e85cd0129ab1abe5f4e68e55438f6f4535248fe213ce5da8cf5f2f5f4817747e

Analysis

max time kernel
103s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 850KB
Sample260804-ld6nfasvas
SHA256 e85cd0129ab1abe5f4e68e55438f6f4535248fe213ce5da8cf5f2f5f4817747e
MD5 d9e61d6cf0ccb59cf75275eaf8a18fe7
SHA1 b0c196ae520960c6ed2e710737430f2e5d3af581
SHA512 0fe7aebd5b6c0373871df8f7e31b100f9404808ec892df8f6c6a6fe0754003a5b9eff1f851ca2cc2d0bbe6d22c865830cc0494907c93309169118e6edba232c7
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jo:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyo
TLSH
T1A205AE17E79014F8E917813989A64A22E7B1BC260770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4852-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c508-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4852-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5160-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c95-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-524.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-604.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-727.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-795.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-826.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-857.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-876.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-915.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-955.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1047.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1066.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1103.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1271.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1333.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c508-6.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c95-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-226.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-444.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-493.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-524.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-604.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-630.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-727.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-746.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-795.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-826.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-857.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-876.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-896.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-915.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-955.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1004.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1047.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1066.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1103.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1140.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1171.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1178.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1185.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1271.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1333.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1346.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1377.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1384.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5160	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4852	2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
5160	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_d9e61d6cf0ccb59cf75275eaf8a18fe7_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4852

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 850KB
SHA256 e85cd0129ab1abe5f4e68e55438f6f4535248fe213ce5da8cf5f2f5f4817747e
MD5 d9e61d6cf0ccb59cf75275eaf8a18fe7
SHA1 b0c196ae520960c6ed2e710737430f2e5d3af581
SHA512 0fe7aebd5b6c0373871df8f7e31b100f9404808ec892df8f6c6a6fe0754003a5b9eff1f851ca2cc2d0bbe6d22c865830cc0494907c93309169118e6edba232c7
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jo:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyo
TLSH
T1A205AE17E79014F8E917813989A64A22E7B1BC260770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 7eb4df14462c8fda955c9290491ace4fa490619703e5e60d2b62dd0c7a1fea4d
MD5 75b8e9585424c621b93643c3e7ac9b50
SHA1 48645683abef01f8704851c7ccfb1238f2f08462
SHA512 fd7c768efaf7e4eb80ecf36fd3f62ac7d229ade6c6b8e39b0978a3268f2cf8fc4773811432c89307489d7e02c48d0df841b8c9894a6bfb58d8498f54ea51d57d
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyw0Le5ji0hmxNrM:A3kMhT1LljbPji0Aj
TLSH
T16B658D16F6B446B5D073C179C9D29A5AEA7238460B30CACF0394D7292F337E19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 865KB
SHA256 b21601a33c232645a7411055c796e526198868b2d7bce1340441f807a4cd82d3
MD5 8305c130778df59672edc1c546090364
SHA1 dd18ba835e54734ba3a2ae56581c5b3f9b917915
SHA512 ab23c2a975b1307c7d1864c6fac3d0d04fd2263256178288904d7d2ead2a0495cd48d2e7a0510370c1fc82417741cdb0b4be1b24cb4f45b3d576217f1e8f2ed7
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyKa:A3kMhT1Llj
TLSH
T1A615AF13E79014F8E967813989A64A22E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 898KB
SHA256 edb9c9693888ad43d844d779a23d31fa536b3969cc65dafd001305208be71e14
MD5 e1dfc49fb12b81519ad7a957555ddcfa
SHA1 13d393982e623b681a0ef2ec053727c339f80852
SHA512 9daee0ec49eb6cbb78e6a0dfe941b56920a166f2ee14abda6ecac78a4602c47eb56b1532668c66eaa52a0dfebf1f197448a0426569f28647755483247f129258
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jZb:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyZb
TLSH
T17A15AF13F79004F9E86B823889A54A12E7B1BC661770C6DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 874KB
SHA256 fb2a167df72bd286430042118267ccaf7f5e6de5bc6ce213ccb3ae4a2f9a1c14
MD5 f6e3cbef26762e0066bb9629ac587ae5
SHA1 84bddd2f5cc2c6e1c671a68ef3bcc736c03a6466
SHA512 7207602c023b54a0406402ebdeee52bdadb7fcb946099a4f55672c2f6f624428934e073b0d6e51acfa720d03bcac6813b42b9ee458c63b547de5c2168a1a984c
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0j76:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLy76
TLSH
T11415AE17E79014F8E917813889A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 874KB
SHA256 bd7a132b67076439ec435da0bc0220a20a4753e7cb8a70b2e973ad630524506a
MD5 480b1c55e53a331c0a3dc296c593be64
SHA1 49592709c8e64ac8bb688af0f2708dce7f445429
SHA512 9feeb54ba47e07b7599729d28a469bb8aa9dcb9b81fcfdb5d8d0f2816357102ea228ebd1a2d68848abc2c7f85c9bdb0de7d03155d34b8f5150f3081c426356a0
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jlN:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLylN
TLSH
T14B15AE17E79014F8E917813889A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 874KB
SHA256 04526ca90f4b8dc1f75ece0f8f15d93ea8ec4bd9d55db145ace1a66caaede278
MD5 abc96fdd74d3fc1b0763ce34f9c53092
SHA1 86df36754416af28b27a7e828cdb47742acdf6bc
SHA512 c24bb7a27dfd0fdc033c4a896eeac0db99e0244c01d427ad76037b2d362668b419dd0d0e91b202d3377bf867ed7e57d560055d141f3b58752b1b036c90e828ad
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jjf:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyjf
TLSH
T1A915AE17E79014F8E917813889A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 874KB
SHA256 5036b66133a1dc9c68faa4814a2fac013835ef2bd7e6a99c89bde8ce513acdf3
MD5 dd9678dcda53348aaaa8344f3a03792a
SHA1 bb86ea48a35ee59fc7b7259056e298d0dbf8d52f
SHA512 854c674c27f1149055fe3fa25ccf700572144c4a2e5fdce69b68ba76a3d37298e88341efc46826e53d0b637cebd7045691af030209893610df92760aa1bdbead
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0j1o:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLy1o
TLSH
T1F715AE17E79014F8E917813889A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 874KB
SHA256 68b5ac617392ebd5cb8b2ed4061897405f436c589a27a91cd9314098b3699527
MD5 22a62b839e3f9efcb166ba3d7227211b
SHA1 878bf4fd4e2361c97c49cc5a7e48c924283e97ea
SHA512 f4d72d1a58570a5569c521b447809baccf336a11cae3d893127c0bee4bf7e5af6fc33d0662e0115023b6a7ecf15ff0c260e8f89929b742eeed84b4dce861195e
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0j1u:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLy1u
TLSH
T12415AE17E79014F8E917813889A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 874KB
SHA256 d4b55937880f87940f3f7cefc1623f41505f0c61880e2028619e567137c8d2d0
MD5 037e080b7eea90bae10505199c2cf48e
SHA1 db599b9a9e6898b3e3d8bb90af8335c252cf4e2b
SHA512 5016c4e4e8c66c65c02f6e575e3b292d40fb06b57cc2c91e6877f1ff0415643d7559f3f5d22bf8d83b4cc99f58e82829407e687cb9f397ca20e04265a3082bb9
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jr9:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyr9
TLSH
T1E815AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 874KB
SHA256 d3a50ed52c9b0918f18a8aaa7f7a168afb3e3f58b583f612d51baef9158d87cc
MD5 016a61040207504eeae3f881d101048d
SHA1 0e4d71141207ab659d71ba344e83604b14387267
SHA512 2742c0b19e716f1913a822665e28ac6aa41ac639e99b033c9628c03c3212c2072c24ce6b1ea693827fabfb6eff35a258f39c227b5e57e339fc74fb6e0b9c89e0
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0j3c:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLy3c
TLSH
T1D215AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 874KB
SHA256 c5a0e26ab6f73408badae7d20c04ee71c3baaeb2c362fb13f7b677e36bbeb641
MD5 42f7b2d621623704388c66ad748c8fa9
SHA1 9bbddb79a841e49dc9c8894d0727095c9f97031e
SHA512 936ce1b790bf3b56eebfc5760eb0ffe8758b1c50e69b5344bb993c4382670cffde5118aa3677b07d8baac8211e6795bf792e835dd2e0707a582ee72cd48c3a6f
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jAp:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyAp
TLSH
T17815AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 874KB
SHA256 3bac81896fb08f0e7852fb8e84494ebfb4c659b3df81bd2fb4ad33291ab9820a
MD5 edd45ccc9c1711d1d724b13c4a49215f
SHA1 91be70724bf275831f935672f3bc1089113a718a
SHA512 fbf8b0a1e5c59a16ef7d110d32cc11c101572ec2a20088e3a94bb46a0654b4cb3297a8ec1cfdffea11bc151c788b004038e23710a078a5d3544f3d55fff09d71
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jH0a:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyHN
TLSH
T1BA15AE17E79014F8E917813889A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 874KB
SHA256 72c8b3c8b25dd53273bf2ae9f2f0092a8db8b1b8b6e6ef276929f074c0924841
MD5 3578ca7466ae5a699c2b9b0523180ebe
SHA1 c2b7b33b330608df6e69d5b2b8f37ef06a0bb306
SHA512 31b47514f2d477596dbecf2f818df1f2b65edd1d9378c9c93a24c7b3bc8ce3cf382d14e09f7e3f137367d6bc19e05177aace60fd7da4abff11f07930f74ef8f5
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jlF:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLylF
TLSH
T18F15AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 874KB
SHA256 b11fcca7a560e80ced53e6e8e2cbedd40ded613c1dc3794214b5b16c92c60820
MD5 1cb3f2a5e6029bf82903263f6bcb764c
SHA1 9a2632c8f1626b34e4162e0bbb1d01bdab1be790
SHA512 a0ce2d0446aba1b1fa230462b4ccedb78b952dfb533251aa3ee4a064412243cbd2f47389d5f7b0f7e6089e121b7eb0ca40bf33295b6246c59434224ca78cfe88
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jGC:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyGC
TLSH
T1D715AE17E79014F8E917813889A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 874KB
SHA256 66a51e9171bd098e4a28e085c4b3c757fe5684ee430aceba7a9b4ac468a77893
MD5 6d7d3aaa233d68255371303337706df0
SHA1 739a3a24ebd72ec7b038bc208b9d95eec795c6ea
SHA512 cb6b73c6601b6f00b458798ccdf6a968943c59d04e985ba8422d00c27ee4afc35dd78b2932e76eadd2b22fe8af69baff31e9792e2e53ef631144086b0d446385
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jJw:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyJw
TLSH
T1E115AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 874KB
SHA256 11c8f79db85bccd03489f93884f8283a055b71287ddb730bcc08dde501f083ae
MD5 36e284658c53a0097dff46429a91a866
SHA1 cb6a8ab999fa353f56948e184fd4b5c34716428d
SHA512 f0418d93e3d3fd2b267583333c251c9c76f1bdd46316897467196b543321608842fee3653c5cb9acfbaf688edb1aa5e7561b5605179cfb75ce65a7e97e2028d1
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jQT:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyQT
TLSH
T15315AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 874KB
SHA256 28ec7569867423a8d1230e8d3048276c328492c4a8e30b5bfcd43b1141c9988b
MD5 0b02a302cfc6544bceed4694ae439cd4
SHA1 aaf338518bf51271490a832b30b08536ec2597dd
SHA512 7839589063069ab35199a9c21ad03a7fa50cc478d58995cf7a82ebc65fe649729d6e2b295ce4cedf87eb46448ebf24f62f54c9a6b8a09ed8ff5a98a0b8f0ae9a
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0j8u:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLy8u
TLSH
T1B415AE17E79014F8E917813889A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 874KB
SHA256 c85da003429c9c0dc486b24c9fda0a9ce50071bfe5b456de58875138e405d477
MD5 1f1bdd28ce308604fb9a58becef88170
SHA1 d7c131f8184f6ee9d9a6b34e7276b01d248d8db7
SHA512 bd9b9897234b2e47e9d4a3ba5159696cdacc8afed6027398b94ee8a64cbbf1595eae982c5e48e212cc4902b4bcd04e340afe8aad6a961f5d7783f0f1cb1940d6
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jab:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyab
TLSH
T17215AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 874KB
SHA256 61efef326287d83a706cfc2a17854b753e1a0f6334326c43d697197551ac9bf8
MD5 d86e34a833c965f48e7dcc522cb807ef
SHA1 86e42cf72238e9cc8e13473dcdbbdabed8b07759
SHA512 b184e215a63a6f6c55145bf50b8fbe4fb0a82fa59255f639a019660d40407f4f088b8ed24ae35bc34d1aab759b03b50cd23fbe45c6da4a3c0eb47d1bf2b8593a
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jcf:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLycf
TLSH
T16A15AE17E79014F8E917813889A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 874KB
SHA256 e58155c473a8dc49bed35d31312550486d268a0b9b85d89da44c2f1d8c5580a8
MD5 537838efeadc0c76a4c3eb76b3b9fd87
SHA1 decf17278bb8720bfa30899fd73eebf5a29bd94c
SHA512 a7fbadc28faac9092789303448cdd285bcf254520003fc827e37a4c3e593ee460844b565ed5a8feabab910759ab7f3a4b0907fba84274e952daf0fa8bfac121f
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0j5K:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLy5K
TLSH
T1E715AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 874KB
SHA256 c39093526f2adb5aa0415f3440dc019e5b8954e496714edbfa3e7955a7f0ce28
MD5 468f628e8c4bc051bc00b5ca1f3d0762
SHA1 5fc00d39c129518ef2e7aaece871fb67d625a8ad
SHA512 5f0d79c030a73ffd11b9fd1449f502e60b220f062b2f8316f652eee3bb9e6ea353a1aa4cdbf474f4afd20cb19094d86066d01a686455a7a37c01447ff5e55f19
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jik:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyik
TLSH
T17615AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 874KB
SHA256 c787f7f9aa112cdacf80f6e8bba851a5972a0cd9a34dfaa39cf6fcfd319c3724
MD5 06d1cde6769f27293733c7d30e6a11b5
SHA1 27dd834e0f5db62b2c58ec4e76e2be408fb6de78
SHA512 971f2ab43c94d646d54020b4d4757a50bba538baaf4efc048712f0bb58f88616c4fa2fe4da1cea45a3bb6630a6a022c459c478978ad56a487c4a8a4c8b64f27a
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0j30:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLy30
TLSH
T11E15AE17E79014F8E917813889A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 874KB
SHA256 05b8f05f8c42960306b31084362b38898fe1a0d7d37d6a9c186eac6bb9c430a9
MD5 00ba99534eba14f2bc27de5021e36e04
SHA1 7bce5b1af930471b84f2364f96a94f997cae03d6
SHA512 1e424cc2cfb40893dd3b6af6a7ddf15daf544e7864f4eeaae84b9fc635703288ee36c898e385f22759049b7fd68b3c4372194fef3519c6f8a34739b8bfe93176
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jm70:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLymg
TLSH
T10915AE13E79014F8E917813889A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 874KB
SHA256 fc59e982b75c7ac8540bf3e4d2bc83915db5ba2488db8c24286ae88baacddacb
MD5 a09fe240d52990aecb223d7759bd57ed
SHA1 ef560d4c384f91ac54574bff0e09b0f06b6a2e31
SHA512 c49e6ad599f97ceb0ea855b6e55a5673872f65d55892394ee39d0f30849bb6ea5594e3714a3c6864b84324bfe31f3577bbbf194195ff7abdc512dfb918faedcd
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jvr:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyvr
TLSH
T15915AE17E79014F8E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 874KB
SHA256 c6a2570ba34dcb7c5caa71ee657e87c417845b238e3e4e24ff07e09cb347e88f
MD5 958fc7a8712b0631738ed90060099ab2
SHA1 7472340a5111eb982fa834df7f7ac8b601e2f853
SHA512 c5f279bd1256238f6e1dd724503a8766fe9762d50f8bb75c792b5f45e349427de491efb1d8ba54a2a44ccb4b791dc1de645f347c8198b5a8b9c298067aa5803c
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0j5n:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLy5n
TLSH
T1EB15AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 874KB
SHA256 8e4882063523320c64f6dba7ce798a26e81fcb7f1719576218b923c0753d8652
MD5 aa9c4676b6a48f9af692dd96daa83839
SHA1 54163d7907897adeb98518d4b2f4787958d723eb
SHA512 16394b9142aed7e20b4b71c31560c71a162830c0a7ea3d4b5f392bdc38564c03129b578925e8c583ff55bbfb49fd5b7196aa1fb453e80e4d2d728aea2098af51
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jVx:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyVx
TLSH
T1BB15AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 874KB
SHA256 cebe984597e07a241be6199dd29a89ffe8cf5677cf7f25e20f277a6fe415d254
MD5 aac381b6773a919b3e22ff539ee5cfe5
SHA1 8d2554d887ad81fbd2de679b42a60fb983a3a119
SHA512 ae249ed87427a904e955c2e5d7a45fee61da67d137b62ce5aae31554342f5e6265f482678476ee02e49854f85f049970b72b4013d92ef016d5f5e1f12f159020
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jLA:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyLA
TLSH
T13C15AE17E79014F8E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 874KB
SHA256 a35d21e37c241d8cfb81e48b056fea400579f2410425cd01ae67050379da31b8
MD5 f5e04ddb8b64257584a88a0b2afeaa00
SHA1 b61f2040b66ce24bbca1a6bdc2f140b40af29396
SHA512 3138ef68398193d9fb7cbbd837f52f95b43b5f8ca0e0495690add7ba713c48610c1cedf660351a98a72732725ee2ae2340d33dd6b87a070f67f827465bc83ba9
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyc9Q:A3kMhT1LljI
TLSH
T1DA15AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 874KB
SHA256 f1eea84e378fb20f4b825ce512b511dbefb9ce8235eb7aaec4e408930722d0c7
MD5 653196e4852dad197d821624fedc9bb0
SHA1 c1ee03e786a5c3aa67d03dfb31e8aed5aef04255
SHA512 33061666628f4cec14bfab91630b94694bb696815dca14d2c46c37ce13d0b8bc54740b73b2da3205651e1d591293b5ee6e82ced6229c87d22c4769bb2d5fa2ac
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jF4:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyF4
TLSH
T15E15AE17E79014F8E917813889A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 874KB
SHA256 903bb95e6c6eaa07e774402d987d34def6444a12481f627072886453043613cc
MD5 22b82898ee12e0a9d48cd786ed65301c
SHA1 8df7693fb0c9de258f0a7eab29e5b7368f9de434
SHA512 abd00a4b3be334baaf7a66b1760ed782c72f230e43eed3f98bc92bed44c2924e4eb4288edce0e0cde4ac95a0a05b9851c0dcd4b98d36ffaa8b1a1374b3878f39
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jQu:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyQu
TLSH
T1E015AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 874KB
SHA256 3698f6c5f808eb103c168d539db53447a5e851554d59975d9109501daf1e9aa1
MD5 e244beaf43c9056befbb1228204c7b33
SHA1 233637ebf9593ae8427647faa44a6c75f1304e49
SHA512 8e7d84344b9dcf05be240e6ce5c87b369b7bf927fe9e500943d6455c2b904b3cd727d6dd86d1e3ef86a1c8e39fcfcf8fff003ba5d4b051ebe6ae4a3529c56a94
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jRj:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyRj
TLSH
T1A115AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 874KB
SHA256 bcf807d4b6594ae8f9d4ccf19486fb6ed19a8f7177704f98a5dd1ecdde106202
MD5 01009207abfdda018391ce4688b5e144
SHA1 20462effa71019384b22bd906c05e707ca2c0e4e
SHA512 344bc1959580460e81d753cad02ed6be870fba34fe98bd39ffe355c2aae42b2845d10a13c3f831d0b5db5bb2127c3e8e7228901fee83ca4ee79183308912ab70
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0j4g:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLy4g
TLSH
T13915AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 874KB
SHA256 11172abded307c2dcfcda0b294dcb79e1423cf9d6438b90e88c2648e8e44d4fb
MD5 2b7e70e1e16f4d1cf0db68a92317c915
SHA1 7004cc9bbff4a0d089caaaf196612c264da670a4
SHA512 d5cf96d24c1041064777b0e3bd915b9bc831e337840fe4466862c39bb1ce521c72e16242024956883eb4abd13923d54e108003425d1c568e3fa9dfb12daf8e71
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jXI:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyXI
TLSH
T1B715AE17E79014F8E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 874KB
SHA256 67a1eff7917b78a01109e6b74b4d46b54ec79ffc012f1452240eaa83deaf00f5
MD5 0ee7eb4109e77f64dcfe9adc27b80972
SHA1 6e01c2e5ac63053483ff1239002580254ceccbb4
SHA512 7d7d69a25f0e962a2541b0a3ec70534bded9ff4de30fc97f637ef453578c128979a9bd371b7c58b19b5c5cee7d9575ec6ca813e86b2c2fefa996c19befd4f871
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jdo:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLydo
TLSH
T14F15AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 874KB
SHA256 9a429c228a62b12d15ee71afc5261e087eaccfc45e29851452406722846b84d0
MD5 940ff8c0afabf54175e033b98b06e6c5
SHA1 8e6eb46a6e42215fec7cbb77385c3e1bfd54dfb8
SHA512 48075b5d41773f8a1721f2e5dee7d5be7eb8a5c8d5de11aff6aa0b648c07375983d2fda5f2372f7cee3e1d689346f400ec3a40336d0e44d4feaaad14fef16b75
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jO+:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyO+
TLSH
T14515AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 874KB
SHA256 e57a710f766810f6adb73248cf8b56cb7fd34859b33793d4cdd1331881beb44a
MD5 5465623b79b65d14b6ccd75854caed67
SHA1 15638775f984b6cb815203f285e2d0820b056379
SHA512 3e9247dde4d3584aa6e6e33376ae0f51a5f9f2933df9f8a16b3e782ee932f62c01df73bcdbdc681f31d82689113b2a0a2ac50161a3104cac1da42624ad5d4f77
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jOQ:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyOQ
TLSH
T14F15AE17E79014F8E917813889A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 874KB
SHA256 fb321f646849f9d632c1ebc47121c3b4bff688aea6754f6e7ed0ff669519a29f
MD5 9cc8066c1c0e69dd380fe8ee2c7a8215
SHA1 9ea06a81f1b4999b2a4db4abd48a60669f7c2707
SHA512 9104a6d3107671ad22e583acb4bdae12415786173fcb02d7e266cd2682b9b643a10edb4eafceb112210e7b403e6da4dbf4955186122a2bd716308e0e77cca9bd
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jvX:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyvX
TLSH
T1AA15AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 874KB
SHA256 df08160f88110ed7e83dcac93e4830c40405a0e3626d111b0cd0feb5a5ce9764
MD5 4ce78a9a50008e68742e04cfd5d1c8e1
SHA1 4e5a954fefc0e9d090af0592cfe2c8d2af366bda
SHA512 e9deac88b6c371959448f8b07929bf93357c2be03a8de40f11a1f5a196acbcb7bd50a5208b811f81c8f5e4388b88896efc902dd3818632fd33fe68d4e614cceb
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jlL:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLylL
TLSH
T1CD15AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 874KB
SHA256 41888b4db54026d527f334f792d3b852c1add1b2851ed7f85bdd8ffee04ee555
MD5 c353505a7adf61a6a1c0c62c1a05edbe
SHA1 7800bfa57279b3e7a818192eed40073b1dc3cfcb
SHA512 83969fa21faa542d7d69d597d77f6f0204952826e625fa65da22372f28fe92ec51421b9315198b14c419a10ffbdb99c2e90fe0af93c1a766b9dc030c94b785e5
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jDFC:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyDM
TLSH
T18515AE17E79014F8E917813889A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 874KB
SHA256 a739bbb52bcceac62e453854df20f33892a221b4f36086b22484f5755258703b
MD5 1595d8665d0e07fc39ed2935c708aaa5
SHA1 25d88b6a9058286620fb900e60c4d82304037b28
SHA512 034af767a00f8e672be61f6fa9c037be46004526599dc622c4009db9aa2109a8a48168eae25a8fc58b413b48aa5db146f16b608dd2c83484dfb864d32c89ec9b
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaoL0jEh:A3mnXoZjzyUTWaLl3z0zDMCpcbaoLyEh
TLSH
T19C15AE13E79014F8E917813989A64A22E7B1BC660770C7DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4852-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4852-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5160-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads