08af9f447714e370941fb07039c4990ba6c32852d4896b349165449f75472016

Analysis

max time kernel
99s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Size 773KB
Sample260804-zhbkragf74
SHA256 08af9f447714e370941fb07039c4990ba6c32852d4896b349165449f75472016
MD5 32876dab202fae6840d43ff4f611b1cb
SHA1 0eae2aa2208cc425d6925ac5426920da6a35538f
SHA512 f596fbf5f194f61dd376b72dcd1b582aad8f526eb6ad7fdd22e8df20770368bee3ade18719a0a667376b0973a00e19d3e87e230d02a7fb632b3357a65c7f88bd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMb:A3mnXoZjzyaTjFxhvND5TvinrmMb
TLSH
T13DF46A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/4580-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000800000001b840-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000016cd1-9.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f9-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4580-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5396-107-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-423.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-508.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-600.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-705.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-767.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-798.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-841.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-866.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-989.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1038.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1051.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1088.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1152.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1350.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000800000001b840-5.dat	aspack_v212_v242
behavioral2/files/0x0006000000016cd1-9.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f9-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-423.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-489.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-508.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-600.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-705.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-736.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-767.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-798.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-841.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-866.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-901.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-920.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-989.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1038.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1051.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1088.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1138.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1152.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1177.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1184.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1221.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1324.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1350.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1383.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5396	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4580	2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
5396	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_32876dab202fae6840d43ff4f611b1cb_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4580

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 773KB
SHA256 08af9f447714e370941fb07039c4990ba6c32852d4896b349165449f75472016
MD5 32876dab202fae6840d43ff4f611b1cb
SHA1 0eae2aa2208cc425d6925ac5426920da6a35538f
SHA512 f596fbf5f194f61dd376b72dcd1b582aad8f526eb6ad7fdd22e8df20770368bee3ade18719a0a667376b0973a00e19d3e87e230d02a7fb632b3357a65c7f88bd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMb:A3mnXoZjzyaTjFxhvND5TvinrmMb
TLSH
T13DF46A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 faabf68dc4ab0d50a92af3c19caf56f46094e9cf13eedd2eb0dbed1d2d593c91
MD5 13cdeefa09e301ae051638931bb0538d
SHA1 d1eea2f3e4d754a758dcdd7e0d88b0aa118bbcbc
SHA512 26a5c8b14d2d5716f86fc9ec4b3e29de544a15d86d6d8f95d8f6aafcb4cd608e4db51af64c70e206553d9c77284336ae7dd387994c0523f46ffec876a137985c
SSDEEP 24576:A3mnXoZjzyaTjFxhvND5TvinrmMH0Le5ji0hmxNrM:A3kMb56r1Pji0Aj
TLSH
T14C554A16F6A44BB5D02BC078C5D2969AEA733C425F3087CB03559E283F277D19A3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 787KB
SHA256 78bd565a93cb697164faba971f2a68e11051ac223c6af6da827795f86f9a3037
MD5 096b949ac169e6c4f61aa5533aaa6196
SHA1 35f8ea5cf22dc945129433d14da8898b523534ed
SHA512 d79f3c126397bca366a030d50c52e3f6c107872cddab06b5369a6a81ae6123e73b9737aa66998cf95cc243f3c35d96bcdace2b1e2486fad2e0dca51c96708836
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMZa:A3mnXoZjzyaTjFxhvND5TvinrmMZa
TLSH
T1A8056A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 796KB
SHA256 e75e917aee48732f042f4e50ac32b09c624b790c4853fd36e2f51802e87c7e07
MD5 c54aaab542197df0442abcd7616d4f47
SHA1 ce04840d1827dc9e03530b40ee2c7c1e502724be
SHA512 f1f615248bd23edcaa7329da0f490d6b1b7ce8bbe9e13f1de3b47d5ee8a00785bd0426862f92547ab70914f4c109f7d51663cbade0bcf0f3a1e935fa1285f765
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMQ6:A3mnXoZjzyaTjFxhvND5TvinrmMQ6
TLSH
T1AA056A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 796KB
SHA256 cf43083cbaff8b0ac58d13082c15683d9cf2979c77e80d72601d6f442b7e4aeb
MD5 0cd235bf422f1dbc4455db4ede9290c7
SHA1 67f3ba4b841c0ef714a478dac24f5fac50ab1bf0
SHA512 dfdc88ff80aa9d1163574f341d9d8fe9ffaaab4ade1bb13cd15741642e1171b1dbbaa6b84b0e6990c62d7516210a64567735e60f6268ea2bf2354411806d8e8c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMUN:A3mnXoZjzyaTjFxhvND5TvinrmMUN
TLSH
T13C056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 796KB
SHA256 4c8fece0180d4c64df77711add178651d4b9aec842a7be594d90545f559f6f3a
MD5 8663e1ccad2e6789df6dc20ced49abf0
SHA1 cc2369cb121bff68185d23b0c61382e27ad27b79
SHA512 3e265ef606e7d84e4ac1eae08b8a409d26485e800f2ab56806ef3df2bf8799c779c3abeee3d918cc4458c07a537a937c09afe0751224cd7a26a326348abe51f2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmM6f:A3mnXoZjzyaTjFxhvND5TvinrmM6f
TLSH
T1BF056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 934KB
SHA256 e4e6d9846b660bdea5472d55dd53503cf546d873d025bf903f31ac6cb6d646bb
MD5 79d145436f2cef08b11afd94188044a2
SHA1 53005ffad2ed62140c0fd5cf6afd034d12a00af0
SHA512 9c21e6c04bb4c69471cf8f46492300dc64c4050cd2b10ca6f58d10e36ecf2a722fb955f7db1d952b2e03ed3b4442d30126e5f2834d1d8c36c4ecfb53867cf2ff
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMYyPz5L87:A3mnXoZjzyaTjFxhvND5TvinrmM5zy7
TLSH
T15D156B07A6941FE9D11F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 796KB
SHA256 5e7cbbdac1455c7a7cacf142fa7e26fdbebb91b71cb145355694f698bc6bc836
MD5 d84260c75ff7dc85e6d0ca38021bb10f
SHA1 04a6a764c8a37c42aee8b8fa2ae7c1ea5a2df446
SHA512 25ce50a757068c14cf84c66f20c8865f256dd0824656c4cb2cbd068b04df3eaf92a44b07513118787b3472cb2129ffaa380bf04ae734e78b36025ad15d2a621c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmM0o:A3mnXoZjzyaTjFxhvND5TvinrmM0o
TLSH
T12B056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 796KB
SHA256 9975f0d578cf18d38427de7c85c1f3849e74610e4e175ac32042a0702685d266
MD5 49e8b3fb2f1fc6af3ab9039905bef977
SHA1 70576a64d84939120b21401005d1580dd9498757
SHA512 0cbc68c22ea0f32207a7cc933bb60bb47e51ab2dbbdf32cb42fd7c9bdcffbfa345d234ff9cbd11311439cea720c21b530d72cc00e2e50ddbc4590b05164cff97
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMUu:A3mnXoZjzyaTjFxhvND5TvinrmMUu
TLSH
T19E056A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 934KB
SHA256 4dcc7c16bcf9a53460875217e223bdd4480cfc77b6eca6db92ee0a850591796d
MD5 5c3aa55741da0c42dbf7e15b626ebf02
SHA1 7adc8f72c73b1601d4429d33fa6fde550a3df48c
SHA512 507c982d9bfdf5d81290c7c4450d239f250a97d777d6fd1351185debc4febddc34f40c4ade6f946ca6ea62b5bb7c203b101a736463e1c2a2c90c8a7495ea50ce
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMpyPz5L88:A3mnXoZjzyaTjFxhvND5TvinrmMIzy8
TLSH
T1AB156B07A6951FE9D01F817489924A62E7737C225F2087DF1364AE263F327D06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 796KB
SHA256 c81e7ff907fee5ca2954706b72c8e2ce068b63e5b2fce5954f4904c9791ca0a1
MD5 a5aa9856efde34188d46ddce49e0bc54
SHA1 ab56be9a686f932ec605f99459b89df4a4bee084
SHA512 af34f00a39b19a3ce8c65e1437753d58e0d352c78f2fa3a54a46079fd1ed12b027d7f8c955b83e4b4f1c66c69c73b66e05f667d809d486ef3f95d4f1fdbc15cd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmM49:A3mnXoZjzyaTjFxhvND5TvinrmM49
TLSH
T15B056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 796KB
SHA256 96fe7f0c4838331464a13cf2c2be14556661a9fb6421406cb4f0310ebc5a3687
MD5 5cc12093a02ad0d314bc41884d4dad03
SHA1 0ceb31aef909b70ba26ba6dc4b7a9a53a1984396
SHA512 0be736fbf66b7b86924220e73917c8db9363358d8a2a953ded376230d6aea198c1b162005cf18589cd66a6d98c5d39751e849d2187342c2a77bec765982ba5eb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMgc:A3mnXoZjzyaTjFxhvND5TvinrmMgc
TLSH
T1DB056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 796KB
SHA256 e41fdc1f6f5a8a4106e0cf661dcb2d0ecd1b25f0c822726cdaffb2cb844b3d01
MD5 b06d7ce1fd84f3a5eb9988a4a368b3b6
SHA1 d435a9e17973142b7e60fb3ecde1b1de13820fbd
SHA512 8239e97c1b17ad4a46b265c0e2fefe116f8d989e2065b8544bc1806672f22d1e10edccfd62ac048205fbc62ae1a401df76cc7aed5658da91b15614816126b98d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMJp:A3mnXoZjzyaTjFxhvND5TvinrmMJp
TLSH
T132056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 796KB
SHA256 e29110413d31dff321a90a17d9abe7615fdb39a83509401b555d091445e3df71
MD5 671e1e82b84ac47b96aa6a4d6b2a9ca9
SHA1 16e3f7914bc5783956b164f7397abee794156f3b
SHA512 b78be7c3eb7ed40ca5f1557419464e86cd0d9d8874835fae61b5db5827514f672dd744ac0ab5c2c6a7a796373b74db384c9432f75b7e2fac2da72dadc969c509
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMO0a:A3mnXoZjzyaTjFxhvND5TvinrmMON
TLSH
T185056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 796KB
SHA256 da2baa94b902e78e8bc18389957c6ee09adac955d65bcd4a9d78fe0608b2d836
MD5 9f97ca5ea26d2ce1cb0d5aec82980495
SHA1 781d4531dd2e874c672487d8150b63eee4c10c6c
SHA512 c0239643efd99df02c12d809a90efbce16842cecfef7528b56de8c5f66a1aee6ae95df0f71bb1daaa92f8993ba8660ffb3ef1014f81a36078fe88bb72212ce4b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMyF:A3mnXoZjzyaTjFxhvND5TvinrmMyF
TLSH
T15F056A07A6940FE9D11F817489924A62E7737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 796KB
SHA256 9a3c3a2003c89297f26849b7ffa6469e13ce8a6f4e405ba709d703574515a7b8
MD5 1249df40189298f6921af020a9d048dc
SHA1 18a8db43f2acdf8227752d39b1d3da4c125fcf44
SHA512 50733a7b876fa9c4d8c88d096ae2856b0acece95f3308eec459d59898f9b0f243691f60e031dd6c0be6d0284e2d43c29d1088189b3a0afbcff9acc0843ac4481
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmM3C:A3mnXoZjzyaTjFxhvND5TvinrmM3C
TLSH
T12E056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 796KB
SHA256 1aa76f8e6a8ee62f4bf3588f92f8212318dda40c1a3780147eb840bdd852453c
MD5 f9684ab6ad52dc03d7ed58a47aa5d70d
SHA1 ba2cdc8a446868dd8d904d38041b59da29b58784
SHA512 514d09c77f7e677e7a77b8b9d19bf83e59d7c01b3239a944515c6e23136ba8d93f5395fe19d5414199b38806f993ce0299b4c59ff8a6bb59cfe4c3cac2a5136f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmM4w:A3mnXoZjzyaTjFxhvND5TvinrmM4w
TLSH
T1F1056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 796KB
SHA256 46d0ee459fcd1851ec13820162b7fdbf36f5e2da597971180acdddbadee1240b
MD5 1aa1f51b2099a93516fbce0c56e7cc9d
SHA1 82231985293839aa74b61ce2dbdde2e656766add
SHA512 69ab71054934e5c2940c16b5c73c44a9983feba934e814091db42af51f2e03dabd5ef3f396a067b0c096990f836a72b6ba5ebe9e8355911cb3ae62e1e99da4c5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMXT:A3mnXoZjzyaTjFxhvND5TvinrmMXT
TLSH
T11A056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 796KB
SHA256 a24a032946f83a80395ed10d86d064c81533bf725824d53a5eebc0bd15fe1a98
MD5 07974c4558a2913c0f26d300e1bcc6c6
SHA1 ca2483dd156adc7f05f9e5b0ed70be686a8666d5
SHA512 340f83292557fe57f4e5321a22a4b1f045bf086e8af741e72319051b1e67fbb00329f5fc1b2517b3d71f61c916e8580eb3e85899f8bfd3558eb194d57c3af31b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMhu:A3mnXoZjzyaTjFxhvND5TvinrmMhu
TLSH
T1E0056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 796KB
SHA256 376d2081eb49de906c0b90a74418470a461be14d0cc097c8cf1153266b3d6ab6
MD5 47da8cece8cc111b9e244178f63915ba
SHA1 9b8637a9a4ec731c5696995da3cc4bb37ed116ce
SHA512 78ce9d6b25eb93b8b7298fc757e80d2fa19a9f45c05c80139574e9ff31e18db265e350f765b63283df96f7e2622397d6711443fd18400a4023366b072879f9d2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMJb:A3mnXoZjzyaTjFxhvND5TvinrmMJb
TLSH
T1F4056A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 796KB
SHA256 42fcf68bd71984d46dd9ebc3fb574406b23d9dbb491415dce26bf170a1eeba87
MD5 6283c1317af44c978875990fa2f77cdc
SHA1 30855a1dcbc4e1befffb9163d9dae1a503d93189
SHA512 e7c2630b6f5294a8497f8aa95a70b4cdd1237ab939169e0b44ec6eca7c984052dd80faef580c092ae03793d96d0ca7005f0d48d24a33612040cb997650972d35
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMxf:A3mnXoZjzyaTjFxhvND5TvinrmMxf
TLSH
T139056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 796KB
SHA256 c459f2a6409318477c5c2cf27a69ec1c3f3a67a3b1861e1e266e751e5be7dd36
MD5 009cfabe33839a622042469bca35dbab
SHA1 4373c92775e3856d49e82165cdcf1a065bb0f00a
SHA512 5c46fc8ed61bed98abb52e71a93744dadbad304810c592ebc860d3a1406e9ad338d03c19c54eb430d6106eb11cb61e2bb396639061c55271007b6f3b57b1da57
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMaK:A3mnXoZjzyaTjFxhvND5TvinrmMaK
TLSH
T101056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 796KB
SHA256 9567adcd0521cf12a1b9f0f3f9c323b4234589e285579052a2907842551c5df6
MD5 7497ca664b4d25c10039cbe7f11e6150
SHA1 ef3d19351da7500d5be74c36ba2798e6d3cfa844
SHA512 6cf715103dd03310d9559f2c80a242b7227e5fb2b10e2248965e7c14b06c3e9e020ac9792b44358108a8f8ceb015080b3bf65580330c5d2b89606c098caec9dd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMPk:A3mnXoZjzyaTjFxhvND5TvinrmMPk
TLSH
T1FD056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 796KB
SHA256 f8ba50abed84299c5a431f6630a2ea0ee6c63e34cec07fc278741ac86e6786a9
MD5 64e0f435d8e86ac04b0b60abde98ae46
SHA1 fe9979d61c0ffaf1c73d74af889da7ff230e7da9
SHA512 ae8d787beb7c91f3287d6bbe1eb360c44d7b8c20b91ee24883205e51644eb8ef1b5e307145a94a957bc323372f9b6e302cea62354fe981f330c40952d6593db2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMI0:A3mnXoZjzyaTjFxhvND5TvinrmMI0
TLSH
T1D6056A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 796KB
SHA256 c4d0032992cb478b38d89cf9da5366df22ed50f13c7bfa1d8f715704aacb9f08
MD5 6e274c8b50fb5e3c86bb444e815fa7f0
SHA1 516fd31e348b99f7931594c6d0fb95f9881365c5
SHA512 6938d6cfe290cf309d79723104fdaadd1550c9d6a5744b7e92db4a57fe29608bf90ecc0a446dadfa90e53831d749a23ea9394cc3a73c5046ec87a7ce15fd2b9b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMj70:A3mnXoZjzyaTjFxhvND5TvinrmMjg
TLSH
T11F056A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 796KB
SHA256 f171509f07e0bb7be8d91d90ef361cf18e7dd989353b4aaba7403416c5c59c12
MD5 efca7e0a28eedf2c2fbfc7613d5ffdb2
SHA1 4642240440ccc451d4baf0a59f0849bfacacc5d0
SHA512 46045236ea5410cc8b1bc547950a718e3d6d6ad5f01c8ef10dddee58d6e1af14a02e3d4987114d15d01709df215b9090b35d76354ddc8d28869b011a288fa36a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMer:A3mnXoZjzyaTjFxhvND5TvinrmMer
TLSH
T18D056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 796KB
SHA256 b9dcf062ee6b8755896e1d4c3b7c649e925edc7704720a0e9cadb9fe182d623f
MD5 c183086c01abe0b5f053ddbd19a7987a
SHA1 bfd0d1f882c05a98d1560b2ac0d89f18ff36b1c7
SHA512 300f93c352f76409edf8c37a56bc0944ef8365ca4415df1ea83e1a099b8b3dc1f367f8ac3fa08cc84e0147027753c5e3d6b4bf119e787ed1e362a86616f9332c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMEn:A3mnXoZjzyaTjFxhvND5TvinrmMEn
TLSH
T1F8056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 796KB
SHA256 603524a4ddc19fc8e51a26f4c0720978bb148facd96133810a2745a48a5369ee
MD5 fadae4c9fb4198d4825e1fae905997f4
SHA1 0980b6829757cd28bf6e8d79764d1cb101f48b13
SHA512 0042c9c9d57ff3f02193a2b734a9da88204a2988a042c4684f5cf13f41eac86630a1dcee13df78744af973e0034352b28d4fd213a84764ddab8581b31d8ab020
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMSx:A3mnXoZjzyaTjFxhvND5TvinrmMSx
TLSH
T1FA056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 796KB
SHA256 d312f96f423ded49cee9db09d2dd51d0ab19b84bbd3716969c6c8409fcb8c896
MD5 365f33b85a0d729253e75df3040c410b
SHA1 a9ee66b73a4c670dc410ce036e050f918333a6d0
SHA512 1dee64f1afb088d815237ad9eac33f25e585d7c2d0d2a1cc86e0ebc044d845e0761542e2d00abe82c51bd0e705280980f7d2e8dcb36706af92640927fa2a8537
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMkA:A3mnXoZjzyaTjFxhvND5TvinrmMkA
TLSH
T108056A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 796KB
SHA256 2d9eea845a0a4c82f91047f9fdee0cad802d7cbbe94680b9bbe3f59eb8b4c06f
MD5 822710537f7c58504690559098413240
SHA1 3d6fd5253264207a129c52b510f40a47f9dcbeb6
SHA512 363f5b3d4bbaac2c9143026af20853875bebcf00f8aa8e9f7f9caaac6d37d007a5fcd113a58d341df117fb9fca66841a8c5c96760aedb79a03b9e133e0b8ec79
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMN9Q:A3mnXoZjzyaTjFxhvND5TvinrmMN9Q
TLSH
T1B9056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 796KB
SHA256 ed5e3727120c4d4272ccac49d66b0fcbdf084abac4dae37ca686a94f144aa175
MD5 e205299ea65c0481062408580d1e7a1b
SHA1 9baf3ebcae8ca478d4790a7c18c11856d0df1582
SHA512 2802c73b446719f389cefaaba438f49125c914c46e838e7123a253996908d2b455b1ef91345bc47ccb864fbee94080043759dff98a1ec79dfb8f1ec31fd2a8f1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMo4:A3mnXoZjzyaTjFxhvND5TvinrmMo4
TLSH
T165056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 796KB
SHA256 bac40fca7f8a9e0c5474020b100923b387e90b0ad8310d9286dbc7999482f123
MD5 890a9a21fa16645ca97e9654f5aa7ef6
SHA1 21f3f9a918dd97bf755c69f1e96ea72a56a07b32
SHA512 d4e5656908a904e47377f88884ca71ee99151c04588a4badabebd07dbf6a1ff1f7dbea5837affc0d4f3e9b83cdd6307798640f610b6f72a44c91e9b4b4e2a267
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmM7u:A3mnXoZjzyaTjFxhvND5TvinrmM7u
TLSH
T138056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 796KB
SHA256 f2c2e88a08aad6397dc3215547f832af61cd114e1c9ebce0ea9b35ecf5288634
MD5 49eed78f80609c4d16599a9e54d62aa3
SHA1 deb7e5a60ee52ed030e146ab2e55129a8a155f2f
SHA512 8be693a3cdd95521667fd7b5c5e55e906142e630d71b2506cd62060129cd1bca7670f65f1b466680da4fdbeb133ba007665c441798b2c49fee7da2846569ab2d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmM2j:A3mnXoZjzyaTjFxhvND5TvinrmM2j
TLSH
T18F056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 796KB
SHA256 766a7a71891facd7e66a8a5b918eacb991a36ec94713ff0e5bb98d0a14e98876
MD5 227175c8278196c227d9c4d93d422512
SHA1 ba15da57fad73a7f1d1a50f828e8389c0def7b46
SHA512 e82ac69f0d9d0764fcd70023c2a370f21c8f975d84a933a3088cef380674554c207e5b884f77f34b74f2f468cda7b7dbcd120803103d20d5d581e11098c159b2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMjg:A3mnXoZjzyaTjFxhvND5TvinrmMjg
TLSH
T129056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 796KB
SHA256 08428c6ed5b0a1786c5ee78f1b41107b497060a551dffe128f806ec0be961e2b
MD5 0553aaa8cae7e15548d1621e00f2c271
SHA1 bf31ef07cf38d3d7f53c02dd4371da37d5dc3e37
SHA512 d59492cb2e6807e6dcd19377a98f9216decefbdce5950b7ffa67ae2fd10bba749b7a13ec999cb4e07ae16a40316e8381c925797aa8008fe4b4af405e71619888
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMeI:A3mnXoZjzyaTjFxhvND5TvinrmMeI
TLSH
T1B0056A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 796KB
SHA256 6525cd0400431ad8dd81eef913fb62baab42862081e205ae72003914f4696288
MD5 c24a4dfe3826218c0bfeda5a4ae9b5af
SHA1 51b714470817586c2bba90c798d7fcd7b2b59ec6
SHA512 9defb10be2b54db5bd7ec1cdea7a3351014c879349d9872ef51009ef34d028c3d57f581460595fd399a4d60877fdc603a29e2342dc6c11264e02413bdf19ea54
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMso:A3mnXoZjzyaTjFxhvND5TvinrmMso
TLSH
T1F2056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 796KB
SHA256 420c07cf3db02682f3cab6cf5b558f541908921176ddcba73480926a63cd934c
MD5 916fa2d529166fce307e72a12c24a5d1
SHA1 f29c0540e097763ec096f14192f0ece0a013958a
SHA512 2f29192c33c5a0ef8c31938719e1cf10a3a4d7f2a0b993e7f8c5981d312c3b499d48cc447e61dccdfcf1019df24cfc74c113ed59c6e73dadd08d360df0fda6ff
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMv+:A3mnXoZjzyaTjFxhvND5TvinrmMv+
TLSH
T1E3056A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 796KB
SHA256 fdfc6cab4b6bf59f853281161cd9373f834bb4fceaa91006525120ba2316c084
MD5 50aa95848b41698a3a6cb65a3e0d7f0f
SHA1 2e18e4fbfb75e3f06b6b59a2c87c502b00b34af9
SHA512 4b1e5353ced83cafd443d10cba101025944c0d4c00e317d139da52e7ed8fbe8cd909a50a904e86f3c5cc8208276082932474e1ef7988b41d247c6aae2cc5a443
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMFQ:A3mnXoZjzyaTjFxhvND5TvinrmMFQ
TLSH
T1DA056A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 796KB
SHA256 12360717f089efbc96b2f4431dc836cf734ec06b3921f684cbfe03d9048d8bfd
MD5 4d91af2b374c256b5d3ec6d93f160742
SHA1 b9efa128eaccdaacec2161c747bb761733e96828
SHA512 3708b4747fab65e79404244f1abfa45184e48fe81c8ea7cef7811cb7f15566bd6529567b3d2b86dd78de217467300adaf11187a4f75bb2ff33b26f02354c4511
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMKX:A3mnXoZjzyaTjFxhvND5TvinrmMKX
TLSH
T1E2056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 796KB
SHA256 82706503d7fc9f797653493aae606ce922ba6d52d3e0f5ea90ae6a7b956dcddf
MD5 0abc0064583b85e07b7704e7303ff211
SHA1 11b02ae735c7ad85ea1e425a8f9d72cd58ad3a63
SHA512 d186b6bdb6f51713c38ab37503a091fb8a375b04e9f2c1d6bb1d06b1e4732bcaa121aaa22ec33d8a93b4694a06443cbefcd508c82c68e5b488987a8337fc4ad6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMsL:A3mnXoZjzyaTjFxhvND5TvinrmMsL
TLSH
T13B056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 796KB
SHA256 bac5b3f8df949bf63a629ae070446b4a2808fa51fbec016226598823a91a4b52
MD5 94c7b14496d87b320a34cfa12f83bd06
SHA1 5744efa38f1d5b4106e2349f21ad83a6907f94ec
SHA512 a1a1fba896e4e69c186df43182763ec6822b9860e023db6fd60362d8b2641ccafe574f9d1db87804987b867401c92f9bc9081fd52532656e129b705feda71372
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMoFC:A3mnXoZjzyaTjFxhvND5TvinrmMoM
TLSH
T11F056A07A6940FE9D11F817489924A62E7737C225F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 796KB
SHA256 9085166383fab0bdec15fef18198789412c26bab79df4cc2748c2a7830c564b2
MD5 2ea4a77f58a5c3f2aecd21cf74233c6e
SHA1 c380abd8bf2c06261858861e20965a90e1cdf15a
SHA512 a118524940a8884102ea50bf2babdca0aa8a0c1e46fb74e7919bc2d33cf0a494470cde2d46d0fb0c31a0a0e487ebf9b2c2c4008b7eda26358d48cda017384d45
SSDEEP 12288:A3ZUnXoZ+yPz5L8aTTfFxhvND3JeU7vinrmMJh:A3mnXoZjzyaTjFxhvND5TvinrmMJh
TLSH
T135056A07A6940FE9D11F817489924A62EB737C125F2087DF1364AE253F327D0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4580-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4580-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5396-107-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads