Analysis

  • max time kernel
    118s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 17:16

General

  • Target
    2026-08-10_823a836e9b1ee165918338026442e1bf_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
  • Size 667KB
  • Sample260810-vtmd6stera
  • SHA256 76c87a672b913e0dc037d9c342852324f8475e4698dcbe43423ab96e5a994cba
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Detects executables packed with ASPack 50 IoCs
  • ASPack v2.12-2.42 47 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NTFS ADS 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_823a836e9b1ee165918338026442e1bf_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_823a836e9b1ee165918338026442e1bf_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:6112
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:2912

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe

        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 667KB
        • SHA256 76c87a672b913e0dc037d9c342852324f8475e4698dcbe43423ab96e5a994cba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7z.exe$

        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 1.2MB
        • SHA256 ebb3cb46e4ae00e12e6df8264ade28b7d271a4dc1336422848a5f753414dd802
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 682KB
        • SHA256 8f12900320c9cbf7b937734bd713a9d89bb17e50515d295ad2d8e3a6e8bc6974
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 715KB
        • SHA256 ff8d43bc51ccbc4b8bb302fd1860f6afac9b190865255f0d90f0b1da4fa0bcae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 691KB
        • SHA256 542e747db45c9ac09581c37aa745e98c6eda873e514dca296448dff2cc2251e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 691KB
        • SHA256 3e723bfec4c15ed8a3d708c9d97e59ad52a9d7caf0e765e0bd77672579ad7b60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 691KB
        • SHA256 895f56504edbea63c317d43b7c5444bd0f505b136494dd1b45855262c3ba92cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 829KB
        • SHA256 af0b37f2c402ff435da9140fbbccae9514d9d216a0bf619c65e5ff17cb804e62
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 691KB
        • SHA256 6bdf65159d1f8acb872ae3bea9bcd0ae4dc5d864245c197194aafc54f2574f06
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 691KB
        • SHA256 59dd9087cc5c897e4b2d62ff402601ef62294503a50a15ab5f9fef5fab88c76e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 829KB
        • SHA256 ff71f8fb197a5efb5b2afca5719df830c2b1ec707b3f715ee4547a47edc3350d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 953KB
        • SHA256 a52648b160f748112233cc784292ee9eac4a4e508fd19b5f5b600c816cf9b26d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 691KB
        • SHA256 57d02a1f4ba1f7e372484d52e7e17aa2e2661d83ac3e28a2ce49d254338e8049
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 691KB
        • SHA256 fa3a31ba476e0d0314b27ac61c68f3dae01f46105ea2de56ddbf545e4d679de8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 691KB
        • SHA256 ce961333f7f4874a8be24c15b56bc1b074a95e3244414b568e528e1b70545ac7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 691KB
        • SHA256 3eeea7b6369119dcb4b84c4c30c7c902af7eb721b703e474cd42f893d5f8bfcf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 691KB
        • SHA256 efab5748145b68b2e8a86996f3eec948c031a48736cc045126f6b33bde6e0933
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 691KB
        • SHA256 d72f114e082a451ea48fa308c5a41b365510fba22959de49b11b4efb21b1e9ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 691KB
        • SHA256 bd580de5a45f6978fdb18aba758901c391898f1dc12b19bd7f37f0c76004e2a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 691KB
        • SHA256 1e7233cb54bddaac828356f2fcc14363861ce648f2365c15a7324a00624db1a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 691KB
        • SHA256 6f418e89f2733ad5699611d7e8e17fb57bb42abad7c0ad2077c4fbaffa0ed08d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 691KB
        • SHA256 a4ce95190d0e0d00b99a14c889a3d78e56f2d5064e01ce4de25e937286259ad5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 691KB
        • SHA256 60a3ff72f76951b4a529ebf0a88693bbc0eff2f57f288534dae6590545d4a20e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 691KB
        • SHA256 1a0009364206ba9ff6d0c3cca22ebd3e497f49c77b8e0969f1b65483a317dcbd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 691KB
        • SHA256 87ccaeeec399769beb5880397278fcf8608006ac3b6db0baa64f4294adf4ac7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 691KB
        • SHA256 a8452ee961a84a67b07c81b78ad0f308b51ff5f6ef68ea9b8087d164f49e3352
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 691KB
        • SHA256 9f34096c4c8fc4155fdc619d468551fc7d97db7e886f4725326f3f73d86e7fef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 691KB
        • SHA256 4604e6f721ef50e8a89d0af65d6fb5b7eec6b63047c35dc42e13c05b5b53721a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 691KB
        • SHA256 7b95c742027ed06c78abaeeba206ef6eb933a31c32d149decbf5440e8518f61f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 691KB
        • SHA256 4e85f1dcaae73b92c1689d2b547c761c00590432156a14ae3715ac3ca0cd9854
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 691KB
        • SHA256 b4c7331e50a1c4bc06702d3b2069ff01a5a3ba08a7d7768ba775f2fed6683a30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 691KB
        • SHA256 03dd19f6a88e915fb61ca64a7469e0f09f63807cd5371b6b3f7a5b1e858e2162
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 691KB
        • SHA256 b1fb3bf1c69b6894fd80ec107818090cbeb9ab57545ad54871361d0db841ff76
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 691KB
        • SHA256 a52dfa0b23bb101699e2ff94b4dfb4aa4e26d9c986a50029ab4624eda672d542
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 691KB
        • SHA256 d80c31ca610cebda3e6797fb60b907f09e751c8129e7feebd4c902a52fbc0730
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 691KB
        • SHA256 0de3a3c7c9379e55065dc125e669d3661f17f065a0bf2f76e4e53d6bd49c774e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 691KB
        • SHA256 1b962ab3a86451a85e74ae85ccbb29314bcc82ef2c73c2ce7d374a92cf1d9294
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 691KB
        • SHA256 95efe0f6213424b9293fd5f6756bae302a960aad571010f7eeaca3b2a10af0be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 691KB
        • SHA256 73ae865cff901dfc9d97447046c4cc5da0b9161a4a3a57ac3b5f009128092f56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 691KB
        • SHA256 d5e90b8ea36b6084a3ab450b261f2b61fa9f2fd8391dd9708c09892c35ea8c7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 691KB
        • SHA256 8d612ccb0083b7664d2d96201da3bd2637a9dd96b4c5526627e7ca40034abf6f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unpack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 888KB
        • SHA256 ed37287589cee17593ee843f9bb473b14c10568d8500518e194b23eb67034e27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsgen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 691KB
        • SHA256 48c6765a4c71852eecc31600ac3f9014e9aa91d57c7fe19f638eec72dc107dd4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsimport.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 691KB
        • SHA256 7916d7b41157be38579a8c23d83096bafcdafe36834dde5d665db68becfd6111
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xjc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 691KB
        • SHA256 798e49e7a5a191bbc4052224f81bc346b4b7e0e3895edd15f5185ce09af8ce08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDriveSetup.exe

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
        • Size 920KB
        • SHA256 89cc70af93a02d080a2363a5cec3b99e3f04d294c8270ddf48d510e9d35e85d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SMSvcHost.exe

        • Path C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe
        • Size 796KB
        • SHA256 301675580690a75a5d094b3c5da6da3c32d44a9a224835f8577fafbc77ae081e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2912-22-0x0000000000400000-0x000000000040F000-memory.dmp

        memory/6112-15-0x0000000000400000-0x000000000040F000-memory.dmp

        memory/6112-0-0x0000000000400000-0x000000000040F000-memory.dmp