03303180cea31c1ae90ac520499fb705ec6431edb7bfbe83cea09e19e50d58e7

Analysis

max time kernel
101s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 787KB
Sample260813-qpr2msaj61
SHA256 03303180cea31c1ae90ac520499fb705ec6431edb7bfbe83cea09e19e50d58e7
MD5 35f7e9be3c0f95285f84bf79bd5bd389
SHA1 5f08a287a72231d28fe8f72bbf23c917bb457467
SHA512 f5ed5bfb6beb97c4dabc83d97a329c21ccaaf708ae9622481c3b81bcdd45f5753af62f826fd1d36b070e1853d6d7a7c0408f73bcc357ff104a1dfbf63fa2535a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQb:A3mnXoZjzyaEFkR4ugsCqsQb
TLSH
T1C0054902D69400E9D11E8234DBA54612F7777C6217E096DF23D4E23D2F72780AEEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/3412-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5d4-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3412-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4132-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb5-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bac1-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000019871-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-360.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-475.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-500.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-591.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-628.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-708.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-777.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-796.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-845.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-858.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-955.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-987.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1055.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1098.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1141.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1154.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1186.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1360.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019929-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5d4-6.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb5-60.dat	aspack_v212_v242
behavioral2/files/0x000400000001bac1-220.dat	aspack_v212_v242
behavioral2/files/0x0005000000019871-263.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-360.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-475.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-500.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-591.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-628.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-708.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-740.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-777.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-796.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-845.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-858.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-877.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-896.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-897.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-916.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-935.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-955.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-987.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1042.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1055.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1098.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1141.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1154.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1179.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1186.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1223.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1327.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1360.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1386.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019929-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1403.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4132	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3412	2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
4132	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_35f7e9be3c0f95285f84bf79bd5bd389_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3412

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 787KB
SHA256 03303180cea31c1ae90ac520499fb705ec6431edb7bfbe83cea09e19e50d58e7
MD5 35f7e9be3c0f95285f84bf79bd5bd389
SHA1 5f08a287a72231d28fe8f72bbf23c917bb457467
SHA512 f5ed5bfb6beb97c4dabc83d97a329c21ccaaf708ae9622481c3b81bcdd45f5753af62f826fd1d36b070e1853d6d7a7c0408f73bcc357ff104a1dfbf63fa2535a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQb:A3mnXoZjzyaEFkR4ugsCqsQb
TLSH
T1C0054902D69400E9D11E8234DBA54612F7777C6217E096DF23D4E23D2F72780AEEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 3074b42f82ff7175a3dac111b5008a5375c3d65d1b133f86c8af1c2effa9b646
MD5 9f50edee4a19221a10362a9daccd0944
SHA1 cf0005d644a2cc951dffea126d941448d11402b5
SHA512 db5603030f8c078ac900cc98a3b351a131f86be41ee920d56bccbddd64da56e16f3d7b741258e2c1cda370e8763fb185f63e0d7c5204cebd2f8975a8c45ce2bc
SSDEEP 24576:A3mnXoZjzyaEFkR4ugsCqsQH0Le5ji0hmxNrM:A3kMpHPji0Aj
TLSH
T17B555916E6A402A5D06EC179C7D2965AFA73384217F086CB13D4D63C2F237D19AFA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 802KB
SHA256 932cd6dc06728d99268331db3c8f82c03e3b48500e72db199f84aba828906f88
MD5 ca77ea285bc1de5143c948bd0de50a9d
SHA1 f7d5d59de4fb78c6033358dee6d4e84b54c63fb9
SHA512 a007c940451e3cdd7160e7026daeeb19478c08f6e39153b58040a20b369d501320a8cf976975a23fe25e38be8afe9e482f6c971f9592e0e3a1985f47cc246eca
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQZa:A3mnXoZjzyaEFkR4ugsCqsQZa
TLSH
T164054902D69400E5D15E8234DBA54612FB777C6217E096DF23D4E23D2F32780AEEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 835KB
SHA256 7d4df859ac79a1a553a9a2232e6a33fe4e4c2648f0c0f039e87e0ceba0cbfc12
MD5 b1be450a13fc3b3be1c8b26aacf5213b
SHA1 2dd978110ff17240bf40f733c438401552a1a206
SHA512 f6e253fbc0c304da8e56ea878effb00429634cd822bd934c22b6c2a4b7fc25b3bbd10c07b71ee3ede42757533c523c0e538260fb46167d9ea1e838492c1ec3a9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQKb:A3mnXoZjzyaEFkR4ugsCqsQKb
TLSH
T1C2055A02D69400A9D15E8230DBA54612FB77BD5217E086DF23D4E23D2F727C0AEEA767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 811KB
SHA256 6eaa0852816caa7aedcd30676756536d1bd81a6407f628f82a5918e22d8b0f04
MD5 83b750a96531657c1856fc6bd72aa5a9
SHA1 db56fe97ae152f41ace87eacbba91529cd29d29f
SHA512 adad0730e108d3afa0cee84551f27cf25bbfa4bebcad09ad85a587c66ad56a5875b1c84aae4bedf860ee3a8feb02615c935929eac2f5ecbf4453a27971f7e422
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQQ6:A3mnXoZjzyaEFkR4ugsCqsQQ6
TLSH
T1A4054906D69400E5D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 811KB
SHA256 0f14264b65a5aa646640babeb66d6623f2156fa2f2175a6bd74af633d805dc46
MD5 ca1de01f677b7391b45caa9e730b8452
SHA1 746f2da44ef55cb16e106f235112b3e7d87851e5
SHA512 e9f38f1fc451aae34e818d032a7146754d03b75bb8651dee986dae1da9408ee21b0bfa9d34f0189b677c0e1f3ce0b3940e2ed901cfe1fe5a9d5c4637b271e8b1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQUN:A3mnXoZjzyaEFkR4ugsCqsQUN
TLSH
T1B5054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 811KB
SHA256 1ee87ee369d668697017bb6b469bc062fade3ac0b5a4083ecff9416066d7834b
MD5 3a450c801b062e49365b5f91a31d832f
SHA1 8e115bc0d0df4456f9f8f8bf6524994afcc35dd5
SHA512 a9ddd502c95b65e90bea6601f058a4129d3a63fcd0380c3daeca2caad9f59cb794f94616d15aca1a16127e99fdff5d27150734afcb33518d7a2cdfa5e7e66652
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQ6f:A3mnXoZjzyaEFkR4ugsCqsQ6f
TLSH
T173054907D69400E9D11E8230DBA54612FB777C6217E096DB23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 949KB
SHA256 465cfb2d827a5caa0bd71edbfae170152de5e268b2afebf8041bb479eab84c8e
MD5 59cd488a1817d8d0f453c63bc05c35e8
SHA1 c75c302320ebe1eba7dbf6575c2a3d3d2a54fa25
SHA512 4a6a809166278c9f455179dfdb4db2b5e2da99d8564adc21785ca5cf66c4ccb4423d4b32cd3390d96902ad787908130925b2b1bceb3380848eba1ac544c1dc29
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQYyPz5L87:A3mnXoZjzyaEFkR4ugsCqsQ5zy7
TLSH
T158254907E69410E9D11E8234DBA54A12F7777C6217E086DF13D4D23E2F22780AEEA767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 811KB
SHA256 22fd80027887e786444a12d6b65ffc20b4d38caa88c9e42113e898d4e71030f1
MD5 49de6bb1bc2485a8f8701805ae51511b
SHA1 dc20f4399ba443b5beb9c24b7b353bbe63c15898
SHA512 4bfb1cf6879f9eb5bf815ffa3a26d249d51660ed4bbd972c00024903538ee86dda759cac0215a785e6b1e14b17a248ab47c37379b01d46072a30ede526807d22
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQ0o:A3mnXoZjzyaEFkR4ugsCqsQ0o
TLSH
T109054907D69400E9D11E8230DBA54612FB777C6217E096DB23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 811KB
SHA256 cd8ec6c5f9b7d601d8c88fcc0cf2fb6732ad79fc2926415969636584c1f868c6
MD5 0b78b3879e991ef4dd7473f590db3bd8
SHA1 fb977d956c924e63aff971f70ff65a452a3e7d81
SHA512 893b739199ff2df115a9aff8b9fbaf5cf52bf82fc7f0a5c77ba5289fec62bc75396ad1ffafa2043c4bdf8c2fd2aaa2cc76b4c293c11e02cd2bfc6532ef6aa2fa
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQUu:A3mnXoZjzyaEFkR4ugsCqsQUu
TLSH
T121054907D69400E9D11E8230DBA54612FB777C6217E096DB23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 949KB
SHA256 ca42be6eb0302ab528f48fbefeb2db7306c2fcd5450ca390d9d5366af5bc7eee
MD5 316d97e8875a9f3380b328390ac6139d
SHA1 69efcdcb7340e191cac527a0e45c92412d4da5fd
SHA512 57daaf0ce098ac1f2b69c3e82a637b622208a80a1e0bcf0ffb2ceeab7b60c3ec72b0f0ad0d49e0aa4da01f4c2aeb97f056ff7e06b195202162775579a1248456
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQpyPz5L88:A3mnXoZjzyaEFkR4ugsCqsQIzy8
TLSH
T175254907E69410E9D11E8234DBA54A12F7777C6217E086DF13D4D23E2F22780AEEA767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 811KB
SHA256 769d30600c06d402436f5ea9bade3756474a9c02c0867fa11374082bf5aa5111
MD5 3f10d0ef8b0362f6f380dd1464ff9ed5
SHA1 17bb6e796f6af6b9b9a5a3286313b59028d2b8dd
SHA512 2bc395d486c9ccf32a2dd762af0a9f9b3301813dc8622bb2819af1b816e675ddc8e10117c686a36a3c777422eac82274a33a10b6a4408cb78d1ee67f3f612752
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQ49:A3mnXoZjzyaEFkR4ugsCqsQ49
TLSH
T1CC054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 811KB
SHA256 86582a6c0a5e277cc72ef2fb19e52b59238cb7a3c5450817e1f12a610f244dc7
MD5 989754a0be9494bc6a295595fd393cd8
SHA1 b9cef46d799a4d4ab490373ac73bc86dbf1e7bd3
SHA512 7989b150f886070a232830014ad7e88eab076ce799863bdd0993f1a29e2282f272b1ae735757935c3a363492485ac209dc0ad2f1587249835c61b7102a4dcd9f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQgc:A3mnXoZjzyaEFkR4ugsCqsQgc
TLSH
T1D8054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 811KB
SHA256 08122d3c7c9aaab7501ade5b4066b505bb96d53d158cb2378791d3d7807fe300
MD5 7ce0f5eb066afb2ba0c458e126031f46
SHA1 fc8341d757264299fa64c90bf781f537c37a1296
SHA512 dbdec645b4e0f8de05616f3d01da13d78e1f16b75125060f22a4d73ea65c7271c6a33b525ec21219c5f338774b0a15d9019f6c2402618e38f5d1118ac1aff82f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQJp:A3mnXoZjzyaEFkR4ugsCqsQJp
TLSH
T135054902D69400E9D11E8234DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 811KB
SHA256 d8dcb9c200fbf85bace3052b4f255785b4bc0f3c059f9d8ba8dfca5741cdb34d
MD5 4719ae84b4a153678d99721968320401
SHA1 e53839d03e3e256998cd633783c2dd971272b50c
SHA512 25c1dce9eebd9649b734c8a7c95ac7e97ea741dc6c8267436a450913f0aa24f56dd08f1f9d250a7f326a0892b769575c0e3b52bb650ed71f8eb39a387efb7573
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQO0a:A3mnXoZjzyaEFkR4ugsCqsQON
TLSH
T115054907D69400E9D11E8230DBA54612FB777C6217E096DB23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 811KB
SHA256 69aada71bb967b42790354dca681a2ce18876fe62acf50cb3d770a29c75e9bb4
MD5 91ca250a3c06011d1d30c778e60cbd2e
SHA1 d3a3a4e782725eedbc4d2b6d8363563eaa726c63
SHA512 548efb66feee02bcf83a8d73c3547b0edacf5ed4d13b6070b7af5f17a9d445471593f73e0fb50b06e1818edb59bddfbb3200dddf71d45a6b094a1baf75b9c0a9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQyF:A3mnXoZjzyaEFkR4ugsCqsQyF
TLSH
T100054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 811KB
SHA256 316c20d13036329d4b5215324b8140085ed1e3ec399cad5545ff3e90d83b3184
MD5 4d0ee466332c5ac586c9a27c8e6e2b9d
SHA1 2c85a9ff5a85af4455340d854fc38ac26a54be8f
SHA512 914230691312aebe940328383ad9cc696418da1189d844485d9e15f52bacb0c1160d7a24671d09cca4356ce118e34ab731ca1b863c0835258d3d056a3431122e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQ3C:A3mnXoZjzyaEFkR4ugsCqsQ3C
TLSH
T11E054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 811KB
SHA256 351c6e1dabe6d13cac61ba71f2d751f22585bc149a923aa5396111893269780e
MD5 922f3737ee1433c3cb081d99c49cfb33
SHA1 bbe25d06560aa1b8f00b608af15f26191d5ee6e8
SHA512 3b987d2d8379a828bf0f7181a843908fab424e56636b97eec697824df832bf185d35eeee383002afb38d7a9f72c30c6336de2579dfaee9212e90bea231b9f4a5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQ4w:A3mnXoZjzyaEFkR4ugsCqsQ4w
TLSH
T192054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 811KB
SHA256 551b3686c919128e6c0e6c446dfe370f5a8df1a1d8b0cbcf87ecccebd956ed66
MD5 e6bc26481ce47dcf51f35c64f7a8909a
SHA1 4861b24e95b19bd5de3501b75f2ee722ad7e4cc5
SHA512 4d10ec2f33360839748dbb45773f588d919104879c7272570f42d6a649f306db22ce0993157e0fd07c8deab6bec3ec5e07223b191485cc83cee987d701d4a18c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQXT:A3mnXoZjzyaEFkR4ugsCqsQXT
TLSH
T15F054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 811KB
SHA256 fdfedba4f73f1e9737f33e7e57c9420789c062af82e6f1f593a9c5a3b767d60c
MD5 1e72984403d92ac932c420a7caedc185
SHA1 fa50c9ef1613d0e209b351ee897dfd66fa6458c1
SHA512 28e0272114e487fc084b8bbc899a3bfd2cba684d28301c078cd64e5bf57782099d3a9fba47ae6db31972907533d772e06a33e32e0ceed8ff14f861723b983772
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQhu:A3mnXoZjzyaEFkR4ugsCqsQhu
TLSH
T1F1054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 811KB
SHA256 0398229651e8305d34069f7e3fda4fbd3c8865e05bb42f3f6556ebf43f04dc2f
MD5 00c6f64f5b72b77d4366ec3daa783970
SHA1 9cee79a53de8bb25c6df9b052f5e8a9ba39a9060
SHA512 9efde9c9d8949f23a8a67ad112d7ccb00b40ee3cf8c715c81444db6cb560a57f5cfaaf789999330a042b5254cf804b5d47b2829597ffeb0327d373f4c4897753
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQJb:A3mnXoZjzyaEFkR4ugsCqsQJb
TLSH
T1EF054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 811KB
SHA256 6dfda32793d5774af271d5fa4368f12b1ec8d0fccc8aa94b1ef9ca4eff2109a7
MD5 50c8844a1a080db3d9672d892a6ed6b7
SHA1 fd4ea27b8cfbbb23460046ddb80f8355803c2c21
SHA512 5e50ecf2671bfc91662fa8aae04eff742c42844f6386fab8ea635726d692b6f34b1adbbd205eeb16c13c16f8cb52764cb9c4577ab7738e5ef46b1a63186b7e0c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQxf:A3mnXoZjzyaEFkR4ugsCqsQxf
TLSH
T1CD054902D69400E9D11E8234DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 811KB
SHA256 218f985f36ec14de7b6851adca329aa3d21ae28f480a203e10207b93fd3c2fdf
MD5 23b031e85904dcbab142c6fd0381389c
SHA1 0e100c0bf767fa324d7e146ad8e4878fda684862
SHA512 b32dc2f36177b4d1da2622e2fd48f55f46ed6e2f3abdd51436953864d41aeec73c8e41b88efa73968e26fc9adbea59ff926ef97aa1c02c075f1218f22bdebfba
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQaK:A3mnXoZjzyaEFkR4ugsCqsQaK
TLSH
T114054906D69400E5D11E8230DBA54612FB777C6217E096DB23D4E23D2F72780AEEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 811KB
SHA256 38f4b70c2f96788b8b7dc768d41cd09b96aa4c8c80cdf78d432823518ef2b5a9
MD5 539c552070ecdb010ce784ae48f50560
SHA1 08ead83c921eb8a81b9da199e9ae89a6096962c8
SHA512 6615020513e39896c532e562a17432aaf07ce929ccf74d02aea185a739b60c75e58e6a8c9492d24df03f6f59c39804d5f9baed6743929645a5dc04c76768cd9b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQPk:A3mnXoZjzyaEFkR4ugsCqsQPk
TLSH
T174054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 811KB
SHA256 6f747e3e930bdc30784db3d6a0f8224d8e7886ee1f6b9acfe3ec87fab301838d
MD5 71c39cb7905cb712c1ffee745498d243
SHA1 e160f7c3d7f723a69570197e6d0af261fb1e407e
SHA512 2b67cd95984beed3a5cb12e37bd1598231147e52f76420bec137f3e9a8699937bfbfb344e38a6a66e7e10e295c944a2a5e1fa7aadf52d6b81be3527229ff8a5e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQI0:A3mnXoZjzyaEFkR4ugsCqsQI0
TLSH
T145054906D69400E5D11E8230DBA54612FB777C6217E096DF23D4E23D2F72780AEEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 811KB
SHA256 101a0cb702c0c9c630874795464475eab52dcadcfdffecdd4e5bea0323de98db
MD5 4c176c422d6052e8df141d302ae48457
SHA1 01c12e45c2705e11f091ed3bac092789100a353a
SHA512 948bdb9942e3c508aaca6187ff24e66c579c171192495de7640ead773fd0899254d98fd5737bd57334bd87251980dc8f4f80a226fa44058acc0abed9229b272f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQj70:A3mnXoZjzyaEFkR4ugsCqsQjg
TLSH
T1DA054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 811KB
SHA256 7e732b93094e221b9b44e221e14472a5ba793b85106ebf8bec0eb07f5582f228
MD5 60eb0dcd87d5f691352ee7627cb61b52
SHA1 3f6493a57b9eb0b27562ef0a6456d86ddfafe212
SHA512 a73227f4feb69f41bed65372a17008a182a11c854e1adba9acc3ceae86c0cb0cd1aca1672d22bc18f31b1bcfd67d2884d113a386459e30b9c3bd04aa5b8b9bcf
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQer:A3mnXoZjzyaEFkR4ugsCqsQer
TLSH
T175054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 811KB
SHA256 8a9b224ba056b54e51cfccd2a861b70cf5260207b21338ae42af6ab47dd373a7
MD5 31dfc4962dd44195df0a2c723add9242
SHA1 3ac4899842b6fd9c9ff00d821f3a54823fe0b3dc
SHA512 1d1350c7d5cdf5bd3471b23227cf750f2ed39e0035b22aac5b995fa52fdad95ad39131b07b5f94e36de6c02e4f331c1714df651c4bd66629d2c229cb7482b6ac
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQEn:A3mnXoZjzyaEFkR4ugsCqsQEn
TLSH
T147054902D69400E5D11E8234DBA54612FB777C6217E096DF23D4E23D2F72780AEEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 811KB
SHA256 6e0565f8d457809b9e7ff71e969675c8172a2db4c3759a7f7dd9c4330041d0be
MD5 28de5ac62cb289553a31eb8ba0dba10e
SHA1 ea53f86769b86195366d0df862be49fdf6ccc84e
SHA512 ba9505b9501962d4cde68da35ffa716694370c20c1afc90a39d8d4b8943c748e47c2935be1024965ceade195fc5dcc6fa93662868224b1ced7bf98e2a93994af
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQSx:A3mnXoZjzyaEFkR4ugsCqsQSx
TLSH
T115054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 811KB
SHA256 5b363446fcc55ff1ef7bae721e38d1c5ddc42b3e57fe4af4424ea63a8f098865
MD5 a898404ae3defdd50a83c9dc01b44c74
SHA1 4b31c9f8c1fd0774d0f04e73de02d5d388b5c271
SHA512 cc420567e55de10fccb394f27c7610533ff1d91a9f15d7cd7ea0f2c3b8e552112356eafd51905dce99e3b94fd87baea9b6b69e0c8647f847ea89eb43a50ca010
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQkA:A3mnXoZjzyaEFkR4ugsCqsQkA
TLSH
T110054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 811KB
SHA256 8da49657478a5bab6705c09d1139719d047b16ee246521d9b41bc2f72cf6be83
MD5 91a6aeb06cf6cb503b64eeae2a9cd0f6
SHA1 ecfa42e98a49407019dc2fbc63ffeac4c2bac7f8
SHA512 66a62df2f80a0f541e8fd582f9b0c2ab6aa7459669346d3c4914e1fc88215bf33d3fecf0888d774c19466f06524581d09ef028a582e63a95dbb44ed497d3ab85
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQN9Q:A3mnXoZjzyaEFkR4ugsCqsQN9Q
TLSH
T191054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 811KB
SHA256 e51ff1a40f2e1752c241f9239a39330d238685c5ce9754c757859532fddd8747
MD5 ce867c1a47f5d45d6c65b6dd0ef33b71
SHA1 556998d0988d9bd4f085ac7c767930156ff248f7
SHA512 310ca83a50a6e00a7f996001028224c8d23e48ec5abdf62acd3f2b3329bb78a94ae6533826b974c36ef7b39d4ede407b05c979b34334dd5fcbf8748340d15bd0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQo4:A3mnXoZjzyaEFkR4ugsCqsQo4
TLSH
T17D054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 811KB
SHA256 1981bac0e4ad35894fe0df5c41f90fe4f10cc2dc97fd6d32ce30bed00d304797
MD5 375ba02da3e0218cb633f8fb7fa4f9a1
SHA1 c00045acdf3d31e171778c7ad8427afb029a6230
SHA512 7df331e4f28ea45f0d3a6522cc3f55ae08d63c4218b165bf0179b8f1ac507bd685280cb1360572ac75c12c0d67315f3e1c11591c3bf364388c50c4e60e27cf65
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQ7u:A3mnXoZjzyaEFkR4ugsCqsQ7u
TLSH
T179054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 811KB
SHA256 1ae3498a9253fc0da22658b28c4d9c78d31ffcfeb28870f3197c34082a73d515
MD5 91c38cf4b413248b00d9641cc56d498d
SHA1 1540bad0d6337c77e7d5fed6a7f549a1a0cfc45f
SHA512 b46e339798ed4e122ed6ab3acca84a816024c69a23269e5c73a9e5f55afa43639cb8aa5bdc1d96a6150cf43d1ae3ecc5601589ce36146c124527f8f6c6d97a4d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQ2j:A3mnXoZjzyaEFkR4ugsCqsQ2j
TLSH
T1D4054902D69400E9D11E8234DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 811KB
SHA256 84f23f79c1d272acb8e5b55ff7ea215bc68bc5cf75b84ab7c3b8a7d4e8f3c8ab
MD5 d6fedf476b12c2fbf0cfda30cef17790
SHA1 ac253429ffbd199759aa443b657a3f473a9d0739
SHA512 36b7484be43818ed18a989abb77a28bed8f61d2dcc11e4b1a1becb20ef68c79af1df287e12842f69c4859778f6e7f8c4eb9b255005e26c6cc98214233e6412a7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQjg:A3mnXoZjzyaEFkR4ugsCqsQjg
TLSH
T107054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 811KB
SHA256 b87319eb66cb39ebcf586f97254bd21207fcc7f01df776f40d72084faa6e8d7c
MD5 8f720555b1651e4c973d400d24a7974b
SHA1 f7918d6d32ec591fe7cac68d5756204e9a720bed
SHA512 64734d2cec7fa3e9b05d81baf01e98b02a570f6e53486f12400b991830eaf453c4484ad2738d3bcffc251a98a5bd93cbbf5f9e18770d1a714dd5d6d325ceebbc
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQeI:A3mnXoZjzyaEFkR4ugsCqsQeI
TLSH
T167054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 811KB
SHA256 99766406d892b3cbe5c74c5cadb4c4ffc593893b549b44f3e68ed959a29558ff
MD5 fd23e2fbcfc049d23dd63612649d0193
SHA1 7cc90271a1d0b8a686dd663dc923201d5aa8465f
SHA512 b41b6e76df1e351afd4efd839ea5a44b9b1f2e3430b2e45ee28b546d3e7986f8a9ed1fbc4f25de585b23ce3b8915d22712e0c3b67cebf662880670d74a73ef85
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQso:A3mnXoZjzyaEFkR4ugsCqsQso
TLSH
T1CD054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 811KB
SHA256 36c5e91a013e1f6fc37480bf1bc8914d71db4f0b583753c54eedeba079d90e82
MD5 72f35d84c1e6f2769f568d6751c06ae1
SHA1 81aa616bee8abd0455de32124b8fa63bfddf8175
SHA512 bbd2d491ef45f33b5dfc4241e10cbaa2bb48c969f6a09d33ed8ed78524b32e45ebe05b4fb1ee1ff463e20d817aead69ce891f8d0835f2d537e1c0c86ad931278
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQv+:A3mnXoZjzyaEFkR4ugsCqsQv+
TLSH
T1F5054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 811KB
SHA256 e11c47e5bc6feb45cec8cbb675d12f6d34fcc6c2d229903793619dd21483bc05
MD5 293cd5a98dea16b9710f1d3965df1798
SHA1 d626f194103ac88902bda4aed7c5765c4c8f4991
SHA512 ba01bbee119f15abc189a63abfb6f1ebb678df27ba0fabddf0826c03d9d8fd7a92a827deeab9bc95be20c687e85de76e9c0b5b6323242a0ba1acd853e0f84b72
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQFQ:A3mnXoZjzyaEFkR4ugsCqsQFQ
TLSH
T1B0054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 811KB
SHA256 58dd1bc2c5d09e2e16290a10a775de45355f90f99b3267c8a267638bcf19321c
MD5 69dc343013b6562fb44515bce9b6e8af
SHA1 3e04c1c01e4968feebc363f4c66291c34ed5d2e2
SHA512 68fdd47e18fe39f90ed862921b8833402e6edaefeebac8062696f49104bf38ad0ad8b564538c942bb4586c996ec5113e0e8a85cec23b0059bd387766439efd93
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQKX:A3mnXoZjzyaEFkR4ugsCqsQKX
TLSH
T19D054902D69400E5D11E8234DBA54612FB777C6217E096DF23D4E23D2F72780AEEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 811KB
SHA256 84654e4b253b9ae773ca06dd016e7873d91116da3e61bd070e419df92775c762
MD5 1c5ecfd2f179674215709b7b114ef2b3
SHA1 6144b8c0008dcd9f1111388250512a4060a9a4d7
SHA512 143b2f1cda21dbb0c089c1613452ea02ee6e7858e870c597f1158d8934b3af2f59a1e470b01b6eaf462fdbaf59a4a7681652fa4bb468cabc7d20156468b1ba64
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQsL:A3mnXoZjzyaEFkR4ugsCqsQsL
TLSH
T117054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 811KB
SHA256 4dd80a1132aefd74fdd121d2ec0a3c37e8acb7268006962583cdc848a2667c81
MD5 f0a44c95b7d71bcb26af671033b64c1c
SHA1 91ed5cb5b1c7b54b2a6ca790a24f0bd6f6ce62ad
SHA512 5dbeeb0ccd5151b1e0baec7ecebe5d36124ba41894ff1ec73ec82ace8a5f0997d0234da53974a0ec95b5baee516cefe40b4c3551bdafcfb0ad2d4ad7b86afe89
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQoFC:A3mnXoZjzyaEFkR4ugsCqsQoM
TLSH
T1BD054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 811KB
SHA256 8c0f364be7beaded8e48796a7074f1376c898e2f49637a4f0f44fee8d02488ad
MD5 e8c227617ad526f09b43166b83a29df4
SHA1 1b9c0bb25f7103749f2333022538891bd4ead044
SHA512 2ec6809763b9a84590840448a0a99a08225ce49dea9a8b3cb38f9c0bc493684d965bd6192cf9490aac45331914972e09b830211c052a06bdd501cb31a0df05c6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFhXsf3B4ugsCqsQJh:A3mnXoZjzyaEFkR4ugsCqsQJh
TLSH
T1BE054906D69400E9D11E8230DBA54612FB777C6217E096DF23D4E23D2F727806EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3412-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3412-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4132-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads