e65e58bad2aaf6f4800f427cd24c2069eae69709cf28076e35562cfca8320d8b

Analysis

max time kernel
99s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
Size 944KB
Sample260805-atmdysba28
SHA256 e65e58bad2aaf6f4800f427cd24c2069eae69709cf28076e35562cfca8320d8b
MD5 aac05038e57284787191d37f5e579b56
SHA1 2dbb3f33f831d0a7b963e4ebc6b1abf875817b31
SHA512 b2c6e6fe3c3700243f30696624f911b3e92a5f291baf31a7485458905c4b322af66c29d4891273d0fb32e5cf0808fd20e4eb00ed1db3d04ff6fa848a9ec8ce35
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvG:A3kMf
TLSH
T12C257B03AA9000B5E116493059A5961EEB357C12D7638ECB23689EDDFFF17C0AF293B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 42 IoCs

resource	yara_rule
behavioral2/memory/4640-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c643-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b301-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30f-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4640-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4800-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a66-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018989-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-568.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-661.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-974.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1097.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1216.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 39 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c643-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b301-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30f-57.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a66-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-440.dat	aspack_v212_v242
behavioral2/files/0x0004000000018989-489.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-568.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-661.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-974.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1097.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1216.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1364.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1384.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4800	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4640	2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
4800	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_aac05038e57284787191d37f5e579b56_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4640

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 944KB
SHA256 e65e58bad2aaf6f4800f427cd24c2069eae69709cf28076e35562cfca8320d8b
MD5 aac05038e57284787191d37f5e579b56
SHA1 2dbb3f33f831d0a7b963e4ebc6b1abf875817b31
SHA512 b2c6e6fe3c3700243f30696624f911b3e92a5f291baf31a7485458905c4b322af66c29d4891273d0fb32e5cf0808fd20e4eb00ed1db3d04ff6fa848a9ec8ce35
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvG:A3kMf
TLSH
T12C257B03AA9000B5E116493059A5961EEB357C12D7638ECB23689EDDFFF17C0AF293B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 ca2d8253303cb59e1b91cee909e20143a071911c0df24a55b77b186757d86398
MD5 22d1176d345cad3fc7d8236182857770
SHA1 8a9cb2716931d8a01a39f32e3d13948d3373b27f
SHA512 85a48aba22d66157eecb1508646e32f709327b228e7a3b90a04b615c21865419999ea96ce6f1b72b0efdbd99fe8eb6eeeb382a9e973c5842b38a1b32a5b8ddeb
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvL0Le5ji0hmxNrM:A3kMGPji0Aj
TLSH
T183653916FA644271D022C07485D2965EEA713842D7338ECB13949EEDFFE2BD19A3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 958KB
SHA256 c4371e26bc4010803b1de779fe1685da2435d1433d2c256ad01e1b7c5992bf7c
MD5 e023bd7ed5d4d9e3d17aa80e7612a17d
SHA1 5f4671bd606d94dc058a6eb75cfb2dc796175127
SHA512 925cd6edc45feac9fe5ec02b5acb24682f8bb63cc52220faedb5799d143dbf7aad23dfb73b292280ae6594b21ff950e45bca1ef158d031e4ce25b40bfe57c55e
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvNa:A3kM
TLSH
T1BE256B03EA9000B5E116493059A5961EAB757C12C7638ECB23689EDDFFF17C0AF293B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 968KB
SHA256 a4faf058aa8a05d5d58f577580e20257cf6db4dfa78b6f07286c934cab45e4a9
MD5 3d758dce7415debe7396c27a2509f5e1
SHA1 b2206b7c495823953de564fe8ca10fb3595e037b
SHA512 1bf1120f8f40a49be00150d1069ac346884f882e508959db93ad01ba48c6f3e22e23fbcfb8d30f5d703f84c65a42e250b4d67d6a959c2f7a07cafaf572ab032a
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvE6:A3kMw
TLSH
T184257B03AA9000B5E116493059A5961EEB357C12D7638ECB23689EDDFFF17C0AF293B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 968KB
SHA256 641039eb86d2f3855ec57c1ac2f0180f16fb16bf7b544431fcc04dc144b2cc12
MD5 0fadb0d9716f594a10c6b9d8cd0e5061
SHA1 27b038417d2aa9e4ffd5d0098bea1de6b144728c
SHA512 72c869c5526fc83af0ba2cd4f461fa9af002389bf8b1f6e91e897407400addc5aa8a4bfcb9e9f6dd7f1285b639ad8555979d1348efbb38fcd1ca1a3e7a90d690
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvOf:A3kMF
TLSH
T19B257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 968KB
SHA256 7e4752ef6ad3d0808e3ae61927873af0e9cff05b9f4de5a94dfd2c489caf113e
MD5 aa0474a4f207299bdc2d86edf1c1b85a
SHA1 65fa9545368e48f2cef3364c2c348e40ce31f2e9
SHA512 eb457f9a0bcb970608bfa93325f99e0f3398570165fad21fe2788b838a66cfa7a87273c5c310f229faaebe76d426f9fe215607f17f4731817134dbfda8d77b48
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jv4o:A3kMQ
TLSH
T14A256B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 968KB
SHA256 1b7b7a8401102288b40e5526263999f4e9b9ffabd634027ad173d982a62d7343
MD5 d2100b5fc835659223da35f7392e8cac
SHA1 b294d3132ac6322acea5d96e1514559a951d1210
SHA512 fa24550c9fd5c7cd81ff640265b8859b4d363d2c8f24843eda2c7eeedf1fe39ab01dfcfe93140b29b6f09922e82c876973ba7018c46f4982c96ded8bd9e5d289
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvIu:A3kMS
TLSH
T1CD257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 968KB
SHA256 6d9d6a17a466f5ef9fdc0386678435f265666307cc207e3541c8801df66d96ab
MD5 666f0dff659ea6c09165bc88809ed467
SHA1 b91234bdaf57bcba4a8c297ec12edc0b1336358a
SHA512 6555cdf18138c4a8141daf1e473c2a34c0b42196a747ab71a713727d7d84d6a27dfb83a523340cb44cd9e544fce873cbdb88219fa11cf128a87a4b34eeb9cd2f
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvc9:A3kMT
TLSH
T1CE256B03EA9000B5E116493059A5961EAB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 968KB
SHA256 b0aaccc5d9f68df735337a107d33b2e57ffc396a46da3b77ff5f56fea90b60d2
MD5 3ead1f72692bd3b8f7da9eb5ed333729
SHA1 dfe6ea828676062a97f7d3338a7fdc8266a9c795
SHA512 3289125c685939c52f8e361dfe5999ef4ac5789352d9b4330e5a32d589974863613d2eb2e1e877c43090ebf2de33dd29758d9d27f05a827022ece6f752d7616f
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvEc:A3kM6
TLSH
T144257B03AA9000B5E116493059A5961EEB357C12D7638ECB23689EDDFFF17C0AF293B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 968KB
SHA256 bf9f4fd6f4948022070b175aa1fe4326a7c5d48157796b6e7eeb3182f0ac56c9
MD5 f432dcfc09d09d4bce46e2e18064c248
SHA1 26d40dedbf9aa50af43a6a2767f3d6602ecd19fc
SHA512 beb30bd6fe1c85dbbc679d2d3fb3c6090c746718c421b485cf87cdbc164a04d27801031a491e2b0348f37ad2aeb2e90bea97f78416474e312a9aa74043785ab0
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvdp:A3kMg
TLSH
T143257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 968KB
SHA256 f78363ff7a797b9439feace70e055d05cf0c4e60ac5c8f0b1b36398b10267143
MD5 480ebf8a4b1f44bba9f4fd21e9d80ee6
SHA1 fc7ae9e451203b94144ad1314cb5d3b9a94856d4
SHA512 49d59468dba4d8d757325b4d374139b27f19232063bc830d1dc2b77162aae4e0559c0e6a099c5884a701cec6e21ce92267f043b64b3cb449b45b471a0468ebe3
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jviN:A3kMf
TLSH
T195257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 968KB
SHA256 101b0cec6de43a75dc47c16a54ead67357dc3e4eb19ea43146468d3bb02b8c10
MD5 5ccd87157a54a15eaf38746db99e8e5c
SHA1 a9ac4615eb7ccb4f596da577992b0ad07cb4b8da
SHA512 a81109c48dc90f9967865a3140122dacb86de40527a807ad855778a521ca9b8b3b2c24d8f327f9c88116527df1f31093678cffc7d287e15a5d1cfa45612334cb
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvGF:A3kM5
TLSH
T1A3257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 968KB
SHA256 e6d29a7253342d5eeb6b1063c4eb20bd381da9b421d08430c8d769253a0d7c72
MD5 7a81e2ec8a63bdd28040d76108d386f1
SHA1 6397cbcc395482a1b9d6ba4ecf21eb90cb4033c5
SHA512 1634013e878027ec5cf38cb1c9c12847dd3d22a858c7a7c3eaa71c904682f69c7c192c116e60ed81b562ac9b3dc9f922b18eaf111ca7184f7ad17d15e8dd7b50
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvTC:A3kMF
TLSH
T1BB257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 968KB
SHA256 d30b1e091d8bd9d35d10ac8ba4fd85a99bf112c7a8e8bbd5a535f3b38bdeee85
MD5 3efc783ee8ad74bf4ed1a3bfc86d22b9
SHA1 4accb9792863d747c80f45ad19155669dc6fde72
SHA512 4ddc5787a75f1aa4c1eaab993deaadd4c0d3df13261c6c2bc1229175d4d83212326af024c26d589488a2782d9c9e5ba16e4432f717c86bc7733fbb48e7c1649c
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvcw:A3kMo
TLSH
T1FF256B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 968KB
SHA256 1955ef92b3252b43cdd2255e773ddad490ee912c684a35e5b2dcbc81a07d1d8d
MD5 265b35b55ffdbcf10d91f800d02fd65c
SHA1 f0f5e7ba4d379bc11166d9d19ea0395a0c7fa0b7
SHA512 c768c2dc5df9a9e05fd310cf59476a2fa18b43a7934414a6b06635558d67c71eeaef96755cec5c1f407c7e00bd7417dbe9ca687b3a898212be3bb80802d720b0
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvTT:A3kMg
TLSH
T13F256B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 968KB
SHA256 e252a618ffc6cda0ef62f8ae56766b5cf1ac1c998c7d9054351e0a532adb725d
MD5 58865776504a8aac0b0bb8262e6098a3
SHA1 17d016e0b72ed5fa91ed9af728cc8872f5747f4c
SHA512 ff7607615b3345ff06b46f897cce6889e16efabea7dfa8ad839a313688d6a1dc3d6a128c3ba56df3c1e803f858b5767d379efdbbb89de54ed7046db386640110
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvlu:A3kMf
TLSH
T1B5257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 968KB
SHA256 8bc1c56f27950b20fb403b39f639a5d087b51000bcfeb957196ab569b700b60b
MD5 6cc0527e3f42e9902d5a022bf31216fe
SHA1 bb6b8d42a50d14906a5410c90fb99689bf514082
SHA512 403b963b3bdf49d097075876ea131a473c5d827ed0f6be5c2fde7bab8a9e63ef46594071697a6c3423b8eac97a9bc975c2774294915d823a1f67d63c824bf59e
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvtb:A3kMG
TLSH
T1C7257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 968KB
SHA256 abab82521e73ec5ca225869805230a8a762eaa390e0dad8088a6241fcc7db18f
MD5 ac3fb9ea0f33387c2ee7b3cef08ea9ce
SHA1 888baca739d6bc4f3b6623cf571f2dda4def6a4b
SHA512 6bd467437b2f039383505acc6632ee492c7ccc9129fa4d7c28cb94bfeec7b658cba764bb9aadc40837ffd5d285a482264dc2c0c027f46bdc53c62ebbef15b174
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvdf:A3kMW
TLSH
T1CF257B03AA9000B5E116493059A5961EEB357C12D7638ECB23689EDDFFF17C0AF293B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 968KB
SHA256 564677f4f17fa828e3f437b6b3fa23f45b113399a088a29a8f12e0bc075643fb
MD5 b35692241d6358998a8176c6e073a389
SHA1 f24b7f0f9cc9c24d343518ab662df2d61c117301
SHA512 d4a11fc4ceeb987d961b31136e9b4dd2903859963d641383295c87ce5e66440b9292f654344559cf4744f4c290b0550a73e971b53c170cac32c728a79438f2ca
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvGK:A3kM2
TLSH
T1FD257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 968KB
SHA256 fb3e0d87a941a0c8c63b8b6969eff4557d943bb5091148ae42f94e155679fc4c
MD5 4ab7f010052156a1f6bc74fcae2647e3
SHA1 ea330099b83a5f2097b7bc03e87a70835084c7b4
SHA512 f56836ff74b9bf55d13292984c06436be4d2901f2e648545adfba2eee91907c3d81cf27977161822b29ed0ad063e6d01a1a20197f48346adf0f91f0681fc7663
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvzk:A3kMr
TLSH
T166256B03EA9000B5E116493059A5961EAB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 968KB
SHA256 e817fa840292e6c608a36c9ee025635399e2071756dff0dfcd9319c557bf0fc9
MD5 a526c1f2d5a3c447a7d332489f71ef8f
SHA1 2969fb5f5c43f628f46577ef56351393e31a087c
SHA512 428edfdd8ececdce5f65fbe055fb47eb0750e9a8903eb31d7ea3b92a8d1315f69055b2f90c6d3ad6a9e1b7dbb3462c1acbbbf788ebab82915d28d63731544cf3
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvE0:A3kM6
TLSH
T12C257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 968KB
SHA256 0e4de11f1ff50874e8c3a9ad8fce54b7fc1ce573612a2413f054162abd52635a
MD5 ff41a52376ac37bc35c82d43b132bd2a
SHA1 dfaaa5ac5bb24535f4eb54d419d395275d805d89
SHA512 9ef392241a69a8ac25a96b4f9ff34112c9bffc0dab657a5ecd449446aeca8ada52a00bff8d81bc992b86ee9dd889b4f92d8269186ca228bc87bfbca56d1f8b17
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jv/g:A3kMD
TLSH
T117257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 968KB
SHA256 7d0219817c4cf218b69f5198755f6902f38efddabf952c2eabf041970434941b
MD5 3731f5c0a79879aa0c87bb813a397b5e
SHA1 ec040388cc9d724b3cbadf66d88c4434983ddcf0
SHA512 9a749a8382b1b7c5c6db55e83476773f27ac86f210d9cfc71f7117cf986da99272f478d8763bf3430bd032e4c32a10c37179e6f29e330152ce5424442f0c9d91
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvSr:A3kMV
TLSH
T193257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 968KB
SHA256 c67cf8b6ebe5c741751993a222ff491c2bd4282600bb20fb4a9ec5ea81e95784
MD5 115164f08e6937f6c863dfdbe3d996d2
SHA1 7f7d03fa46ceaf42d93d0743129ff3e93f1ebeeb
SHA512 fca49f96b711658a3156e430725558af9eb66079ce83a86ef5248bdb6e2add2c7219348c507aae2387c5014cd657f3c3b6084cf8ce4737795b5d2345b039a5d0
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvwn:A3kMH
TLSH
T16F257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 968KB
SHA256 76efb01596ad3b793b75b657bc23ebc1b626277e6a4f8a6b896bdc4dec4d3c82
MD5 e6959547b379d928f5602731a9d93daa
SHA1 0287d6c2b026ec1b6c03d6406cca3b85133cd1d0
SHA512 d8c2a9b1a3024db93d8382944af946a015b478b6a708238aa28d831c4d1473598877fa36967a8b6e67950012422d77e91d6268dabb966ac1f716b6b661f08270
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvOx:A3kMd
TLSH
T1B3257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 968KB
SHA256 e8a6336c1500581eb68cfe74417f2f951db0c2a707c97b9fc5547c7ba6d21eb1
MD5 9ba2eef0d7d01a1c41391a1793a610f7
SHA1 5401f44cf12e7a2a7bf2d78ea01c9301d2afadd3
SHA512 e9899f94d9f52dfbf5d35dcf4fde3a60f030d3bdd6945cc7d54b05c1acc2b9e1a73037ab9fd16f2d2a87a017b67899b57a758d8352e973ff0d4835c5a1be43db
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvoA:A3kMC
TLSH
T193257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 968KB
SHA256 88afb5eccf858181cab6d9696732a7ba1c4c33675b8bcfc308a7ea1df6d51325
MD5 e9dd95223126c2aba45c16217dc1f467
SHA1 f3c6448c3e8ec83bf70e348e56b97c897be0482b
SHA512 8536f0b7de5abf461ce7630431bb53ddeb75d4dc0f0124faa9ea5f9f6471087d745f08aa2c45a09074c06a258d4ccd0825d3dbab3fa9b8751a601b78edbc1fd6
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvB9Q:A3kMf
TLSH
T13C257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 968KB
SHA256 c48811b97e1044b03382f228aea4af9305f387967df1ba3d8db1f181d731f1f5
MD5 bbfe960459af4822f6cff8aa61b7a62d
SHA1 830a388d95dc64837b4086cd742834863aa1ec4a
SHA512 9db15964a5fac61b0c1423ddb9e37a851d21bed7a3f84d0a0d0980a3bb9c6c9f37fe7da1d03ee17731f7a9d4834f3b8976ad6c0b3d5da1a9e6750443d090d6c6
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jv04:A3kMg
TLSH
T1C0257B03AA9000B5E116493059A5961EAB357C12D7638ECB23689EDDFFF17C0AF293B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 968KB
SHA256 4907748bdf5cfbd450523149254bcddd2bc3ab25942008bd36844adbc283b8e5
MD5 f4dda046be4d6fa6d6be24a8507c3c99
SHA1 009c2003363dac82c830249346764ee046c0fdbc
SHA512 50a39f1c11925964343aa179ce80442936da50a8680f8bb13fb4dbc204f66822f2d20689f20c372e56b69fcf87f685327bc301a5e417829e15deacc98e33766d
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvfu:A3kMB
TLSH
T102257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 968KB
SHA256 71f4673922da9b6c9435e6d39bddfd3f75fd3571c1efadc7739e17c97fd92d15
MD5 21b3f0f8443cdd3b147b6b0fef4f2f30
SHA1 36b2ecd3f8f0337ec038fc1111b9d55231e354b3
SHA512 b99bd3a05b3647e6ff04d0249391f4b68b72ee73899b79f3d6a915b5b4dd4060104f50c543aea70c128c190f3d9408ea1940b162eec2953bb8f7da565e4d3bf6
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jv6j:A3kMr
TLSH
T1CB257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 968KB
SHA256 326d7d57a9b66e9b2aedb73b2a862d4d42fefd77b2ae840ce4998409c9053d2d
MD5 946f8157486c2169ca0b52257155b841
SHA1 b47a3810072747c44c30840eba8a52e6bf4a9067
SHA512 cb595c6825da6ecdafa72adb35364d41b64c64adc0d7d32f67168086356f3b3e025b2b1f2b78b43945f0bdffcf28931748991be6c2c56d671cd6883280f475cc
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvng:A3kMj
TLSH
T1F6257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 968KB
SHA256 141c456dc72e74fccd21b7cdee524093e81ca9a845050dc2ffdb8a86960c18a5
MD5 563808997357e15a29f6242465366ddb
SHA1 5fd92181e6fbf8f8502c8e56c44865de891d342a
SHA512 5a707a411e5e6af520fb281a02565f58845eb000595f5907cf9c053fdd85d4d24a5467881bbe4cbe4b531573f24147ed142adc2f7142b577fa11d2f1f8e7038d
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jv6I:A3kMq
TLSH
T128257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 968KB
SHA256 4a3ec3511cc239af59c129d7440daf62158a480d46ab7f9d5c75cfe18322f4be
MD5 ce20430857e49c797354926658dba893
SHA1 7df55a2c0d0a75444d54e2b8922533e7f0d62abb
SHA512 6051b9760878dc14c8fcf3677f64b15c1d3a50c641985811237b5e10fb7647f0715c28cd22a3cd00403ba8cd9f9af5d400d5de5e53c4f45c8a8ef67e48085002
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jv4o:A3kM4
TLSH
T10B257B03AA9000B5E116493059A5961EEB357C12D7638ECB23689EDDFFF17C0AF293B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 968KB
SHA256 b9e6d6b2b71704563b1187a1b15919b595cbff8dd866ad422ba708eb63f2ac75
MD5 fe0a0b00d1b05fb47921fbee6eaf39cc
SHA1 59a41e244dea42748a930e1e7ddcb4589f953974
SHA512 fce9c488a4cec9ae4a57cc88c8167e8cdbf592922faccbfa6327847b347f7d893d56fb735e43290554a2f821c265305dc8fd7070db4e35ef69bbb28bcd669230
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvL+:A3kMF
TLSH
T1DC257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 968KB
SHA256 927611013efdde4aa6ea7cf71dfbbc48d3538437f8fa9281df17c87b8de89b62
MD5 8a5efa0327b52f2d46d5e10943a11c2f
SHA1 8d993c6c59254f644df900e1f6a16aca7674b3b0
SHA512 27a26639c4e706555ffaee1b074db77f46a5987b372db5afcf612cf003ad0a082a646b99d9baccd2863ca0cd1f57bbc1975f9c75d16c17d62688de2ceb5101b4
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvBQ:A3kMN
TLSH
T112257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 968KB
SHA256 f6202bdb4ebe916f56a95e79eb684097fabb7e1e39a7db4b18576de167db8d56
MD5 5514b4e047597be6871fb8ffc67b47f5
SHA1 533284e2094bd6da95a327e76e827de90b27d6fa
SHA512 e4a28d1e3b7e84f6a778f97805b8bc112549983c730f73ca062c792b5df7c51480971c70ad551488bb7172662a0bb07cb2c7824313e4a795e53ac84154a8086c
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvGX:A3kM5
TLSH
T18A257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 968KB
SHA256 1a09a5a8282ff5de2ac721526f36e691bf0a92a2974047792d4296450160d775
MD5 3752e4f6576f2a19bae4b6e2021559d0
SHA1 4a76a167e7b8638486b443aebf20b0f59a07ee1d
SHA512 db91fd49cddc4a0a91c40010e2a09c982e221f9c3b62c205bfdcd936414ac25c1abb549c84ff727f52a885325c472afbd843c6196af4969c10f8af7378056b38
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvAL:A3kMz
TLSH
T110257B03AA9000B5E116493059A5961EEB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 968KB
SHA256 eb3c20734f966d4d1bff6bc98137a6e0b90981dcca0fe6aa67f636d54c8e0c02
MD5 db106a1a57e0ebbda4d834814b3f9d01
SHA1 a6ae92aece0201a4a2f519e787eabeabb95179fe
SHA512 148065912f2326c98b443854aebca4beff7e7bd23c853b16d2dce67b07f84da80c6187899d1961df2713e1bc42cfe4789d0d5f1808f86fb43873b38725de7a79
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jvsM:A3kM+
TLSH
T14B257B03AA9000B5E116493059A5961EEB357C12D7638ECB23689EDDFFF17C0AF293B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 968KB
SHA256 61e2b20f2ecb6f4704f2916b7fa52a9a5c997650f458e2a37855be8756308543
MD5 3293b4450bee0dd8ef23ab8d5a4cbeff
SHA1 5e3841e925e44e3b6e108a511f81022b47163f46
SHA512 55a1d19ebbe36fa585d1c2fcce35b082eab5e83c1b7af389bf7ff571e1bdc3c13bf7b2dc88b7e9f4035a564aade70ce5a997c37fbb0b805ce95bb66a9f4c9e3e
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zc9jv1h:A3kMQ
TLSH
T178256B03EA9000B5E116493059A5961EAB757C12D7638ECB23689EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4640-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4640-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4800-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads