9bc83fa3e98c1459622428cd68b9f6b7541a58bf484dce6c4fd27aef2e16f3aa

Analysis

max time kernel
102s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 865KB
Sample260811-15bppsdr61
SHA256 9bc83fa3e98c1459622428cd68b9f6b7541a58bf484dce6c4fd27aef2e16f3aa
MD5 d106d9234faefb4b909bd1c8a70df4ca
SHA1 2168012e86243c3d50ef0a5526300876a83197f4
SHA512 2a12ee19e456106d146db5ebd38fd7d28473eccfa4f3aa2ef2f680f2ba00735eca6fa04701ed6bdb8484a97ce0d0de752dd9d1d5dcdc79a3b322056bebcca213
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobc:A3kMhT1Lljj
TLSH
T11E15AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136456262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2440-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c503-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2440-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5148-83-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982b-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bc-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-508.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-717.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-878.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1086.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1160.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1243.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c503-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e6-39.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a3e-222.dat	aspack_v212_v242
behavioral2/files/0x000400000001982b-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bb-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bc-489.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-508.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-625.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-717.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-878.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1086.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1160.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1243.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1341.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1366.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5148	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2440	2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
5148	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_d106d9234faefb4b909bd1c8a70df4ca_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2440

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 865KB
SHA256 9bc83fa3e98c1459622428cd68b9f6b7541a58bf484dce6c4fd27aef2e16f3aa
MD5 d106d9234faefb4b909bd1c8a70df4ca
SHA1 2168012e86243c3d50ef0a5526300876a83197f4
SHA512 2a12ee19e456106d146db5ebd38fd7d28473eccfa4f3aa2ef2f680f2ba00735eca6fa04701ed6bdb8484a97ce0d0de752dd9d1d5dcdc79a3b322056bebcca213
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobc:A3kMhT1Lljj
TLSH
T11E15AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136456262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 4c520456bbab3e3ce3e29b1515c61ad104f66233e193d7b1fecd1c99147a894b
MD5 3196c93fab1325c1cc6438e91e42a94d
SHA1 67a66f3161eb32c31759d2e63410f03efe277d1a
SHA512 52f64cffab9869f129ada5f0349d429d1af5c9f739b7d367c196fd4203a3dffa10bc33445e97103b480620d4135af8c2a25f5094f1501857f8979feb731f4373
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobk0Le5ji0hmxNrM:A3kMhT1LljfPji0Aj
TLSH
T10A658D16F6B446B5D073C179C9E29A5AEB7238420730CACF039497692F337E19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 879KB
SHA256 960333d9cab78ac3de4d8c8d509cf308895cc5cbf78560cf8718f8fed23ce824
MD5 3cfa318275992b5386c3843c06cd5a0f
SHA1 5413f08cb4f0fefbd1c2f62f1eca7a93a27212bc
SHA512 a741973836947c53edd7ada9cab35abd6368546c7f844af38a91cfaacf5e4bff4f8000db3be4a8580144196d5a1e62eaf182de6c0f2879973f9218c45a7ad769
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobOa:A3kMhT1Llj
TLSH
T15C15AF13E79014F4E96B813989A64A12E7B1BC260770C7DF136467262F337D0AE3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 889KB
SHA256 df7b578d90d1568c0308f5ca1adef69c5d4038f5dd4cfebc5d6bf95636d3d2be
MD5 03f4650a66164b288122a9b27d4cf056
SHA1 c6d22fec8b2bb8a7b913647bedf7dc0e08d57a79
SHA512 d51b78be2bc63f8842437395b0efcabd512f14929841b4c6b09140a54b7f4e6cdab365449517de5006d32d8f0c5f1cb5304505c40f9277e320ae7719ba413775
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobv6:A3kMhT1Lljn
TLSH
T10815AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 889KB
SHA256 41b9049995504236ec51103030452429db51ae95ba7cde4a8841e885317bd925
MD5 84bf8aa6133520e9f8764b48f47ea1a0
SHA1 29b713bc0e07a69db3fbb0f402f6801f9cea8410
SHA512 d3e961df676a35a3bb489a4c0d4c634519d0d65e17b76cc38f94783ea0c036de44dbbfb2bb029576504521fa676b6b18863730a73c494a0003ac8ce46a8e12fd
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobxN:A3kMhT1Llj6
TLSH
T10A15AF13E79014F8E967813989A64A12EBB1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 889KB
SHA256 2e902fcbb1776c4a31795331644f2f31def03f2f442fc2926949e5a457510828
MD5 c42f97e1bf80b5cc14931113ed8e300c
SHA1 70895e7f801de8edaf99f241cbd73656615b3b83
SHA512 bfd0af1cc73e08c266d16205c4ad04766660d642b7af6dc86f1e69896e894fb2cabcfcde19aa6ca67e5b8140ba21e89174c3a5f5dc6006816c2aeeeb99fc3fd2
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobnf:A3kMhT1Llj2
TLSH
T1F015AF13E79014F8E967813989A64A12EBB1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 889KB
SHA256 19444c8afd4f0bf1f1c4b82803366b96c82a8c6f1b14375da56e5b6d24861b33
MD5 7fe09c6a4d6c2a39e589fee998135926
SHA1 96378823308a48c46d729646da2bf8f8f1a165fd
SHA512 7a9fd59f46f50c171003a33808cec36efc73d1afeab3b99057540876907f14533f64fd99588d911549c9e17f39e21c2b2c0bf1419c68df6c1dc41d15ad1e8114
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobpo:A3kMhT1LljX
TLSH
T1B415AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 889KB
SHA256 db07c48d21c0cbe5a003229842cd4344047f29f8e00dc96b260ee41eb9e43c3f
MD5 5982735221eeac3a8e7482c013fc7320
SHA1 adb2ba226409b348d72f853db171bd11f73251a7
SHA512 59e3e222cdecedd57ed28badfee2e3aefbdb18fb6a712c2022fb48f2a63142ab622dfa0393aa01c3b70122eb5dc382eb662f029631cd1429220318cbc39d8dd5
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobZu:A3kMhT1LljZ
TLSH
T1E815AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 889KB
SHA256 90762df464293401b19cbd2c0608db11226e2eb9e62330caaa764193fb4f5c83
MD5 22fe050f1fa5c7341ad6cc49d4946471
SHA1 186fe82f0b13065871a56f685c30ef7a3c454093
SHA512 372ebef7d754819946fd15ec4269bc0408a4608a0343699d05c958b70085ee932774a3e040c8c6da0e38cf68bbc1aaf9a7aa178853fa5701b5e617d8a803fad4
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaob/9:A3kMhT1LljU
TLSH
T13C15AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 889KB
SHA256 687e5dfe0e48e4388ac3cf2d34e15e389eb7f53a92e39928e0d3c665835c50a3
MD5 092dff26b78b23c54bfc013687c5da9f
SHA1 1f267932ba63b0144ae3f6a3016ac713385dbdd2
SHA512 128b683a145f38d38453a1d4187d45e6c0ace5c474acc85d02cafd123e3bcd2ee69247b7a41537beafa00cc3772ab1e3f99d898525b7d581cb5d27cc1e4c1c05
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobbc:A3kMhT1Llj9
TLSH
T1A715BF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 889KB
SHA256 1d78b1da6a3c6fbc007860405baa819c3bd55d984510403a6159ec9204a14abe
MD5 ddb77206c19bdb2e85870d142897392b
SHA1 a1b532b57407433a81b28b5735b240ca262055fa
SHA512 27ae22f5e86b4c2faf8a7b3424e3d6e9a1890e6f5914092c8356efde53ee2282efbd28e6d1a1c591c4983a29e81723dcd5933f33118b13a9ebb5ec64916e1d84
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobEp:A3kMhT1Lljj
TLSH
T10B15AF13E79014F8E967813989A64A12EBB1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 889KB
SHA256 dbebb7e1059218591d1cb8a2ca77f19bd6ea9325b3d424561925b9d578b3e38c
MD5 b4041884458eecfb7069b7077dea4b46
SHA1 d1e4cdae490582071fb93aaa56bbe5b18c8aca05
SHA512 1120c1466f4a6354d3f72d77b13a205e4db40a2b4e4eedd742c61a0c488be8abc2f9544df6b739a1531340da28ff9a48e5023b56007e5ec2f2f6fe3ce2d1cc5f
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobLN:A3kMhT1LljY
TLSH
T14C15AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 889KB
SHA256 64e018b61c6481fabe93226c706c0c4cbd8f2ac33cc3496ab4f813d83f39d7d9
MD5 23a1f7e6c57efaa613f00530db03489d
SHA1 55f7d6949332cdd4df881f99e39626545e8d7be4
SHA512 7fc04e5f8316560249bc66ba0720cebe1e967cca13b5c883b975fa19fbb37d083b563ef29cf957e608c2721866f77a86a3c54164551e43edd59d3558dbe5eb74
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobZF:A3kMhT1Llju
TLSH
T18B15BF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 889KB
SHA256 dd1e8f8023f6a95e04675ae027338ae30ece64a73b623efed2ddb89d559301eb
MD5 fe09cf5e7fd67a712bf09568010759e6
SHA1 38b296c52990927f3199fb6eca7c082bfda637f6
SHA512 fe361748a0840ab6130e67cf2a16913a381d54887a4820f4d48d772c92c17096bcacc815ea52339a9c0157eb78e2880df81b380b6df1bb2511115197e061124b
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobyC:A3kMhT1LljK
TLSH
T12115AF13E79014F8E967813989A64A12EBB1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 889KB
SHA256 5ba76343501c20d5624061e4f4158447935947878e9442ab3a87c188c2713680
MD5 b4f3c8ef39f273cf478742e58d8de9ac
SHA1 d329037158d60e4f15e0745fbd873dad97b7d6f9
SHA512 c894b31bd9b868ca66a8c86ee3d9cdeec46a88f105543cf9eae1741f48162e5bd0d76207c581e0e3bada388baf549bd40c740d1545297b049fc2e9455e7902d4
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobtw:A3kMhT1Lljf
TLSH
T17215AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 889KB
SHA256 9946288be14d4ad226398ae24255fb4cc7d1bc45f68192def2b1d9a7bdf52dd2
MD5 601e77a5062fcfda997f99df6483b338
SHA1 db60920966c16ff6f4eaa0accdc85b67c9cf58d3
SHA512 dc11c95036b565d040fbb06aa0d6c36e6f2826c914e7137472f5c96dc05a1f5ea994896dd2f5fca353f7d46ba3bc9d84e6605d290e16e69d453fa75bdd322f01
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobcT:A3kMhT1Llj7
TLSH
T1BE15AF13E79014F8E967813989A64A12EBB1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 889KB
SHA256 321511bdf92410a31bfbebf378b4bf367e12af31a14bf7b5dc14583cfbec74c4
MD5 a8c674de00eaee3afdfb3f246ff05c91
SHA1 b9994c927b3a845678cf778bc05130760a1140c1
SHA512 71452584b9de76f84a8d6a0c713a0e2fc91b1c19eb1bb7e411e71f82d1898ee80b4b06aefc115e8b286c9242c5d4f6fb65ab3f5e783fa8ca1a2d88dbd37b6721
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobwu:A3kMhT1Llj8
TLSH
T14415AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 889KB
SHA256 d81fb0a2ad77bd804e5ddab8c523bebf09636326db99f0c4a7dfa45fe34aca5e
MD5 e66ac7f35827cf5a93409165eadc53e0
SHA1 0cee63a60af38e80948f359b2a83276b78ef542b
SHA512 6d9e92903d34e0122d824154978e96bead09fce80056508dfcb8cdf58be7f4e744bad1d61632b09b1c06e0c305b2b1fd3e959e8fea4c0845db7c665adac77ab7
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobOb:A3kMhT1LljV
TLSH
T1D215AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 889KB
SHA256 8499aa9c3a357061cdf2aed35710c5b7738060827b9b83b1647f925236ad0267
MD5 ce00e74efa8f4c4b0d51a4c64c511c59
SHA1 d3be22a3eeb3f5609a4ab923897d40ce770cabee
SHA512 c991d9d46f925a82197862db39247516257fc924ca386f069d468bc2cac771f8a3869f609e9dca92d41045f5db6bffe8f7ec7212664dc847e0630dce700efe5e
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaob4f:A3kMhT1LljV
TLSH
T12515AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 889KB
SHA256 3141556b3da8bd28eee4bcc944d2a127f230160bd97201c14a87f1d8e9dd0164
MD5 6618a1cb8a00e66cdfa69c5dc6ef26f4
SHA1 5e228c3f26ff144e3d0afe0ffbc5701f33faeedd
SHA512 eab259f7c40d6776bab86630ea1030c272eb39916dcd3b691a5a3de72ffc85d30ca301df653009473045f250e7b7e9f8779dec17396ed04751ca5cac0ff217f9
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaob1K:A3kMhT1LljN
TLSH
T17A15AF13E79014F8E967813989A54A12EBB1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 889KB
SHA256 4e28bf175f3177af493360897f641f408d73f0c75be59684561255338535465c
MD5 b00141a0e84e222003a6bfa4be71d104
SHA1 88ea7fae6767d3d4c75c9d599237c7bb328312e6
SHA512 b644afb56ceaec0cddb8e83cdcf88fd0d36d2262b08a1856e7b4bd139a1835a0ad445e577ceba82455ad478addeaf1287783b07c602adb720afea8c43f4fd05e
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaob2k:A3kMhT1Lljk
TLSH
T18815BF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 889KB
SHA256 3d10b2c9f8da72e37a8a1bce435ab8d48a75d6bfa38f8bce1e1b7d60d3917ba7
MD5 bf033e8b79aea097c4016b6a452c90d2
SHA1 f7b41312c11173c3cc5cc7b5e4659b42e70b5874
SHA512 988fb33e17f7829366d94b63cf7d61515bc76a80f433a66e4b1293685c84e4d5ffd3750336229184c5e5172643c76b513cb60312e571df9e91d85f272a7c4dcd
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobT0:A3kMhT1LljN
TLSH
T1B115BF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 889KB
SHA256 21fc76a2e0c028317ba5f53cc43201dea6c64b351b4c17ad8a9f1a177f74b82e
MD5 cfd23d68e93ff3e19b56f0813fe1ce7e
SHA1 487d13737549ed14954922041b68b4c1fb9c9d11
SHA512 272d5de7de2ed120f2da19110c6e97b2c6724be0dcf930ffc841fe3cc67bc2bebd6c7023e01227634e35b58494ee4861e8c18fd179598ec5c71c2f666b213e6c
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobig:A3kMhT1Llj8
TLSH
T17A15AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 889KB
SHA256 50c7ead1f798c381a7c9f82e01b9694e33f664133f00b1770523b7cebf6be350
MD5 bdc320c7bd50a1d2b9a96a4582e6086c
SHA1 0de69ef4fa59c98a4f9be7a247a457aa5124b3d2
SHA512 55edb5f44866a36fa15c878059c32557374e2027e3590a81d411b9dac7877fab7691ed106b76e587d3ed828a4a335268a760dd593dbf766d9bfe249b77dd3bb2
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobDr:A3kMhT1LljO
TLSH
T10115AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 889KB
SHA256 321fa93ec960c306fdb740a2f80b3f711890c2b72254d0d1c5a45f92e325474f
MD5 48f5287963dbea44956f92a41a5b57c7
SHA1 937a90d5198f8d0f164d735aaeaf946352344038
SHA512 d41117dbd5325275fbcf08edf8d1e794c24bada66d5decf1da1e6358208fe7140f66f98cebac31df9392aaec3f5b5df43c06ad4448ca8b255d5677847f3e4f57
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobln:A3kMhT1Llj4
TLSH
T19C15AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 889KB
SHA256 672e41ffcbb3df0042d8c8583eacee32059a96c1ed96c504b167612c6f58b0ed
MD5 8a26b71041d81b87f5017d0194d9493a
SHA1 44b1c2c787cdba57c3d9aab244b1a61f1d74d6ac
SHA512 e5674e019d0bb0091edea3fac9e08a467da60d24e75a39df6bde500f67c981ea63e8a2ca28da31b70cbd8945d60792667fef0f6c4cdeb9ccf59f1e720dd08c66
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobRx:A3kMhT1Llju
TLSH
T1C515AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 889KB
SHA256 a36afd14f551b4133b166449568923bc40544d59313cd59758ee31a1cd331fc8
MD5 f6d33db9be27a348d18d6b45cd6949a7
SHA1 b2c34c2746dbb2ce90e0d429cd9f06750dde9483
SHA512 ff95a38e8151f1cac1ea06c1becd3546b021d254fe69cad213ad6bf041deb833d2a5be493fe34e93bd164594da2bd540e5c991a50176109849091f0551841ed1
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaob/A:A3kMhT1Lljl
TLSH
T14A15AE13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 889KB
SHA256 c4fa8250fc4d9e94bce9d918d1162e739cf51f1f6ae11c16d4566af890fe84e1
MD5 1f0820f84aa8ba67c01ce107a209b5e4
SHA1 4cd306e4410b5bc7413ba503fb2464296f196942
SHA512 7e0b48703b6690a728c31dda96ef1457fdcefcb1c7a6f1f0969d84cfefe8d92b7ccc7c04bb1086aeab93a1db52de3a21fdc94e2d34aae2dc3cb84e32a2182156
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobQ9Q:A3kMhT1LljE
TLSH
T1C415AF13E79014F8E927813989A64A12EBB1BC660770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 889KB
SHA256 5c632a537eb01c9ee4002f492e9deea8a74cc814bc754b0dd3c596ed8aab65be
MD5 d5a6947ef18dd878146de793197ed37b
SHA1 378043b684530334558c0d9559b388534f611eb7
SHA512 5089cd88d22c7a5780c0b9727b12e755e1d7ff0b9d4af0450816853e9fcd1eeb3ec4fbd442694cf0c74c58b90e638dd8d80dd11e4e0a123f9d91b52ab453d309
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobx4:A3kMhT1Lljv
TLSH
T16E15AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 889KB
SHA256 09e5c639224b3cb1a3fd90a7467d2a8c47864a9988e526e5ed8c4acd333e479c
MD5 46504302f4d447389fabefb0587d0651
SHA1 201f6b786c09bbf7721a2965888b24dc5573cf09
SHA512 319d3efce2f44c1ef49dbcf73d2777538910ed3d1624dc693b794bb25a2dae77064146c208e4b26670a75c800d19c74b9a2f71885dfc293c2ea0c9b5b75ce2dd
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaob0u:A3kMhT1Llji
TLSH
T1C915AF13E79014F8E967813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 889KB
SHA256 8c536526293fceded0f34b1245fee3ec5549233d5f7d688dd69a0303facbe36f
MD5 e9af38171713bb037f4e3a5c55a3f6b5
SHA1 9e0603d239e6aa0640c747f050318d77b16ba460
SHA512 e98f22d964eef7d387c454d1a3426e46bdf0d6c89f452887dd8aeb51b62df79b1d0b5686bfb7e49b11fb43fa47723f266431bd8551fddacf3013613625f84c95
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobFj:A3kMhT1Llj8
TLSH
T19115AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 889KB
SHA256 59f8380e1755f3b153676062df14fa97a55d7545fe55526eb113745012b3aef5
MD5 bd5006d6b0bfba2d373c67a63b266779
SHA1 c75460733af8c5381ac24b96af5825b9cc3f3130
SHA512 6b32396ec62380deaae244cb86c68105a80ba563f053f896c9be45258137ae3a2605f9e1da155a8ce4ee402376a1ae1919713ebd465b987370b775cd6088f9d7
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobMg:A3kMhT1Llj0
TLSH
T19715AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 889KB
SHA256 81038de91761185e4feeedaace3d3a02d50bba0ce3778bfda209bd5a849da573
MD5 e99b9413865766045ca10a19160cd659
SHA1 7603a44ce372bf547f402ffe890bf716f1dcb549
SHA512 409e0afbc44d1afa84f9de07e71838e7d61212f3d840ab4871dfc593dfbffd21ff890b1f847ddf864782dd4f4d460c5b5642a36c30ffcf8c182850ee4e709fce
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobTI:A3kMhT1Llj9
TLSH
T19D15AE13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 889KB
SHA256 bb26901cf8acca8528a9c6bf18178468003ac6d87953d0c8e8e522a0c94cfc77
MD5 b38a346d30be9aa3ff29f2bbc87e1f84
SHA1 392a39997c7715cb0fa3af7eb528bdaf3e8e4b23
SHA512 6ed8f463a8780fe66a07640b48c8c6c7d698e97903a6af5575d0ebaf1bb080b5b35d04e8a80333f69dbd1cfc22c0b34854cecb0a068b84ac1a8245315eac3f3d
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobpo:A3kMhT1Lljb
TLSH
T10615AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 889KB
SHA256 51c4819b39c9765abd64bfdade9389dd151b1d4a1bc89ad5579750676b75e39f
MD5 29d27b9ebfdab7871c69a7cf8ad7d572
SHA1 1f8e550e30435bc1bb8b3f27b688447207152a82
SHA512 9004ad090996fa4c4efdda800633dad21c68bb2ad14ec4eaac82cb804147f5fc8db37154870cfb3fddcaf4fbbf3dc586a54ad7b80d7dfd7bd2ceaaa47be1f672
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaoba+:A3kMhT1Llj+
TLSH
T1B915AE13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 889KB
SHA256 57d5e33129f4d7c8c781ec41eaa9db2969fca0b72e943a20ebf3d725c625148b
MD5 dd87c07ea5e888bd1cd42012979d41cb
SHA1 1fc6b283c27630fd8b0a26b0764643581a231c15
SHA512 251a583052bd2ae14ba4ccdc0b7835572ff4f45523bd2fdffcbddb02bc45256d40fb29ad745f6c187ba2326d1842331b708fdc4b3b17f3e935cc7d11250e97eb
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobaQ:A3kMhT1Lljq
TLSH
T1F015AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 889KB
SHA256 d06bae17f032858006ae08f8ce0a33c2da85b86a6c17a59283336ce5660730e7
MD5 225539456507486085a4df7a4fd15db8
SHA1 fd10cb706148d96db4908eaaf0b31e866d60bc38
SHA512 51ac029369189d49483b8ad2acfb9ed2509c2e0baa633b6f2c375d174ff0727f0172fe813a83dd5cc6b7490dc8a5277eabda6d91e6ba0bf944957b2070942e6d
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobrX:A3kMhT1Llj6
TLSH
T11F15BF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 889KB
SHA256 4fee2dc5436b15123cedfdcccba64a4d746a27e334d9d12b99cbdd0b6ae4767d
MD5 b3bae39fdf80b5a3efebc943f7c38ad0
SHA1 1686737e8411f805890aa2a86e312ed2a0fb5f1a
SHA512 49366df3324eafb9c56805b7a3b5f0ec3cf1fd1d38dbada6b6fbd084784f680ae002c18314c6cf8be88153939501720e491fc7473e91cfaeff71dbca7feb97f1
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaob5L:A3kMhT1LljU
TLSH
T1D015AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 889KB
SHA256 133df06f360649ebc0ba803a7ac67e7567d20f728ad7c12dbaa5606a83fc314c
MD5 c2bf8f6acdfa5164b6c04f92af364444
SHA1 5715fe84049b52ca4a0859c840f5a654a6d51051
SHA512 cf7435b1e9058e35a7c5c88f669b3e492ff2f4fc58bfee2797eb82846f923254074de9887832ef7ceffa13d4153f159e4f7a2c517b78df2c8ba74c6597b0e5f2
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobnM:A3kMhT1Llj1
TLSH
T1C315AF13E79014F9E92B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 889KB
SHA256 93a017e17676d6dd9a4089dd2c996f2835e756c139ed0af926afe0d81c593eb2
MD5 d065de2a32a3f54743f123de8f8c0300
SHA1 95b42393a94a55e9439b1c1d862ea67c2dc1bc82
SHA512 884489e9672e17cc2f77f621e5b2395858eb055416270c72eff75ec71eb4d59542172569b6c80dad92c6c9373425e50ecab89fd19bc0d2d84bb9d8f09662828c
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpG1baRaobQh:A3kMhT1LljP
TLSH
T11215AF13E79014F8E96B813989A64A12E7B1BC260770C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2440-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2440-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5148-83-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads