e7114bab8b455051a398eb5aaf9cf0d7ed0be6a226b9f4b459e982dd423e325b

Analysis

max time kernel
104s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 912KB
Sample260811-qsj57ser9v
SHA256 e7114bab8b455051a398eb5aaf9cf0d7ed0be6a226b9f4b459e982dd423e325b
MD5 b15b0c4fe1c6f37cb27cb83020761d79
SHA1 b16b392159ec058ac403311698526be212f25f0e
SHA512 a1bc34a71324e8cdfab03c628ee843539e39966a5e9e616100f8f8069574b7187c1b1539ade92c8312982e823ee6559092921eb8cff04fc7ff379c0938949ab0
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gw:A3kMhT1Lljw
TLSH
T18715AE13E79014F8E9178138D9A64A22EBB1BC660770C6DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3560-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5f1-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001b2cd-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f9-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3560-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1764-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-563.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-611.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-748.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1079.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1282.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5f1-5.dat	aspack_v212_v242
behavioral2/files/0x000400000001b2cd-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f9-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-563.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-611.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-636.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-748.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-797.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-846.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1079.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1147.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1282.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1327.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1346.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1764	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3560	2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
1764	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_b15b0c4fe1c6f37cb27cb83020761d79_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3560

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 912KB
SHA256 e7114bab8b455051a398eb5aaf9cf0d7ed0be6a226b9f4b459e982dd423e325b
MD5 b15b0c4fe1c6f37cb27cb83020761d79
SHA1 b16b392159ec058ac403311698526be212f25f0e
SHA512 a1bc34a71324e8cdfab03c628ee843539e39966a5e9e616100f8f8069574b7187c1b1539ade92c8312982e823ee6559092921eb8cff04fc7ff379c0938949ab0
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gw:A3kMhT1Lljw
TLSH
T18715AE13E79014F8E9178138D9A64A22EBB1BC660770C6DF136856262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 fd5f96a9beda3998d63e19c1de3daa173adee345a8ef8e7f9b1e3a7ae23988c4
MD5 a21620d44b257bb20cd0927e3ca99e5d
SHA1 c818aa94bb42eefda65333bf7bc03831d17e9497
SHA512 2eb44f75e6528068fef98c801f9331695fbbf863cf28fa6fa5e0cdb535b8a0503875acb3978f0edcbd78fcb27edd1cb57db78d36060b1b3811865fb5ff832e1c
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gI0Le5ji0hmxNrM:A3kMhT1LljIPji0Aj
TLSH
T13B658D16F6B406B5D073C179C9D29A5AEA7238421B30CACF1394D7292F337E19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 927KB
SHA256 0f96471eb6433c3665c3ca1f9370f63ca30be6d5b984ecc586d4fbdc2f56858f
MD5 190c11a1b82be9fe7f3274fb8b12c710
SHA1 e81f688fa16d44a2a4401192cd51a75221513bfa
SHA512 73c5c37d2acfc2b4b1e8b138b56b0222c78c4b2661cb7439e5159667b46a5fcde93c1574c076655683d4961e1a02955601d9b86f1e085e5bc54951318344b475
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gya:A3kMhT1Llj
TLSH
T1FA15AE13E79014F4E9578138D9A64A22EBB1BC260760C7DF136856262F337D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 936KB
SHA256 8a917336b563033be1c7d2e4147dbd92fb86888a149c7b2c77c859fd8dca5f82
MD5 eba3c4e34d6ff9473cf8c1a4ae70bfa8
SHA1 cdf220bfdec0ca07426c9b2746e62b23d7bb4823
SHA512 4ba0aa3ba4d5c28d2de0bf1a0d3261d8450319853a57dfdc714ee3a8f5c0016efbbbdb19b00435943fcbab1e8fadad7a7aeacf045809302d73e1a04144515d40
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gD6:A3kMhT1Llj2
TLSH
T1B815BE13E79004F9E9178134D9A64A22EBB1BC660760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 936KB
SHA256 9a10726550b20624b1a769238438216c3bfa95f060cacd7a6ab7e906791bdf32
MD5 02ee7ff4e25f84fd39cc1071f7fc9b33
SHA1 494ec6afd3e1c5f705763a41f0db3e36a9c7a282
SHA512 27dccf23b81a4a3f695968ca74f7b23cc39483f7d70d2543e433984540efe45fb0f1087c2e48eebf157b792787bec60dcea005014079522d0c16d0e55f4785af
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gtN:A3kMhT1LljH
TLSH
T19215BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 936KB
SHA256 d54e70b1222835b54dc99af640c5886e4745836f04beeefaef0a8bdc448d97fe
MD5 a9fc35166517293a0479aab3c7facc2a
SHA1 22ccc6dfb545aeaec0615b32dfff74d29b4e6ab7
SHA512 97b46a1ac16352fa1517856c957ab8ff5216585b3e39775bb3455126dc1716ef0ffbae45c9f08b004cb5d941b5f7206838bcbca818dd6ca1b4ffddf9bc1a9bd2
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gbf:A3kMhT1Lljj
TLSH
T16B15BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 936KB
SHA256 496894f40314395dcfe91bcbe129e2cdd62fb79b9eeb4bc1ad319dcf50d9cf6a
MD5 1835ac63693005020dbc06965e41a7c7
SHA1 21c93eb3ae0609dfa50622ea49cde2ae4f11607a
SHA512 a7fab24b419ec831cb5e905e04fdc79fc6c5972a9402abaeb24735cd2bfff4597ae383efb9afa8dd6868abbe9a75780d7effa6a4ee598fde7ada4f71f9dfc435
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gNo:A3kMhT1LljS
TLSH
T1AB15BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 936KB
SHA256 d0ef22ce23bd4ce08b4729308ab17ded70f59e0ddff49db4e88a0ea1ffb560d1
MD5 cb10486e3289873d7b9a946a69d878ae
SHA1 46f8efa1c3dc27b24031d30b2c76a543ed8d1153
SHA512 29a12147daf10c0f51d15afb91c80d4706bff5e4d74f51e5a2191facaf2c176876800e102651cc4d9cfdd5cbe6dd2c56dff2d690cc07fbc54fc7e8a05fc7ff9d
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gNu:A3kMhT1Llj8
TLSH
T1C415BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 936KB
SHA256 4cafabc37a46cefae830ba63871037cfba825b2dec4e62c337caa69d0ed00b02
MD5 461fb0fdc295a29d61b078fe9ca1ae87
SHA1 59661f347caa369e5eafc16355513fab702700af
SHA512 2bd0c48702213289f901ba31f569f5c5bb6f94ba959e0c48697ab8ee08c0dcb56da55b560662bbdee05de09a4e2d209eee16fdc040d5513c7b6fcd60f2535449
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gj9:A3kMhT1Lljh
TLSH
T1EC15BF13E79004F9E9178134D9A64A22EBB1BC660760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 936KB
SHA256 85db754f485fcdd8e1a013af623c435c3f994fd307ee0011bf76160019815368
MD5 15e651dfe1719ebba7dd8466b7f1e6d6
SHA1 10fc954c0485ff3407e9d55db2578980db7cec08
SHA512 a1e1316face6879fd0770f37e681845da6e26923244b4288555519833a36659207553d5567eb328262bbdaebcfcc71060417a10c28538eba018d71a0840fd363
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gPc:A3kMhT1Llj0
TLSH
T15315BE13E79014F9E9178134D9A64A22EBB1BC660760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 936KB
SHA256 b8ebafd4a088a09fd952ad4ef329f618c80346fad48b0bc9a375132bb5658301
MD5 d2f46afd7ba5c5ef7019ffd7c9662fad
SHA1 46d0c043c2e0c0352e05215ebd5e3ae3b145fa00
SHA512 948b5f7df3aa1f9cafd4a0dabcc347562c1c2edeb4ae0864fe3b5d559112ac38383f0de8da3d4a2b9a764b3e63aa7661fab2357a1d494e341b8bc939ca65cee8
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gIp:A3kMhT1Llji
TLSH
T13815BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 936KB
SHA256 527f8fa4417353027c1d3e4aa219d50cc6dd831a2f7c9cf1155f74dc63f9d7d5
MD5 69b1b1dd72c2bfe46a69912b5d28f05d
SHA1 0f5efdb6524cd3821c5dea1cf2a980e1e1376237
SHA512 b0d1e6ef1a620c4010c994fa4f5d65a8425885f71f087abc81cc0569fd327495b461d012ff84ea1a668119035de161456bd5f5204ccfa90cb9cf60480b91a059
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gfN:A3kMhT1LljF
TLSH
T1F715BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 936KB
SHA256 6937869fccd5fd832e42af6f12d8cdc02436e0d8cf0bb96271524260c5a10927
MD5 011489b9f745d89b1f6254dad74d1965
SHA1 c58722669d7077a95897f7ab5bf93c417a2e4169
SHA512 0002eafc41d72c2c45d97de736904adb56dc4de87300e073949cf39af619797fd94cb2806d2f264bd0a55e5ca7fde82ec739bdcbf06d7af2d9f873e37628ff75
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gdF:A3kMhT1LljP
TLSH
T1BF15BF13E79014F9E9178134D9A64A22EBB1BC660760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 936KB
SHA256 c6542cc665e1f5893af69d33d059194282a2b0de9c0e6ef0c039f1645a73ae5e
MD5 a6318cf1e5d2379dcfdfc024cde6e335
SHA1 ae164530f87232f696b215eddf91ae28f846d6df
SHA512 cef684dbbb0829dff27a2895e382efb995c3d2fc63b70d3739f7b3c3a8011e63fc53b73aece805ea83b8a0f08dc52b1eaea9ab5f278c0b1644918a1c8facc612
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1guC:A3kMhT1LljD
TLSH
T18715BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 936KB
SHA256 0c040cf54c2259d5e5352f0b419c43d4f537d00dffc4024e288d485fbc0cbede
MD5 a744ada2ecd1d4533b65e3b01931b012
SHA1 daebd2174ff1e67b0804cfe75bbfe44bb722efa6
SHA512 40d8fae766952c7c34ebd80c3dc4a6657e49c05d970e1ddc818fedf4f133867501a182c423657150fb5e2caaa47d90ee5e0abf841228d9be43385e2c8da8b4ca
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gxw:A3kMhT1LljG
TLSH
T1B815BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 936KB
SHA256 40a698607ac81e7c299dbdae403d5bf22b3871024419052eb731b8c19d67472c
MD5 0d57f33d46152544f8bd4e1323a22b3d
SHA1 edae4b99698060322a12325af30a8dcd97716fbb
SHA512 15d8512a0ca3488e080056a69ea6b19a10dc37dd45ebb98a596621b62a5f59fb1d97fd1b5f5f46fd4242394ceb7124f80bfde626d99aa56435c7d5254c56846c
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gYT:A3kMhT1LljG
TLSH
T17115BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 936KB
SHA256 731560489b4d75254b01cb6c9ba8538d7fb47a23afdfb96263918443a9c529fb
MD5 dcb59bcbd5532006bd73685ffb378968
SHA1 21ca8ce911497da931dec6bb778d1f11d3958c70
SHA512 c3ca55483b23efec7b4d74da365f2e9fbee2f70b80e6eecf47ce94febb21381bc008383abf5c60faff8b8122345b0f186b33803f5b9ac56a1c39442ae7ec35b4
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1g0u:A3kMhT1Lljh
TLSH
T1A615BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 936KB
SHA256 13ce7fc69ce7675b7dd185891f0025e5a2bb4838901dda9ae4bcd82c5132dc29
MD5 5f09d3d4adf9956f952bd6fae84f437e
SHA1 af6cc4f35a5a61c10bf160d19549b9135d3756e9
SHA512 78849cb642daa536257623d7137608e6be7a6f621200c2855cf2cb923a0508fb33014bd34ab9337ca022ae8ba5ef0f49092148b9e185f73042a39a688a8e6376
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gib:A3kMhT1LljA
TLSH
T12B15BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 936KB
SHA256 e3b078f67c2936c5125e4386c9afa2b8a5c1c148faabe7b837107c782850380f
MD5 e6248e5e48b1928ed2187a54b793404f
SHA1 37ed3176513e8964354089ad8783863cfe0115c2
SHA512 e75c872309c33ea068fa38f2fa3ddb1e2f3c39cde8bc40f8608d2b51e6f18d82ac00f71709a18477e3b367226380498a9aee8a359247c8c83f7e2877a74d463f
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gkf:A3kMhT1Lljw
TLSH
T12F15BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 936KB
SHA256 c30a00e1c66e3dfac79d1cd56b8f3567f49282bd03048fe24bff6bec6a2f1524
MD5 3d53784819d5983dda284fe5dbf53bac
SHA1 d79437e224f604fb1c40e3c70a33e72d17389950
SHA512 2cd759697b6bde23cd5482682a46ba88666cb19db4098f79a1313497173cb4174ae56411b3fa6946e9194cc2f29128596a38a765864fb5b9b7f73d9041ebd1bf
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gBK:A3kMhT1LljQ
TLSH
T18315BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 936KB
SHA256 dbd05dfd81133fefc773b67fcc84d63992b3e8b150161f2b27246de4cdba9c04
MD5 64dbb00d26938505c647df81e976f534
SHA1 2b7ee5050a5a53f6b77e4e88bc26a02076b35bf9
SHA512 1931d16ce4bf5aa368634afc407ad7314c3c77d6fac37333185792c385472a815ff013f380dafd749b32896c979c65e075a9d81c45bf0274bb69a42ed7a0a472
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1g6k:A3kMhT1Llj5
TLSH
T19515BF13E79014F9E9178134D9A64A22EBB1BC261760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 936KB
SHA256 c752dd2ec3c0eb6e2575f2a25ab949dc4bca2029131e92c101ab9432b8eb9c5f
MD5 d34380fe171a509b2309cd255e7adab7
SHA1 55ec0e29d95c369a7836728552cbb092dd4ff7e7
SHA512 5b05c19e19947db2c947bc5a5d78aa06a1941c242ba823e9df42901b1e37adb515433c81019744a4a4f6c6efa83957c446d22cdf159b52f28bba05d1f37b6252
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gf0:A3kMhT1LljM
TLSH
T18C15BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 936KB
SHA256 38e0544538fc6ff6658d4752d45a3a197ca22945d43ce2e864110bd9383b835e
MD5 254f6081019954521b283a087cc3d295
SHA1 b1f0ab6824c4afe374a972d1cd354202f48cd8a7
SHA512 fbc8268ce97b6ebf3bf86345e5afc739a5f38c64dfcec165a2d42a7f38e85544ffe13ccd5204e5336ffd586a98e7d9444b44eff399ad66703fb5d05cda0d1613
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gug:A3kMhT1Lljx
TLSH
T1DE15BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 936KB
SHA256 f622514ee6cc8cc4292e170ddc419002941462f2664e03a5913f46895f293dd0
MD5 d8a9911e498fe64f7dc96c1cda718911
SHA1 5f6a7678e8d7e238bf09eb14b7668c4f01bcd3b1
SHA512 4e405fc63927f0329b5303ce45a4fd40ff5b84c6caa222841f76275bafa97f3161c9028cc66e19a7e7ba1d3a00a0db8d44fc1b9bfbf79912e7da2754f7158869
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1g3r:A3kMhT1Lljb
TLSH
T1DE15BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 936KB
SHA256 ac1b97c2a430c864a31b0dfb97c267d78a601f50f6a5c4e978d9729739cd512c
MD5 121d3aced79ab2643d208ed381d60f09
SHA1 3a7fa368027b44586b9efff2200fe5c6da12a768
SHA512 cdd72e739a83ef0a86c0435f1d798e27b94f0cf21ead0499a0f753a5ed651f1087974dea4823b868a4f38fbd10dfd5e895116acecc5460123849cfcd64d85564
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gBn:A3kMhT1Lljt
TLSH
T14115BF13E79014F9E9178134D9A64A22EBB1BC660760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 936KB
SHA256 2c15ffee414da8cfd51053162daf17c60ef1feb41968860849386265ca07e2fc
MD5 2dcf541898d7dfa8536b9baf7d87714c
SHA1 fb041e3262b4306794e97091099e37a61fbc5cc7
SHA512 9119064e98b46468666c177890d266b175e9637c0194bf878bee62253e8ef5398f6ac350734012e066c20188975e18e204416fd38f829bc1d7a9f2fc82d74f67
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gtx:A3kMhT1LljT
TLSH
T1EA15BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 936KB
SHA256 b613157d20b6447c78f1eee2b2dd9867e38c7c69271326faf3d58e7295b939a5
MD5 f639d8788ace0b427c4a66cc62ae94c7
SHA1 e2126c6666900ed87a4c992ab0232633c104a7a0
SHA512 bf723f1f205a25089966b0cdb78e83ad45f1f41909ad74905a5419e96fa710858d3cec141d0ee7dbf67635c8448b645f8f39e717f3359906578a9c445a99dfd0
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gzA:A3kMhT1Lljs
TLSH
T13E15BE13E79014F9E9178134D9A64A22EBB1BC660760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 936KB
SHA256 990b8c33576489fab20ae5a268a41b9b58beb2ccfd7369b55195f38522171378
MD5 e0b5af772482906a392e1abfbf0db872
SHA1 bedf8bb96af9b34b6c945bb385bc9ff7450f8bc5
SHA512 294702064fadce0b9c9622bf647bf11c30d6fadbd6cfdbee34d419c639087cf82b3dd6d4ad7f55a2eee1c47a02ade90bc36f2c10cb33a37a16b29f282c275163
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gE9Q:A3kMhT1LljN
TLSH
T19E15BF13E79004F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 936KB
SHA256 8f4d625f95abee4fa75128ebbfe13bb1193c7192b1bd020bcac86f6e297f7d67
MD5 618ebaf15da5e4508966b1418ce6d361
SHA1 6ac8890876fee5d13d14e2bcc588bd6c410739f5
SHA512 4d291165e4e62a02d23d55e0b88fa6bd54d02712e02ff8e1bc03056ce5f744d93aee27520781df6e98e3789de5250f1733024172db507deee720db1b696f8197
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gd4:A3kMhT1LljS
TLSH
T12515BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 936KB
SHA256 390e0bd00cb7ed2ff39177f0feeee361209cacc22514446d6651a3d1563ee804
MD5 ef5c47fc15afba898d7bbd72f2e119b4
SHA1 3cf92b8b84978b1789c770cd4424f5e4880a5a19
SHA512 118ec4b6c7343ae5bdf0e6accc16f640fae1371fc85dbff09e5a6af0d80dbb4d1c61532f76fe8e25b571fc612ca5e045eafb09a19333ea0257c61d7a9f24ebb7
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1g4u:A3kMhT1LljD
TLSH
T1A815BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 936KB
SHA256 fafbb9f840e45a7918e1897ca1ff07278f4fac1f3b967493f3184730983563c1
MD5 62ad44d4b9423e6f71abef4650c8b606
SHA1 d3229e9df462f9c663ad8cce76d8cd1a54f53713
SHA512 3087cc85da310ec8ee68f49ef9c8d53479d498d634269570189a549e5dc7b2510914beb5ef0f8d57e4e24a128ec321703a7d93b099bf8553560a6ed1e4a6f7ca
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gZj:A3kMhT1Lljt
TLSH
T1CD15BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 936KB
SHA256 2182a3db5048759653ad1c76441d7f4c4704920dcbcea492f42f7b535599dc4d
MD5 76309633d4ae2ebb1e8ed7da5286f31d
SHA1 d167d8a41d658f76151c3e3d2d752a1b5a06ad3a
SHA512 2751af196dc74458a5649b9d1c1e143618cad1edd2bd80afeb5f3d737d725eb464a6b67bdade3c09c0faa27b955a0d2844f712c2a0c195d5cb0ed67350f9f881
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gAg:A3kMhT1Lljx
TLSH
T15815BF13E79014F8E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 936KB
SHA256 23712adcd184765511e844dba7162b96717e738072d2af8a95757d5fd054ce69
MD5 8a0655c2b07c140662897786d35f8102
SHA1 63e24af9e5e3548f8bdcdd96c16650b350b51d66
SHA512 960eff7ec81d5987a8a512dbc77df2c6d76ae6da55f464f62602647f9754b554ff2d07fc05292ca33c749311967a9cb1892f1a060b7a7a293c3aef6bcbd6d5ce
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gvI:A3kMhT1Lljg
TLSH
T18015BE13E79014F9E9178134D9A64A22EBB1BC660760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 936KB
SHA256 9ac654ee53d61fc7155e92ab51f1c78259dcf8fcc2ed4910da4a604f5396c2c8
MD5 b3c12e69e75ea9a94b4facbac697b546
SHA1 7a45a9dbf354870aa05c795ad94189ad28477b8d
SHA512 031bf5edfdd0eb996e063feea03a88d3b12406b63f2852050ea7fe90660d30d9a988158521ff5cfb896fe26444928de05ad3d429570895ca4db12ace815beb6b
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gVo:A3kMhT1LljC
TLSH
T16615BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 936KB
SHA256 f15807960d84298f25a8906e6169bab844e6a96bf1db03d1d9842a4f71e5bc1f
MD5 a63491a287ba7a0d657cd84c4c5629b4
SHA1 a7ab8b5fa941d1c27ffb5b60906232e306eccf91
SHA512 920c04ef4900329a68aaa123ad1ac3c2bf9633d0383da8af588dc4fa41157299dc54ef293235f712ecd0663f900daad79ae13860b895c4841e14092ef943eaf6
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gG+:A3kMhT1Lljn
TLSH
T1EF15BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 936KB
SHA256 0d791c26f3f313b91ce8e4ab97e725e2288ab76f7b63f49b2664a165678dc9ea
MD5 118e66f6812b3b12b5ebe88162375859
SHA1 657934f2dd1a3d93d2f3cd15157f108f5cdff1ab
SHA512 78afd65b3b0fa5d2dc5151810319b5f021b75847559204e5b36d50b86fa4950e2680ef2c301f07a0b034096723169f8c5e4bb30689bf112517ffe3b655d7a33c
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gGQ:A3kMhT1LljT
TLSH
T1D415BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 936KB
SHA256 5b6a17084627ff547cdca9cafe778c4a2bafa7c09cffd364f2f1ae0a797ef5da
MD5 7acba3ba5c02f2ab120b1883c6b5ec4a
SHA1 a2aa746af5c1cdf0231ea5ba7d0a8f4fb99ac563
SHA512 e4dd95929bc202175e5dca5c9411653cfe36cb81425f83b31305bce319e2c6f57037a6168815dc03682c69aca3ea564bb80dd0af039ab619b2e78e04d4ffedfc
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gXX:A3kMhT1LljH
TLSH
T1F315BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 936KB
SHA256 612182b2c60867e174396cc3a8257a2efc9ac224f1d7451e43b1ccf6133950e3
MD5 08d7d8e3527e42d51f42298a917e3ffb
SHA1 b2da7a20f84a821f9e5674a379de1d89af84b5f8
SHA512 007d6876d7b69f83a33fce657c83426525a6703e0db497ecda0510633c691428b837961c1d4ba59fc675f2dbc56726aff42a94b386f639bb4e33793e7b30994f
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gNL:A3kMhT1Lljp
TLSH
T1D615BF13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 936KB
SHA256 d0661c3573ef4b01d4ca9ecb2bce98a4944b1023a8b4f853125615d36918614d
MD5 3484f2bfeac1f9c4cab5fb65d83a0650
SHA1 db7697ec3e4f48b4430e221c259c43f1135bd45b
SHA512 ef3e3abe2aba5b74b5c0e7b74f5b056aeabc3e1f031fd5f3fe0a9cf16af42974c657a6dcf351cba533ac3fc454cdc8fdee97e77d687b1909b38420473a57631c
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gLM:A3kMhT1LljQ
TLSH
T1FF15BE13E79004F9E9178134D9A64A22EBB1BC661760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 936KB
SHA256 533d06993e4fd58e462b23dd85570381fd4aec7259def6c7947f930d32ad9ea4
MD5 0386a1e246b50d835e4cc4f0a014b95c
SHA1 8eac0fc2ef76ba012c6598e19ffff767e2ce63b4
SHA512 eff64710c8185bfc5626508e0275c825df4e296b060cb83ce722d94ca95fa85475e549a38f9c98c5f4d5bb8b0e0480cd3c195e4f63ee40d1d3f645fa5c2c8880
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCaOelRaRai1gMh:A3kMhT1LljC
TLSH
T1F315BF13E79014F9E9178134D9A64A22EBB1BC660760C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1764-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3560-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3560-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads