67816c1d44d826813a070d7c8ab681077dff57795c11ef4638dccfed4a9a187e

Analysis

max time kernel
109s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 873KB
Sample260810-e2yt6sea85
SHA256 67816c1d44d826813a070d7c8ab681077dff57795c11ef4638dccfed4a9a187e
MD5 8d34a9fa3dd0d0ec6d66db7b42a05d16
SHA1 addadd800949d10da8f95d3f8c02e3d2f80e521a
SHA512 e00cd3f8f75653d83824012e3af0ddad79dafa93d0f751714d31bd6050c27a05e738ff2f56e98dd72cda29559e4c7795869a5f908b5ca3ac41c84240557abbbf
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Qw:A3kMF56rt
TLSH
T1DB157C03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4824-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c519-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4824-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4444-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c95-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-432.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-520.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-727.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-795.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-826.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-857.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-882.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-923.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-936.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-955.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1010.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1053.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1096.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1139.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1164.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1186.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1242.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1332.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1345.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c519-6.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c95-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-226.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-432.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-494.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-520.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-605.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-630.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-727.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-746.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-795.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-826.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-857.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-882.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-896.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-923.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-936.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-955.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1010.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1053.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1096.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1139.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1164.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1178.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1186.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1242.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1332.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1345.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1370.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1383.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4444	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4824	2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
4444	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_8d34a9fa3dd0d0ec6d66db7b42a05d16_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4824

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 873KB
SHA256 67816c1d44d826813a070d7c8ab681077dff57795c11ef4638dccfed4a9a187e
MD5 8d34a9fa3dd0d0ec6d66db7b42a05d16
SHA1 addadd800949d10da8f95d3f8c02e3d2f80e521a
SHA512 e00cd3f8f75653d83824012e3af0ddad79dafa93d0f751714d31bd6050c27a05e738ff2f56e98dd72cda29559e4c7795869a5f908b5ca3ac41c84240557abbbf
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Qw:A3kMF56rt
TLSH
T1DB157C03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 5377a70a638715f41b6c52614190f928d81e54ea0dc8765d54b561e5a6ecac55
MD5 d6d2fc9e68549bfca15cf57793778284
SHA1 454ea538cfec150725137dea2925c85b56131011
SHA512 e02548fab1f3861b1c0a3614050b43d8aba0094a90d58817e9ab7305511a2faaccb124dc7906be7452891201bcd6af536a2d154195c8924914bbae91f8923151
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QI0Le5ji0hmxNrM:A3kMF56r5Pji0Aj
TLSH
T193655A16F6A44BA5D02BC078C5D2569AEA733C425F3087CB13549E283F27BD19A3A773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 888KB
SHA256 e13bd296aaed9c7dfb9d2cf31f02a99910a679a83486fc216876b7884ec35ec2
MD5 7f1a9da37109cc2056b144d226e2668c
SHA1 277406b4d56fe9e495f5847438e97ef4fe1f4764
SHA512 0a93f78a383caf708a016a1515cdab496792e4dd2bd091f6fbade23799bbd7a3848a741dff693cee49c1ffde33558f1eff2ada3a6664ae65046cbce3436a3021
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Qya:A3kMF56r
TLSH
T1F5157C03A6940FE5D11F813499964662EB737C125F6087DF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 921KB
SHA256 bef9e3bbe2c68d0d1ee07255853210f24f42ec27999dd0344c5d59b0ffc1c7dc
MD5 3f0c9c3d484f80dcdbaf9616ba101806
SHA1 b027481a931a1535e8b303c4454e46989fa0a767
SHA512 0409420b644467b3026b5f56779c857f5ab692c0e870fb81fec573adf8aa4cac2c73c56e93b7724a56ba4269229eb909e150cb6aadc36300266ec86a329a63b0
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QRb:A3kMF56rob
TLSH
T1EB158C03A6940FA9D11F813499A14662EB777C525F2087DF2358AE253F327C06F3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 897KB
SHA256 5dac9b527e7fceaa4606408aae4220cad7947f9d0c7685b05c7637179511cf36
MD5 f94c03a374eee6b83a6ebaed18fe62f6
SHA1 e49333f5a0fdea54a937a16e70926e69b64448bf
SHA512 7884a3043e545ddb23b91e575810b52f327f2b482f09be33f5cc7990fb296ce3c241f81cf5fd855bac9763eafccae0e8d6dd4ad3a365cc4667aaf3fb8aeae859
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QD6:A3kMF56rF
TLSH
T1D8157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 897KB
SHA256 2376a7adbf48bf715561fdbdec663e3a7a953942520ba8bf6a3d3373e75747dc
MD5 9cd4b582ed276f7b392a504b31793afd
SHA1 fc61a65bf897c29a0de7c24684026150226a3d58
SHA512 e34a0aa49d0090df4e59231a029d5bd51abd85d7285edd057d5030581d367c5f714a43d4c1292704e81b59ff874f0a88abeb2c87d6db5f63d68c06f78151dc1d
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QtN:A3kMF56rU
TLSH
T127157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 897KB
SHA256 1569cf373820900d7b2b48654d1122ac62f8e5f15be58c8ad084b0bd3db8bc1e
MD5 140b12e362cfa789927c8fa6673f8da1
SHA1 fb15a08982744dd1c9beb5032c5e2c131c9968a0
SHA512 f9283c688c8478c34dd73767d12a21d34ddee80d86e78595bbbe71e7c4c64eecdfb8f5738ba1329a51c3330ebf7f0fbf80c917cc568b82430f0c6fbbded67a41
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Qbf:A3kMF56r0
TLSH
T137157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 897KB
SHA256 84081e8adf79cf4b059bcf22b20238c632fa6c9d1b67d3d951d5e035c8f6dff6
MD5 08fa89c13a60ff54035355dc779f385c
SHA1 ff612492655bbccb96e38e152ac1b579006de208
SHA512 980c233075faf95627a1a221ffc1f9d7fdf2de0f1059bb689ed879815b37ca3d73152a18471e7f22d264d656447af97c951e5d9a62a31b33341975aeeb7a6a1f
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QNo:A3kMF56rJ
TLSH
T18A157B03A6940FE5D11F817499964662EB737C125F6087DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 897KB
SHA256 08907e35dbdc603d69161507b73a7d06ea8ca8fd665b83fef1889cc9f4ee82d8
MD5 eeb4f5aad71c307495d01f9dfbc84591
SHA1 eafcc4f6718337ac117b72677eb89e2d8c8194bc
SHA512 c532ced97c90ef4ebe727647f131e9fc9156437c872e4c75b2a8b90687d542a9c54536bc414559d42e111c8517bff204dca4af27972ba0c6c790c5741e34a417
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QNu:A3kMF56rr
TLSH
T12F157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 897KB
SHA256 b46dd5f2b05cc3069719174badf59d6c77cf1fae0ae1de0d67870eadf766768c
MD5 df5a6d4598254a316a0f6abdbc63f0d9
SHA1 755dc49013f6a1b6cf5eac630913869c6ca0ae23
SHA512 8cd3bb8b9b44955920a1c225e5d61efd092c35c918db6161ea6d39d5a581b86b164605767bb59cc69ab8c0048198f8c4867f25eec12ae3990edd9f407b6f2757
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Qj9:A3kMF56rK
TLSH
T175157B03A6940FE5D11F817499924662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 897KB
SHA256 c6ba684b3c0d5c99d5289a059d9be68f214ae5d2a04c07513bd36c38900c4af3
MD5 e373533a473c6400c4fe31266993c059
SHA1 1bd7fb344165b71a13be35e5fb38f05cef02ed35
SHA512 d215910973e3bef054699d280a1b67284a7603de18b9abeddcfcad150f05eb641f738c84a0cf2ec6df59953afd2a783f76636788ee0eae11a2cf860967efce71
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QPc:A3kMF56rn
TLSH
T18F157B03A6940FE5D11F817499964662EB737C125F6087DF2368AE253F327C06E3A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 897KB
SHA256 55fccc1dafe2f687884e1cf7e5c2d9c1370b1bd2c6c08f22245e4b6650426f50
MD5 2b100b0471e8c317c6bd1c73abe86e20
SHA1 067ec0a0cbe4526cd62e4e0ee7a6107a4c009fd5
SHA512 1c151ba5fb1f49ba4cab03486f4e3777dc90c7b1f80ed311bc56a94b2e4a8db152e0dee44978861d72bd422059cff5c9d82c96c7bd18aee82b6f3cbe9552ce71
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QIp:A3kMF56r9
TLSH
T133157B03A6940FE5D11F817499924662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 897KB
SHA256 4ebec30504dae807da2284266b27ae2989c97460ab8d6efd64f9349a8806d3d8
MD5 35dd8e74cb12401f7d098429a70c96e3
SHA1 60e9c80d9b325fe4aa5df101353eff49f4975b58
SHA512 18e7b024edada5980ae9d89192b1aeeb5bc3168cecd761536d0600989f1c0a4d5a461f458cb51fcb289e032b5df0b84824175f30045edbcc2f49594a1a878891
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QfN:A3kMF56rG
TLSH
T1F0157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 897KB
SHA256 ae09b7b836a6ad29e1b12d47a1532686681cfbb1c5bd9660a41acaf8e0be34e4
MD5 65fb71d4d6b8683ee55db12e55e094b9
SHA1 0756f005528dc33a671376eb9f6ddfb8cb585b4e
SHA512 2ed425c942ba7b4386c89df603153ff47608b2d35e0fa84929e6d0cd4a27bb35a71525eda4cd269a5d84380ba908865e9077c723659cbec05a7b928d01675d47
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QdF:A3kMF56rk
TLSH
T107157B03A6940FE5D11F817499924662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 897KB
SHA256 adebcec81c7a978fe3816cee626d46fce13665d64266c9f35094cb851a6245f2
MD5 cfcc7e2e7c2af1386f84037fcc9f2f4c
SHA1 ab23380465f903f9fb9e365624ec1b771dfc1bcd
SHA512 09c49a2d7d17d44baf7e4d12856439badcb954f00b480d5c94f134b54054847d934eafe04fceb1d0e9ce859092e6d1864765ca17f62a9e67931497da5f0f6870
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QuC:A3kMF56rQ
TLSH
T1E9157C03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 897KB
SHA256 1cf52ad81cf890f93ac14cfb2591325a05844a9918d8b0e57704ca5505d48e67
MD5 c3b4ec5e3bba4a1013d4f0950ba42e91
SHA1 522cecbac3f7371bf5087c3cd14c14fdb1810b4c
SHA512 c280d09b0dba4777b85dd7c502ed6d2ca903d44b0083a98edb274fbb54295b14f197d970dca5f9698e1ebd8b560c6272f59ff83da3247305e70d181d84993720
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Qxw:A3kMF56rt
TLSH
T19C157B03A6940FE5D11F817499924662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 897KB
SHA256 ddf12d0570543eb530d5166f06afec49c8871951c480d80ed6ebbc782c1300b1
MD5 fe68cf48637ff736d351129b5c37e544
SHA1 4a7ae92bc05e1c3a2f300bb4483576ec94b10e0f
SHA512 60afac7b69fa56a22921f8ca7fc7a4b857ed67e2e22cc5b6f397dbb2ba91c6f544b46bf0a62b72edf567a29a24d836e05ef858764b346ccf4226f4eda31580b7
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QYT:A3kMF56rh
TLSH
T151157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 897KB
SHA256 4a9a98e825d8059b684b69516182489c339a7282e11f8fe0e394764a796f8a44
MD5 d31137c0303f0aebeb03314d346ab2aa
SHA1 9ba4bdb595b4909c7ff3329af8d821031143d96f
SHA512 a2f62fc878370617d0038a1a9b63dfc2ec6cfd3feb920601b7a6955e6e1db00b9de30f3c505ee08c72b9e0753bcfe9cf50c2937ed311ba6ee1a130d277a2231e
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Q0u:A3kMF56rW
TLSH
T15A157B03A6940FE5D11F817499924662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 897KB
SHA256 75855aebd87b830b11b7ce0aed8feb1953d8cad9f4bef4d9cad6af4a21218378
MD5 1bdadcc94ea6210747d8b9402854fe67
SHA1 499616d401b78c6ff1d3c51abb0a40674809c5f0
SHA512 f4fd472d16b16216ed3837091db3a13997a3b77d97d24affc01b0b2ee249fe09e366dc1f65d95feb1d1772941a2e98e696c350ffb3f8e7c4df3d1dfefb745b2b
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Qib:A3kMF56rn
TLSH
T177157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 897KB
SHA256 3566d74f2144aba0076bdca45114ce7123920b15941e09fd4b3ff26cbf8a7c67
MD5 b0ea8ac5a7ade85ada634aedd598b13c
SHA1 d6c2e5bb021061d49d591d4953c3f84f92a0b7d7
SHA512 9ff1f1fd3ca6b24f6cbbe3e4005667fef9a5500b613ec67f0546b5cd5ef145035019ab9b466665bd3294009ba3194899be31bbdbd35bab5de9daaa5714041062
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Qkf:A3kMF56rP
TLSH
T1FC157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 897KB
SHA256 8026220f82aafa49cfcec8cb02948c66cf4dcf183785b3d5487586ab140a62e8
MD5 261141ecaeac1861d81a143953111419
SHA1 35ecaeb5d79074f9ce167198492452300962b3ce
SHA512 c6c67836c9e2bc8c0bcdb9aed41896efd0bfc702e71de492549e1f4d94439870aa38dadc87a4626c62e66eaf4e787cb81562adf319ab7bfe6615c3d5e6402170
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QBK:A3kMF56rv
TLSH
T1F2157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 897KB
SHA256 305237758ca25abbaeae61a2add930e9f15bc578f9dce7967429389df88991bc
MD5 e72417b958debc3880b63b1612d3596d
SHA1 36aa88dbdcb669ddc575c252dff58e17eac68a21
SHA512 949da8a39eb5eab81f7b4f0654c5c7b23a308159801e959c1b1df67856e650407886e98c4711fe9903da2d13cc8bc242f41af1e28d39bec3cd5a25cdd4745b6d
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Q6k:A3kMF56r6
TLSH
T158157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 897KB
SHA256 9249bf405dcb15c8b49b3f7e2bdfade8c727b46d0c520db0ef6fbc83d1774d86
MD5 304ff9dcfa27bbb120cb000e111e6135
SHA1 2b46f019047c85d4d8473e6c33d859f47404a728
SHA512 5915e80861b363df21a517bf3198824d93a95a2dd40b0d4a7350eb97d28808052683c993864f3a363719feb897471d291e257b405de833a32099108576705741
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Qf0:A3kMF56rP
TLSH
T182157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 897KB
SHA256 1ba8e38c0afa11d397663262a295759bbb816b62444f287c885b468a48183f01
MD5 b3cac52668deb997a387d7ae9374b266
SHA1 d6f67a2fa91df75950e076590a6b2f4462c39690
SHA512 05b56203933132e117b5b1260c496031bdeef8cf9075dcb98a0f2d5cdf08b9c6909cfc4d3a157c39951129b18a92b500f685c4021ece370d350a6cd56870977f
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Qug:A3kMF56rS
TLSH
T114157B03A6940FE5D11F817499924662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 897KB
SHA256 d2114c29ce4135a6d5b6bfce56521fe1d90283442a3b8ae25345db88a0607994
MD5 5baf754a529e0b6d9e209ac0eb708adf
SHA1 8ad83e4e8d489058d6b056ce9754c93d269e2019
SHA512 0be7b5f87e1b0847f3afc1768f28476c4f2bd56028ead9cb3557590567725660a9ca5b971eee5031aae43d729087ece4af567f3b4b532070769f1851bf5e0aab
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Q3r:A3kMF56rc
TLSH
T1FD157B03A6940FE5D11F817499924662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 897KB
SHA256 5925fbfdb5e7fb58269c150d2f81b4fa94fa57141e85bcab2504696a2fed6ea8
MD5 013c4bcf4a6c76574d7caa23e35db333
SHA1 5d724057ac6ee21b0b6e6bac4933c6b49a3d53a2
SHA512 c6f305f8bffccbe69879f99101a61120a0ce5b5a0c96190526cfa21bbc4e1afd335bef19130c71852aa08b371494785e4cd677ec3142b311dea7065291749a1b
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QBn:A3kMF56rm
TLSH
T15D157B03A6940FE5D11F817499924662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 897KB
SHA256 c9919bbeca41b1578a6a25c1062716f2b7ee1e8e0413b708caa991c9ff4a75c5
MD5 f34c6d69d8a2c684c80c8e6c65457766
SHA1 8757025d9ee612b452e65a60d6dc61e973015cee
SHA512 9679d63bf9745cfbf9543cee2f78b1689167f3733c21f9f3af66338d718e53cb1d52467ff311bc92af843aea9067bc66f85ea061b778933d00871d04ce4fb4a7
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Qtx:A3kMF56r8
TLSH
T151157B03A6940FE5D11F817499924662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 897KB
SHA256 7ba507495fdfa7bc2ae76747e131109ec2906a29e57be2cc58065ef8b0fc5ea2
MD5 31cbeb31746c5133711a1c8f009974ae
SHA1 3e5e6081c812445eae21807e2f156f4a951c9553
SHA512 dee9b10b37c78be863abc193ec0d529ea0e267971d7a70482682245232d156cb829fdb75afbdffa0ac5ece3396542a241865df5fe37ba3712efe46133fb796a1
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QzA:A3kMF56rH
TLSH
T11F157B03A6940FE5D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 897KB
SHA256 fde9c810cf43f60ab1e7770acc9bf569c9c93327617bb7025731aa1e6c2f89ea
MD5 b45f8a4f3fc89ca45a19f51b97b0f380
SHA1 99b1948960283a3e7f4fb8cc3462fa5bf9c813a7
SHA512 baedaf122b27f375616d8ef9e6ab17dbbc0a01cb421b9d48ca9345e9ba32862e62e183760012019ecc0bbdd17f85673037c35c8bbf84b8e99579c1b69bb3a8f4
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QE9Q:A3kMF56rq
TLSH
T162157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 897KB
SHA256 76a2387f02688b179d9099b4ce95cffd0a953487ed269ec983e5a538ad21c71e
MD5 d44aeb3463e90aeb3b29ae35cc76460b
SHA1 cb64adb8511ad048471527f33a4b0f9be12dd52d
SHA512 b0fe105e5cb369ccecbf9e50e44e17ff31b3bdce8664cba58cda3746756dd8063314632c1eb327af291e494ef2463f6bfc4ed6bc6a7d8ad838c00e600b6d605c
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Qd4:A3kMF56rp
TLSH
T166157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 897KB
SHA256 1cefca507712555cc8b9ac498949e08d514926a2c5ad4fe3cd12da891233a388
MD5 58d1cfb4bdfc32b0730e6b3f0ad1ef40
SHA1 6361169b37b0f0d3792590af7fe09e6e2f027a95
SHA512 d347f918dc255b4f14a3aeb27569b303def53bcc5a7f53867df56e9ae022c821b20562723ded97e26e6e0a5c623395d3022a5a1c7778f67f1c3e9f7e70df8215
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+Q4u:A3kMF56r0
TLSH
T118157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 897KB
SHA256 4ddcb78a794cea6439a3c35060b0932f7db2ac9758a22021bd3029db117ee1ad
MD5 31c165c9d493f7888b617d75c8bfd6a3
SHA1 215f49c7e3fe6fd2a54ff495ac47f938cd17b93c
SHA512 c3e3a1a88a591d5d0fe48fe17d399f97a18d09fae190eb3598467af379911d4f7c39a834e993388f6f9489ee7599e51b578c4e5168f98d184062a612f5891a42
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QZj:A3kMF56rW
TLSH
T16A157B03A6940FE5D11F817499924662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 897KB
SHA256 3f16a2b2de8143b9784ea91c899f9b8b7f51f403a2c0f4dfa4c5e32f7fab537c
MD5 db6df0f66ae2398f43b952875deed3b7
SHA1 8c1984b62581e1c233f1f202868eb7f15a2006c6
SHA512 6706ee37263edab5e8e6011527049aa9615af18819b1d68d6353b55cb6be26fbf87a01aeb449eb8a89d3f898e5d4a4a75ccb123bdf87745323107fd9237e4a8c
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QAg:A3kMF56r6
TLSH
T105157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 897KB
SHA256 23c9d097ecfaea0dc6af1c5ee6f671bb6505906c60e72b6085159fd3ea0df2f8
MD5 7ab67e01fc368ebc0f6118b2ca500194
SHA1 eb0096f1e4df7d4bd6b8a58e1d1d9923f8cfa9c4
SHA512 1447619c1e77d4404bb51ac9c13ea525bdfcf2b06f90783388c2833f863373c4a43ef0198350cdbd379d3e5b10266cacbb93d692bdc3b17de3f045cc508544d8
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QvI:A3kMF56r7
TLSH
T1C3157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 897KB
SHA256 f3d9a605447d1d1fab2d0f6466070ac208084c3208b53af23d9d121f9d8b4134
MD5 af45fce9b71e7b75f2d1a53beac9e35d
SHA1 50647f9e2376ed82895377ba614d0620294c63c6
SHA512 15100182cdf45ddddc77cf13b5ce657845818f179492d987ae14889911f595a6a05bee972f2b4ad7381e2dce5781f4839eca837d144643c52b6441e0c17b3f78
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QVo:A3kMF56rF
TLSH
T1B3157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 897KB
SHA256 5bff545448b65a00e19c3e946cb403234b494b8c970e89940a78eea03b8f78a0
MD5 567df5dd27bea25c4eab5f548c891da5
SHA1 dc397ebce2518795c12bbdd6237b96da63bdc262
SHA512 e5840d957739a87a0eb678b99a8c4b9dca15ce81daaebf78fd6089211717d3ea56ae2e5c48bbe4eb1693c42b27d4599a3596d6af2ca725290c7d5228b1fda6ad
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QG+:A3kMF56rA
TLSH
T1AC157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 897KB
SHA256 ae7771605bcd5f023465c7bd55abc2cb685d6bfc9ba80a083ba91030ec85464a
MD5 74d0519e12c49b3dfc64dc94ac8b537d
SHA1 1dcdaa193664c72bc842a4115cac31bbe1d01d22
SHA512 aa5e6d280d2791cb04ffe3d8620bb88cfa1879eb27e5b88637d11614970c29648706102cc227c9ddea018c6a647ca43903d14bb97ea7d87d87b235c3c10f5042
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QGQ:A3kMF56rQ
TLSH
T11B157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 897KB
SHA256 11aad7ec3f899825d6378ce73e658dcb8824e4aab46850dd11f139e3b1862245
MD5 cee47a875b417c5b9f415c09ed17a7eb
SHA1 b0a6f9f63e2be82592fda5b08c90324916d29405
SHA512 4bd69a37d4e6a77736083d898478fb6328c3faa77e4d67ebad6bad0a6633a0616f359ef507cf9e4a2e198900feb4a0fbe913107b3efe6e0e63ab79bf1f1276d7
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QXX:A3kMF56rg
TLSH
T14D157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 897KB
SHA256 79caf9abff2d905db38f46d27ff1ed0f2b633e15b803aacac02aa7f6e470c0f1
MD5 bfd855835fad1ff171fd8e3bfb7feb27
SHA1 14e4541ad14686ff8e5823547e0efd4baf046d26
SHA512 2471140fae8d85c4bc9fa6af4054c84e4abe081f094af7aede2e77ab3f811d7318dcdc8b28a3ceb699db893809cffdde8f89df0b68616f3fb2fb3e42481b7d05
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QNL:A3kMF56rC
TLSH
T1BD157B03A6940FE5D11F817499924662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 897KB
SHA256 9adc2eb6e2999aec712009db48e68b24f65c24f552dca70ba8b0cbf4a0dd69cc
MD5 47558c077091c8615300c2b0644e716f
SHA1 08e407d7fa2b177af1b64c36325e4bae10f5f496
SHA512 4f055c5eb833fb1bc5cad57a101d70d265cd8a33a19472b1135c196a9ab38ae9f63aa920f111c5027b9703a1aca883f0c93120e8e9a1500e4ab700f91213fa13
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QLM:A3kMF56rP
TLSH
T142157B03A6940FE9D11F817499914662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 897KB
SHA256 48a46a7943eeda42c8ce9fbdaf7749ac440acfba94fe4082de0ab4b60a317b61
MD5 1acf76c27be7d0c0ed35c452d4c3521a
SHA1 6528a9a8451cb2f3ce55faf375e9a1a59d7b2dbd
SHA512 006587bd7644e6a7ca08d94f8c46c07255a9a628aae136630b3e9d3899c0a826d48d49241dce56181f40d5d5ef8a8b7a4ca01a436da42e6fd1c4de704d50224a
SSDEEP 24576:A3mnXoZjzyacNVOE/HgD5Tvinrm7dCE+QMh:A3kMF56rB
TLSH
T161157B03A6940FE5D11F817499924662EB737C125F6087DF2368AE253F327C06E3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4444-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4824-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4824-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads