e2b3425af348e05a1d5ee7172be5c4e9c19353048ee78365d756f57d00dd5276

Analysis

max time kernel
94s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 912KB
Sample260811-2xrlmateqe
SHA256 e2b3425af348e05a1d5ee7172be5c4e9c19353048ee78365d756f57d00dd5276
MD5 318b4c885384238701a7c56c6c373f65
SHA1 48185a187c54e32cbac654ccf13929acdaa39552
SHA512 8047d0737afe382bb51ceb4852393363e1e92bc2543f8838dde81142d9f04e5ef19e0a4bce15ed8e1bbd1857271cc0e1210a617984a3f6015a4e3b63acc46b49
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qN:A3kMhT1Lljz
TLSH
T10515AE13E79014F8E9178138C9A64A22EBB1BC660760C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/4644-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4e3-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4644-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3360-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-679.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-777.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1079.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1153.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1240.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1396.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4e3-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-57.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-234.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-259.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-440.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-495.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-574.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-617.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-679.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-729.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-777.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-797.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-852.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-871.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-884.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-891.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-910.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-929.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-949.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1005.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1048.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1079.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1134.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1153.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1172.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1179.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1240.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1326.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1346.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1396.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3360	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4644	2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
3360	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_318b4c885384238701a7c56c6c373f65_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4644

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 912KB
SHA256 e2b3425af348e05a1d5ee7172be5c4e9c19353048ee78365d756f57d00dd5276
MD5 318b4c885384238701a7c56c6c373f65
SHA1 48185a187c54e32cbac654ccf13929acdaa39552
SHA512 8047d0737afe382bb51ceb4852393363e1e92bc2543f8838dde81142d9f04e5ef19e0a4bce15ed8e1bbd1857271cc0e1210a617984a3f6015a4e3b63acc46b49
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qN:A3kMhT1Lljz
TLSH
T10515AE13E79014F8E9178138C9A64A22EBB1BC660760C7DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 edf339b3a9319ec242cf0756bca77c3f38a8b3994ec12d645b1061b50ed51774
MD5 2bb105be7606dfc5166f0e09b268a1f6
SHA1 88735d8ac2de658841cbf4fd6082f20499a80db2
SHA512 65ac2a799ea610a5dbfda9b216697c207d91bfa3fffda93f24dc148b27ace299f0c2421279d259f05dd9d20aa55f534539666e7282acca6b491d80bd428985db
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qZ0Le5ji0hmxNrM:A3kMhT1LljvPji0Aj
TLSH
T171658D16F6B406B5D073C179C9D29A5AEA7238421B30CACF1394D7292F337E19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 927KB
SHA256 47fa0ac2b227bf14ed36ef5e186129bafeb7120d5a12179cb05113ec07b22b8f
MD5 354c6222717c331350b64e43766cbf0f
SHA1 9bde52c95445fc91aa1f377a8f0feac5904f256f
SHA512 d70a4ac2634d82ca4ebef02a5a49a31af3afb94e7c28b2efca3252f25c2d1cc852c532ee23b48b38a576f19799bef6525d297e0231f7341840cc53141bed6087
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qLa:A3kMhT1Llj
TLSH
T13615AE13E79014F8E927813899A64A12EBB1BC660760C7DF136857262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 936KB
SHA256 0b036469ca0dddac8fb25eb211c3304bad8cc77f53726955a45b8998435e59c1
MD5 23d40690d2d0a318ee246f245d8ac3e4
SHA1 87823341a78e7358156447b0da86e7e9473e0613
SHA512 1686cdd067d29b8c96cbeba07c4ea70da6c8f460f8c2f071c8da036b430d2a97f9f8d5a6a04029bb93ed7a577e2a921ec09faa217148a83bbedcaa9b1c401618
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qK6:A3kMhT1Llj3
TLSH
T1E215BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 936KB
SHA256 81072715b683d54f299c7acc53ffaec493e3290dc327ea654bd699f77cf205f5
MD5 c431f1370f3b73e0bf41d0d8d9046e43
SHA1 ba86df8c935fb9f90db9cfbf9c605aa8f7b6a176
SHA512 f34f3729712ac4dda793b9b99e9995a5f7f23a46f310231defd41886bec4a966810170343533d4241ac203f5e7c30b9b7b41f7f9e95b999ab00e4edc39266253
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qyo:A3kMhT1LljH
TLSH
T16C15BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 936KB
SHA256 ebee21396cf25cc118c3fba4bd6ecf84d8cf14c210715edd9577631bced657f6
MD5 bb4e9e6e1c93f541b333a05df5732473
SHA1 f28ee685550b6ee8b19ba0e8a071d87524bd650b
SHA512 9bb234b4daca6f603819ed8f1e012dcb280ca92089ced608abbd74d1a6d96f8651e27deeb903c725107103f83b691053acfdfd945e579fec24b0aa7a0a5772f6
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qmu:A3kMhT1Lljp
TLSH
T12715BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 936KB
SHA256 345458bae4b1bf7460b7316bea770d25e4f583e8aca0538c042d9e1b232cf7ef
MD5 e8ac86838fc41ebed79b9048bc4b7242
SHA1 a41e32d5144a71b2711208239a1bd24e3de4f4df
SHA512 80ba2bc13e17a876a4a27ac3a2014b62feb8715bcfe8173c75302ae1c2b57543e9822374fc013a2de42b5328a2b80cec06eecc0ecb282dc00a99509d6e2eeeae
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qa9:A3kMhT1LljE
TLSH
T15315BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 936KB
SHA256 4b68256a20b94d831638231f149e27948985067afd4f4969bd36d5dd92a17952
MD5 92e23ffd948efd41b66fe268df25db9d
SHA1 4d1ee41d5442df6edc3779cc744130af4cda9e12
SHA512 25a748664623a446cb098217d73ff22779e8ac8fddfaa600baec4e1a207ac93be569e43172225a8287ffe5f087d1b9b6e9c2f02dcc14f970a9c9079580c60fc3
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qac:A3kMhT1Lljt
TLSH
T10315BE13E79014F8E9178138D9A64A12EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 936KB
SHA256 48cf18bb931de987193d2c218d41a08b2da5eb712cd41c5119ad4f6a31759198
MD5 46b7bfd3ad22a3f92a519cdaa16bdc89
SHA1 481a06ef66b7cda22669568b2f00da09d5d307fc
SHA512 dd8510e8387f40e96569006f9df92bea4a0f9df44a06fa9b6468a2b0203186907d9c0a6ddad13bde0022fe15b97747aacc3396014579c8ada6b475579fccab67
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qTp:A3kMhT1Lljz
TLSH
T10715BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 936KB
SHA256 a5b2d142acb2d59502d78c688dd63eb2051d3bb3cc0177694ba4bd10a4e5b375
MD5 4ffb25a2580988c4cf4179e2683bece5
SHA1 df60cf4ce9ff55994e14d35228fa5491886edcc2
SHA512 0cd739497b58411b431a8f06eb372ebb7884192f37b12f79589b675e97e666cd5c577c556d4d6fca38bcebf76049a443d7ac1b25bef7cb9458f72ee0d35a30aa
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9q0N:A3kMhT1LljI
TLSH
T12015BF13E79014F8E9178138D9A64A12EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 936KB
SHA256 8468017d605a9765b4049349b4f8fbf6e3db94c1e238723082f5325ddbbc1921
MD5 e24415a615740de0fd1b8d39fd71fffa
SHA1 9c99efdd9de95d722e6edcafe54de869c0ea48be
SHA512 ab0ef652ee02eb233ed7748906d31213db8f90cad74f238fae76fbe0b468e5de7b6754c9dde263b5f4eab2f2d82ba2536dab2ca4b32792ee64d4fff094518d7c
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qcF:A3kMhT1Llje
TLSH
T1C115BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 936KB
SHA256 c7d03984fe8ee48624ac884bb73fa46e7643bbee1e9ea27f2f05b2dd374ac180
MD5 0075c29ad00ba079d67eda34b0de43ef
SHA1 c27a2faf5c3a7a28f6455c97801abbbdab4fc1ec
SHA512 5585f343abe0ef2e5baa9c334fdf62c41f1e118d752dc8de4ab5f708bc10b3f0b5201b15a0642c938a1d2d68ed390d44e65c66abf099be2b28de0af1f0f82ca8
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qJC:A3kMhT1Llj6
TLSH
T18B15BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 936KB
SHA256 5e192b8d1342011dc73ff43cf0414f82b9ebd16c833e46f2c599d88968416ad4
MD5 3c31173377c12d6baaca32c3fed28075
SHA1 a0830d14c4fea31f069f066f7f7ad9361ce39da4
SHA512 30312d1286de33fc406741f7ee9239ddfde8ccab65333881adcdf2b363816a1921631e882d7852c9ae3aa666347c1c7a49b3c2ef32f02fb3f602495c4df5bfb4
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qqw:A3kMhT1LljP
TLSH
T1BE15BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 936KB
SHA256 c3fd84d6f777d741ac476475a312a1470b8bc8b1883476ac7e0b686a1fa3481b
MD5 cb551ce3cf62a4f69a17774f5a57ec52
SHA1 3a5cef5b9670cec11c2e08ad9302f0ef574e1fb1
SHA512 28aa2996f3998a1373fe16bf8ba50deb423781a982800532184de30aa28ca50419f6a8d9efa62021483982fab5210f8e62eec0120ff4571bb7d46596370c839a
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qxT:A3kMhT1Lljr
TLSH
T1BA15BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 936KB
SHA256 86726b3e1bb57a4727510a49520a2f6c5a56b3b8df2905d878c87121f7cf1b6a
MD5 dba241872b8655f6d128a15acddf9387
SHA1 0c7cfcae98bdeed4eee421dbeab2697d4eb34569
SHA512 0445d2403d5136725ff93ca40726ef7c71a57bc48798e1d1baed8755b9b99245edd0a076714b87be162f16c7d294d10b547bb72415567abfab53ebfc97b300c6
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qfu:A3kMhT1Lljs
TLSH
T1BA15BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 936KB
SHA256 3645fd98b437601b8c8c982c093d5cd40b7a7cecbf397fcb04399bc31eca3063
MD5 1c600d8b6b36260073f658d218ed1550
SHA1 ee10422e79fbf1a0787053c92c2fc34db6317cbf
SHA512 396f17c1a7814e1f295daf0198704d50949978a28037636a3cee58715aae810459822679acb8ae94cdc7da22b8f04c92c4288be26385434e05cd4895694ff32d
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qDb:A3kMhT1LljF
TLSH
T16C15BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 936KB
SHA256 ac5c30cad8e8058aa24de5c4c6df3597c11503fc904dd8746146324909d0f46f
MD5 6167fb5b80f17accc90edef096b6a0ae
SHA1 626e9cb6516989316d31550e734df171fd99af85
SHA512 f312bd45886110db3c54fca07b1bfda48dbd266dca3c7b0006e1f95beb0f16a00ba792a03a96d48e065b6c8df58cec3d649b8acbc361f368bcb2b0fea7b87933
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qXf:A3kMhT1LljF
TLSH
T14415BF13E79004F9E9178138D9A54A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 936KB
SHA256 d1b7be6ea379b02df8d65f8729111e2f095d8cb60ef0d657ac51b235b6705701
MD5 f3fcede9413d3ab4dfebb0245e9315c2
SHA1 36e870eadcce606561a6abaee763fc8e587ddc71
SHA512 47f558a36819747a0c77d12f5de4e85129579671ed860fad6135dfb49eef8ff636228d440fd6cca22847f1610291034e32b9457949b79e324bec4808533c11ca
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qgK:A3kMhT1Llj9
TLSH
T17215BF13E79014F8E9178138D9A54A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 936KB
SHA256 018bfe4071771bebb4599cab7eef464e18886e2a1d14b4145e72c9ef00023518
MD5 d34b1ffbde7598092a899e463662449c
SHA1 b1b58c10f9c502090359421441b64774268352ab
SHA512 d7db056e26e5a86a98802d9af70dcdd836a21ac3d3c593763f6cccb6e16d0d3000df19aff0944f4bc995ffa0dd1a5ab2b80744fafbc9fa5af83aa516f7809393
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qdk:A3kMhT1LljU
TLSH
T11215BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 936KB
SHA256 8f22a78329d1c5a16525a0a16b5dc651c98488d90ca63f1d4ea675e3864d659f
MD5 dc94745d5853a877440a1d68689283c9
SHA1 2f94e7b601b143c002784d22cc0e6c2f9ef89550
SHA512 f964a28b6889bb402ebcf428fe246ee7c81183a74dca83ae89b3d913e6a6e9c68f67f8fe4334a55542a60ffef2f9dab941d31b936eb24b97cd99718deb5d6173
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qC0:A3kMhT1Lljd
TLSH
T1C315BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 936KB
SHA256 3a9c7ca6bedcfa9c7f8c3246a7342e28808b4667f97b93c91f8518802636b93a
MD5 6eaa501f9e187ad0ae58490c695d304e
SHA1 837f435c7c79ba05f6468dc3bf03898bc668ca49
SHA512 8e8e20918924b0a0163ef2aba5e1162273fd2d0916523647314f59c317a6d60fd55234f19de4e387eef632275cd68fbf27eaecb8678ea175596e9ac59c2c1fa9
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qRg:A3kMhT1Lljs
TLSH
T1FB15BF13E79004F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 936KB
SHA256 771a8f4c80954a8537c7521677ec18c0a8f3d37756c948a2fd7534cc9b4a7250
MD5 abffa902d93703f37dcb7ca580b8cade
SHA1 5154e252fb9dfaa6596386c73defd712c3f28352
SHA512 60f9b7276f9d81ad5a0591ff85d0d1730d10be64a75a6dbf421a4d6abbf4192ab47ca8f94e8d58bbd68b8b7138ada0cb70d2f28f0ba2fa71174680a4caa598a1
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9q4r:A3kMhT1Llj+
TLSH
T13515BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 936KB
SHA256 56630386aa0ac4ae59c6a3331a7c7e1675b3400230badd9d4d8c53bf9491ac4a
MD5 3c497bf819b57402ec9e1c610142f475
SHA1 dd4ac612c555efad9c378f54a164476f6e6ed1ad
SHA512 376b91c29b1e6d552d197b000c0256ffac638cc003d7f84d078d8ca35948fe787ecc5990d8a0e3f3e74569a07945f2723e2bc4fab213a88333b6ba7a98e38c81
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qWn:A3kMhT1LljI
TLSH
T1E315BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 936KB
SHA256 c11192e86181565b65d6a9b167f333dcadb865c66d9e8ced225ab5ceea1d87ba
MD5 5fef2c449f03fbf23711b3f188578c84
SHA1 4a99dc6e45fb5f7e72c59db4d74a35af77da6499
SHA512 8776cd2f7090bf9576e8d406dd17e43921c0b694329e53830058481a7f72bf4ee598d55a9d2629853f5abe5b2642b830bb6428f9d508f5eb0f7b60c520a016c7
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9q8x:A3kMhT1Llje
TLSH
T15E15BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 936KB
SHA256 89ae2779e0f04289077baa3b0375311cb83c75f6503824d670beb770ab93c02a
MD5 b71210f200b70cd8bb32f7177b30ce33
SHA1 1dd4132aecdb4f03ce29f70e6f361a8697bd87d7
SHA512 81ad530725706262579d1432a3a43dcd9a50f73be5754e2738c88e5fefc39def168a255262bd17e53e6a983d469695d7bdef3da9df31d04a2d18fd6f420da6dd
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9q2A:A3kMhT1LljV
TLSH
T11615BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 936KB
SHA256 cbac9904fb0f9509f062b53c593824cb3f9385c505c2f153d49112c41455a4dd
MD5 c4db7f7f089a39afbba2a78ba40cf5f6
SHA1 4db68e93faf6d095850d6218190ad55e7624b603
SHA512 9fb2464d3a7bf6e86f0e54d241b887c96dfd8a762d5c66f6939ce941455c98b51f08e73b7b69c0b5a11ab8ff25540359535b9aa1991d2ddd6e28f600911db2c8
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qv9Q:A3kMhT1LljU
TLSH
T11715BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 936KB
SHA256 736e23a0701b2fee7607e2e52860f3a57f6620110b953eda70dc0ea07a484d31
MD5 add4f78e9e6f465ba1675543b93a87bf
SHA1 49f0a1fff717e4365a3ffe45e9431136329d641f
SHA512 505790f4d43d175d1ba15a92d954b883f06ebe8d06f8589925ffe80d8637e4f9dd2bbfa92e47d02e0d14d01b17fb253918f1a853fe9f68051b176498e5e7cfa7
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qG4:A3kMhT1Lljf
TLSH
T1D815BF13E79004F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 936KB
SHA256 9f78e040575dd9867c862292f82d4f93c072b716ff6dbd1b41c0d15a6fdfde87
MD5 22779bd4aa22e0b2c7c246237f74fdf2
SHA1 24e3bc3d79ec5afaff92422d1090a6125ceab148
SHA512 9a4b680b97f2f2e9f127768c25a3bed888f15bbd373a51fe5b50c273715236a11c1795ed6a36d10f1b48e996ea4a94e39f8be70a6bf40a442dc49f6352637de3
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qVu:A3kMhT1LljS
TLSH
T13215BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 936KB
SHA256 52e316c57f9db01c07ee40830501673adebf7c93c54cb5f6559ecd1c78260441
MD5 957ab412fac3334fd5ac5e7adc86e123
SHA1 a5e7c9efbb19011b84a6b2f0c6a5e9c0f537ee10
SHA512 778fdc88fab53623cdbe404bcf6f69d8a2fd6b5df9a0a197e24a7a4c69db61e4ac030dabbb9f4184c3f3275beb68a7d80ce5187eccae11de19ef64c958b6f2e3
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qIj:A3kMhT1LljM
TLSH
T17915BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 936KB
SHA256 9989bb2b42a23d0b8a629ea10679a17b176b563c2abc1839c076994bc5bacc4e
MD5 b38fb9bc72d9e9ab7f7977f1fb220781
SHA1 ca5b19c2575e82ea0d464c02d47c4070293152be
SHA512 f6ae54599390f9b6473e260b9309cb9156a36c6098e1f70a699d17d36a254bcf88bbbf0d3bb7a1346ff3ce4da5a1ac9291b709b8ea1896df75713cd8e9a4af33
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9q5g:A3kMhT1LljE
TLSH
T1FB15BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 936KB
SHA256 6724432510baea42d146182fa097c30d399ab2cb41b0a498afef4e2d0765e654
MD5 2946934bcb2db642c29327cdee047877
SHA1 064d9f0ee069e793dbe6cb2c54d1a40e55be74f4
SHA512 cc24e8096da558b3dbd1c27d323a1d0f27ae054093df568fb231e3a8435424401b48bdb1af22189a904ac1cfe270f4a7641f3b8ed2ac0a1b805f924aed66b899
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qgI:A3kMhT1Lljt
TLSH
T17715BE13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 936KB
SHA256 4a43b762cdb25401c03858ec8e13f532d2cd1637f1119202297ff1d68e758dc3
MD5 b7793b03a866cc33976c20c7894bec29
SHA1 5f48f3eb22738b4920c21304c31179472952c5b4
SHA512 f7c82a95f8536f7fa0b18c8bca45f44d0c0f9b4befce2575c5ec524103c8c22c78f592aea61dcc40d38dd1c541c7a1c976c80ec71079e2ab1493b168a34da9e9
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qio:A3kMhT1LljL
TLSH
T13F15BF13E79004F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 936KB
SHA256 076dfd0162b3a06fe69a73eee939d3fcc9fcd943cfaed76d79cfab8f870e1010
MD5 c5be481fe6a60a0959b4c7a8b0d71b1e
SHA1 ea5b84393181c24c40cd2bf962aaf90ad0376649
SHA512 03cc1aca5be9db722a9fdfb218892aae6bcd67fabf06cc2fbfd27c97c46c1e2fae61c26dfd18e1e495553379cec5c90d62b751c77e1e37bc2594fe0694f3d8ed
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qZ+:A3kMhT1LljO
TLSH
T15E15BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 936KB
SHA256 e99936e1302197fa24d1ef7c2b2cf63c4832eefee215be573d2561a93b6ae1a4
MD5 45ef059d9b1d61f74f81b8e0802c49c4
SHA1 f055c048683c7590da9b9814ffb2e44dd1a8cb83
SHA512 59f11aa8be75be10a196e8eb5701d485ebf6be9f06e64ce67021f28431506e7a24666ba201d1984235ff1401f49238759939ebe567a8b9c1ea4d33cf25b0c338
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qHQ:A3kMhT1Llj6
TLSH
T17615BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 936KB
SHA256 f18253b2fc66e6efc28ccb09dc3386841a44966a587e8a5fe88b8a0986de617f
MD5 06300bef8727b96a3332f199cf5745f0
SHA1 a8e4f94d5f927bcca27010031348fb09a57b9611
SHA512 df899388c184a5ad3080a390aa1bd23eca63e331583e44eac6e0e77aedbab25f99e6172da75552f8f81cde699b4e5679298fef0bc909033db91d58eddf4df06b
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qcX:A3kMhT1Lljq
TLSH
T1DF15BF13E79014F8E9178138D9A64A12EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 936KB
SHA256 2c50cb1a658d8035bf7e10ee3b9ee6fe1516bb41f0b9df0023ecb892ad17e197
MD5 6b3c452b4300fe4dc26eb5fd5f1818ba
SHA1 f8b8d3602a93e46ccc0e9c05234e0fad2a0c39ad
SHA512 814a15fb96ca8fd4c7dc938196133a543a1b0509de4952ca76f13faa44b1b869e1f03173ef8188b0fb151a2ff20ef69ded25110ce487e02b7e179dd57e6e7b77
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qaL:A3kMhT1LljE
TLSH
T1ED15BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 936KB
SHA256 6cd53d729cb2c1770822b6dd39cdc9c8594db9f11375acad8feaa3bea64e41ef
MD5 79d6fd9d009449fed043dcfc5529eec0
SHA1 108e59a5ae59c30c9c1d7658582864d8e3bcf313
SHA512 d32836f6e9b10245114fe1be463ab5785c18618ecd38628032a1f7f335bd083a7e1d9a88806b5849e65c09261b38fe2b8a60eb6963dc23effc5c64d06018f62e
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9q+M:A3kMhT1LljF
TLSH
T1E015BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 936KB
SHA256 e695126a3cf98d7fb0b8c3217a70a81bf33567176859876b2f10539f9983252e
MD5 2b43c6c3308d6d6b44c824034c8eed6c
SHA1 42405f97eef2f6d9b770860067934dd4e7526f2e
SHA512 05ef5f842ad253b83ed7b15fad50a8063df1f9560abea40ea8f303f88cce570d9670be1b6ca286626d5df0772ea9c521b95a2eddee26b04dd4918b1dc20297b4
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRaif9qnh:A3kMhT1Lljf
TLSH
T17415BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3360-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4644-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4644-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads