4fbe4ec9ca3390d2e92640fca64b1ecb43070894a33adf04c579e12ee3da6bc5

Analysis

max time kernel
112s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 929KB
Sample260805-ms6gnazvas
SHA256 4fbe4ec9ca3390d2e92640fca64b1ecb43070894a33adf04c579e12ee3da6bc5
MD5 e7a525ddc9983dc03f850347df591ccb
SHA1 91af810ea1e96f49a24369823aee1c705b61fda9
SHA512 565201614eb3d347a7b57d9f9f84712825a50a7b45d77ea73dfb50e621cd29d136ad3641e5dca7afd76f5bebb7adf2eaf02e5ba0ce691db80ded5be34613b6c1
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaG:A3kMjKJ
TLSH
T10F15AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 42 IoCs

resource	yara_rule
behavioral2/memory/5036-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c3de-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5036-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1216-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982b-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-443.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bc-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-578.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-622.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-659.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-732.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-769.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-800.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-843.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-908.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-1008.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-1051.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1082.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1131.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1150.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1355.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 39 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c3de-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a3e-225.dat	aspack_v212_v242
behavioral2/files/0x000400000001982b-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bb-443.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bc-492.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-578.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-622.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-659.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-732.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-769.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-800.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-843.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-868.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-887.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-908.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-934.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-953.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-1008.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-1051.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1082.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1131.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1150.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1175.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1220.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1330.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1355.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1374.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1381.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1216	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5036	2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
1216	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_e7a525ddc9983dc03f850347df591ccb_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5036

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 929KB
SHA256 4fbe4ec9ca3390d2e92640fca64b1ecb43070894a33adf04c579e12ee3da6bc5
MD5 e7a525ddc9983dc03f850347df591ccb
SHA1 91af810ea1e96f49a24369823aee1c705b61fda9
SHA512 565201614eb3d347a7b57d9f9f84712825a50a7b45d77ea73dfb50e621cd29d136ad3641e5dca7afd76f5bebb7adf2eaf02e5ba0ce691db80ded5be34613b6c1
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaG:A3kMjKJ
TLSH
T10F15AF03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 3bc1c32d082fd5b145fccabe3a9a6a0b1b9f31bbb5c497242cbc6d919b4e1128
MD5 63f0cf13aa36188563b0adc66a1aacb9
SHA1 e13a6868b9cd42b2752a177e546e3d48a1603222
SHA512 92229b5f8bda93aebaecedd5831f4855e945c20b9eac412281c0f648b1f4c83b31753a13f37616043b783a2b80b1b8f06bcc6766194888ce6311ca9c6f6af35d
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGP0Le5ji0hmxNrM:A3kMjKJFPji0Aj
TLSH
T1EF657B17F6A402B5E077C174C9E29A5AEB7138521B308ACF1398C7692F237D19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 952KB
SHA256 ee6a03daccc9edeca027d0b38209b00962408df63f529e84ba009594d8c6543b
MD5 397cccb9481dd62e5f01e0777ff07924
SHA1 0688458bf7045a9513bf29ff4b33db9aed982ec5
SHA512 f08f1e8f42d08fb5abbeaf0c6833f5b4e31b27b5295546e451407804a39dd42dd8d2cddbe9cd87d90416f0bb68cb4aefffa8a4bc85033c0705224502b50584fa
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGo6:A3kMjKJB
TLSH
T15A25AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 952KB
SHA256 fe59bc6948b63cfa6b55660dd61c581bc13f68af8bf17ea269224db4c0082d07
MD5 70893284e57a2c8abf6e130abe1e31f9
SHA1 baf0f2598c8beec2e71d8ba8a302bba06249cd8b
SHA512 3efb60e6cd12d66acb031f664dd74a032740f9e6b662eb74b3321e248edaec1b22b6e00e5b17a68c41462b328e79e74ceacf80159f7b0d6c93455d0c2322a98e
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGsN:A3kMjKJY
TLSH
T1E125AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 952KB
SHA256 28ae75e6fe0713d7cf5080d78a8cb159d1345acd080cfb57beb3fe047b60c7dc
MD5 1235c63d402db8bf59577b576c113c1d
SHA1 5543209cd8e113f20a2382572327e0a5e44fa722
SHA512 32a09560c571fe124f8035002cbe48eeca3c5c9b77e42f8ca9e85c059f6098a94cf451dcdb312b3bb68e7b600704cb3624286ae5347d8a88b2a6d74263a4ba0e
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGif:A3kMjKJQ
TLSH
T1FF25AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 952KB
SHA256 dfdc905906e20eedaad5db391d8ed4d098332c219d273bda3613bca83931b440
MD5 0f97bc7fcd893648c9471b64259692cf
SHA1 2f75b5b2d7b08678d28bfcb46730712cb56c6fd2
SHA512 f737c5e9273306d15cecf27a94d6e34c4ebdb3faa21bea70c33f1647f8422eb3002e40bde1976d5c53734dc5fd291a68dfeb1fc4710d6c6b3077ee1f5e7db7f9
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaG8o:A3kMjKJd
TLSH
T1D425AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 952KB
SHA256 851bc632faadfa4163bc88154e8141a9fc61ded2962146ea175a5ee3f63eda31
MD5 7dc9faac5d5eb464d88084053c00b14e
SHA1 613da26bd3b69d16047465889af3b17fbddb8525
SHA512 3554e134db693a5bc3c577701944686f61b99950b102a49b88ca507416adca28bce55ee1859ed163d5cdb1d1fc58e04c8da03df01fe0ca1395f1533baecd2a12
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGcu:A3kMjKJv
TLSH
T1DE25AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 952KB
SHA256 7c3a55fb9fea9cd7e30966572a21fb5f027c6b5a3d9b61f7c4fafd72cf6ba4ed
MD5 e7cb2f864c88a746df674fb31c120574
SHA1 df310d85e27bf503ec9fe67f9796471cc0c3ba0f
SHA512 e868df6e34e2ef7210e0c1346735ec30f14cb6018c027cc7f8bc1f9284eb7afa5ae5ec1548ceac4a59811e4cafc8a108a5c97778ea449ad95842a12b2a7cdd04
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGg9:A3kMjKJO
TLSH
T16625AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 952KB
SHA256 6bd9cd559b97f74dae211cbfaea16d08052f4711a4057b080fe42372f862dd24
MD5 199a9211cdc59d207bdc887d8c59fb2e
SHA1 9acc4551f7764400c2d531da8d3d5e8f2040890c
SHA512 a193d082a2252c5406f610ccc30fe182c547420aa4b32bad92997b0f0aaad5ccd944a7f8ae23b560927fc7e683f9dba8babfa17e18ac0d0933c8fb90e72e4149
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGoc:A3kMjKJj
TLSH
T1F525AF03E7A410F5E55A823099E54A12FB75BD621B60C7DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 952KB
SHA256 0ecc6a7367787da9f8f2b29f6daceb22db240b2fa66b2f936e38da6c2eef73bd
MD5 24fdcedc8962cf397b11fc19a82307e0
SHA1 6f3130f274a027c74eebc7321f38ddab2944debc
SHA512 deada4555ad8d71a2c2065182e28704af77e37f6de5114bdc6ab8075d5f376c859db78b17ae2938ac82ccbefdc06c4f5bf8b8b74eda121fb4220c6a19be242ba
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGBp:A3kMjKJh
TLSH
T1FC25AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 952KB
SHA256 31f673299935fd61d8a4708b8b547a76f2a893583c9c595cdb5892fa13d7aa2c
MD5 9283759470db012ee151d714056b7cf3
SHA1 230629c3a88f2f53a50b0731b6f80b890af1c53a
SHA512 d05b5253c0790dfe2d178265cf9e49bc8d76c6cf535c16d9a5c878614ad4f08d159f020ca1949ad63991f91f06244d7f3a17244584ae35a869a70c11890f440a
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGWN:A3kMjKJ6
TLSH
T15D25AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 952KB
SHA256 755842a4ec1bfa7c9be9d05551a0be7cbbe3f87caf2e52e5e745947dbb5bce64
MD5 bc7e82dcd4ff1ffb05bc2b4ea0046453
SHA1 36e922c3f8381cc927d790dc705264eed06fce86
SHA512 8779561b8aa63cb723ac696dbfa6a6bab8431a3395a24c602cc01e1b696308f0c514b987e8553569d3631fcf3ca0dd33199add37606a28384fb63006a49cd333
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGaF:A3kMjKJA
TLSH
T15325AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 952KB
SHA256 2f1f6ddc84f213d0841a7857ebfbcd8fe682537922de59fa3cece5e3a296ec33
MD5 5315d151e0164a8de45830c26346a708
SHA1 9a3ac41cfce9feb49d32a7bb71d76f855800a656
SHA512 cee6743ea7dfc95de186392d618929f6ceb0f9689e2943ee2f5ae4c10ab329a6ebea43dd990c7f7f1798c01cbf22ce18522fc5c77488638e2878fd055a657766
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGvC:A3kMjKJU
TLSH
T11C25AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 952KB
SHA256 5eb3de0f048e15fcf58c654a8db414112bfd2f29688e1ee8eac9e30123b59f9d
MD5 c332ac5894cca39c638468aacc8c659a
SHA1 e135b3896a26ec68ed09d26126b4f36da4344888
SHA512 6e456a9329ba308201ad922471316a8d89b7faf26f97f29fee9657d363468cb6e6133824577e5f2bbdb37e1e4a7fea43e58d347e449d69d1c05aebda81b62337
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGQw:A3kMjKJp
TLSH
T1D125AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 952KB
SHA256 46a72fa92ba17af456717000df2090e15573c319dd3fd58ac54b22a7465bfcce
MD5 a2ac1076ed0343e54ddf0eff3caf3eb2
SHA1 27fdf990b4473733a8da05d036fd68734dd95f45
SHA512 2bd0e8bcd8adf5b4e7237639d29958be5ffa82972b92c129a0a143f78c46a39312a01ea23493024888b1c52efc8e72af0ccd6f3d7971fe729aa74e9874762e67
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGvT:A3kMjKJd
TLSH
T16225AF03E7A410F5E55A823099E54A12FB75BD621B60C7DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 952KB
SHA256 f5ca171eb46db1e47b9ab032d1005faff0ec54ec8ddd5be6a3d05e0f12827a75
MD5 c27817480eed506821d65e1f9818bbfc
SHA1 98756c0791f94fdf3993f3bfc0b368e0e5bf9a1d
SHA512 f2e8a0c4f086e219e0ec276962e89dc85b52aec48308cb5dfdb33d1a7216b4becfe44d1bdb2acfc11240d2b55070e76aca3e6aa619ece5e0b00ac793fb23c21f
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGpu:A3kMjKJi
TLSH
T17D25AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 952KB
SHA256 bf0f7726324beae448d7b18ae644ca26e4587184acc1dd1ac0faf558f2cf3945
MD5 6ee4e580f7bd99495808eb645b61e73b
SHA1 4d12c7e972438c4460c7c3d540ec3a59552c3779
SHA512 ec46f21f98919ab9f19e46585d1419214d02ad8914524a76c3c5fb483c84bec3489ca84949e1d4c1b776655010fab0ceab8416377041ab79a5036c6ed91d6126
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGhb:A3kMjKJT
TLSH
T15025AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 952KB
SHA256 0018414c0369cdb16f39737f475d7ab6d6bc4ad2dbc4e440158a4715dd8b50e3
MD5 70c6c778a43ee2384c5944109d1390a2
SHA1 927f158c8742ab76ff6829bb1c98fc2906e299bc
SHA512 60f15b352088f2e9d662dda337db1f19dfb8debd61e8815c1fff82bd84b43e94dec7e1b776660dbad7109845b7803d74a5466d6565e6107be40aabe51c84fee3
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGpf:A3kMjKJL
TLSH
T19225AF03E7A410F5E55A823099E54A12FB75BD621B60C7DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 952KB
SHA256 a8c097a239d50e350bd22a7cd9053806fd125094a01a5dbdc45b25c4646005e7
MD5 6ed8a8f860e0826ec1214575d3150ddf
SHA1 55f4c4390059f21f98ac4b2140c3fa3e19f69f0e
SHA512 6f00a343e6fc818d3cbecf3392b13ba71639fdfa201b5d946a30bd9f0327a7c694b3f1668dbb002b7f6417ca290a1df4142b3a1021a9a495389962cc19ad7a3f
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGSK:A3kMjKJ7
TLSH
T1D625AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 952KB
SHA256 734cab93a9fd63e687dc9bb3bff85051cf510320c0a0fcca30ca1c3a7a76dcac
MD5 10e23e16003121c6b3694dd27ba03129
SHA1 a94e4cac077253d0962eb5c010c9c1488cec76ec
SHA512 5477515c97d128ef81e3c3c86daca491679819349c99af0a990c6460b98aecd7c4ce0bfb5ade14433b5a76290930111d3815ade60e53f7448d0254eb07d38b56
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaG3k:A3kMjKJ2
TLSH
T15C25AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 952KB
SHA256 4a2abca907e6e4c393a2e6255dd95c9d323dbe2345b6e3f87a1981637e5e88e2
MD5 15b36a873a39255fa728d2b7d8788406
SHA1 98adab8780ddfadd9c31b135ea6489d82d78c428
SHA512 dac23123ce3f6b51ab661efb79f4026a97631d3456559827066437136f6747a6572d5555bfce80aaa9b63410b0e9850030d3c6a9ba97f96c10d0a6b0cab20b48
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGA0:A3kMjKJL
TLSH
T12A25AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 952KB
SHA256 4f6fe98947ed1946ccd7182d73502b4b73a4da72e58023c6b4db05507d44ee60
MD5 e1c2527b3636a189b7b24c6a0dade07f
SHA1 00949c052793bcac7517d5ba2081c5e752083f2c
SHA512 917e8493165fe81c07e9512038312afe10b517b5a084b848659268b7db066ff0b654179b03697d2f0050c829bbba91f1e10eb68a796823c0e9a9dc2f8bfbb06f
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGbg:A3kMjKJ+
TLSH
T15C25AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 952KB
SHA256 f1ddcd15f8a69ce1c73243cb45c6b4deb96247cb22a277df7528829b5a9ff2ff
MD5 bb1b173646b138d6d0bc8eff1f5cf0fd
SHA1 0a15ba98371d5be726f3c333fadbe9678d4b6ac7
SHA512 eb022a4e5db478e6561d3bed079bbfb01a094405ebe6536cf4543bf2484a87b418deae1d75b55d69f696cab1946f5ed30767cf35a739c0a544b281e044b4c197
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGWr:A3kMjKJA
TLSH
T10D25AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 952KB
SHA256 b0ee78b6f3e45c34d76b37ee8019fa875338b3aa963db8acadefe4b629f3fa48
MD5 c33c433fe17e23ab1fcede161b06130a
SHA1 956a2dffa57d4802353f156628a49ac44faaa453
SHA512 390c6f2982055a31d87b76b5c07ca352a812579c29b3a3476ba4f583ef2ff586c95d63181651e3dc852e9284981d25be92022787791d3aa56fb5c6bb53da28eb
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaG8n:A3kMjKJS
TLSH
T17725AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 952KB
SHA256 ede4aad9b0d81a8ac272602769d109d6a2ee78ccf2d4547de0eb41c429734fb3
MD5 85d135373c4d7a88bc2198b671756336
SHA1 de8192c5fe7e27367884beb56fa759c8d7ecfef4
SHA512 10d8577d8c76d39ff3c452bde88d9704e15f49dc89063ccfbd38d2e51a5e4a5f647acfd57438fc4e31f26733dc9f70013b88f22bfdde7f0f982aaef117cf7df9
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaG6x:A3kMjKJg
TLSH
T1A325AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 952KB
SHA256 6eef5659500170460e67081ae5338d831e4f65f3c2f674ed41c65605836b308e
MD5 19823f5b4bd3852ead3b32b756b77589
SHA1 6204a44210b37bf875df394f9c96de7ae5ac57ad
SHA512 093ff733e04c41fe3240a626e400a06abd82c8ad1a6b3b15262e27af67c28d64e4e8d40860fd6d27616bdc36f0ac27b079138a2a8bb013315557d7c3993887b2
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaG8A:A3kMjKJD
TLSH
T15325AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 952KB
SHA256 72d44a56268424238959ca24ba3332431ce284bc9a5902e1db611da2d3bfb34e
MD5 ac72ad7780757c70edd0ec9ee6efea2f
SHA1 5f3ecc07b51905c3f14bb38d4e2a54425300c3e5
SHA512 263cefa281b7e154f6e469d4cd028b34dc2a8c1381f21f3fa8b6b982ae2e6ff9eca4efafc2b28a1f56b24925fcdcaa413d79dfde0e5b42d91822455a75f44b11
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGl9Q:A3kMjKJO
TLSH
T14F25AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 952KB
SHA256 0967a7d9e90da623aaf5401643a6572f1f9e8f8496c854234459b2a288ae372c
MD5 a4fd6e8c73e478578ab41926eb7264bd
SHA1 a8bc1161320a181139431ca2baec24fe8f27f9bf
SHA512 1fbefc02bb3463eb48331d1fee1ba8640e2d49fede71da2f8ea41920313b24ef1448c9286a08888cfc3cc7d32ee31d14fe93df8277137f9d858d7c530af5285f
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGQ4:A3kMjKJt
TLSH
T14E25AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 952KB
SHA256 48aa4168250fd790cacc1c2fcbc1e5bcc8b22e20da10e3c7449ae8dc4a36c240
MD5 3eafd44390e552ba31017b2d16b4d384
SHA1 184367a20fc841eb5fa8d1632fd9f8ca4ef7959a
SHA512 0d5b3a091a0bd6d813ff2054e6d38a1af67b72801f1b4a4c5a24001af89d891928e7550472dcc5ee0c4056ae17fda2a15d1b21837a9442fe730f5961a8c1e89b
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGTu:A3kMjKJI
TLSH
T16025AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 952KB
SHA256 50f8b53da661869e5b999368f3ea1e3a0c41050ce0cd9e5d1f82bd69a037c300
MD5 02b6a45e0c4e2d61f0ea227922fb27c4
SHA1 ea12ee15b81f8a5debf344e24a73777f7a332bb4
SHA512 9311cda2274e5b1b57b95deed2f4d5de271bab110bd9d74d78a63b38c4ddecc29f2c515ce37c0c2667bc1dc5e1afd61af0d569c1b3190783175865eddcea9a6d
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGOj:A3kMjKJC
TLSH
T1AB25AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 952KB
SHA256 7eb9b71e89617d914586e5a520892d838d58c09b96297321246ebebfb58b6f94
MD5 8aaaee6e0fd9a256c0fc727e7b2e60b4
SHA1 c70d21f75007f2c7afe9da8d2b89fa188971625b
SHA512 42f785f50d0fc866d54567243e33a681614836e3a343e6d0e681f4dc9a244e7efbe1d05df51d90dbc9b67731c2af1585b20ff1b10c8d49e0b10993aa6ba10f77
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaG7g:A3kMjKJG
TLSH
T10B25AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 952KB
SHA256 1a895e725dce10c2b445512f2ccd217015b76b8e1fcc0866da1b9d2a63166152
MD5 bcb0cc1c542d8c0623deee83e6e3ef09
SHA1 52714f0a1baafb8b6b1acf14a6de1bc3932310d7
SHA512 5e99f10e34249582159b8322b0c0cb6f278ece53dd4bc9440d3347d6f04481d55c73328d8edc4b271379e14f601310fe1cfde213252efcc12e1d0767d2da0bc9
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGmI:A3kMjKJP
TLSH
T1E025AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 952KB
SHA256 ad98e15254554c55fb31c00066c837dd815fce1de4a1c0a156b7562370e6603c
MD5 84c677c2a741e0242aa7e2f6baa6316b
SHA1 f521a51b7c6b414eb2bef3615105c3a627283478
SHA512 0eed69e098d5b61fe9c647be31b54772c479f783a0a79410e37fe11f04854f1e012d7984d2172b0a6bedd1fbd6bee3a43566cb6ababc877f15d462388e0e8919
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGUo:A3kMjKJ5
TLSH
T15825AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 952KB
SHA256 7fb9fa629763182c5d324e3979cd034d2f8d208bcedec825eb5e988750406988
MD5 c23c29df247874a65261dd9f08e4ea93
SHA1 331ad20f1181b67cedbacc275a83c9f88f9ffb19
SHA512 43abf160eccb1fa3355612c9037d60f2698756149292fa5d474911875f107696ce465d284d87694be98d9babe8964070eec4856b2d384e6e3b0abb4d95c77d03
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaG3+:A3kMjKJ8
TLSH
T1D425AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 952KB
SHA256 8346d3652cbbee6d2150cde139caf56a8ffe4857459b1f50e2ad21e7ed4ea0a5
MD5 5db600b1db6a72ce3429203201bb191c
SHA1 32dfa1bae9ab0456c36ceb9c9836199184c5fbcb
SHA512 ff3982e2ca4b3cf52c612baaae153aac053f403a9ea0abd6d2246f41517f3b0517ebf742681e54abde43220fa768b6632f4fc6d4c99fe6fd6d2d071f269d3b24
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGNQ:A3kMjKJU
TLSH
T1CE25AF03E7A410F5E55B823099E54A12FB75BD621B60C6DF236882252F737C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 952KB
SHA256 d02539030b02c6eb38c30fd41fbfae701e8aeec71094a27ee3d311a7abce8e33
MD5 1658e010ce2a3a867b33d1c7b89114c4
SHA1 93fcb50302de0bef01ed483d05d412571ac11615
SHA512 a78eaba30e5a91ad226b4ed8786a62c0344cda67cbed5296d17b0e4ba032240d0259c5c36dde26c45361ba225d448a991c7e529aeb598a4474b97e4b56d815a7
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGCX:A3kMjKJU
TLSH
T15325AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 952KB
SHA256 9a322a8d97df4c23e5df3588ffd141c0778a29d02d2cdb5517a2e478a9ddbb41
MD5 f8df3933689e931d23d2fde76212ede5
SHA1 560705b0232f0cf066e13bd40c326a870c555c65
SHA512 8f90f084fa16956690b753c67e020eb27eed90f7bcc1f9d5b4e86a38f4e9957cb1aa7724f9ea23b6e7873505adb890f4d88a03f03edf836602ea6791c7af5149
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGkL:A3kMjKJu
TLSH
T10125AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 952KB
SHA256 f5c191dfcacfe4ea95157eecf22ea3ff18cebeb96ee015cbc726ce14272b8c68
MD5 9b86007095874bf0feb14bb9492f2067
SHA1 2819f1de77ab0679ea645b5752aba527989acbdf
SHA512 aba7694961297106da476f31374204094ea42f19a30635813baa42444b48277707e7d33c0c0ceedd4f59547116cd7757d9f17178f4bd874e0624301902deae0e
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGAM:A3kMjKJb
TLSH
T12125AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 952KB
SHA256 11cf1a96c6e0a39ca4c485e12b62c0fea428573a4a8d6bc83a781b1d25d2b1a1
MD5 99bc0e3a5099c3f4d2ff05f28c10ae96
SHA1 ac643a298641772aaf94a7b41753a42c4c619550
SHA512 3add0f421c2de4b89411d41490d025d40a501c0af07e1471bbdac8543e48d3b28f330580874ddf656f33ef530eda2b15bef9c242a7de73b14f50c61ef9e71801
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYaQdgiLaaGhh:A3kMjKJV
TLSH
T1E325AF03E7A410F5E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5036-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5036-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads