97d77c96f219271c4981e5d5c7c0b47bf6c4edde178464976361d9716cce1811

Analysis

max time kernel
112s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 918KB
Sample260810-ev8qss1cmb
SHA256 97d77c96f219271c4981e5d5c7c0b47bf6c4edde178464976361d9716cce1811
MD5 9c5069f1fe9931f7b14319eaa0dbdd53
SHA1 14d82106fbc00cdb1331aa99e3e4abdbdf7676b9
SHA512 f2fc375cb9055051dfc51708044435528823acb66282e03191528cc8b217098e35f9502a78597748a70b0d7444bc804a232dc702a869ef3356c4919a7ab4a21f
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMSEHaoc:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoc
TLSH
T14F15AE13E79014F5E8278138C9A64A22E7B1BC661770C7DF136856262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4132-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c51a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4132-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5296-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb5-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-265.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-446.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-563.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-662.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-766.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-803.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-936.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-956.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1085.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1153.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c51a-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb5-60.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-228.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-265.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-446.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-495.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-563.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-625.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-662.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-735.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-766.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-803.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-846.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-871.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-890.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-897.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-910.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-936.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-956.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1005.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1048.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1085.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1134.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1153.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1178.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1185.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1222.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1326.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1346.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1385.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5296	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4132	2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
5296	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_9c5069f1fe9931f7b14319eaa0dbdd53_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4132

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 918KB
SHA256 97d77c96f219271c4981e5d5c7c0b47bf6c4edde178464976361d9716cce1811
MD5 9c5069f1fe9931f7b14319eaa0dbdd53
SHA1 14d82106fbc00cdb1331aa99e3e4abdbdf7676b9
SHA512 f2fc375cb9055051dfc51708044435528823acb66282e03191528cc8b217098e35f9502a78597748a70b0d7444bc804a232dc702a869ef3356c4919a7ab4a21f
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpx4VMSEHaoc:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoc
TLSH
T14F15AE13E79014F5E8278138C9A64A22E7B1BC661770C7DF136856262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 e3f3337dd42d5b473ffff98ba97baf5eea40c781c4d712274d193af7645b5f32
MD5 7c5080b39edd5854e890f56e20861795
SHA1 0b72e4164f7078b8da870067e94bf2c0af326ff0
SHA512 12fd4ae6fc48501cc775e4e57c5b901401e5c97d287a265f027ed510bec56f7d193bef611c1a86ae6a06c63bec816949c5fc03bde0322bccca943d0432dc7d02
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaok0Le5ji0hmxNrM:A3kMhT1LljFPji0Aj
TLSH
T121658D16F6B446B5D073C179C9E2965AEA7238420B30CACF139497292F337E19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 933KB
SHA256 7d44a67dd313f8e6fc23c5008558cc8277d60b2ef2b2be8904b49866abbcf9d3
MD5 057001cefcfd67434bea2bbab804e5c2
SHA1 6a6f5ede59284a46048f78bae72e1d3a03b2be23
SHA512 2c7ab5c1945d0c4b967cad8cdc7322ce6e27e7cf70c7ec0a4302f791de2ef16248cfe32c060dc877e692a423f44bbef2be78e9d991be5638ba40b6bf866132eb
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoOa:A3kMhT1Llj
TLSH
T13515AE13E79014F4E9678138C9A64A22E7B1BC660770C7DF136856262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 966KB
SHA256 8f4b2696359440c9878bd470e024f4900d11ac08a77977aab08dfcd92fd988b6
MD5 c3f98b8249885f1c5f51b5c86817fa21
SHA1 57d70c3c5acf43f5f3692d539ab5dff6f37ac6dd
SHA512 255db58c44d3a7e7b5f0b199f4467ef5feaca8fcfcf241073bfc24e3e27235d8d17acf0ba1a67da16ed3229eb6da9d34c04a3bba0b93b74ba284819bb679c76a
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoNb:A3kMhT1Lljkb
TLSH
T14625AE13E7A004F5E8678234D9A54A12EBB1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 942KB
SHA256 76d06d191a0e0a6f63c2a2a6509b560cb3b2e157d20662f7b6d04211b5ba89b9
MD5 80bccbc772249cccbcdc9a83f10c0559
SHA1 85726b4a084d53e17a001b2a208cbfc933c17876
SHA512 6aeb3fa81e0e8f11957811c8a31ce0861c62830c5d4fbf408d048e2509394559512149aec8d36c62ec69ef8a88b53a5a668d56d00d416b6d92e6cf3b9b22fd5c
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaov6:A3kMhT1LljB
TLSH
T1F125AE13E79014F5E9178138C9A64A22E7B1BC661770C7DF136892262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 942KB
SHA256 bd91ee1630cb760cbb1f990401a18139e2cad5fb8cc13b48a8ec861c0052ba9b
MD5 48f1155aa610118ff6566bbac17602ef
SHA1 7c107f8fab81a1a84ba95a7777c75378446112d9
SHA512 4fba478ddfb884cbbc46785b8eeb314581ba7e14eff5cc4b7f9d22851766093445ddb21ec64eb6616500007506e1dee9a9c2e0bf340ec0bae5d589dab0e45602
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaonf:A3kMhT1LljQ
TLSH
T1CD25AE13E79014F9E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 942KB
SHA256 fff433ab3be0023b0eb9a9eea474aed7ffcf55e416521d6aae301073abf65bc3
MD5 fae7f5c0a7c1cb0f2ba172a098802dea
SHA1 e34519bc9b143cd1a1cef79d27bbecd5f973f772
SHA512 d5d3d130792402bac1e52a993a7bbc8b0065de493fbb145adb85e84558fb9899912a59eaf2a3948a36ad92e31f3932b77437b552a5a66f9f975bd6862d99aab7
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaopo:A3kMhT1Lljd
TLSH
T13625AE13E7A014F5E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 942KB
SHA256 9ac35818766f6a9d988349faaba9814260d3b1a7cc2e2caa1b15ea62e58f2b71
MD5 821bd3120c960b00e588905274a4258b
SHA1 4d8dcf2528fb131b094359903881d0cacffcd3df
SHA512 0941d11a65558026c9b6be3ec24bc76598cdb526db5a07297904dca7708b1b2d99e21b7255b6343ab6ff410899af7947e65032ba04d06f5985ff1d64707c8957
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoZu:A3kMhT1Lljv
TLSH
T12925AE13E7A014F5E9178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 942KB
SHA256 c92afe488fe95f03071cd82473a29f7b0dee526b4aded03b78f40776dc4c5b27
MD5 acc6441b14caac489e4a03e71fb90912
SHA1 3cb4a813968e27d75b9921a3080103a7f2f0de86
SHA512 becf2f72bf94a499c170d7e539fec56ec49df8c63e89a821c8db611f25c4c552bfcd8c0194444f13ec2c788b26ff29ebd499c6f6045d42c9c06574bd3839eeef
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHao/9:A3kMhT1LljO
TLSH
T14225AE13E7A014F5E9178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 942KB
SHA256 f800a3cb92ee4f3bba19583580292399f6cd1069d13ac812215d0a2d019a8955
MD5 ea92d749e14e09386ab2e3e5deb9f01b
SHA1 e585a8460ea54de15a5af9daf73fbd391b9aac73
SHA512 4823d0168fbe294d972f1f30d5fc6cafa630ba08700229a6eb40b890e1d2417141a8246fac1158e0e9e6a4fd3bade92897cfd4eabfb6f8bd31546f5ee657c86f
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaobc:A3kMhT1Lljj
TLSH
T10125AE13E7A014F5E8178138C9A64A22E7B1BC661770C7DF136856262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 942KB
SHA256 da90cfffd500982ad166483e97d0579980cba0c09b3e881359142fd7c6ed9914
MD5 fafd7e00e24cb057abefa308d6fb3433
SHA1 0c4046ff0c97d1289e72f28dda8eaf6551c2a28d
SHA512 da6a22d5f4ea092cdec6c82e9ebd1e7bfb959d650799a5fab2aa6b42eec66882c9e8f801fa5afe54c523ac411f2e591dec1b8badc62554f432c401653b0b4448
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoEp:A3kMhT1Lljh
TLSH
T15325AE13E7A014F5E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 942KB
SHA256 67c972d25e6b4469f5c29e4b23731303cc58160d924605952704afb11735ff51
MD5 5b42aa5b0dec46eb79c63854a5cb0988
SHA1 582ac7d97c809a2cd27baf002d2996e3907abb86
SHA512 1738ced564ae434613842c4b4e5ff58112b2a3ddd56629ab6fac620a5b816a82afdf5e0a8215a5dc82f47dea37c7eb47cdd422ad397094671a23510f3282603a
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoLN:A3kMhT1Llj6
TLSH
T15825AE13E7A014F5E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 942KB
SHA256 b6f9a709a3dd7abb2091f7d10e09b98fed59b07d5abd8b7fcbe6ba70337ae54b
MD5 37d3f5be7fe5d4a3a7974fc747ece060
SHA1 710643b6d9e9f4a1edb7ebaa951e3c0a9a7efb96
SHA512 962fa3a2d9efdb9a90f4fecf454e75eda101e963a44daf7178d821126fe7bf1902b14ed19366beeb2dc254746702ab519d5a08b64cc95c31cca87854b9d02f57
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoZF:A3kMhT1LljA
TLSH
T1D425AE13E7A014F5E9178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 942KB
SHA256 d76f765e467bc44be772cdc5be2c55b505a78f87e4eb3072457962293e09a30c
MD5 5201a06ef57eaf1461be3940979fe092
SHA1 4ba3142545df12da47748e1f92074cbc11c93ceb
SHA512 a1ea347728de31469cff5d6e9e59002512446860fb1b853ae0cc7381547bfd720939daab8aba27ef58086f6c32ca20a778411941aaa57c9fe47b637deccc118b
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoyC:A3kMhT1LljU
TLSH
T12525AE13E7A014F5E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 942KB
SHA256 c85244edb5397137a6453af91023d1c67d1b7bc140710688245a0d5761c0c2c4
MD5 9560dc91cfcdfaf643ba09ab22f12924
SHA1 bd0c0b213f0e147691f845d80883f2cbf82165c5
SHA512 5cb43b2b7d8f49bcb9a402e07e4215a9fcda16cd462f7e9f6681fc38fe17b1109a04879aa758b3d3eb478506644012eb6315582c7b8763eeba1123153262612e
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaotw:A3kMhT1Lljp
TLSH
T13625AE13E7A014F5E9178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 942KB
SHA256 d3752d7439696ba84969510e6b1d05f8d8b646ff0c109758bcc1726f02192fe9
MD5 642c601e237fabea5ff66015c8ced8b7
SHA1 9455e15fa667631cfb73899868fdbeb099a7594e
SHA512 59deb05bbc4ba916e3e1d45792d697c4d17c6d5e53b27655c71707ebcab9fca33d359b0da812d0361d8264b23c76f7af8f41db1b8744afcad07ba9b8cdd8ee51
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaocT:A3kMhT1Lljd
TLSH
T10225AE13E7A014F5E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 942KB
SHA256 e9611135e166e9bd62d95f143d87cf117a60652f2f6bdab82cf43c239d2757ab
MD5 fc00e9199a29e47a5d9c9bb2aea42f3f
SHA1 a9c26e737254e5addb31e1b394927eaa42368be7
SHA512 6da4d4abd315673c437a021c2ca0cd312eea2c70b9b4d67016593ffd45e1ee556e544ba638fad21bfe9630d744b2a0c16b58526a7cac48a56db0b64f66054a7f
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaowu:A3kMhT1Llji
TLSH
T1DD25AE13E7A014F5E9178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 942KB
SHA256 5cce0fbbfe2f0e8ab92fefe0acc5037450cbddf339a7770653365f1658c3e929
MD5 6fbdb828f777739d49048dbedeb66b02
SHA1 86931cdadaf4084f45f43eb32752dd1ef7b4be0a
SHA512 13ed55e3950b9f0a315c5a313c2f8ccf3d1f8e67e391990a15b94ca16a66d374ffd3d852eb4a3af39bd4f68d29dcdead2b5eebf0ccf6e225ba62db6270cc21d1
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoOb:A3kMhT1LljT
TLSH
T1A825AE13E79014F9E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 942KB
SHA256 3fe03201850b6a464d8990f11d2cd15c72f9b1a00b4f8367d61c543e202497e0
MD5 d2f128e24a2f57072a33d8122601db52
SHA1 e072522d61d49bd4a94596c51050bfbfd81f5f88
SHA512 f2478b9aa3ddd06abd0dece5572ef3cfa4db3930ae839c4a4745161c504d22884e40b49968b17ca894e78ee20d751cf109455d8d74e4cc2d7153c8c53776f2f5
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHao4f:A3kMhT1LljL
TLSH
T19D25AE13E7A014F5E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 942KB
SHA256 7834337fae0a2975645cadaad08681124d23e388735484c8532140bf42221dbd
MD5 7cd94cd688aede7ee1aa747930fb970f
SHA1 b3a82b9fe61905839b7c4df581695ad96c40e43a
SHA512 77aae613f98b6c8c15cd4a49ed490abcfb9d0b03b23f98284a4a882fb2bde760b7f9481fbedcc0269fa51a56c30993e373d4bef90fca195d06f885220ce6d15f
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHao1K:A3kMhT1Llj7
TLSH
T10325AE13E79014F5E9178138C9A64A22EBB1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 942KB
SHA256 5ee7fa6d772937a47ee81f9481adcb7270f63fea9019997a3e28bebfd7ce94b1
MD5 76e07cda523f5387bf831be39072c5eb
SHA1 1e48192ce1c4e693b8103edfe13388e34846dbfc
SHA512 e6ed4d6f3080743ac4c6dc21f289abd545a4debdf20325ddcebc1b472ece3eb565de370a227beb5557904624f30e8994621adae345e3758b294008c546decd1f
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHao2k:A3kMhT1Llj2
TLSH
T17A25AE13E7A014F5E9178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 942KB
SHA256 7f03a9530a32b88b4d046c91e7d1e6739fdb4ae1eb956a1a47c1340cb2818ede
MD5 08ab2de5c337f95ef2333eec5843cd3d
SHA1 2024d587b3c64ad82c318f0722195e55de29c29d
SHA512 fe18f47e84ee78dd749fbd17ea274e91f316c65c066daece0afef820445c2f28744d50f547c9fed497a9357114647cf13f1a6202848d6ea85460041d9e222969
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoT0:A3kMhT1LljL
TLSH
T17925AE13E7A014F5E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 942KB
SHA256 802acafc7b32bef8176e624e6bcd0132dc10a0afb32871cff4236bfa7699e98a
MD5 c42641080aaead91811cb2fd7c9a6c9e
SHA1 b6eac8645ec3b800882c62cec7ee5e16b7ca84aa
SHA512 9249984567873d90d8e7fe1301854689eaa26738beb71df4ccb81865e67c1135d822ae4d13920798b29f076e6249b41407689456ccaf2cb7b11ec3c957994c0f
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoig:A3kMhT1Llj+
TLSH
T1AA25AE13E7A014F5E9178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 942KB
SHA256 86328d242bfa6d808480bd2b1cf6236f5e53904cc3e7044844d0926eafcd4d16
MD5 dffddfa619a1ae8dcaa7d3d953ef5753
SHA1 56c24c4ea15bd6c52bdad1a1d6ff903e08ddf398
SHA512 7e11989106df18df23ef7589073ef943142e84e69e9a38a1fd224299e60dc6faaa5b093e562eb4302d317357040313f3e78bc49861b367d1cfe8d7b02ba63975
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoDr:A3kMhT1LljA
TLSH
T14725AE13E7A014F5E9178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 942KB
SHA256 4fe8959d2c8c67d5236ae1aab31284a8e81bed8d4c7fcf34db43a749c1298164
MD5 f39555b69bbcde6cb0840604b929de2c
SHA1 f60746a8dfee7df6843b06569b9d2aa41767b01c
SHA512 3749bd1fa5f3c7af808b475cfde710bcf11d6036b3e309616104c05001d755bb7aaf836273c4d27cc496f803beb9cf587e150c8008a3b93d7856f6acfa025d23
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoln:A3kMhT1LljS
TLSH
T1FE25AE13E7A014F5E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 942KB
SHA256 c1b1c3ba8cd3c0bfcf7eb22af5d2467f5c8757f016b7052892c9a5c28a938c76
MD5 7703b6a746a4d707279e57b1e397eace
SHA1 9d5368b71ebaee314e901e9e3242bda3e0b3669f
SHA512 9d9d23feadccfb7054f213d40ed70fc6842d4fa8e3daf58f7b58dcc23c41e7806b07763eaee64ea3ed4009ec7b9e909dc14efae4176fe0f389ce41a163f2bdd3
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoRx:A3kMhT1Lljg
TLSH
T1B425AE13E7A014F5E9178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 942KB
SHA256 dd922928d91fc133bdeb11a6523d063b6628a3bfcd57cf1b836a8e21779215c5
MD5 69a49d5c2a827ca664fc0478d839aae3
SHA1 49375d5b6814400d60c2d5f9fb64a7517a7f370c
SHA512 e32c446960af2f6821259ece4bae05fd019778ed1c0c1859dda5db6308423470728ee570d6329d06d892448b4aa9e3705f9f1a294bfc9295fc57094e200fae39
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHao/A:A3kMhT1LljD
TLSH
T10A25AE13E7A014F5E9178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 942KB
SHA256 e1acb47a6c0199b5f37ca0fd3738bc5868b7f43c719d7dc0a1fd8c990f61175c
MD5 07ee289ba3823eacf20c17e3595f0934
SHA1 081dc5bd00163f46f48b43f4fd825bca4d129c3c
SHA512 dfe2563f039a6d58f94d0c5194bd939b1f625b46e7085b211ea01e91394eb11528b495b1d4e072f7cf0918dd8332a683628fdd5f92f1dacd92ab0db6f9d03149
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoQ9Q:A3kMhT1LljO
TLSH
T18225AE13E7A014F5E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 942KB
SHA256 81d1771697e9e5f46f89058fb74cd3c6063c4b9c035612f7e736769435f3711d
MD5 9dc6fe9645241992371d50e1d48a9702
SHA1 64665c1bd557c46c13e499cc9ddede02c36c3503
SHA512 9a3742de7f3b2b02f304f4eea62145c96a60cd0971c73c5b750938d32b894bfc8d584d0b3f6d36ec45fb9215f2a1aaaaac038d84661fde05d0fd48eeaa37034d
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaox4:A3kMhT1Lljt
TLSH
T17C25AE13E7A014F5E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 942KB
SHA256 3685bb83d7ea4606d83702c19141136f609faca127c13c0fbe7e40b9b1886b7e
MD5 eee0bbfff80b2af217477cc2e3ab32f8
SHA1 5f80389b9758470723d3f61baafe10a76c301cb3
SHA512 509c469cc65c95b14d44b8e99cd76a7fb17bcab529fd4abbe1426d91d5ef0ae7ec75ffc01e7c5b16ddbc73d9b79fa35694ebdf6afb17b3da90c0f74d88c39dee
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHao0u:A3kMhT1LljI
TLSH
T19F25AE13E7A014F5E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 942KB
SHA256 93108cac1fff67b905d7423ee19fdfaf7635f4fd0eb0e4f4c3b65c1df97358a5
MD5 2bd36e9fe20f9b39ee2d8ee195aa63eb
SHA1 d152d6619cbe24e5db8ac68df4f98a6d5a4090c6
SHA512 2f9ce3636021f58650f914266fc266868ad62cf40f24e10833ac15f9e53f21e1e16e7544b7dc91d7325dfdd10d05ab0f93d3c9fa3d1b27d5b58f8e39a424bc87
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoFj:A3kMhT1LljC
TLSH
T18025AE13E7A014F5E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 942KB
SHA256 f0e89c0c7362045b3b9295135f23e2560719a8f58dffb85c2133d5f5bbefa8e9
MD5 7802bbbbc8f6f0958e1da8315840d5b3
SHA1 dec6077c7e82c75590914ca3ebee79605ce97098
SHA512 a0f85274aa83c1913e70e85c11e41b0f50bac1226c2a7bcd5326bceeae84d92e0d7f7ec87dec5ebafecbcd78d271143b77958a3d6dbc970a99a27cca96109e8f
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoMg:A3kMhT1LljG
TLSH
T1B025AE13E7A014F5E9178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 942KB
SHA256 8800d47862e40586f42bf5cf04253dfccc275c1cdf0dc451ccbd95f8339d7878
MD5 4471f455df7855c724bd919416f2fbc4
SHA1 a0b3d1ffbfc90d55c06b0130f1aeeb0121873578
SHA512 3889703814d555824a0f09baa4e01953316761f58d9d064bc66ef703a2a7596f7c0efb9f9bc42dd2608dae02e91cdb36c8d1b444f2b3909f112ecd43dacef380
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoTI:A3kMhT1LljP
TLSH
T14F25AE13E7A014F5E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 942KB
SHA256 9025921965757f193658fe2abfc61d379947f88b74e28b4e3eb193a404be33b2
MD5 b3928d7d260b56319e928017af91d84f
SHA1 3c03d0dedf2d557a9c1ad8832f7517263f121745
SHA512 019ef2b88758611f5d9c60e8b8e2f75dec6d26dc3aeafec6e89178626765688fa5611a8ace6957b47bef69f18687ad82b7d71ee5c5c012015515fbed5c83e030
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaopo:A3kMhT1Llj5
TLSH
T17C25AE13E79014F9E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 942KB
SHA256 87490aceb5cb5e5b79cffecc64894782b1517961f7ed91801f99f0807d23fa01
MD5 f5378bc7ecc9ee730d61c0e84f41144c
SHA1 e6c23a92e81eeb323a75e1c626d10a6c852fe92b
SHA512 314bbd228bffa715088382241b486e58f63f29dc069ddc4f9c42a2f33ac8f7666e2120590348f452a595501148063d4101a912280ed90efe2df7dd1b3a9b7b4c
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoa+:A3kMhT1Llj8
TLSH
T13F25AE13E7A014F5E9178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 942KB
SHA256 33f6faf56cbaaf3bd27e66a98ab838404ee4f96850463850b7b15b05ab489c0f
MD5 66abca049f434dd02f077276db2f3c22
SHA1 a6ba36e97867c0722aa216b13c16861ffa78fa02
SHA512 209f7b1b8d14afe86181eae03b35abbc27df8f5ee81ffbde0a03f75e44e913e904931fbfa970782a5cc820ff00db27bcb9013897cede931654d1f2dc70e1f290
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoaQ:A3kMhT1LljU
TLSH
T11725AE13E79014F5E9178238C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 942KB
SHA256 543d24168264d3b815aab9dce27572bcbcfad36558dd7935ee1b97644d6db834
MD5 fe0dc8786d4d4591a698ac7aad6ba453
SHA1 1f82290b26c3063ff54601659de63c36bf849cf1
SHA512 6778a50d5f69eae50bdbcd4b999f3ebfb57150e95cafd5bc7357c06c07a4abb8904e81c157d7a7bca90eefca1cd3499fda344f5bc6c85390e1d9a950576917a0
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaorX:A3kMhT1LljU
TLSH
T16125AE13E79014F5E9178138C9A64A22EBB1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 942KB
SHA256 267b54cbd5cbc8a8e9ee75ba8ed1c5f66084cc7652735715986d3005d0c2d7d7
MD5 386383b3559e992c6e793a8b1d2de2d8
SHA1 3a2901ca09573fa188e818e31854840d70817451
SHA512 711a2e2500f25744638d6d2e134afc6a055bc9494dd2275fba61344bc20216c9efe260c40d215894c9b8318bd647a76b960b9a2cf20e0a466d6e4e6bcc7513d0
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHao5L:A3kMhT1Llju
TLSH
T1AB25AE13E7A014F5E9178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 942KB
SHA256 0e76e4bc24f5fec968118e91b127f8bee753270e59d1df81f4f76c56ee761a3a
MD5 971119328bb3f7356a87e4233eb020da
SHA1 ceba3a6481e8918bb92db2cc2a9baba7379ae736
SHA512 b5d608c2a9189babfe6fe0285081c5078746d7f27fe8365f302cd54ccbb67de9af0d439e0ec79d7f4360b043ff3a0f6d7fe07abdc89d82d98ba64a02f5ec9e53
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaonM:A3kMhT1Lljb
TLSH
T16225AE13E7A014F5E9178138C9A64A22E7B1BC661770C7DF136852262F337D06E3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 942KB
SHA256 78a39448629ed053724b60209e745bae6aa47a0ffd3a66996d797262bd0ef682
MD5 be0321b8897f2d514d22ab59e5153191
SHA1 2f21a6078362aaeb07d8477e84063fe2f675650a
SHA512 d0b8310e6f345af7031f8e71d8811d8b2fef6feb9015a8ca32c162bd14e2551121293e887cd7986e045efd65cfcc915ec267c87ba7e8645dd14e080c09097759
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpxDSEHaoQh:A3kMhT1LljV
TLSH
T19B25AE13E7A014F5E9178138C9A64A22E7B1BC661770C6DF136852262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4132-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4132-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5296-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads