2faa2ae6ba1fcda10432add02d138a8476a7cc67ebfbeed7af54b41723aed80e

Analysis

max time kernel
105s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_7f847d3585a53a55f7b51a5d8137e63e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 927KB
Sample260806-nl7a2sam8t
SHA256 2faa2ae6ba1fcda10432add02d138a8476a7cc67ebfbeed7af54b41723aed80e
MD5 7f847d3585a53a55f7b51a5d8137e63e
SHA1 0daa40e42de390062e8964496c248877d12e1f9b
SHA512 c41dab33761abc1deea6fa4b92240702990808f50ea0adc653f06c03457d9654910d3d07988d74a3ed152e4e6820a27c936814811e3d370ac24b2fff10b5a526
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y76:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y76
TLSH
T1CE15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/1524-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c57b-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1524-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5712-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c87-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-443.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-577.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-620.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-664.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-732.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-775.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-800.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-855.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-874.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-900.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1008.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1051.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1100.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1137.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1342.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1367.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c57b-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fe-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c87-60.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-225.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-443.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-492.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-577.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-620.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-664.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-732.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-775.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-800.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-855.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-874.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-887.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-900.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-953.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1008.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1051.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1100.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1137.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1219.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1323.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1342.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1367.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1374.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5712	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-06_7f847d3585a53a55f7b51a5d8137e63e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-06_7f847d3585a53a55f7b51a5d8137e63e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-06_7f847d3585a53a55f7b51a5d8137e63e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-06_7f847d3585a53a55f7b51a5d8137e63e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-06_7f847d3585a53a55f7b51a5d8137e63e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-06_7f847d3585a53a55f7b51a5d8137e63e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-06_7f847d3585a53a55f7b51a5d8137e63e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_7f847d3585a53a55f7b51a5d8137e63e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-06_7f847d3585a53a55f7b51a5d8137e63e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1524	2026-08-06_7f847d3585a53a55f7b51a5d8137e63e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
5712	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-06_7f847d3585a53a55f7b51a5d8137e63e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_7f847d3585a53a55f7b51a5d8137e63e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1524

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 927KB
SHA256 2faa2ae6ba1fcda10432add02d138a8476a7cc67ebfbeed7af54b41723aed80e
MD5 7f847d3585a53a55f7b51a5d8137e63e
SHA1 0daa40e42de390062e8964496c248877d12e1f9b
SHA512 c41dab33761abc1deea6fa4b92240702990808f50ea0adc653f06c03457d9654910d3d07988d74a3ed152e4e6820a27c936814811e3d370ac24b2fff10b5a526
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y76:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y76
TLSH
T1CE15AE17E79014F9E8178138C9A54A22E7B1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 5502027d404923733f8d494b6925dcaaaec5395ef7cfc94f315ec8d539939b88
MD5 2bc72d55b20ac21cc574dab7e5eb3177
SHA1 ec3d6b073904dbaa2c92ebe484b3a291291a9aae
SHA512 4086cf4295515a5152181b7d8a6ef3d96a318e73a6ef09336c12d5a01753511ddcef5fb82ee53043f5c27d5a7851b84bb67a41ec8f5538387261d1a83f57e7cb
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7K0Le5ji0hmxNrM:A3kMhT1LljgPji0Aj
TLSH
T1C1658D16F6A406B5D073C179C9D2965AEA7238461B30CACF1398C7292F337E19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 942KB
SHA256 5a52bbbc9602a2a03877e1d144989aad71425093a40c02ffb33aeb967e8c0235
MD5 5a75f40a886d50055f6e78c9ce2daf2e
SHA1 59ad1a40face1a8d66fc7342c7b0af74f92bc384
SHA512 7fae8122aaff23c2edda55685b8756a56ab7214136e5cf4540b53bfa9f9926041319bdbb43081d9e77301715b4346fa5a3d311e1e80026e69e61b0f4e764c8c6
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7Ea:A3kMhT1Llj
TLSH
T1CA25AE13E79014F5E9178138C9A64A22E7B1BC661770C7DF136892262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 975KB
SHA256 d205012307e76d4053581a50b782e02185890fd400fcdcdffac05bb3200208d1
MD5 829ba6fed9eff67350526ac03b430e57
SHA1 e89e50f19590b2a4c0118b4ec623131826b59184
SHA512 0b205f53097a8a9c4eaeec9d71553895b1b35b1b2107daa7c69977a6652f46bb7ccdd35b63548401ecd8a63588fbb87713a318ed8345b85544aaf11ba29289a7
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7Pb:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7Pb
TLSH
T14D25AE13E79004F5E8678234D9A54A12EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 951KB
SHA256 d3e03291225b22f86ac907c725808a4bf6281e2f6b79fea0b74b91d13572323f
MD5 5ff5b94860198271ac221442c225c60b
SHA1 108688edd48fbd22a30ec970eddfd9453e8d7d1b
SHA512 e6344aba01d7c8d47ee6e5bd025370465d66c92ff0d736140f7f9e0969535cced28e52617173a036e9f493f82e90b8fc7ff882cefc0ab8420357107d7afd6b55
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y796:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y796
TLSH
T15D25AE17E79014F5E8178134C9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 951KB
SHA256 d4bf450741d1e162dcefd9757536b8e217c20899c4934b430e3397a3d3e734a1
MD5 daf0bb65d41bebb038d70c020d371d02
SHA1 a9ed935385ec82a5e5a21ea541b447ce3b18c868
SHA512 74c6e6c8bdcc11b024df19debbaa6a86da5d7ca6b22ea51bb0b68966d4c6af7e2659b672f5592f83ad2971cb0fbd9e2282b5b56db6b138b29c2f9c7bfa982ba2
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7TN:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7TN
TLSH
T15B25AE17E79014F5E8178138C9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 951KB
SHA256 01bb7ab3600bac2676a6605a2b27ceb0c4fe9835005165df05d42fb3c3a1ba17
MD5 6b0b3f258ae124824a0daec96eb584eb
SHA1 fe44d87cc1af4b25ecb4c3b4e7b582a215435461
SHA512 a19ed87f6728f1b9dbaaf224a457c1b9a0e205d528d78e4d4a20d1695291823141aa61284d2d2c3f157c510c2ea1cdb3692d2294a8da82f3a7fee1a74c4e3028
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7hf:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7hf
TLSH
T1AD25AE17E79014F5E8178134C9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 951KB
SHA256 57490df3cdefbbda4b29c6835a3b6c13a59df07441bf35bc3e54547644e8dba9
MD5 dc10ebf248b0d4efc11ccbe88b6731f0
SHA1 4966f38536583866d8197c20c088904e9551f9da
SHA512 e4c2ae2b75f6352bd8280973a2e826500099fe40076abbcc7d6c662444e62b9cd077030a3fa71f376c4f95d4eb3068d9a5d6fe7c079bb7d281a3107972c780a2
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7Do:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7Do
TLSH
T19625AE17E79004F5E8178138D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 951KB
SHA256 228b111b89abb85562a1f9de879af00104bdb16ea15b566af10f49b36006b932
MD5 d209a6f93e3e658c6e64e6b44ec1224f
SHA1 b6f6f7df53dc140f8b0a48f08bae148b4610d634
SHA512 c10d49605548f9d839fb8b01d0bad564a1fc9f243ab7d274902ae3434c48852b817ffe74fcf6e9746cfdafcc24bb3660578502095064e31ea8b633a4ca007bfa
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y73u:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y73u
TLSH
T10F25AE17E79004F5E8178138D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 951KB
SHA256 c93a836aa9d74561126f38bdf0853a5dbe795beb4bd7338c32be96e40d951229
MD5 8c2f0bf2f606f0fa80c65ce8bf8720d6
SHA1 1218f660b87d681a1dff1da5a6ba24c80f98ed84
SHA512 b7581241df9e9394ef0c731373768bad23732a6b8827bd4d45db762a69138a078e146bcc52b6ca639b6584d48dd269cf2c507ae7815d42928c74b16df5bd0271
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7F9:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7F9
TLSH
T12D25AE17E79014F5E8178138C9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 951KB
SHA256 6a4b1852089c7beec3dc75ffb2d393b0f0e3af9777664db87fb00edaf5da848d
MD5 3276388871330129471893d92e3ff295
SHA1 1a8a36d844f5b444dd470b78b25dc5801de3401f
SHA512 53c9dd30a076c8e8a8857151bc32f642b9337a3f7eb0f1796b0bbf27de37a30fdc700488c746d9861723f11560281b6fd96ddb338ecc2efe4726d937c6a47678
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7hc:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7hc
TLSH
T11525AE17E79004F5E8178134D9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 951KB
SHA256 05b3f31ae8c775fae627f841314b3a67c0512b38e2b6cd9d956a905495c66ee4
MD5 72b2901dfbae17e58c3c5a201baa7625
SHA1 071b5da4de98939144f04326831787b6744d683c
SHA512 7f5e39cc8750499c36af829b0620f09423f34a72e81c3309a77ac9c3616e2c1bb13906aca81521c86c1d328bebc0b9cad2eb14a07a15e6ee07f32bddcaeac2ca
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7Kp:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7Kp
TLSH
T18725AE17E79014F5E8178138C9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 951KB
SHA256 c582822b99caa6d6a0c634e5bf834b0a1906f09b0b136f834d45182a3323deb0
MD5 a2cd2100c0de9804990d588b29a2b94d
SHA1 dbfffc9116532b9b21e380507e3344db60f29edd
SHA512 d4cce10665807a1931cd210f6b7d047ff6cf3da07c5b6859441989f7bf8aa9852dd1f867e4a17aa74e2f293de2cd27a591a75112024264461247d7c6a12ffc24
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7t0a:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7tN
TLSH
T16125AE17E79014F5E8178134C9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 951KB
SHA256 90b2cfec609d329c4be57edf6e1e1852493ba439e0156533c3b39a1d39d91098
MD5 f7f0004b5e84ca4878bd7dc1db4f711e
SHA1 7a3ea581b1367499de60ddf749bef0c7615bf357
SHA512 885c0ae852f22a4ffa1f9c2c7727121baf1c3c3566836ca242c40af5b12e1632c6b648a17779e15eb681dc65dcc57492847d91a03513ac5648787316d708472b
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7fF:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7fF
TLSH
T13825AE17E79014F5E8178134C9A54A22E7B1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 951KB
SHA256 a02d32705a21fcac319e8c0f6658eb395af53f83a00aa4651b86c49b8b87fd56
MD5 9246b6a13c867a6c96b277c7ed89e14e
SHA1 08323a9fe9f008af3b7f9240e1909d5145cc6abd
SHA512 d7157b2989043f5684876b7a48ace500486b0fc28a8ac93b2bbbec29641a9aaa0726f6d6d279d97e7d16fb8beb3c314ecb096f539437aeb4e486b191723769d8
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7AC:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7AC
TLSH
T16A25AE17E79004F5E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 951KB
SHA256 7cfcf019faef63d12bc350f51adb3e7aa9fd67486929d8db0319260c2f8026f1
MD5 3ab8f3b92b7a7fd13b97b17ef74fe882
SHA1 18348eeef56b4680eb918b281887e0d0fe4aeb43
SHA512 480c48a3eec3d751705fa604ecf1744e6def53206f7a6974fd2cacd3f305c46e41626227a0656d0685ec90724884c51a12ee638d016365fc24121b9179d78976
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7Tw:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7Tw
TLSH
T1E525AE17E79004F5E8178134D9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 951KB
SHA256 b5f035c26494f569024b76cf12f47314dd584000268d18ebb77ba298cbb42bf2
MD5 75fc13a2235d487d0b3e5e3f78b5e7a8
SHA1 133e4f623dcb10a220bbc72708ff46e64c6dbbfc
SHA512 a89cfac1bba700321d9720492e82f6413582769dc4a1bb824edbc8cea2a591c57788b76e11f3996e50d2763ef4d16118aecc3c657554423d5257407178758a43
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7aT:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7aT
TLSH
T13C25AE17E79004F5E8178138D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 951KB
SHA256 8d157fa4babe44b65aa40c2c7d94aa06b649e26c5e5ba2598db8c3e9cf168b0c
MD5 a418c6c4bd88997ccfad10e46553e938
SHA1 515299e881479541e1f96ac0662a4748742fa252
SHA512 24b5f1d286eb4c5962c4309301eb5b54f56f9c71397b9b4ae82802522f29ff89e9cffd812122c70354da0f2c0083cdb4ce3e4dcdda26372f6d11b0c728c704c6
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y76u:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y76u
TLSH
T14025AE17E79004F5E8178134D9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 951KB
SHA256 87ff106442c430095050c84188b4e88f0e61d9e3b78177e890ab678b5e2b28d8
MD5 f95f3ea1c3127dc8a21c1cc8ab8e4570
SHA1 25c74197564e9ed8bbd6ed62b763811c714c1f9a
SHA512 eb85d7fdb8575a8a45f844642cf6d3a92a32cfb56ee512afa406202e250da1983ec1016511f7db61912da4866f8fb6e512ed51f732fdcfb09bda597ed9a9e49b
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7Eb:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7Eb
TLSH
T14F25AE17E79014F5E8178134C9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 951KB
SHA256 b4d72ed4031a594e56454f7d9b8479b09268c8edc816644e49a905fb984474f1
MD5 699f2567f7ecee367a3f99272c15e139
SHA1 21dc21a64d59eb98b1c1cd77f4715dec482daec5
SHA512 6dbe31247a02edf0d8a8af595bc9b56827d11c65b6ca4cefe9f5d8dc86765489ddf3e86020d359b54dc227be7c47c40827d41f54e68f93771071fbe084ed26ac
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7Kf:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7Kf
TLSH
T14E25AE17E79004F5E8178134D9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 951KB
SHA256 99db343a7cd37bc80357fbeade0dedc1896765a5858b44ef62c06df95959d556
MD5 f998e7b2fc2f1584c51fe6e29c4f301f
SHA1 38f01b46e5a137fc7863fad93c04301f72e271a1
SHA512 ffff41e0a02f9af4e5a13a8f8f965a69fd0b5f4059315ee1132f54868cae899315e9930b2a4f5b88da341c780c1c67dc659c1431b91d7ae0c5293ddd4196cfb5
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7XK:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7XK
TLSH
T1F025AE17E79004F5E8178138D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 951KB
SHA256 72800066d05204bbc725979e54c204c0fb459f2dd34575228de9eaddaa6ddbd2
MD5 b0ba198c95e8b1b9349d71404bb179d1
SHA1 b6d8e3a0a932230364ded67349c93bcc530b6eb7
SHA512 0d4733bcd3c3d30919748c8893618fbd99c91f379ff76ab74e4731496b86fdfa6a84992f6195feefb6b92601eebeecfd482b4a05b8ada82f68526b462b1d6f03
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7gk:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7gk
TLSH
T15E25AE17E79004F5E8178134D9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 951KB
SHA256 5e61e0a916796c3f4cfbb75a419cf0b0d240c35d5a4ca0193f916db5204c7f75
MD5 fa04b4765986423f12191d92234ab840
SHA1 78cfd6c4c150ddf0c1ce40dcf2ee83583a7ff14f
SHA512 2889e4d944f370f0da286682771880918c182bd6ae1f194664aabc4e05580b0e6f4356d56ab4d681a11e53c4afc8f94e1c5162ddfd8e35cf70db18e600a694b2
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7R0:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7R0
TLSH
T1C425AE17E79004F5E8178134D9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 951KB
SHA256 d9473212fdc6a324835bb9db35ca369125d1c233ef403a85812b3b2c7de0444a
MD5 4a4331c04ef4b521e5c454df2b7af3dd
SHA1 e02f60f69096268339917cbc25a7b2eff58e87ca
SHA512 9228544567b34fb681556e2ecbf98ce44842e65e53333ee08cea6e21448bdbd884a67b7629a0e308321433376005906053f397f4500a297e82fd7515fcba0fc8
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7E70:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7Eg
TLSH
T1D025AE17E79004F5E8178138D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 951KB
SHA256 656c35fbc2f68e082bdd683331558ec3e77db105bd59304eb06c92d723ddc1cd
MD5 a9dbea18746e87714d28290fe7f37f2a
SHA1 5695431796b4d5681eed6d604c6f13211854f8fd
SHA512 6a294424565d0c25eef6b93a1c2cd3170036269ec31d2f039388ce72c92f7d7a607e27a8aabff469cd46a68bb3eeb663b9d1397fe7d0262139cc6aaa27f9665a
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7hr:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7hr
TLSH
T13C25AE17E79014F5E8178138C9A54A22E7B1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 951KB
SHA256 ba10d41fffc82c2dca93877553f4693a38cd752e9ddf794b69fd773843ff727d
MD5 5e69b8edc64fb8d5ee4a10b64c4efbae
SHA1 dbd8968d56d09b988fa3e1ade6692a64c3110561
SHA512 e3344726bf198256497d0f103f1aa93d159a8357d6099adf6df7802ba855887dd457445b3e7ce69ae3478f5a3cd918d7c8f03054691eb3e3d7dbdc7271360bd7
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7jn:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7jn
TLSH
T1E125AE17E79014F5E8178138C9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 951KB
SHA256 68a0408ab69f517c142621e04ab794de522e986c0cd84b2be46794d7524f7a21
MD5 cdca01f84c43d922cfa9833c1e509540
SHA1 3808234202ade502c74ddb9a7a0dbbbe48d85d27
SHA512 17bcb937d5822a454e51a4676aa6b8fed3b83276a025d329b7fa5a0bf670f7d073965dae2c1057351e7f39538ae619d39e18c502486b05fadb5b25999a8def06
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7/x:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7/x
TLSH
T10325AE17E79014F5E8178134C9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 951KB
SHA256 63e227b999094cd38cb09557666bc0955eb4b70087973dea0e239969d926baad
MD5 117e63cbb06adf8eb5f4ecdbac1d6e39
SHA1 9c1d79d63f0bf6566f3fb5726930c1c09f448f97
SHA512 9da1b9afb39173f2cb1e217f8c3e59dfd15fac902eda79a508d85761739a5cc0292c8a0e0effb38e299e3a3a77e755f5a7777b6c1957db4111776c11372cb272
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7lA:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7lA
TLSH
T15C25AE17E79014F5E8178134C9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 951KB
SHA256 6cbd18a5624017502456c4a9baf51858b34f322d6d7dc307f568f3d3a1aece8d
MD5 96e52746c30e4f583e8dce3b2082984a
SHA1 197514ac1c7d64ee4cf9f7f2d95bdf5e3a255724
SHA512 f5f4af9a147d2016923ec2be8982390f79f624b6c181b54a64998939644e17c62d53ba655f80f22dbf9de451a529c17b625940f98f2eace2232345bd79f20c2e
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7e9Q:A3kMhT1LljV
TLSH
T1AE25AE17E79004F5E8178138D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 951KB
SHA256 25945c9e81eb3c3e05021e82f80317a0f5fbe87cd695581363e58dcb4bb8edde
MD5 1380bfacfc5c1878a99498eec636c629
SHA1 7c902c92daaa82438f4b6251e74fe76143d6b315
SHA512 92ab1dd6779adf29cbb690de7ec2647d6e28ad4656b3dc13ed6556866ce504c06c5ff3be5bcd1d54661c34b20d5da54d5da37671862128dbb2c40a5a92d88791
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7L4:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7L4
TLSH
T1A925AE17E79004F5E8178134D9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 951KB
SHA256 46c4d7cc19933dcb69118fd8821c20a349e831af03f967c1dd27c6602b16a0a4
MD5 e43d0e304c59df711a5504d615f11751
SHA1 d9dd814f39b0779d0393c33cdab3e96d5eddba13
SHA512 ea71752a50f3af14c9ff0d230fcbd6a539f844cf62878ae81fda2b86b75babaae2983d4fbb92521e4f3c4636356372f1d4bc96ce7d76c1440c7cdac869be6f0c
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7Cu:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7Cu
TLSH
T1E825AE17E79014F5E8178134C9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 951KB
SHA256 3310b3c2a010eeb079f0b0f98f822017d8413579c1ed0343685828c5c298c5d8
MD5 66ee87becaf06904b4d32bca3af89662
SHA1 84d436be5c674ad32bd2ad229e436fed64ae30f0
SHA512 0f8014e94744f2abd4334a341eb2ae0372d650015f8d9d62fb0e893ae6bdbf02c67266b6f7d32f428e6fcea4a8659d3207153db25420f1f287b4ea7e5a59b054
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7Tj:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7Tj
TLSH
T1DF25AE17E79004F5E8178138D9A54A22E7B1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 951KB
SHA256 b9a27ce1c5377367df8f16a0f67b1b7559ea621898335489516e4e91906cf1a5
MD5 8fd6c5563c58c587b053be8ad259a733
SHA1 aabe6c85e2d8033da62334b75f2220ae9bd52904
SHA512 313924f4490cf12903a2de7a018752bfd7a28f10463628c2df69172d5102d5bc51c33d159179e6328dc306b677461d43780290314ec93377cc95a75f0d708d4c
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7eg:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7eg
TLSH
T1B925AE17E79004F5E8178134D9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 951KB
SHA256 92a896c9cbdc360aa70753ef00e5fdbd8eac268c9be23371b794c10722085808
MD5 686e86687c2e8ff98abfcd3d0eb2546f
SHA1 4715b55662f0b0fbcf85d0fc518282b587505694
SHA512 2cba8c218319e5456f46cc87703036d10993d90102c67edf19d3361024ac5cc173f60f009a8e00a4b3e3bbb3763335972cd20e333f8ee1edd7e32c32fcb7bf1a
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7RI:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7RI
TLSH
T1F625AE17E79014F9E8178134C9A54A22E7B1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 951KB
SHA256 b4bdce12f9d7b82b91c2785fc2b47b6d2fb72a17fba005b46355945d49e55a8a
MD5 ba9e8f88066915e557649fe71f7a6642
SHA1 07b4cd308b6dbad61fba198f4bedf84d7226354c
SHA512 7bf050790b78dd7d35d505e43ba3e8d451bc6c3394ed4b865af899ef060ce327767b166cd35daf9c35aade7de06c76d37d4fc5c038795e931b4cdef3404b3246
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7To:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7To
TLSH
T1ED25AE17E79004F5E8178134D9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 951KB
SHA256 341c68743a6a4d55acd6504ea0f6bac9c196e99e7fe6461cf18ff05a2ba49869
MD5 dd250b78c540dfb8afdb896a7b6b7cd2
SHA1 9334e5d3ad37a13d71facf7b2da660a0d08bec52
SHA512 921d0859ba159eced39ed840860a14018ecc64075cae958f3783696b5262fc7a4f671526feeac7b934f876a8ab57529f51c9cc3ea81496a5086b0cdbe0f00db0
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7Y+:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7Y+
TLSH
T10B25AE17E79004F5E8178138D9A54A22E7B1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 951KB
SHA256 47bfca45b51685fc5275ec6a37ece73dd7abe33d85f3a5d3a3034177b4acb955
MD5 b7fda0e00a081947cca1adfac514718b
SHA1 53204ac7bbdf061d13a46a12740475609838f02e
SHA512 f4b3c6bce74ca314f4ae3f2a485dad8a27963ccd9d588592d5ba8e82f338d2ac664dbc7a3bb35be6ca9dc926779f1e40ccc2493546acf09a715dc87451c47cef
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7wQ:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7wQ
TLSH
T12825AE17E79014F5E8178134C9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 951KB
SHA256 6df3a8558578e8ac6fe2f551800d585c3fe8202ea6d74b61ef2ae47f59724127
MD5 7b5b44196f6f78af174e248f81f05d6b
SHA1 7efdb1a3763e0eb128cbfeb7170785919a576548
SHA512 ad4095d626623a91a75048c6501fe0ad275ab60163539015cf8f83f3c30bdd7134ede187f63eb345189e781d5c4af62a2f23863e7d8ba38af607b38bee2c855b
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7ZX:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7ZX
TLSH
T1D925AE17E79014F5E8178138C9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 951KB
SHA256 cdb5b49e5a535ac0a8e91d6dea934760ea6e765113e3fab3284524129d671d16
MD5 72ce7425da66b3ad2a27d0ca795ebf11
SHA1 bd7c0110c695441986b751aa1f36654094498938
SHA512 bbf9e7c0f64888578ac314b54f4bdac234ce428d9539ce9892498eb061ceef45b8e56bbcbc717edd01f3864e58d77faa714e49ae5e646148e66b42e8470a3e7d
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7zL:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7zL
TLSH
T11925AE17E79004F5E8178134D9A54A22EBB1BC661770C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 951KB
SHA256 39142cfbe5f1d12a1361f79032249bf639570c44fbfb3372c960fcc70cad4762
MD5 10dbffe12c85479c8f34a4c877b97b87
SHA1 4e0c414fdb180905dbe42497ad56484107a7e9ea
SHA512 e3c973f5596c893e0ce320a654bb2dc3f75ecb03221a86cc826bf480b584407f6b1a48ea2091296b518e8e386d68e11aa7921b671a39f83b9691d58db2eb4c9a
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7ZFC:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7ZM
TLSH
T16D25AE17E79004F5E8178134D9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 951KB
SHA256 18f5e726bca93030e6609082b5ad9693369030cc0ea7166e8a5610ba6950a7c8
MD5 8960ed2fc27409b2047e7b723bae2eea
SHA1 49242e9c28bdd6a67d4d592488bb20fe2c1b82f4
SHA512 f99d9d4d1f2bdd4e716ac96e77998958140e19dff279ec32b07c1a8d63e7e49f58702254510899f91229df5d5c20ac8a79e4b08bfd3531a1b8172b17cc0185ee
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMp7y7ih:A3mnXoZjzyUTWaLl3z0zDMCpxDp7y7ih
TLSH
T10225AE17E79014F5E8178134C9A54A22EBB1BC661770C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1524-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1524-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5712-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads