093cea19f7717e55029f75b6ba6
SHA1 d2d361f5a43c023dceb4c343222550ab1a57c3bc
SHA512 c81c31a92030de5e4bc1921d55152c6834954aebd8df49dfe905f58c7d63e517edeef7684995bde9a2422e1c56be7c4bd368aff6dc52ea11e1325a9a4517e5ca
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2Rao51:A3kMhT1LljE
TLSH
T14C15AF13E79014F9E927813889A54A12E7B1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 913KB
SHA256 adc80f67cb1c98cb02321b8bf77d9b8031483dc64e1746eab6b8573ffcb97921
MD5 d1704b5da9f027e331f1497b3a63079e
SHA1 020d859f312d93419004c9f9e08563591ef5ddb0
SHA512 0a92f8a9859d1deb33b5d222eabec2b8360153c1cc977162b9c39458b62b5ea6d0650a4b2584e529053b7a99e075c2a1d1f9e54d5a260eca59ea2bce1fd897b4
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2Rao96:A3kMhT1Lljf
TLSH
T17F15AF13E79014F9E917813889A54A22E7B1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 913KB
SHA256 d8fc2bd3658d54d01b203a61109276b1cc8b9ab4ad1b89cffa0821a7b2719542
MD5 71859156d3de278eff29f6b9252f185c
SHA1 5866e08684d5f6a76c57b5f5c3a3196e1169e099
SHA512 d92cc6a877da90ce6e31a57e362cc433994836a1053f94620c92eca7756ade7bbd068e796e7c887cc45c1968645e2cf8e935ac86f31f7dd71a125ec086daaa7c
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoTN:A3kMhT1LljC
TLSH
T10715AF13E79014F8E917813889A54A12EBB1BC661770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 913KB
SHA256 59c613065a02a16bb01f53c68ee84cb6b5de43d242f27b1b257f84f4a32e79cd
MD5 d20a43a51d53c6e2cfea6e9cf1eaa8fd
SHA1 0c8f05cd88a791d3326eed011dfe65d4aadae949
SHA512 5402bf960cf247eb9eda6057c0bf86c1ce7e9c2d5eebc2eeb4951e1267293880373935be91e976075ab6fc2cd766fbbb5043763d002f83cea8ab532bfc548640
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2Raohf:A3kMhT1Llj+
TLSH
T11515AF13E79014F8E917813889A54A12EBB1BC661770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 913KB
SHA256 cdcfc78ee2e31d52af8d787eec9c686a694e54ba1438766e3bfe524a76a4c0b6
MD5 a4fee42ebb5093d935ef793e5d3aeb81
SHA1 5c69c324788a2365ae015faef1d9731f3af74581
SHA512 e66578dc5bdd8f84f930a2c38cdaeaf5c6aac640abe9ae1ee2f5ede31e726d033a3a73aecf6965e3e1338d0c561ac2857f7a4399a082deab014fda6cb88ef953
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoDo:A3kMhT1Lljf
TLSH
T14F15AF13E79014F8E917813899A54A22EBB1BC660770C7DF136896262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 913KB
SHA256 e58348f1a7b0d5b30de21876d3a117203201641778c423c5bfafaa8ee0a485e1
MD5 68cbaf8a7cb3464e6109fb49cd3b2146
SHA1 3360421fa455fa4dd3010dd90b8637982575ccf8
SHA512 cc5039fb188bc1244fd84e6075cdf08569c2510a082414092e16393fa89133ebd47aedecd571b1a097f1d38a6de850da4d3e6c1827f9d21110e0f4fb224a88d1
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2Rao3u:A3kMhT1Lljx
TLSH
T10E15AF13E79014F9E927813899A54A22E7B1BC660770C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 913KB
SHA256 4638504907fbf48b824a7194ff5462d5ae4ff1ef21595ee25c93cdd57ad93699
MD5 64bd64d3dbf41d3b82d2bf3ee9dc19f6
SHA1 21331f8e3bac6ec5f846836271d8392c19c24d77
SHA512 537d9f76dff2d58e1a834ef547a9ddf0ae4ef47c6e129586d1f35ba59109427c299d02ac9bd9d8410071640ff50a9fe39827c240a3e2006335f94d6869d1e04a
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoF9:A3kMhT1LljM
TLSH
T11D15AF13E79014F9E917813889A54A12EBB1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 913KB
SHA256 64c9dbeb7a2df14f1970482c5b8aaa91c4935430dec02dc1ce8d4e81712a55c0
MD5 07baed49beb1462be1812c2cbf66369f
SHA1 7d7cc72f91f9770d98e276afecd718818eee1f8e
SHA512 9a6fe6ba7987e42479230a53168be34cda4515dd4a441c3cc54e3e8b693d7db221cfa3197d1a9aa2a30324b92bd9902cab4a58d0a6df1de32b1dacb91ec62c57
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2Raohc:A3kMhT1LljF
TLSH
T1A215BF13E79014F9E927813889A54A12EBB1BC660770C7DF136896262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 913KB
SHA256 2d5c25e9d0e01360d53880f6dd984e54de955eecbd3b01afddee7f94af5230ff
MD5 55687fd2956fe244836c8d8e9fd26437
SHA1 558b0ddde4748184db4d1eebecca0dec0149a19a
SHA512 166b525703f1c3e0f9adaf09de01726c41d06517629e12294d8750f369feff7ac08a92deb77e83830bfa870f3520ba41c40fa7d9b5e1856de1fca36a67dc9d9c
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoKp:A3kMhT1Lljr
TLSH
T19715AF13E79014F9E917813889A54A12EBB1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 913KB
SHA256 a68f2b065fbfb1e05689cb5292f337f80e346fab925786d6ba50a33fb953cf8b
MD5 10c60b9b5abac687e9e400ab421a4a8a
SHA1 d108307ce9a96e4c4a174b83701384d740e868cf
SHA512 5de18d6ac5938849b9bb6f9afaab2d7d1c32fdae8cd1799f33989bf247d05c07502595f317d56d75bce927b0bf0788cc5484acab2cb5c7187426980177fa97f0
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaotN:A3kMhT1LljQ
TLSH
T1A215AF13E79014F9E917813889A54A12EBB1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 913KB
SHA256 15241ffb12cfdccb866061fd1d25213231c306a9821bf828fbe21d92311c9203
MD5 5544afa8b0448b8b927f919b0819d737
SHA1 ab328bbe482e75787f4381cd18cf431d042afeba
SHA512 137f4706b4796284f6de254311fe2621e611f271c92a2de074b527edc12d2b014febacf9a2294d6ccb9a58aae8732240beaf1feb0286b76bd5b9b16c53539f68
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaofF:A3kMhT1LljG
TLSH
T1CE15AF13E79014F9E917813899A54A22E7B1BC660770C7DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 913KB
SHA256 ec325b5f20c54340e3bf30a7224b5fc477ad610fddcf6b724ba782b9cefe049f
MD5 13d29be03823c7f1ac69f043f2612c09
SHA1 15daf856f171e805fd54db1c781468c147b29399
SHA512 e65144c9f90b6231b50c35147b3c26f831de2beb7b461b8304d3235bcff0e1076df1de7a96ae06a63f420cc40db746deabf0e9fbe01e4249a2082d99dee381ff
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoAC:A3kMhT1LljC
TLSH
T1E515AF13E79014F8E917813899A54A12EBB1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 913KB
SHA256 cbc985b12605f859a48c0bedb999d781a4e606207d5c8bc12ffd51380b5bf716
MD5 efe0c816b82efb3dac28bcdd27bd53a4
SHA1 b9ddf0debca5bf45b717414d097aa8dcd793902c
SHA512 2202e0211d7c9735931f984f19032db09aa6dadd75a9f09bdace5f89437181b7d0883a4b0a584bc904979b9d2ec722f33c3809937be59d6baab10a5869efeee9
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoTw:A3kMhT1LljX
TLSH
T1B715AF13E79014F9E917813899A54A22E7B1BC660770C7DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 913KB
SHA256 4c5656a9cc9f6000558d7a32ad7de7be45e465e8b60191397fdd8b3eb5057cdb
MD5 4bd45f9ebd71722de3dbbef551de1499
SHA1 c67521ea60f2cefc5113930b5dc86e624b7e6264
SHA512 c67d49dad4b16b5f0ebccd58228f7941e9df50fd4a0c91a24c349f7a75bee8167e4ebd8174f664c4272a87bc263c0c49731cc596915d869abbce7726463d195d
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoaT:A3kMhT1LljT
TLSH
T11C15AF13E79014F8E917813899A54A22EBB1BC660770C7DF136896262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 913KB
SHA256 4e5d770f99f57189e193a8a07c9a051d4910913f07253d9febbb34ee53aaaea1
MD5 00064f98a75911ad387705ec62637202
SHA1 23b02357b3cfa723d24f6a6ab8cc562a20654af2
SHA512 3778e8e53cdfa5586ea39cb6c8cb81deb13779ddd093ecf056560acbcb6ead8d32c30b029092b8f09feda69afc5abffabcf39c91ae0ff6b72d79e8948dd1c4ee
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2Rao6u:A3kMhT1LljE
TLSH
T17F15AF13E79014F9E917813899A54A12EBB1BC660770C7DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 913KB
SHA256 0d9643a26e09f20c9face3f68a7f17610b469154dba4f8945981f75581df9152
MD5 8c04ee6920862e6dc5bc6dc8b4519458
SHA1 9a4172a9bf2d3957f2eb121f1b9653dd0a68f55f
SHA512 7707162372e2103cde5e7c8b93263a1451ab7511084866761726931679d999508890e0dc19f149487ee1e67b48b63d9b829bf974600f7153503868957ae60c5b
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoEb:A3kMhT1Lljt
TLSH
T19B15AF13E79014F9E927813889A54A12E7B1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 913KB
SHA256 fb2b09cdf542ec9d0ae0c09f344ce32ec0a53480c56624584f90557c628c4909
MD5 4223135e40da26c35e8c135e05c02167
SHA1 a44d501277a843c9733f706970ae2c9f3cdee7e8
SHA512 d10cc0e941ea113c09c486f53ea43300994c9636ec589e0715781305b79f7d8307659ce5c333f439b5fa483fc5d4b9e38265283df64d67821018955e3f157aec
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoKf:A3kMhT1Lljd
TLSH
T11615AF13E79014F9E917813889A54A12EBB1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 913KB
SHA256 3f191588d778339fd8d6caa9658a951b3627601a10b9f1dd6ea8ccfafa5e3f82
MD5 d53101c86fc5ad8a5f1dcf18ce620b23
SHA1 b708fa80622bdbac1744b269346291af565c5301
SHA512 4ba0f422f3852c24120e06c2462e9f0c5f1836e6e1ebbdcfa286b873c93e504b2b55fceda999e4e094c5b62891fd6b3f27b7dbdbb0f95cfa034d7598570e143d
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoXK:A3kMhT1LljV
TLSH
T1D515AF13E79014F9E917813889A54A12EBB1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 913KB
SHA256 e57dbf5680c75048fcbfcee5b86b1925fd930e463834c83ee23d8bca38702212
MD5 6bb0f9d225727386d80b4d3a6bc78dfc
SHA1 a45b82e255a31649e8f6028fd11594a61eeb04de
SHA512 01586ae71d562827a9849695ec369d36aded2b60d979be19db361a43ba1967540b9dc8fa8aa334cb90eaa921c4c2f93524d6784e1efb39e051983712b160f3da
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2Raogk:A3kMhT1Llj8
TLSH
T1C615AF13E79014F9E917813899A54A22E7B1BC660770C7DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 913KB
SHA256 1a15445c2792e409567c73d4e65f70915e8722d0c420345ea98203d81c8ea8e3
MD5 70d82d55fc743225ddd0eeb5a7effadd
SHA1 ad53bb970fa721ef17ea77211ac62b5eeb55c910
SHA512 75e33a5a4cc6e4ae70c5e13e0ea7f927b782e2fa943745a325e23a48d18acb19cb68ae5d70149428898eb7f7a066e70560399cd29ccace66fae3317c7c8ba99f
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoR0:A3kMhT1Llj1
TLSH
T10415AF13E79004F9E917813899A54A22E7B1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 913KB
SHA256 1f36efb93b2909e5db6e3e958d78f28c839d40e7d1f98585182aeae7c60e4585
MD5 0136deefe5dc2f4d5bca10389bcb4d36
SHA1 90b98aa01a9dc6cef9aa6517dd3cdc63764bd868
SHA512 8eeef4d6bf4c39be878be409d753be29b0c79925ba7549a73fd04ac1fb148128534ff2eb1edbaa001e3ff872c6c992e76fea9ce21cae1037fa26258c5ed5cfc5
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoEg:A3kMhT1Llj0
TLSH
T1DD15AF13E79004F9E927813899A54A12E7B1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 913KB
SHA256 d5f34f0d6af0c049916e53657296b2b541a3264560305088e8d3c88a7f1018a6
MD5 b7af05d610664e17f1f38df31bd4799c
SHA1 d7b8b944cfdf444167bcba65290292f246352055
SHA512 ca83980dfec7ae70e2b34ee982be0ff9438c3c90d4960d9323d1e106288fc8fb4309f55e53713fdad8627e40ee201babaf13196c09e6c431f6804fca5976fab6
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2Raohr:A3kMhT1LljG
TLSH
T1B915AF13E79014F9E917813889A54A22E7B1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 913KB
SHA256 9d248984be4206a8ded8f140682c21503c647006a47c334e47b6e0d85436e1d8
MD5 6a03a24eb72c8b02e213f7e4f8eb6ff3
SHA1 0fccc4a54a92a064b3c46d9c988a29bf2ec1de3e
SHA512 4883e4ccfb6f28c3aacb5c1b88882406087e804600ce0c0c0dbfd09d57edad48b4bdd4f2e741835b09d461921af8ff5165d1ba53a834e5d9fb6ecfbe0a4acb41
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2Raojn:A3kMhT1Lljg
TLSH
T19F15AF13E79014F9E917813889A54A22E7B1BC660770C7DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 913KB
SHA256 f6c41d4a544a1432fe0706147330a833962ce5364b9a011dfec469ae8971732e
MD5 50f312ea50ff9b40e1e931f22cef7df7
SHA1 3dd90a069864c5aa8b29228be8024028b110f4e7
SHA512 00e93e5fc229c9562dee69ec06d152dba6ab702ef805f2c33d41c248203aba5ded307b3cf53d5fec02d5dfb4209eb608b961ce94aee6c505922cc58a33df55db
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2Rao/x:A3kMhT1Lljm
TLSH
T1ED15AF13E79014F9E917813899A54A12EBB1BC660770C7DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 913KB
SHA256 ccb7ae03e79f3e9ed4b889e3e97abb3e683374a50d872769513012b987e13ec9
MD5 8beb223bf5cf275ad605150a0dc31142
SHA1 edd4a77c5a499eb64337478166df5e7da71f9199
SHA512 4e73c026eeedea7abf3b28f390b83a36637cc6b93cda17b6d223b71c834b91c754609058d0ce46c5733c8e605b239b940d6e27cd71a77ee1084b9dede8343e4d
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaolA:A3kMhT1Lljd
TLSH
T18B15AE13E79014F9E927813889A54A12E7B1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 913KB
SHA256 6110bbc30a167b74c6d0aefdaca08aefb723f0fa16df60c47af791899aa43066
MD5 41de7390c1dc35a3d76d7a039a123e56
SHA1 1e668c67448790da1936f987fde8b07ac25bdc2f
SHA512 03448e871cfbf2e99d75b11d788052b566140df3c7985c055c8c7e480102223521704455653388c4529466bcf2512f8a8cc59a4a617fbb49e00574b648644611
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2Raoe9Q:A3kMhT1LljM
TLSH
T16815AF13E79014F8E917813899A54A12EBB1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 913KB
SHA256 f5b7f115bb3490f6c97f182a8f49afc8796798edf7e545982fdfa85fb711996a
MD5 2a66dcfe1f08d9e5d3715f92dce686f7
SHA1 1257f3126e819f3587439a643023262507f043f4
SHA512 0769fb6bc1b308fcc422d44f1dbb68994b554bb20acc0494485f554b0d498c314b3d823fa07905ea083c1e3e32fedb0d1a3847e1ad388d8bb71dfe6182fcdee3
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoL4:A3kMhT1LljH
TLSH
T17115AF13E79004F9E927813899A54A12E7B1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 913KB
SHA256 6a5fabbe616acf9300a4745ff2c34bf0ef70c834da8f0791b9fbeb4e19d63ed4
MD5 25d34fbf34d620efbbac7a94f08b8a7c
SHA1 7e256a77a054af34e6aafb52acb5981db7a102ee
SHA512 02a122ec5288e54e95711dcd3e5df9940eb9c78609b556584730e7aa11a235b2f97d319c76d4f964ec470d0a4d5c5b01842e270fa41a65c3409bf5f8d6f68575
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoCu:A3kMhT1LljK
TLSH
T1B715AF13E79014F9E917813889A54A22E7B1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 913KB
SHA256 ab55f5ca07e5dc6c9f779468d07130b094bedf6d2154a01d8490160fdea72237
MD5 e27340454945d12f59156477b3dc4bbe
SHA1 44e806aaa818dcdfd66cbc38194aba0c31cf66b7
SHA512 161e983e3547720150c40bd04a3fe3767fc801a17ffe8047c73393eb9fd0be094306380fcbe60acba950d9c8e73b30b36116b534b3f8941a7bc3e6b802202db7
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoTj:A3kMhT1LljE
TLSH
T18615AF13E79014F9E917813899A54A22E7B1BC660770C7DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 913KB
SHA256 49b7a18e789bbb6aeaa9049d582beb3aa73fc76cdf284c2f16b83d905b440379
MD5 e9f9b7c5e60a509cd0a1ae7cc5fd03f0
SHA1 df18a615dc27fe65b2168a88f0ffd4d5e906ca80
SHA512 bdeff9c3ab83fb532eaee74d42155d20984e3db0b272ddaaf2c3f2979eac28c1b205e5e6989a622a11d50aafc61ad3c2b74e6e1c3bfcf1ccda145c123839f714
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2Raoeg:A3kMhT1LljM
TLSH
T1E815AF13E79014F8E917813899A54A22E7B1BC660770C7DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 913KB
SHA256 76f42594e419ae722dee5e595ab335641886b0a2788a7b3483c819a9c602afb9
MD5 f8421f1aafd403ec83a7fe00ce67c5c1
SHA1 6d190d4f219e3e587346cc3b2ec773bfd1b2fc19
SHA512 eb7300d694789bbd7703b04577f4030c1930ae41ecde02c848089e2d3a9d1994c1377a0bd4c178a926862a32ebe774a14a1414b551694c4ceced0553b0e43b11
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoRI:A3kMhT1LljF
TLSH
T18715AE13E79014F9E927813889A54A12E7B1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 913KB
SHA256 ccbd4911f0c4bf2322b98071c70d3b4887c003b98e4922db032c0db39dd42b30
MD5 7f2cf70502eae4275a7fec70b6e23de3
SHA1 cfccb9adefd4dca2d80bb4a8adec670ab5a640d5
SHA512 9d6301644d39afbe9868d418e9f7805eab430da67c66f05e3fe3774b3d69ed99c11ad088942b6ba849b5e6411b677e21fa8b15393a78c5d0ad57eb2ed159d657
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoTo:A3kMhT1Lljz
TLSH
T14B15AF13E79014F9E917813889A54A12E7B1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 913KB
SHA256 d731adeb364fc0e7bd64f72653487732b917ab8511cca3ac9e05895e3a17ce57
MD5 407326ad1cf304d83b3c803ebaf9f17e
SHA1 aece2846747ec5797a9b07b1c4c3561fad9fa52c
SHA512 411081582fcc668affe9635e5077332ab6815176055f3a91cbd62d063159d3b9bb1723fee66f30cfd3b07f528bde624d47a24068de50a47ae871a3391d5f83b8
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoY+:A3kMhT1LljW
TLSH
T1F415AE13E79014F9E927813899A54A12E7B1BC660770C7DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 913KB
SHA256 2384acd98f8b1400614fc201088a60962c66c905a2508953c635222d72740350
MD5 67eff72e5d68890739f18d16ebef056e
SHA1 3f8f696fa9b5e6cbb382e2c560e0b1c8461b2176
SHA512 7de744863af2ebdb472d6f6fb77419e10e1382ecec4db956c741e751829d2a48fb584edf07c5fdbf594431cc743431489c08981b38eb095e590274437e243a61
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaowQ:A3kMhT1LljS
TLSH
T11E15AF13E79014F9E927813889A54A12E7B1BC660770C7DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 913KB
SHA256 fbf44f44c509355c93f72c0f80c06fb6bd79094f5987aea93d7ba669b572ab6a
MD5 c116d1da98a91e0167d0e5c9a3f749bd
SHA1 01e9d9dfc566041364a8c107ba5a335eff425f0e
SHA512 40a9197200b3b112385f6deab778f58b90d61d67307be79a6321d8e049e0f744584cccaa67d426f087172e077514634e27b1c179a3ab47f38e3cc75046544692
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoZX:A3kMhT1LljC
TLSH
T15915AF13E79014F9E917813889A54A12EBB1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 913KB
SHA256 50fce8c80cab76379bf7a745a57901e6750f4c133eeb8d92d51739bcf636b1ce
MD5 97e160752a41f941a781573285d8000e
SHA1 b575c52a840e9051f9b1cdf0d1c592ee8ddc5f66
SHA512 4b579dc8485abeba3f8f5af62231b8761d0b407425c8c5c6759a19b44610021b8ac255dd9aedeb0fddb5af73c41b9a21a7de1316759e387490f574c46ffeeb4e
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaozL:A3kMhT1Lljs
TLSH
T13715AF13E79014F9E917813899A54A12EBB1BC660770C7DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 913KB
SHA256 37ad08bc6ce18d98cf18816b59f450e2aa1efde371809452c69418a9635b33a7
MD5 95d5aade9443e2d4b7ad0aba3750f197
SHA1 20073340de5702300851c23855a40f3d785afa9f
SHA512 6e5aad92dfe0d35343a96b063f87a067550824df639d4cb6fd5b01d491e0d7ea3331eb31833a30f5c4beb3d75a2867ab9c7ba47a5651374867bd42ed58fb50bb
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2RaoZM:A3kMhT1Lljd
TLSH
T1B715AF13E79014F9E917813889A54A22E7B1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 913KB
SHA256 2631b3b526bf00c63fa2b04090c91905094ccc60019a9eafae88b4e07f49828c
MD5 54964c1a7a1958eb7ff382e934c8d750
SHA1 db86fa1bc60ba6fed58847af21ac63e2251ec483
SHA512 0c1a2a2fa46c931f3706f8bda6b03b9195359db04b3a50cd8ed3aaacbcd42ec08fb8c5c354039a32f736f8366549cd7ea821039dce07af25d523d1290807cd62
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdJx2Raoih:A3kMhT1Llj3
TLSH
T14515AF13E79014F9E917813889A54A12EBB1BC660770C7DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2448-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2448-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4920-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads