8f6df860be8420d3346a263e9afaa6a62335820a46daebe5f6b635c57687b151

Analysis

max time kernel
103s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 852KB
Sample260813-vbld6acb79
SHA256 8f6df860be8420d3346a263e9afaa6a62335820a46daebe5f6b635c57687b151
MD5 3c8dcfeb6c1f372be9a844ffc4a56ede
SHA1 0c1cb8cfb267c8fe6a736c167bc01c15b85b7b49
SHA512 1091c57ca0581b4c9496deb17935ff3e98c4fe3f590ff3c3b251b94cede5d69bae3b78e6e1494e2ebd2c8886f04234b55780a960e810e9159d7882d487e0aa2a
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3k:A3mnXoZjzyalb5D5Tvinrm5EQi0
TLSH
T1E005E406E2940BA8D11F8174CB954662B6737C225FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2400-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5ae-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2400-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2892-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c87-59.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-479.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-510.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-601.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-627.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-719.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-744.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-787.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-824.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-855.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-874.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-913.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1002.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1064.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1125.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1144.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1207.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1356.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5ae-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c87-59.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-218.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-479.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-510.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-601.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-627.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-719.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-744.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-787.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-824.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-855.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-874.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-887.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-913.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1002.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1045.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1064.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1125.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1144.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1169.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1207.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1323.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1356.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2892	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2400	2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
2892	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_3c8dcfeb6c1f372be9a844ffc4a56ede_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2400

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 852KB
SHA256 8f6df860be8420d3346a263e9afaa6a62335820a46daebe5f6b635c57687b151
MD5 3c8dcfeb6c1f372be9a844ffc4a56ede
SHA1 0c1cb8cfb267c8fe6a736c167bc01c15b85b7b49
SHA512 1091c57ca0581b4c9496deb17935ff3e98c4fe3f590ff3c3b251b94cede5d69bae3b78e6e1494e2ebd2c8886f04234b55780a960e810e9159d7882d487e0aa2a
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3k:A3mnXoZjzyalb5D5Tvinrm5EQi0
TLSH
T1E005E406E2940BA8D11F8174CB954662B6737C225FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 c9cb4e03314907514e3225b0aacd5d65f505e1de63f637c15662f553b351698a
MD5 d60e6d9709acfc35019f768b6ae7da02
SHA1 203ba3a73aca39d90860369508b2da968b0bd1cf
SHA512 1dcddbb23d8ec190c90d15d310a6442e0d7ea83acabf71efe3eb2cdff10f372f0d3a6d99b97e2bb835525590be54683fee578d77d2f0784689396f812a36a642
SSDEEP 24576:A3mnXoZjzyalb5D5Tvinrm5EQi0P0Le5ji0hmxNrM:A3kMv56rUPji0Aj
TLSH
T1AF650716E6644BA5D02FC074C7925656FA733C424FA087CB02D4EA3D3F276D19ABA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 900KB
SHA256 f5240ec9db479f01705d6462d4dd5dc91aa41d4f1249986585343fb5a82da1a5
MD5 bbce17132c546066f764383dec1880d4
SHA1 e685ce49e5f2a561ab27b43565898c2a14488b28
SHA512 91054bf4725a24922632a03cf7dca032dca14896501d197bcd707de476da515144577d24199ac1c0cbfdddc199533b14a3263ee5ff82992757b31ad9e886c1ad
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kyb:A3mnXoZjzyalb5D5Tvinrm5EQi0yb
TLSH
T1A115F506E2940BA9D11F8174CB914662B7737C125FE097CB12D4EE3D3F32690AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 875KB
SHA256 b8613b829f39c5ac556a5216f41ee809fa08bf1eb6fa8991dba503be12bd8677
MD5 86701ce7f016212d26dc0f945009b127
SHA1 26644406fe7974f33a1c3038c603f08dcd806e09
SHA512 d1fea7cf4317d09d88a44276dcb9235f94ef79bf79235e31bd41f65f3ca43344b89487165c4a8d1b80e07090ea92802daf4fa300a96e1231ae822294154d5103
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3ko6:A3mnXoZjzyalb5D5Tvinrm5EQi0o6
TLSH
T1C315F406E2940BA8D11F8174CB954662B6737C225FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 875KB
SHA256 96eb2a8160ad3ed36d3a2ace5885bd24f38fbd9f6a02e5f22b519d8918a8eb28
MD5 17ce02c89b46d6c4c53b8b450fe98714
SHA1 7046456391d076e4f15331da2288c725935032b3
SHA512 5fec681bb36e2c278b2d52015120a39fb75e9dc3efc037df31efaf2f255960bf4b3a679c8388b0786a0c49711b0eb958452c151b1350c84db14b4331fba9f764
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3ksN:A3mnXoZjzyalb5D5Tvinrm5EQi0sN
TLSH
T1A115F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 875KB
SHA256 ec27165a8826ef559abe15707bcd27b3ff9b1ff108d0effb526fca4f59643180
MD5 edebdb83e0a851ba5284a82215af2559
SHA1 517ee86366a6a31e88be5b24de17216a37e5c02f
SHA512 b284ec4307efa02140e5eb2144523503129486bca05654fa42c8057ed4ba1ae21d99bbe39494449e34a7392b91b933b18b5b14a817d2fd31b891758978d43b0b
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kif:A3mnXoZjzyalb5D5Tvinrm5EQi0if
TLSH
T18115F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 875KB
SHA256 365e1f8cd1a7d48cb32499611d1b68d3323d43a6c0a571dea5474b616951c0d1
MD5 ffe60f7bd755a4856951b6b797a5f4e9
SHA1 7a3b794d3b814f855df230f2092f1205903e4427
SHA512 4a953c29d42e05024de9384b5899bb1a36af0b04b0aaf82508369525c13c50de69763bee7386b201039b8c9fca4c8642542e77cda807aeb5d016f0611c87ff44
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3k8o:A3mnXoZjzyalb5D5Tvinrm5EQi08o
TLSH
T18615F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 875KB
SHA256 efd183da93ff12e18d6a1568f16f1d40f564b9b2441f6edbed3f129680632237
MD5 1054c991eb38944a5a6a66cce03b3723
SHA1 b4f4cacf01de541e6efe951e3c3cc93031cc0c79
SHA512 7b21ff8d5c50edacfb794a507c4289792ca66bfada44414ce0ce823ef3ef83a12c8e096ab5d4a4ee7ca39df2e612b3587f24f4473e98705451fa7300c3ae84d5
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kcu:A3mnXoZjzyalb5D5Tvinrm5EQi0cu
TLSH
T10615F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 875KB
SHA256 a61316a897c4db1f9def4dabcac020abe9ac561ab374bdf990f7ee2ed1470d2c
MD5 5346e04292704f98b5c6b37e10833b66
SHA1 f661ccd46a462ed631027a7926dcc0935e83036d
SHA512 52990846e781f26b66117939084474514485d8f3cdcd1c4e64f07e9745b6dd81f475c7e90db7a4b3273e165344479febc870e280d2acac20ce6bd10be3e701fc
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kg9:A3mnXoZjzyalb5D5Tvinrm5EQi0g9
TLSH
T10B15F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 875KB
SHA256 8179d54c80708700aae891b357c446cd63c73f343a16b75ff8df9dd847ce8170
MD5 f1b6b6be7fdc7ab3bfedf88fd74f8c6e
SHA1 854c187fdb31bea3272cd8ce115b070c1eed9b33
SHA512 d0563a577019b532a0a546c153e7221ea565061ef9431d516d0fd84d0828747f7576c7bc461d1ea5bb5143c0fb3872fbc89b7c8a1864273c97ce733409722ee7
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3koc:A3mnXoZjzyalb5D5Tvinrm5EQi0oc
TLSH
T1BA15F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 875KB
SHA256 5b40b55311a2b125ffce8c1e55d63ca90ab47590160709a51174624c86013c5c
MD5 1c5f7e798231fa358b469b68d1d150ca
SHA1 e11caedfd6bec878544c49b7fd0d9c080bc26834
SHA512 4f5ad2dd0f8dff1bc8c278f6cc1e7109e6424b8d615e18f0e4001b56befa0edb6541931213f1e5fda413e8322aa6e613998a716ab87af59d20830191965a85ec
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kBp:A3mnXoZjzyalb5D5Tvinrm5EQi0Bp
TLSH
T1DD15F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 875KB
SHA256 760969c34701a2360226788f48fef7f733001030485bf45bf0fa98d68c1be1d4
MD5 ca2b19b30356393e73b9f1222d34e809
SHA1 2e7fcf7fd5f3a38a8161457412af3bde22ad87c0
SHA512 ca48af61cdc1dc154cc9710a72b0244ed612042b6fa10abe0cd65d241fa491addf8fe84effb01fcc2ca17fed3577e5ea71aafc8666eb49ac1ab856674ad34df3
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kW0a:A3mnXoZjzyalb5D5Tvinrm5EQi0WN
TLSH
T1D415F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 875KB
SHA256 2f89167360419f36c98790d34420045e54be47089b7fac3df16ff79f8badbb1d
MD5 c96536faf02672c20a481943ee766246
SHA1 7a1a126ff8ed013482aebcf31c2530d442f7a765
SHA512 eae05b774d874dff0005eb20760c9cd2e42a1716e21a272ef658741d0941b091dee09a8e0c18752a657ed9fe6d13fd5e91a9b712e232d00fbc46f2a987bfb036
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kaF:A3mnXoZjzyalb5D5Tvinrm5EQi0aF
TLSH
T17415F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 875KB
SHA256 5de6b13180e118ee3c87d5a44eee55b4d411d985c49978da5a99cf530e28ae5d
MD5 722f6f2e3991cd6eb737ef46a7003a32
SHA1 24644d34ccbcd980128e9a42ff0347f7342baa2e
SHA512 0e4f821aa10a50c09efb8bc006d488742940a478efd1895776bb708404ff8784dd7eedbc4f4088feec48e6ef06a7577b714bb7ab286d1c81e351385681af4f65
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kvC:A3mnXoZjzyalb5D5Tvinrm5EQi0vC
TLSH
T1C815F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 875KB
SHA256 6d6007d503df0742baaf6cdded2f5fd03b0c27d0e0333c178401221f95dce8c4
MD5 9af97f02629dadd29661ebe8cac80a85
SHA1 3a65196a55e4a6d09f41997ef3d1fc981aa39af6
SHA512 f9c1e29342982ddbb598a1840d2ad124f723be17b1c24a86761dcc0676305855c22906c8fe8f921daba43ee656cc1e5faae72ad9da15e4f98739c0f8449fe1ce
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kQw:A3mnXoZjzyalb5D5Tvinrm5EQi0Qw
TLSH
T1AC15F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 875KB
SHA256 22ad9367a16036e7bfb46f94ac2971866439a45894b0e795a60e97c0a84bb56c
MD5 b78d9d53e5d681ed17432451ba214934
SHA1 1c4577c4a6aceca0d5a8f5782e87ff2e7354d9ff
SHA512 b25ac4f8882aa90d831a94d201e879cc1b0bcc6b6e2f7fec0ba5c5ea7dd2c8dcf9ab94020d4a043936157def4f2b8841582bdf9973f36b43bb68833eca9157ba
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kvT:A3mnXoZjzyalb5D5Tvinrm5EQi0vT
TLSH
T1B615F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 875KB
SHA256 972314843082bf18b316d6da57934e4b3ee5a1a0b77ad4788d022dd85a9c2c55
MD5 1581273f86855951f99a09689e3b461f
SHA1 464f92c05f056cd5c47a5d1f03d81a5f2f056779
SHA512 534347fbcd3de9831c2bac7de9f7d29e9c8aa7c0129a1896dc11b2faa7821bd2401532238fed6a78f943e2552c2d3e769e625518bcebc4139143d91302216574
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kpu:A3mnXoZjzyalb5D5Tvinrm5EQi0pu
TLSH
T1B215F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 875KB
SHA256 7037f715bea350aea809b66d103af316425d94de39ec451781a1bb3b6e0945fa
MD5 59163bfbbe55b70e852f5b431c09046e
SHA1 dd7a649b482acfa68f52b669d518943480365c23
SHA512 cc03d49df1f45c282e71df573cf5e2b21320a0c45d3db7da9091646cda6a8ebe9cb4e3b391ea2c3eea3a4317461b084afd273879a069a7ef2e45eadf6044b778
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3khb:A3mnXoZjzyalb5D5Tvinrm5EQi0hb
TLSH
T18415F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 875KB
SHA256 3ce0d936a6fe195be127852ccff742b2130beb3cea44aae53b8e9d7d27359776
MD5 ca33e08fb4c17cff2a9d16a2c3201137
SHA1 a8b6d404ffc5160cb16c8a308ef26b4e44091d19
SHA512 8ec324763f9ee19887d68b6a5b55f8904cfdcaa6be7fb80eab8d3f35977ccf88a8a99ba82d9fe06736f060d343762e7bc71a59b083afde8ba573bc549568f4c0
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kpf:A3mnXoZjzyalb5D5Tvinrm5EQi0pf
TLSH
T1C915F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 875KB
SHA256 99ad82f8215e202c858eea6dea933e65d243e867b4e8b2d97a4a80708c529317
MD5 d84354e5077bc6a9d74638fdf98563a5
SHA1 a71792a5636fb75843cc7a69af24d0fd4e0c0695
SHA512 a0283daa6848944cc287c52ddab599af2d5be7df30a86009b815a1fdd5d8643eb95def5eb3190d72a05e0c23e26f2d40feba9255643879aeabcbb359b21ad373
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kSK:A3mnXoZjzyalb5D5Tvinrm5EQi0SK
TLSH
T1C415F406E2940BA8D11F8174CB954662B6737C125FE097CB13D4EE3D3F32690AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 875KB
SHA256 a086a1fabf8acb8faa238e186a54ee78947dcab17a6f9e55adb1532d3d11203d
MD5 8b30c4875ad78b50527a83d8f01e1bff
SHA1 01203984bb9c6c8574989d65c3fbb62d0d6770d2
SHA512 c08b49dd547523689677702bbce9eab73a6e2b758c48cf6a75643cd911a13d95eb5d0d8def4d41cfcfbe383f6bc9ecfffb1ab03cf25828704d9ba2d203c0b1fc
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3k3k:A3mnXoZjzyalb5D5Tvinrm5EQi03k
TLSH
T1AA15F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 875KB
SHA256 1479b5d10df5d044d30f76fe773d19c277efbbd08b1d414e261d3094a5db7131
MD5 f59cd0c394f4e155956951350e24dcf9
SHA1 9854943709c46321b4de0e14145f148167818c63
SHA512 f66b0105918ece726ade590ae0b0379d054577e442b506f6393c4434bdb2b089c711f2bf32e16d2ae773e22e1ed8c2f7c05936d2b29e8a4bd8d292427e104ee8
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kA0:A3mnXoZjzyalb5D5Tvinrm5EQi0A0
TLSH
T14415F406E2940BA8D11F8174CB954662B6737C225FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 875KB
SHA256 11022f433783d161a42f32933c9beea293e31f1d8f8c454f7e0e092cfb1a8da7
MD5 1e06f363e3f44b1dd8bf3e5f568feab8
SHA1 1b1da127ea01b5ae190b060530d9e2ea82d4c528
SHA512 ee29ee9849e3aa6f3bc3ab526b5141f82b9e2ab69e4ca993a78c26633405c14092d1e61b65c0e21901e2bfbb9b5392b43feae31f4f71874701fe74a0045f11ab
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kb70:A3mnXoZjzyalb5D5Tvinrm5EQi0bg
TLSH
T19515F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 875KB
SHA256 6d8c1bf5877585b86a1920f73503b7065f59e15fc8d8e825f6eccc9c5e7cd25f
MD5 7458504f7eb435a5c9d6527fea3dd74c
SHA1 db1b1620cee6082fc20fc8ce1733d62f57254c2c
SHA512 de6a527a19dc024f6fe596e66126160d8736c0e82bac0d5da462be7203fa8a771132edfc260528c2de9c53f0687e0a9c28edc86086972070aa8569481e98a1a0
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kWr:A3mnXoZjzyalb5D5Tvinrm5EQi0Wr
TLSH
T14815F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 875KB
SHA256 7460f3ef3f774a39cbdc28e0196b084da8a6b2014d80db19e05c2f8f4ab5e9d7
MD5 6d7fdeaf5a38f3aad52fe5700418c802
SHA1 e3e4a2a70eae0112dadbdd39ff2df680ee587e25
SHA512 0b12a4e7249f16b7d1ca6e1fcf6230a75a3deca6eba7f2c1c2c0597d520688aa258e4b8fc0d4d3ad5efbd31510c505ad324319d7dbfdb5e5a57471d0a458f8ed
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3k8n:A3mnXoZjzyalb5D5Tvinrm5EQi08n
TLSH
T16115F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 875KB
SHA256 2b965f79fa681cf4bca102cb823b314c82e6e6b54e5f1d8a6752d1bb9b695990
MD5 84e20b3af683a324c284eb5d7ca7dbad
SHA1 c91d6bd140d09326580680f136a6fe1e95d7c0eb
SHA512 1e43fc22d07788614d527c16c0e7d14a38e280741b3fe0e54247f104030e7b73301bc17af7c2d1219e047abc88c6b60b4f399d6506229a703524c1af24c10400
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3k6x:A3mnXoZjzyalb5D5Tvinrm5EQi06x
TLSH
T1D415F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 875KB
SHA256 04f639913766be7a42861b0c00c63a8a5d63c0fab0e7bd924e987be4a72eef24
MD5 8ac5e05cd2c788611541b6ded051af90
SHA1 0c338c15bc385c68fc15a01adeb8d05fbf30012d
SHA512 95b5faf58fec395aeeb21eee52b5f0bd0344d6940ab4c0fcc30a0c2dd6aa876bc91bdd376fc0e77b29d08abf16fa6cd4cbe4f051b795de41405223ec331fee11
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3k8A:A3mnXoZjzyalb5D5Tvinrm5EQi08A
TLSH
T1E215F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 875KB
SHA256 2c9170f770bead606b235ede7ceed61225d2ac7108b31daf9c0d6ff015d3361d
MD5 e2b30d537631429409659957c4496fa3
SHA1 c9d27b5828faacb900a2912567f4448e1b6b39c5
SHA512 08c2986d9c0abcf1a87cafde74dcd69900c3de48af2273351eda5abea9053143d466bca90a9ea907c71162f9bfeab994e9ab1b7af798f25e60a7dcc43f5eb68f
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kl9Q:A3mnXoZjzyalb5D5Tvinrm5EQi0l9Q
TLSH
T17E15F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 875KB
SHA256 f9658498e43a4658a6864d42c68d0c65b0f8f3c291ea04c10d7c799a9ac484df
MD5 aabe404b44c9465ae0a61b75ce311507
SHA1 8550a8f408bcc2d40580504feb287d676d02446e
SHA512 664ea1e9fa038e1f0ba5e81cdb1f06e77ee24b68ec3abe76792c187468f6934d6e81c8f25c689bff17147b9ab3d62ef335c35994c00f1f4efd67ad8384987183
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kQ4:A3mnXoZjzyalb5D5Tvinrm5EQi0Q4
TLSH
T1CA15F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 875KB
SHA256 1221157ca4c25eaeff924f013eca197560cfd363c4609ab258e5aceb72c783ea
MD5 8b140781b9b2cfcad719b63c757e039f
SHA1 a1e45e9d5077b17b5df42aff11e5bddb7a2ed2b5
SHA512 44dd3a88bd03fe6212703fe88d1aabf3390c6f66f22693337a384e06c0e01b637245617f584fdcaa28418509bac540ff10dd6eb4e9fe4fcea8c7b8a8a04e480a
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kTu:A3mnXoZjzyalb5D5Tvinrm5EQi0Tu
TLSH
T10F15F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 875KB
SHA256 c90f4f5485aeeef23676d7556be4773efb2b3d0fd3aa663b5f433e32d076e56a
MD5 946649b3af1f90cbd098045bf5b0ec78
SHA1 97ecab37f73c29bb110192240a31e8312dfbee2a
SHA512 6c5e53492f9cbcd4f5ca52ca9525c99afec474962452d1c995dd79407bf632aecdfffc57e4bd20d909571942d2a38965ed0200104099a33d386bf5ba37d4fbac
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kOj:A3mnXoZjzyalb5D5Tvinrm5EQi0Oj
TLSH
T1D115F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 875KB
SHA256 ca2d8743f288ab0c4bf3aabf7aedd1349aaae301db6eb2d57509af4e94a56df9
MD5 70f127ef181bf8f00e40ee6599d8c284
SHA1 f23e5ff6b1facd192aa504297a585a76fc9e1bd3
SHA512 0b033ccbf0e546574d57768e8af510335fd8b25733f9206696c62df69bedc811d01a01c08077e0118de61809bef3ae1b1e91bdc292d94ced20067c6aa6b4a97e
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3k7g:A3mnXoZjzyalb5D5Tvinrm5EQi07g
TLSH
T10315F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 875KB
SHA256 53414f998ebc61a0476ddbd9204b706f783a36bd73299e093160be505bdd7c79
MD5 e6fb1f99d8b5bb4cb67e3c59f41cc50c
SHA1 6e6eabd45791175348e62fccaf9adef37f277673
SHA512 cf3153f2b547e7e395ecc10413d3b55faa35e3e3d539a5df903fdf8cff1db63ba902bcad683a06cd49d00ca65f8b2849860d241f4294442da333312760338559
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kmI:A3mnXoZjzyalb5D5Tvinrm5EQi0mI
TLSH
T1BB15F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 875KB
SHA256 22b5a0cff37a82eef52b233fed52f9414fb059eef50e1e55433dbffa60970be6
MD5 39c98569671fa13c21277ea80d7ef586
SHA1 c8230a85aa55b64ef05d5183084e542d9cee3d7d
SHA512 b1e68e4384857f9fd758621c2b2b28246cdd65103802acf360ff0a7f3d227125ab9bf1f37ddc1972e7da65643ac7e73f3c226222819ee02bb17d81d90cb5557a
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kUo:A3mnXoZjzyalb5D5Tvinrm5EQi0Uo
TLSH
T1E515F406E2940BA8D11F8174CB954662B6737C225FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 875KB
SHA256 245faa3bc68aa48cf6a29539565d07bb965f14374a12ff7d6e53ba307ecf8891
MD5 4b743ac76e39039cb5d03bc466bd41ce
SHA1 1b3eaea16e8bc74f1b50a0100a996203956aee75
SHA512 0fcdef444882d8d6851643d7690c6cc9d77f39c247621194cb78be29ab5e39155e9feae3a6b1680c45711f02d767d8987325ba4dd24e04d83ef7c8f0af86ba5f
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3k3+:A3mnXoZjzyalb5D5Tvinrm5EQi03+
TLSH
T14E15F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 875KB
SHA256 7df081516ea11befdce68f5cd6b60c8af226c93ae8ef1e5c3ce4ee169e113881
MD5 2d2e422a6fe00179e4da8a9cf80b12fc
SHA1 ca593285174338033d4d0f09867913270012854e
SHA512 121a1e87188505bdcd97d787d588e9366d3a87be3268e2a82fd6671aaae6976d54e90e3b0c509e533f28df52888df7c4e874a8a50332cf4a28a0baafb2d413ec
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kNQ:A3mnXoZjzyalb5D5Tvinrm5EQi0NQ
TLSH
T1AF15F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 875KB
SHA256 e20f1b76272edea51917a273ff4c7c5fe5d386dafa57f0eafbc031f42fa0558e
MD5 085f1666cc5d7782f1be45db34c7e3b2
SHA1 b8cc404151de0113bc1af257b65bf811cbcb4434
SHA512 8737b36e29455b20c002cf7b59041bdbed9893476ba8113e3959703314d180506d90a280d3ed9534303ff6f539cc3cc9478f26c59a1da6f617ca9568443de9b9
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kCX:A3mnXoZjzyalb5D5Tvinrm5EQi0CX
TLSH
T12215F406E2940BA8D11F8174CB954662B6737C125FE097CB13D4EE3D3F32690AEEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 875KB
SHA256 5a9bf97c55029d4864d39ea5a10db2d4aa7a880eb7393450a31a0c211f2c2450
MD5 a290b23b8f3faddcee48a9564a2ddad0
SHA1 66f5b94c17d4a931a73b053c38d39113a7cb7884
SHA512 c7f11b8af8241ae2a29773252de08e4e61ff15faa9a60e75828e918f6e4f132165f2215c7d099f466c2b67a661a23201ab686bf5c1ee9d01ba8fbdd6000537da
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kkL:A3mnXoZjzyalb5D5Tvinrm5EQi0kL
TLSH
T1D115F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 875KB
SHA256 2ff049bc8e9bdc317ac3e1d6a4e5db590bc3101416f29dd00738f5999856c780
MD5 e12f78dc4156c3f940fa4657538333b3
SHA1 d8d549c106a91cf71a6e3ef3e23612bdbb0cca90
SHA512 d59d3f24e364cb29a4fcd55fd1567bd6a9b893fbc484f94606b18180be5741c67ff748d9f984fb2ae44b66622b3f6fb8c59ad1e809cf740a0e6e7d095e4b0f2a
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3kAFC:A3mnXoZjzyalb5D5Tvinrm5EQi0AM
TLSH
T16315F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 875KB
SHA256 8d567c0b2ad0a0a774dd8c82618edd0a19dde19ba203584f682a390e4d8de900
MD5 c38deccf3d9149dbe545a1bdde608d6b
SHA1 a64df865c7f321fe20ea0231d4759e18b080d66a
SHA512 dcec368403db90838bfcbe4be0cb28681ab88d94abc07b0be370f80e09a187fada75132887487b5a8d9f3e234d17cb22e14a357f2edd1e5ca04e7a475972a3fb
SSDEEP 12288:A3ZUnXoZ+yPz5L8alb5D3JeU7vinrm5EQ04Xsf3khh:A3mnXoZjzyalb5D5Tvinrm5EQi0hh
TLSH
T1D315F406E2940BA8D11F8174CB964662B6737C125FE097CB13D4EE3D3F326906EEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2400-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2400-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2892-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads