fee3689cb9bf555d77a6ab428968f5a79f4c793cd36e2e599373c228e31bcede

Analysis

max time kernel
106s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Size 883KB
Sample260809-thb9dstzat
SHA256 fee3689cb9bf555d77a6ab428968f5a79f4c793cd36e2e599373c228e31bcede
MD5 c15aaa47b4e9169bc5f250f57d62c5ce
SHA1 65a7d408b86c423558688a43f569ce656dd00244
SHA512 dd46c57e2e0a98b179145cffe727920227ca2840d86f75319330dc415ad81da895b829ac9a75f51a381d91fc329c28336728ea7a1e4a2ee7d7420312080ab6c9
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfF:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfF
TLSH
T1F715AE17F79014F9D8178138C9954A22EBB1BC661760C6DF13A892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/3428-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c53d-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3428-33-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3608-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c89-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000188cd-202.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00050000000188cb-258.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a5c-356.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-477.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-502.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-789.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-826.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-858.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-878.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-936.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-955.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1010.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1047.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1066.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1141.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1186.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1406.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c53d-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-40.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c89-60.dat	aspack_v212_v242
behavioral2/files/0x00040000000188cd-202.dat	aspack_v212_v242
behavioral2/files/0x00050000000188cb-258.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a5c-356.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-477.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-502.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-599.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-630.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-789.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-826.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-858.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-878.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-936.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-955.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1010.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1047.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1066.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1127.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1141.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1186.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1223.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1326.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1384.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1403.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1404.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1405.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1406.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3608	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3428	2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
3608	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_c15aaa47b4e9169bc5f250f57d62c5ce_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3428

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 883KB
SHA256 fee3689cb9bf555d77a6ab428968f5a79f4c793cd36e2e599373c228e31bcede
MD5 c15aaa47b4e9169bc5f250f57d62c5ce
SHA1 65a7d408b86c423558688a43f569ce656dd00244
SHA512 dd46c57e2e0a98b179145cffe727920227ca2840d86f75319330dc415ad81da895b829ac9a75f51a381d91fc329c28336728ea7a1e4a2ee7d7420312080ab6c9
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfF:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfF
TLSH
T1F715AE17F79014F9D8178138C9954A22EBB1BC661760C6DF13A892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 a9d2333136fda1b242101a51c3df321a038123ae0254c1d478e2650df494998e
MD5 c80cb5d5d23cca3b03a2bf44a87bad34
SHA1 0e20404ba41aa9b3afcd0ba0c765a22600b8b1af
SHA512 e0bf9a14c90b34bd52bd5b6c4015bf3b487537cedbc09b8c89df977f086169e26834f8ab2d3408dac2fadbb18186c73d5ac077113fc93f4d2a7beae666dcca38
SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfB0Le5ji0hmxNrM:A3kMeT1Llj4Pji0Aj
TLSH
T153658D16F6A446B5D033C079C9D29A5AEA7238421730CACF1399D7292F337E19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 898KB
SHA256 f12d17d24beb01f36e46685f03ade94204c781be436ce1d3c294afb8b45ccb71
MD5 a974b7ce29cce27d59caff580a71d0d4
SHA1 3978207ef5e13be935257a463fe658b98255597f
SHA512 b5c4bf7892470f85f90646da3fbe7efd0c7b25e491fb4fd262340b0d667423837335c738b4c65fa58e657d16440e104b4aa6ed5419cfd71a233631307de0a129
SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfDa:A3kMeT1Llj
TLSH
T17715AF17E79014F9E8178138C9A54A12FBB1BC661760C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 931KB
SHA256 d52ca0e2eb66a4b090cc05ddc38b47075ba9a2990e4566d1706fec2300c02742
MD5 fa3be59244e1b8fb2e7d9ac5fe149b33
SHA1 7f60f8ddcb77958cbffef6131bb75e3b4f0f538d
SHA512 792bbc6f8f3778fb49f087b71979675fddaaca2ac79ac014389b80282d13580bbb9f7eb330033c7db5adc14a697a57bc055aa6158f6a921a6284345d41d41995
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfQb:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfQb
TLSH
T11E15AE17F79014F9E8178234C9A54A12EBB1BC661760C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 907KB
SHA256 c5378410e74709bcdb65e8172480b04a8e4ed37da80470c8bc40b68326a3a5c3
MD5 dc96447d447271b1b3bac1a6612a5b8d
SHA1 a52cadec65906f9d7e8ef0e8cc8c40bcf3c359e8
SHA512 66a3d882e182ebca5f84a9c4ac7963d128edfc4fc1695465e1bd37438aaacc85b925d8ca538b31dcfc36c3998b1e85b305607440c2ac2babbfa0b988ad2ff853
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfLZ:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfLZ
TLSH
T18615AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 907KB
SHA256 5ef833fb35b9373b72da2a5990cf23afad76047bd10847428c1b15189224030c
MD5 02eadfd12769686f918a447a79e97cd0
SHA1 13f58dfa3642b280445a48c5a82468571ee3bf48
SHA512 a7d0eca87c4d86f97e62282ed3c82e4058adec4c827c238a5caf652ab4eac1b97230a159306c4ee2dd43ce0fb3bd14f63ee8262d426335164ce479f7691894ea
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfw1:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfw1
TLSH
T1D615AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 907KB
SHA256 f50804c18987b89ee46f06736a690424867dc9f0510cd21e93a0f64237172cac
MD5 1d17f9c3b000fe9e4a39ea87a626b03e
SHA1 42a4075af57102917824e95a11fc839b98507a4f
SHA512 3ec32568330ec900a3594c5ffabb8fc6fd4c756851cd603f0bbbc6bd1a6f14b3b38a4f26e3259b276cee14a7c5de0575694d1d7a88a715ae2da7f59bb24ff8c1
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfi6:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfi6
TLSH
T17615AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 907KB
SHA256 e43c310d50df6258a93779878f35a13a6976d5436fef373828f5b99a0c500316
MD5 4e68bfad15efb19c455e19a7f0470947
SHA1 5be818c6f53b65f627d59c669664948fc07200cb
SHA512 8060a59ff68ce077290867a431c505c0761b9b89ab782e285296e3651670b380dcdb8dd777b3e0ec008bcb4b6456df4d5a28b37ca66003a33d181b7b9134d6a0
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbf6N:A3mnXoZjzyacNVOI/tTWaLl3z0zDbf6N
TLSH
T18815AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 907KB
SHA256 a44e866ba542e2d8a256e6ebeb4a9a8d252a65e1751431b9a721c5cc6c7bf9ca
MD5 5cb16d40bce288f9a77a0a7a204085bf
SHA1 b637c5a7f1cf6882e480e1dc54955f7129e95777
SHA512 e391dff2eb1f5eb1f45f0d55ff58ad1605f37911a403b61c12d7ae4fbf04583f50a5f5275288a79872f87126d0585110f6b4e83aececdd4c5687f3f5b2c2f2db
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfgf:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfgf
TLSH
T16C15AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 907KB
SHA256 774195c7bc1709d28af9eff776b2e7e3c870c6c779b44be1e74139a981423525
MD5 17307c9efdcde57fc4760ebc58a5e41b
SHA1 9e0a8bcfdeddd4190a76874cccedc318f58a864c
SHA512 5f6b5f41d58ff5c49938f000b08e705f9be1a89c45a83b884cc74c02376a13924c3a53e57979624d9535983db39519648be08da8430d4107958e30f0571199af
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbf6o:A3mnXoZjzyacNVOI/tTWaLl3z0zDbf6o
TLSH
T1A915AF17E79014F9E8178138C9954A26EBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 907KB
SHA256 2a7c46ef7e9ef13fb620a77a4bd4d8430c1315fe11480fcd32e07ef3bbaffd25
MD5 1325ff3dfcf43e79d610d074a8e013cf
SHA1 95e7a54a0f8a8bffb4e4e466eedc277e8329ea87
SHA512 98e22763f517e76da3c31c41177fa3c07ac4911cf98cd307bf9702908eb6c9bd7be3fa0eee15a48916f5770c964f61f4f994f6a3b41282af6269e026b12aed0f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfOu:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfOu
TLSH
T17415AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 907KB
SHA256 d9007724c2f86bf8f61c89a8cefc888df50a978289ee33a1e2cbd778f670a782
MD5 6a3fb17f7b3616d1b288a3a63e75fa54
SHA1 13892e44eb61ec148bb4c430935e8cde6e1edc4f
SHA512 44be1cebb19c6231e4e759cb7967a5fac7a5b06f8a020bc4479442ff0444b7450d99a2d1e13aad72db70f56b5f7e1ffde597dda43cdc11b56081f57edbe612a4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfC9:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfC9
TLSH
T18015AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 907KB
SHA256 eb05ad679ecbd2e885dc70d9e64d3ac606438ad8a77ac395018c97a2c636fae7
MD5 a6302a4b3d731b9987e49c53a1ba7d90
SHA1 3daf0d4ceff29e14c32afc6018637cb40be847f3
SHA512 eefbdc54615972b4ad86e1eff463d3b9b7a88887057a34113701bdb9bf7a64592a6c52b5560f1b9b224eb6d606ad7b046701720d20840292913cdb79a7020625
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfCc:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfCc
TLSH
T1B115AF17E79014F9E8178138C9954A12FBB1BC661760C6DF236892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 907KB
SHA256 a1bbe6a13bb5ca07b59d5045a412be13d17aea568cb38dceda988259a7554d9e
MD5 cf2f44ab086dea016295804e132c8edc
SHA1 0c7565e3b9a8250e17ee9eff76a466e2b6422c3d
SHA512 13aeb387750525f8273bb77d6040c1722c44632a81fcce7b5de67ca40c22033c3f353fe2c64179797c7523d613c826da4ebc1ab47c0394709e53a4ab77959802
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfLp:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfLp
TLSH
T18515AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 907KB
SHA256 7e2f136c0a8b49e518653561864a710d577b3f982edd3ae9795d8bc909885706
MD5 c4d8379a7092d6143a8623cf2298fe7c
SHA1 a0fc5d011a3e518dd9da0bbce60d44d53b272030
SHA512 96be57ecb81e6552edfde564d0938d97fe9d9c5fbf596fcc21775cb10158b831e3863380042c935d05327c23c709c7586f65828cb5f9ae191e3636bca0228216
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfc0a:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfcN
TLSH
T16615AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 907KB
SHA256 a98a843a98fca450f142de06037bd474638b40f27b384443b133179529580aab
MD5 0c75e0b557470b9425cc13561f6bd621
SHA1 9a8c5c2d677220a3983fce74edb6c6d74e436d69
SHA512 15618aeeac8d6da1513402b411e145dd130113839f2f23d70631cd26863db8fe8c910625bc24037171281430a274b12fc92caeb8f463ca54636b4a513286efdb
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfEF:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfEF
TLSH
T1E715AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 907KB
SHA256 b92dae3abbf5e7eb7ec6a0dc5f4b0ddc288dc7eba1fee2abdedf0cc726b89b3f
MD5 c0db37135a2d5335ea59e6f1e0536edd
SHA1 1365ec42169ce880e78328fd29274628d50a9458
SHA512 6e29d9e2ad464debf708f10d41d6e0b1b87f33d31a1aff185ef81e329d1ce883b0ce54264cb5bc0c66ca0e1b2fea0743ba4cc1cd89bb70a9897354476c0a5790
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfhC:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfhC
TLSH
T18415AF17E79014F9E8178138C9954A22FBB1BC661760C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 907KB
SHA256 4e5fab0b527fef2b7d04bd4c043f57a81a28725833280cab732f6b5ad593ef80
MD5 bb27380dd8ce5e36e8518062bbf1c809
SHA1 f3babe38c7a853fc67d2c45adc39bcb5b3b97eb7
SHA512 53aa2f409d100e5d78294db14112fda71910bf944da710515239b11d60ea662552274c18d81cc579a94dce166481140d60d6ac47de24256aa9100edab9fe954e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfiw:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfiw
TLSH
T1E415AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 907KB
SHA256 9d25a287ade2fc5c00b6bcab7a111befde6addb9de7d9d705b985b8b4037f1a4
MD5 7b3be2d5a2b261bd130bee2d055c0169
SHA1 30beeefa7d64b31889a1fb585d8e9d5abf0f4514
SHA512 753a64916cab7e2b742c8d001736837227f1e42029abedae74ac515083c5b4654ceb46f73cea911ae59a716c4a814a7399bb16660d177fb5c427556398025038
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfpT:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfpT
TLSH
T1EF15AF17F79014F9E8178138C9954A22EBB1BC661760C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 907KB
SHA256 bccedf3be783e663cb3e368161afcbe6f7a2acdaa19dc8405326c793e0811be2
MD5 c2d20fec51840f878e3dce3e75de8e04
SHA1 044fffbb45c45438a9f0dde83d7d827844f1136e
SHA512 a72327c528ee8881ff9ee02944adb13c183ee639c7ea59765923faee25926c0234bf16db5385ecdf33f8aeff6e2a23e51da3b932ba6a71f48a6388bf557de400
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfHu:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfHu
TLSH
T1EF15AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 907KB
SHA256 c7d1fa978713aee07e77a9722e853a096bca51bcc51b530b37f81a072048b868
MD5 ea6f3daea44a46bcbe5f8c073c29fc87
SHA1 6a243c690ea899e3886cb2671e57f71b2ed2da30
SHA512 2221626b8852b4f8140444ae9cbf4b06eb2b9b5144d9e4f44ef6610d59161d4f99d67151470311bda6d3e2250361748912c4363465f062219340406aca9741c1
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfbb:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfbb
TLSH
T10315AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 907KB
SHA256 f4cb1dceb22fe5bda94ce59ac74c7618d9a541a908d32a51df4c141e64e6d408
MD5 67b6dab33d54522ff70a7d48cba19266
SHA1 2fa4e21a42ed3590635faf08e88cbcf3e1354798
SHA512 f179460615c65a230e19d0559ff8df113b93e9b041159319c48e648871594e2a2e47e9fcbf83c1974589a2cb8862dd9d3abe222b734a3a7dd8eb3f86c938734f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfvf:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfvf
TLSH
T14815AF17F79014F9E8178138C9954A16EBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 907KB
SHA256 f42f91c3236480527a057bd336aaa655477b95e0bc879f2b8f7abd5c03833e66
MD5 8459f636a10b856905d2da450c89f6d1
SHA1 e5e23d4ba2b00311f87e1ce2f0ef81e8ab8c82d7
SHA512 601af7745144e2ab2b4ec447c290ac0f22da96db80ef7ce07d04ba6178ecb537da17ae2614a9fc7335bff3bbd60887e830b1dd663f15baad88a5caa7dce30051
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbf4K:A3mnXoZjzyacNVOI/tTWaLl3z0zDbf4K
TLSH
T1BA15AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 907KB
SHA256 f5734611c3dfcff4cb1d9246400fe98405cae32276d17d64d14e07d72740c8e0
MD5 02da57ec727282174ae89c6edb7a37e9
SHA1 d44197bc80fc051384d8d36b96c403c26ff35ad8
SHA512 131fbc65b9c9d067545bb1ae94856fb3a97cd03e4a0b39cca8a1c5da71e5f0ae7d08b80c0c6c3032dbc4b3b4ce41c7ace960a2ab42b2f6b6658d361ec9add762
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbflk:A3mnXoZjzyacNVOI/tTWaLl3z0zDbflk
TLSH
T1E915AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 907KB
SHA256 bd8bdd684eecf39db9db6acc4411dad042b18dfd6f0833efcc43fba09752af65
MD5 f2a5a8665a934ba386ce33113b35cc40
SHA1 09861d32517b7dda0d840addc64c111a54d6f931
SHA512 3f276184f1a3c7519e5cc75e0a32b4a779e5f780332be805cca4565e0eb90fb2100bd70c1c3c37f6ff7b22774012429c79a97ab06f0bb3eefba086418c01e533
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbf60:A3mnXoZjzyacNVOI/tTWaLl3z0zDbf60
TLSH
T10C15AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 907KB
SHA256 f4cfdbf140752f1471a7631c521fb2123e20a7330b5c49724d85cc8be4a31855
MD5 63564532cda22458dd75262e11103cde
SHA1 f90918c9bb8c348c7f6009c8e2072807ab0caadd
SHA512 6df61674c57212adb603fe4b54da753800466930cd2023df1c169046e06e678d9e53eac865f65e60ec4e67f8605d05b7f9aa5831085d9aa2ae49b9b96f38db1d
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfp70:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfpg
TLSH
T1E715AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 907KB
SHA256 bd4988815b214d56df3a7741781713c0746840b3245cb3be26de607acd2efef7
MD5 079d41871bea706851488032c72dda99
SHA1 b590beeb00db3851ff0cceb6efa561f550f03f26
SHA512 82dd19334e4ba5ccb92275f963faed19e63b0a82a78dc3d29f87d3eeefc0f9eddc32661cd7ba728f21826d5948dea86c86fb1c820ed5bb4ab50b61eb383d3b8c
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfQr:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfQr
TLSH
T11A15AF17E79014F9E8178138C9954A16FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 907KB
SHA256 c3c9ad33a55295b4bba46bd536911375cfe68a260b48801071a576bc15b09d86
MD5 d19ad0d843fd0f542b8c16629814fcc7
SHA1 9eb833ddbcd642cebb7bc454055d09c534557076
SHA512 e6652c106a9ca32a4acf53a620859ad96b982474caffb83d04184556eb3c38d2924e926a7d6298482016326e9367e124d184e63783f321b4244316a89298677b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfOn:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfOn
TLSH
T12715AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 907KB
SHA256 972467f00b858be1ea2d702c39f5d382fccfce24b1bfd0209c550db8cc94ba95
MD5 342074f9a0454f70ea60cbce855d2079
SHA1 f5e78e200aacb26984055817c5f3ef2f54f202dc
SHA512 d34a42d6a18333d7c5450bd9459055e253d664ab5824f48fd12b6e9e0abae5ea27e19f2c32b545b7d6493985bf39912836712397f20b8a5ab3340001105d2d42
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfEx:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfEx
TLSH
T14715AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 907KB
SHA256 fc630ed86e7073b604dca7fa66d99ac20b2e7dfbcebc1ba0d35d975e21ac6c03
MD5 d9de72d7dbf80ddd2cd7abd5d312e91c
SHA1 2fdf2315d7c5192ae20c59a37adb3cd2a6d0a2d4
SHA512 93e7077f0b8b2306c6ec29ed53aa986dfaba6cd46743bddc7421538382e4751a07541f3a40fbc85fc29e88f7618b2657d9915f47d4a33e85a5cf2bd326217f72
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfOA:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfOA
TLSH
T1F615AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 907KB
SHA256 2e314f51cae1e276e25ce14861e1e05cceb2a2f6c4af764e9f1c9f93eaeefef6
MD5 efcd881a8a2badfc2681d0a90b7c43ba
SHA1 240048d5a544c7227aaa39ff8f8cd47b7cccc2d0
SHA512 29198b309eadd1d1a02bff802318d60da399e27f627acb0c830259c0a06c15ea6375481d93f52040db44ef0677e9ac52089637dcd94e545730d18e924b36808b
SSDEEP 24576:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfH9Q:A3kMeT1Llj9
TLSH
T16A15AF17E79014F9E8178138C9954A22FBB1BC661760C6DF136892262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 907KB
SHA256 94bb3b974efb8b686a1d6a07fc4379f2931449b0812fa3e44f197f1b530c1f8a
MD5 98f166ffed921f932b98f2a9d5f6872a
SHA1 87b7432cee81cabca7dd41ebdb9260321a229bf2
SHA512 e9e058bb7c15ae416b0f9584eb6e1ec12a0a62ef1a3657c6a0b1999432ed416ba219fd08fb38d206978f24a087b39f365fc04d70999230114b21c52cdf0f87fe
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfO4:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfO4
TLSH
T13715AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 907KB
SHA256 30fff88d40415bcb1ae4b8d0b4f461f969e3edcc3128a711d4cd24078bd6dcf2
MD5 8404aa57e9625fb080c72b602475e16d
SHA1 cddcbf19b34bb2e2b29363cc6fa8f42aec69cd97
SHA512 a4ba90d6c21b5a73fbf0241cda69fee68b77e5c09c503c35745c0bb9473549e4da5b223bd5aff1680da5d53e90c8b2133fb2b916b42767714204f1e36a3e106a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbftu:A3mnXoZjzyacNVOI/tTWaLl3z0zDbftu
TLSH
T11215AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 907KB
SHA256 311aa99104f17c907dd0333a0d6f61eb1b469718f22a35267c2f09cf6ed1089e
MD5 197499c2a54484ebb5e140087cbe47ca
SHA1 2c7f29f03dbd6c5e9c26f6871726effe11224adf
SHA512 a323a6a64d8c24f0f3adf13051198044d3df4c2c969be7c09bade78fb49dc459f7ec1825f5ced61b84f9d2cd1c8a856ecbb46347203bdb28f92560b141c8800e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfgj:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfgj
TLSH
T16815AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 907KB
SHA256 cfefd0b3e2b6c94d210a22c0c961de9551b089e9fd6a63568d3a7a78b08d5740
MD5 71d9b7038c22281986ab43d059674726
SHA1 5e562096c401feee5228d52d265dfa3f62a3572c
SHA512 07c2a86c2993a6c669740ea18b9d0921c8bcf8cae68b2c702ce9e7e151f1702a6f2c58b998ddfd5622f242d7f6fc7d1fab3023b4d59c55e7531742df5b20e002
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfRg:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfRg
TLSH
T1A415AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 907KB
SHA256 40f0310459702b9761b2e42c0a75f24806d793f2bba6bd9618681fa2f298993a
MD5 a3ac4e20524a36e84d702a63f06dbf33
SHA1 f7c794baff78480b9dd53c18823b14414ee290ea
SHA512 7fd7b351857975a5141388bed40858feafa60c8f21e069302e0437807808be4e3a31b3aff70c525afa0007da504d093b6085858f9b7d41d99c14a77ebe3d3609
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfII:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfII
TLSH
T1E215AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 907KB
SHA256 2626cefd051f2c112dea1e88e7c1fde83c0da2c2bbf6159c510716409b920bc0
MD5 cb61d0d6350ebaf1760f508c886b2fe2
SHA1 1cc0fc7c2ccc29f0c7482ee475dc6dc30029a7fc
SHA512 4c74dc9dca8dfd6cb32138457c6a96283b47759fddf25e562d8f2b36695f9fc5f566012434649d9282cd73f5c319200d34319c479bf00e38bda6c095b3642591
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfqo:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfqo
TLSH
T1DC15AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 907KB
SHA256 cfa30a8f57edd8386eae363db791d64826687667991eb71f86b67553ac77052e
MD5 74a362b0032b3e829db5b3fc0ca57d8e
SHA1 18dfad0d8fdfeb271c7de4901957361c5a6382ec
SHA512 b6851dce481f8d30775db03e02914d8eb2e0b0777114b0a113808e30fbe15d3a1397d0f5c2874014c0de5c0b0eebe160a951bed9ace6e565630efb0177a4b789
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfB+:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfB+
TLSH
T15715AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 907KB
SHA256 81520967e899062c25fbe04380a0ae8c6b34d0d4247a3502d44247054f26a65c
MD5 f458a31ea687cd43f56cc5973896e720
SHA1 a1652bd306729cb8c9bd268f7bbbb922d55a7813
SHA512 8bc870f4f992f3b2028fde8f2e1d2ac581bc4d3ad8e27f50e5908eafd897cc3071df996fc8428d89f904056cc6da72ec74ea109bfafc060dca89d29d382a31a0
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfPQ:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfPQ
TLSH
T17215AF17E79014F9E8178134C9954A16FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 907KB
SHA256 45eb4f7a16f5a58b5934e266573cb1989cf9fa76bbb221dfa9cc88b64fa7bf5f
MD5 864a43be178e67bed95737f8a0e6a57a
SHA1 229ccee21112a31dc5642e7e94e006fc4540535a
SHA512 2d2dc5a8ea443c22d6d260d20d1c318bdf25998085a70268f78f74d370042000f7921c2b98feb72317e506d8a9a39f439ecf97ea4c183faa3e9a0f27136c32c5
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfUX:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfUX
TLSH
T1DC15AF17E79014F9E8178138C9954A16FBB1BC661760C6DF236892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 907KB
SHA256 3a136013442c9f794f008b4fd22e073f7e05bffa6a5d69e8fcee2c171677f105
MD5 b8b2882c2ff3327ee2e93c9af9fcacdb
SHA1 d9dbba182a9a64f33ed4b963c890fcc69ccb7620
SHA512 693e841e30522b34a6b98c03162900dbfe06aa403ead3743eeccfce4d9a7c07bcd707b4d76d4e9495d50cc93860c926d482fff6d43c099fef1d82f085e212388
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfyL:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfyL
TLSH
T1FA15AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 907KB
SHA256 9438c53ef248c49c17a0c4f2d40d253e0d4dda2eb5b0602c05f2f587e4f7ff36
MD5 e2c11283f9e6aadeed07eb8dcf1a6707
SHA1 a4b2910f3f8dca05fa0768eecd38cd7785ea00e4
SHA512 ca2867868d6ca4a2038553aec2fc5d1efe49e81cfce2e8201569005d2ce5f38b5b825ac2e3694d092afb53ac2153f3ae0021e60f9498b315526094026da3fdbb
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbfWFC:A3mnXoZjzyacNVOI/tTWaLl3z0zDbfWM
TLSH
T1AF15AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 907KB
SHA256 c5df5a97284beff526b24eea2c4dbcf4b163df9b779a9e77a94c69d4893737a4
MD5 43cea2211d33fc250f3df9863e5a0dab
SHA1 b37712090ba424ef8ee39ea54fc56c83b4231d7c
SHA512 f1dd4a2f2192293381499f0e32abebae7a28e224e882cca2a7af003294adf51850e6fbf05a4acd994f6191eacbe7327a3579aec73fd0aee5f75bab58dda794ac
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHfUCd9/WYoaLHF3z0z04PDvhbffh:A3mnXoZjzyacNVOI/tTWaLl3z0zDbffh
TLSH
T1EF15AF17E79014F9E8178138C9954A26FBB1BC661760C6DF136892262F337D06F3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3428-33-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3428-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3608-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads