c758548582287b709be0263dfecadd4aafa817a4a78e723c39524e1c0ed059b6

Analysis

max time kernel
111s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 850KB
Sample260812-mt58aacb25
SHA256 c758548582287b709be0263dfecadd4aafa817a4a78e723c39524e1c0ed059b6
MD5 c48ebee52b0b340dc9da48a9c705df74
SHA1 198966f24b04d16af30b7c45e7c63f991e98d2a5
SHA512 7d5b0519fb37ccf4939e1b67bccb2478e29b13cec6ddb4cdf27856f124f9803a1572a6a2bf53d373de7981ac3a1c8eb977097cfc7cd4a672e364a182ae9faf07
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2Tw:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2Tw
TLSH
T18305AE13E79014F8D9278139C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Custom signature

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/3556-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4c9-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3556-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5568-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c9e-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-408.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-481.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-512.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-604.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-789.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-826.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-857.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-876.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-955.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1011.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1054.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1097.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1187.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1333.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4c9-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c9e-60.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-220.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-408.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-481.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-512.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-604.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-630.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-789.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-826.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-857.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-876.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-889.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-911.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-955.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-980.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1011.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1054.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1097.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1140.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1172.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1180.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1187.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1224.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1333.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1346.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1371.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1378.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5568	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3556	2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
5568	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_c48ebee52b0b340dc9da48a9c705df74_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3556

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 850KB
SHA256 c758548582287b709be0263dfecadd4aafa817a4a78e723c39524e1c0ed059b6
MD5 c48ebee52b0b340dc9da48a9c705df74
SHA1 198966f24b04d16af30b7c45e7c63f991e98d2a5
SHA512 7d5b0519fb37ccf4939e1b67bccb2478e29b13cec6ddb4cdf27856f124f9803a1572a6a2bf53d373de7981ac3a1c8eb977097cfc7cd4a672e364a182ae9faf07
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2Tw:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2Tw
TLSH
T18305AE13E79014F8D9278139C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 3ec2bd9baac51b64d3012128ec813a6b718f5a0a03815ad47a991f00851c26fe
MD5 010c39ee625bc69e60ec1d949f9c33ef
SHA1 4470a6250fbe96fc0b58755f565fa154fd4dec61
SHA512 cefd41788233acc69321777de990e3346910642f2aa8f8550e50819f9177e5e6e9af6d58ca637d797788f61460c73e64299c4dc0be8e3098732fc32469e2ebee
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TI0Le5ji0hmxNrM:A3kMhT1LljgPji0Aj
TLSH
T114658D16F6A446B5D073C179C9D29A5AEA7238420B30CACF1394D7292F337E19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 865KB
SHA256 caf705297182a3b5bff65b7ed8d06f21772ccaa8ee9665278a556a7081746ccb
MD5 c7a64090db41f6b6a1df81f7f90b74c8
SHA1 e8130dbb200a8b58db47a1ea555229aae2316bbf
SHA512 3c2a8cef003a52c8bf6721fdf3502b714a3884a273bdd9daae11d96b3fcd4bc9ae17caf5bfd33160b45715e657f6542f4fccb60e95e16b86488ea030436b9090
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2Tya:A3kMhT1Llj
TLSH
T1FC15AF13E79014F8E9678139C9A64A22E7B1BC260770C6DF136456262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 898KB
SHA256 236066729a72796be1c259840db279ef7d462828dd12e4995164abccbcdfa2fe
MD5 893333da7d62974e7f0ad38ab9fcc443
SHA1 b3baf7547abd0974bcaca26342ee14f812d23dd5
SHA512 c0aa8d27e1341b2b710ad446971d61e55d5d0c21b3a7eed6dbf404748b94f2b33323b8fb6e76159b2bc14b3da419ff9be3db20d2c2db8ecfb8ecb91aa13ac2c3
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TRb:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TRb
TLSH
T1B415BF13E79004F9E8678238C9A54A12E7B1BC661770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 874KB
SHA256 38adabff6f60130e281b3724c643c958980b043e4c7e8983207773622098c054
MD5 6ec3aec4ed9ba991bf1bfc61919c44f7
SHA1 c16cabc4ccded3df9c0ad4a2ae34232d4587193a
SHA512 5b893466afb2c0d1774d45e70008541cd4de4b084e9b59a061d13d015a3b952e9f9788a0b6af896c1872f7e7f8797a2faa9ff63997cadb41e48f5dbf44f2f3db
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TD6:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TD6
TLSH
T1AB15AF13E79014F9E9178138C9A54A22E7B1BC660770C6DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 874KB
SHA256 3848badaf70fabe8de1045faeed9921dcee686f3e7fa9781cfb2231144fcdf04
MD5 b7765bdd842f923a1927166af4485bea
SHA1 cb80d3539ec01eb400cd0fba48a993a9448c8e8c
SHA512 bc564bab52251e4dad855f04d70e95f9fee03f794e0f32032f326376f45e28720c6ee3def1f41414e8520c55008fb9b11a5afc94744d0ad907e9da781fc4be13
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TtN:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TtN
TLSH
T1F515AF17E79014F8E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 874KB
SHA256 fa0220222e8e818d040a333d6ae5c662dcb2a37f3282f64ec4319974c9af2db5
MD5 0dcd094047ad46de7664dc75c720f928
SHA1 ad760ed56f3a297a9aafd28cfccb17584a1d7904
SHA512 91149cecc15e6e67b26911d98548f290d98e5603c2cf4334e5133bd92fcc4efc945268ab890797c0ed3217878293827d3c770fc85a2d5660e09dee43f0d70251
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2Tbf:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2Tbf
TLSH
T10A15AE17E79014F8E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 874KB
SHA256 c7711b89a9200688b669a95b427cc8f01021954a3979d72b24794cb3a7e7dac5
MD5 792238b57cec0f5ffa43765c2f4a7d10
SHA1 22f7b02a9fa635c7b56d3064ac14df955e63514d
SHA512 e2febada1f63786500bef9355aa22da69b5abcbcd6f597319c2dcba6e14ae0b24f1eca93dd8832dd52324d91ed1c4582d9929b2701bfbe7cad6231d1375fc9e7
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TNo:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TNo
TLSH
T1FA15AF17E79014F8E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 874KB
SHA256 d1bcf57d779a589ee7b6dbf2f391a0fe84a3cbd03c2a071f481315a4880c8843
MD5 47bf4fb58551baff726edde6c389cac7
SHA1 4caa1227995d01dd037e40dd894b85ba13db95d2
SHA512 27ec997cda988c156c963592b4ca121a16dcf04ab4d2492ba11456a6be643fd4e93116d075e951019bd560e9e66a9ca5b004bfc11fad5dd057ca5778cf1cdae4
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TNu:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TNu
TLSH
T11615AE13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 874KB
SHA256 5dea334bdd69cce10dfad2d4b5a43a4ccb86b898b389a5bbde4998fc075935fc
MD5 a733359bf26273747183095547277677
SHA1 e7cbd08768074accaab0d2db62005c93d6f5037f
SHA512 3a474b49e30d67aa54f6b5ff17a781023dc1a1ab93890d48e4a0566744bb1cafe1db0152f46fc929fabe300ccaafe7387a31d2c9b87952d84979320620592a62
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2Tj9:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2Tj9
TLSH
T13E15AF13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 874KB
SHA256 de11d406b7f3193c7fe01e7a2339ff25a2bb814d6cb1340c8d7e349e7ea619d6
MD5 83363a6d06c0a4287035f634e7e06985
SHA1 7ead87d0a9c100a334c26a62a9f73acf7bc11532
SHA512 4db54075d9187a96f28644444466122207b24c2ce7d9ec2a59e03aaa4578a23b6db9fadc52c4b50940282e66d249a2e15ab1172eba6fb783187fe0746641aecc
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TPc:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TPc
TLSH
T18315AE13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 874KB
SHA256 14780fd2ebff792733f997dd22a3548576983f6fb580fd502f3a713d9e76867f
MD5 d7befcc7e378cb986d948b6c67107464
SHA1 02fb1f5331686e0d5ee470609bc1a9849a40efa8
SHA512 9820e5d2b1bce0d87ac4e94b16453ef585f030efb75f7aaf100220e4c69c1ae1341f3c03ba16894869661223eedaf70aff9beda7b1a42626a29f88b1397c95f7
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TIp:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TIp
TLSH
T15715AE13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 874KB
SHA256 b2dd282d5ac6743c8f2722ded548a2dd103970b67b64c271ecc83c91d8604e45
MD5 508a6eae928d425976d5b3383484cfaa
SHA1 826bba8b5d106f51ab37de52d76fc3f025a00b54
SHA512 d48dcb6630a1e9f50f8ca9c80fdbd710dca073b7ef740de594a587bb759549dae599db4502269b019b6c8e1a80fbf42678ae2c3cb0f7e6697ef94f5ec1fc0f8f
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2Tf0a:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TfN
TLSH
T1E815AE13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 874KB
SHA256 151048075ff5cf7baeb899bfba038834a86dc2a96414761dd57a4efc14d4388f
MD5 4d3c228bcc700c6a1edefe8f43f697b8
SHA1 ecd35d474b0c5d7a2c59abce91f020d1f92c9e4c
SHA512 444f9a88ce470237fcb0caed7c9fd235e824f3a6cc25a2da27bfd973b0f434c27f89df358270de7eee7f6ab309291d3dd67805e2239937b083453c8a61f76c80
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TdF:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TdF
TLSH
T1C515AF13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 874KB
SHA256 977e48975b2131da892ed8ee2c52098dfda443b70f7ba9f922400461ca26cc0f
MD5 9ea5f0bfdfd801fdb6d3d0d906cb1d9b
SHA1 8d82746d07c4bef546f0cfd465d9af354ded48e3
SHA512 0d6eb226ee0abb72887af2023c93c490e2ddb21a61dee79a414bc1a1003b253fc991fa4ac0084bb4ebc8768bf5437946f9045511c064f3e70e9823a5a0321c19
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TuC:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TuC
TLSH
T17315AE17E79014F8E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 874KB
SHA256 70bd43b054a2075e8bfd2264beb00013d441f55623f176b4194a1f2064baf960
MD5 75140520d78358a0b92418b40fd75197
SHA1 cd67ed726bc115ad9885037926d1eb7906b3049f
SHA512 d156ff7333e2962f05f7882a980109fa8797b1a51b5346be65fe509c8036494109f881fd3fdfd09f620367860391598f88b8bb37023a742f040f6ef873b956f3
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2Txw:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2Txw
TLSH
T16315AF13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 874KB
SHA256 5eb1af09b0982da2cc4cbc5be0f5515e35cb9ff705667d392fb4e276836abbf1
MD5 afa9a3e81700e8b52d6d0398e1d8a12d
SHA1 77c4e7777dbbcc7fca02ca037fd636f9d0610fbc
SHA512 ef200193dec51e538b0c93661a203fe953b5faea716e1416bb1d22abd8db3b2ba748cd24b02a7dee24590b3dccb6a33af3e74339b10f205a325271cca8e13be1
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TYT:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TYT
TLSH
T10B15AE13E79014F8E9178139C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 874KB
SHA256 71365d2f1c5604b6db28402a67fb5cd4aa28377a912b7141e2230d1efe25975c
MD5 1f27a254b7ce4404beaa2262182ec968
SHA1 ef0db115052872ba488cb0737141e0c0791de7eb
SHA512 80ea6f10199f305dcf237addc95f73cef74285c20131c9969bfd8e5165ca1bd9254200061e6eeed15ee06e14e9863b6e5464d67178602b99760d6f8fde755724
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2T0u:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2T0u
TLSH
T1F315AF13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 874KB
SHA256 61304e10c93b1d2c0d53bf8e46524e77c6b44d3d8e505496460050c93694adf8
MD5 d6b4e8b074e4b92a1368e05661f5e904
SHA1 0dc7d232272db1cf21db9a5cf4e7982b54d2839d
SHA512 21e286eba7cdde30ec5d4e3bf78ca80507022d89a6e4a9c258f8402394fd5bbe2687ec33136c249b53a6c43706e822081a6b7c4c25654f76768663f0589dface
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2Tib:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2Tib
TLSH
T17615AE13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 874KB
SHA256 cbb8dedda013ffc371be8bf11d1324fe9040f3601139f019ac3401d356cdb9ff
MD5 3d478bdbac433836632fcc2144095685
SHA1 986c27384751c7244965ad697bf688089c475632
SHA512 c621e3784bb9316c65a195b3faf615dd42e38dfbff963ce56110df66521422fe8c0a15d32022256dfac2235da70488e360592939f8d4f27758399673a92d6e90
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2Tkf:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2Tkf
TLSH
T16315AE13E79014F9E9178138C9A54A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 874KB
SHA256 f7e8a14d5642d9503e0af716dda4b3f2af3e932d97367f603cc973c7773599a9
MD5 65f12da8146e55140fc0ad8e9377d02d
SHA1 1849e98286b1925a1e2ca2da06fe83a077bbcbfc
SHA512 2a5f7d03fd9c327fca0ce8660e46a048c7369a32c9f33dbb0ff2478869d3fcf32762e1a22fd8e8d1ba7bda44dee04a00c2bde9ad9009f1acc6bc45c1e833765e
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TBK:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TBK
TLSH
T10815AE13E79014F8E9178139C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 874KB
SHA256 f6be20136f3b469b7b696278d52e64393a749c2bf422e1f428b2d2db67c6b9bf
MD5 ee77c2bda483a8aab67da6f8fc486f90
SHA1 2b770b83fc1f16d5470269e39627e058662c751f
SHA512 f9a7012f05afd6159e0c7ae736a5856440a0bd078dda6076b9a16d8aa6563a8d4035c4abad8e8fdc3421f406f48b3549af5fc21437a7f71d02c0deb04f54d7ab
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2T6k:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2T6k
TLSH
T18D15AF13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 874KB
SHA256 1ffa0b0e1802c29a0a9fe3095f27e11b4b4624ac6cda576684cd273bced9e7ca
MD5 89cc372ee2c0c916bfe63b534d90d533
SHA1 c706aab2c83bf7920bdde9194aa28f82ba6c52ce
SHA512 06075403617ac57bb4173f8ca7d9557cb1b00d46958f8fad62693a3928e8df1ca0862c104d19120f6e98484e46bb6cdacdcd63ebf0d3ec79c4475c975f610700
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2Tf0:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2Tf0
TLSH
T1C915AF13E79014F9E9178138C9A54A22E7B1BC660770C6DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 874KB
SHA256 e4859126045ad242779e7b451e81e1d1e76a682c1a4761ce2ad523fbd77e47e6
MD5 63b175ea6b699fe4e5217beb7d4b8639
SHA1 6536a99d010f6e54efd4e4f5802375a564420251
SHA512 c73da91020fcc63d926f1f00874ce8479568ae230ea4de7e61815a2230b0730cef8690955b0e2f83e18822019e163de97f05f1ecdfdee21f956e4701fc2e38b6
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2Tu70:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2Tug
TLSH
T1F415AF13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 874KB
SHA256 42baedc06711c5e8518f86acea969d8eed6a8ba438fe7a8f3fe0ddeeb06e406d
MD5 65aa74378034bebb0e0040d1392ae90a
SHA1 e8b48dd0c7522a637fcf8cc0087a5a1e35239df3
SHA512 33156558529b607fd80b83cfa1eaa608732bbfa48e7fe5e7ab66bddefd65e527646ef68b59431722fcb59afe4116fdfc8fe15fe732227fad235670ecf0d2d660
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2T3r:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2T3r
TLSH
T19C15AE13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 874KB
SHA256 9097ed1f0179022440108229c03c3fe6afb11b19ae1594fda052718829527803
MD5 d437b95c62272d6eec4d2c8934a5fae9
SHA1 000bc6fe9d7e506235b254c2a0efaede8f18f782
SHA512 6faaf7dcb31370fb9d10536586ccac11f7715f42635313f3e27c281af25dee7bc7fde2484083aa3e6c8b660f1a1048f44bf15caf6682776d7fa29e5bc2f5340e
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TBn:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TBn
TLSH
T1B515AE13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 874KB
SHA256 fb52aef38ecd96a959ca9147e18608729cdca2f29b03d6f6a366cac34251f414
MD5 80ea5faaf1693b58f6e521b2849d0a90
SHA1 ec39d6ecfbef4657f7ef4e9d4167ca2c07614b49
SHA512 efad5e37d84896e01d53bfafee021f33cec918f108ed2137408ce0cb93d770845b1e4bf805f9cbd35dcf5decb9e9781918c0775af85645625c226390d1716417
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2Ttx:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2Ttx
TLSH
T1F915AF13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 874KB
SHA256 f6459514917978700105170b6a4007cf544d724b723b7cd32bc2d14f8176c914
MD5 5fe938dca5514ec7c71cb27cc5d33f32
SHA1 a0d9476a4fa2285be4cdb0734ea5b04c48bbc616
SHA512 57522a6d9f122cb4fac208f9ebfbc7e258f69218de39723e557a014725f6352879b4b883d9823ef0a05f13b8aa90bb0bc705a4fdd6e5c004f54b8efcd7a4dbc0
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TzA:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TzA
TLSH
T18515AF13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 874KB
SHA256 ba73fe081923aae9e939b07a33b08de156f4d508b881ee5306f52df8a7244f79
MD5 5bc2c3915d38a64e65898849efc27916
SHA1 fe7856c1feb6334ff02aae22c9e8b06763895c67
SHA512 9bbf8deab0f37dce36771b834729cf0d5e8eec8792ebcc2d8accdcd364680b61091ab5b6496c83235cd3f3f4fa3c8970a2c947c7cf04e2d9ced95aa326b30dc7
SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TE9Q:A3kMhT1LljV
TLSH
T11815AE13E79014F8E9178139C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 874KB
SHA256 2bc47e81fd5e01bcb459c30022e84fae7e6d68c1f8dd7537b8f9076d4c070ee7
MD5 fa984ecf49cecdc2d0ae7fd3a72d0251
SHA1 caa827df711e7735c28b9e3ddae007efa34937a3
SHA512 d698840d70557cf2ba0d56c9da5818b5a9c5d926cf54c990d2dae39d92a579f89ae4628f5d01cd679f98f6bea139129b053b404326186ecd6fc141f41d0e56bd
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2Td4:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2Td4
TLSH
T11615AF13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 874KB
SHA256 1e104810d133dd4e6dfcd4d54dbd9b90b1783e23599e4ecef32a8824fe5784e6
MD5 a8f5a337ea10821b2f349c3485b60602
SHA1 ca1a127f05e41647b83bd46c791d55c3aa450d29
SHA512 8ce6a63f9f42857a0cd2a131d95822bec380740310db8c6ca44388866019ffd92109aa9e279cbcf3ec9c654e4756b7c4ffcdbd785d5b582d5dffeb702e7ad4e1
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2T4u:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2T4u
TLSH
T1B115AE13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 874KB
SHA256 d4b26c0be35c0aee16e398e318e5691354e7fe28335c92347c4532df06ca3730
MD5 b9edbc794b2c1b8bc29b69bacce78f2d
SHA1 33dfbade58e70964af360387c10868a116c7fd24
SHA512 a5cce1b79e84853d53316da8604346d60801b39be4c5ff1995f5ac1d5b0f2229ba9bc47f330056bd334707e7d4179ecdf8687a2e18777886e63c6963e7913a33
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TZj:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TZj
TLSH
T1E615AE13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 874KB
SHA256 41038b385119aa9461994b56c5abdde4149d6d0b10d90df057711843f5f7eec1
MD5 0f1cbc3eb7a46693aa14f38090d8312d
SHA1 95a78e41be9e9bd7587964b1da263df4fd87fab5
SHA512 2acce9a6fc9f8eabb66e063afed9ffdb39769ed094c80503f2a1ca2ce844d94c313c6b1b6df1942d7790dec0db2ffd2dc582b786af6a7f0f0364cf09fdcd40d8
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TAg:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TAg
TLSH
T18715AF13E79014F8E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 874KB
SHA256 9b7e868e00288c432c8b199af8b8b5825341bf86ab8b976e6a0e71070af92cbf
MD5 e9fd185593931f1aaea7f168ca602096
SHA1 58ad4bb0e165bb81cb9c3eb95086b03e8541c197
SHA512 cbf76b4a5a67453fba4b14c43cccf3ec3cf8bf3bca5413980950b7a36aed2bcd9cbf18c33e602fb3d4475a33f58da573221937805b31cb4f94c5a83e5e27b659
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TvI:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TvI
TLSH
T15115AF13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 874KB
SHA256 72cc7540f755b71f6b6fa9f113f2188a88de6d11c2c7d88965079418f5677b76
MD5 062b5f0d8b6a02e2f4fcfebcf6d0968c
SHA1 531a0556d9587b17b0e395e5fea7aedcd143527c
SHA512 034582399c3a82807f9dd9fcd08c140ef3e0ec9e1fded6b19a339ee58e5ada1d81d828f7a2cf746c4eb04a3ef651d50d7d0e43cd6a61cdd47559c8c60d708e2e
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TVo:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TVo
TLSH
T18015AE13E79014F9E9178138C9A54A22E7B1BC660770C6DF136896262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 874KB
SHA256 41bc3c5b71643b4e045469d5290cd7a611124be21fefc34cc52717501a34496c
MD5 af9b17108b626ee756089a22da73ab12
SHA1 9b44f2e5dec2f8c5b2cca33a09c648c9365f39b3
SHA512 b45c8839c0a26e4732410308a20a1c5c67843a28266e7a5e865be6e03b53da4f101c697e29882145cebb6c1a3a13014a92ab1fbe8a501454d1f2a7340379e83e
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TG+:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TG+
TLSH
T19315AF13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 874KB
SHA256 e5d2c6a3083c51829654675829240830f7acf1261fa05538fb488bb829777069
MD5 2f75d97cd14539213b043373b87c65f2
SHA1 c6f50010262147ae82b7b919f4912ee53f6854f9
SHA512 270ddf3461e5c8b60829ab17b1d1442118db72ffb8ad65356f6996e50699db77e601420754e88b93a078e72f611f8262013287dbfe4dad2fa30c9254cceae7cd
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TGQ:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TGQ
TLSH
T19F15AE13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 874KB
SHA256 85cae54fb97e6569194ec18c953a0c106e7fb193ae28a29dff102d080e09a0f5
MD5 29bdf0e87172dcba7544337ea4b2541c
SHA1 67b7954d8442c46de5375687ea80c7cbd8bb43a7
SHA512 a6615859451b5d9ccecce093faa32e61ae4e268ddef0e0698220432223cd758dffc6756c764aaa1dc03415207f0a32ebfcc4bab5bd3b7b26820131b015f55e1b
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TXX:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TXX
TLSH
T14415AE13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 874KB
SHA256 e51e884eb4b20c08672bf9d62e2a82af83468afbf678b503fc59536e7909b88d
MD5 e759ea711b13d525a56a654d5d9123fc
SHA1 e84ffa988564ee4b9617e6be2744c12d41fcd7c8
SHA512 319458f8e9b6f6f8939c0d63f72f6d81a8bcf7b5e52548bd8dd5ad43e2792c376a6b0128f62ba98cbd1a191938247631febda905f4893b2cf736b11d0a90427b
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TNL:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TNL
TLSH
T13C15AF13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 874KB
SHA256 c381a24297853043cbb438939318f6ff68eeb367b7357b1cfaf2e89da7ac95c4
MD5 2d13a45609743c7787461d3cf251d237
SHA1 aa4356afbddcf4fc95edea9ee025d76d250005a2
SHA512 0d97933d9f298e89a69208e70e04200702f4a15390738ef38983d0115812a08ee90511312a708027592033f70951fa5a3165838d0a96835b6b65f233d68354bb
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TLFC:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TLM
TLSH
T10815AF13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 874KB
SHA256 5985f9696b1bac5498a8f88f3c5a90824f1c4db41d4c5796e31fa14688e6c62c
MD5 63181988b17b7a99dfa70d12935ccb9e
SHA1 c23f1308667f415c8a17ffb6cb6744da69218240
SHA512 b76553581c6e58cdf34a20d9956abba24fda1800dfd0c81bf35ff1a5e83d3cfce5bdb8c037c1a3546caac8c667e7f25da5b8ea3eedc236936ba516650c378eb8
SSDEEP 12288:A3ZUnXoZ+yPz5L8JCd9/WYoaLHF3z0z04PDvhVHVECpcbaB2TMh:A3mnXoZjzyUTWaLl3z0zDMCpcbaB2TMh
TLSH
T1B815AE13E79014F9E9178138C9A64A22E7B1BC660770C6DF136856262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3556-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3556-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5568-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads