15c74601e98a14020e70984570eb98623ebcdd1b8ddc3e3105024a62146d14d1

Analysis

max time kernel
103s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 929KB
Sample260815-k41z7sshla
SHA256 15c74601e98a14020e70984570eb98623ebcdd1b8ddc3e3105024a62146d14d1
MD5 96f2125d423531b998f9ced9fdc592f8
SHA1 526e34cd5c7f40dba1974afb89118e044a4a3546
SHA512 80d9639b2a85a5dc520b83751a46c412e20dc05cef1a6970949880e8679017077dc277df22b70b8d6d973c1003704649180568a9be4ac020bb0b77e28915faed
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJ9:A3kMjKsT1LljX
TLSH
T11C15BF03F79004F9E96B823499A54912E771BC561B70C6DF13A8A2262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5860-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c53e-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5860-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4348-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-216.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982b-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-424.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bc-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-528.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-607.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-638.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-798.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-848.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1087.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1193.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c53e-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e6-41.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a3e-216.dat	aspack_v212_v242
behavioral2/files/0x000400000001982b-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bb-424.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bc-491.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-528.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-607.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-638.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-798.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-848.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1087.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1136.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1167.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1193.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1334.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1366.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4348	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5860	2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
4348	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_96f2125d423531b998f9ced9fdc592f8_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5860

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 929KB
SHA256 15c74601e98a14020e70984570eb98623ebcdd1b8ddc3e3105024a62146d14d1
MD5 96f2125d423531b998f9ced9fdc592f8
SHA1 526e34cd5c7f40dba1974afb89118e044a4a3546
SHA512 80d9639b2a85a5dc520b83751a46c412e20dc05cef1a6970949880e8679017077dc277df22b70b8d6d973c1003704649180568a9be4ac020bb0b77e28915faed
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJ9:A3kMjKsT1LljX
TLSH
T11C15BF03F79004F9E96B823499A54912E771BC561B70C6DF13A8A2262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 8783e15871bfedbf20f17aee0ba3afbc9aba65c5adc05e7ad5c05469f699e64d
MD5 d6afd6e57a08e22684a9f046ff6701f4
SHA1 f37f5e767589850dab65791b264bc2a333c2a61b
SHA512 ddae8f5b77e4168653ebc0f12f6cf380024aa63fc2e4a463d5834ea203051fd5e36478429fd1330807dcea823a31928153fe1f78d5d658df4682f0b727330abf
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJJ0Le5ji0hmxNrM:A3kMjKsT1LljTPji0Aj
TLSH
T1DD658D16F6B442B5D073C179C9E2965AEA7138821B30CACF1398D7292F337D19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 943KB
SHA256 274e994ade9757687190375b67ac4613f7f280a0ddeaf9ee3ea1600dd2ba8063
MD5 025bd3cb53a0acb4fb76eedf68d649e3
SHA1 743e13606c3eed1b6d72b8a02c3ab9435b674c21
SHA512 9d6eaa24d2506f754417a904bc88a372c4c1172e1329b63c6fc89bac55e8ca732e6d2a612137be34b1da47ced540c316d6aa9a5c630902c2a93d1f25bc243513
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJba:A3kMjKsT1Llj
TLSH
T1C225BF03F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 953KB
SHA256 064b0257a33924b20844e5129530b02946d401717b44ed91846ebdbd37299da7
MD5 3a6b49707b11807a8e88a722764c446f
SHA1 2882026e6f9112ec7e3025ec08a3341aa9635dba
SHA512 9113d0fc9c3b70891b0340134aff0035a67261224a33f05ec92fde944fe294ba69127ed26817183ba920b24f95fd4632c0dec572961f47007edfcc113e03c63f
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJ66:A3kMjKsT1Llj7
TLSH
T1AC25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 953KB
SHA256 fe3708581126517182bce28566fe5e7f5917566c15511dc7842b5a441fa36bff
MD5 4e49251fc5c8d094ebadecefa6af3d46
SHA1 0d43db0a25add46db2c3f321c3538c3e36e5e4d4
SHA512 8fa241788e934228eb155c407b08cad49eed9151cb6c4db808df02150d1f5a7d35ec62be5403ea07766d8d9172f38504702f87c15616aae15c1921ba480f906c
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJyN:A3kMjKsT1Lljm
TLSH
T1C925BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 953KB
SHA256 802a137e4500aed1739e4324e4406feb67450cdbd591ce7f8582c9d902a546ca
MD5 81c63c853171d9d6494cce5b1460707a
SHA1 8ecc46841da511ed3215e358a0b8549f350d9583
SHA512 aa5d4f1a6a674947172a84da3881d3c69be6c3d1a688a37014a0128fb313348f9ec398854a1aebe9cb00cab39b57fe73573a3ec99bf83a352f38baf45377a678
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJof:A3kMjKsT1Llja
TLSH
T1FC25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 953KB
SHA256 95689ca339d0ff94c664731fdb18cae30b0d395dcafdca145c08b2440f2eb6ab
MD5 4b35240808b298edd44f13bfa94c0ecd
SHA1 dacec29a34701c7a48e550ce003808d452b6079d
SHA512 e346e1c8fb1ce4bfd47e185df3c6e30c5a028a2453629b0e585944ac0c47e5a9463566b355809655234cfdf10e7e5e50b1830e1cfdd5f6b20b131aea2c02c080
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJCo:A3kMjKsT1Lljj
TLSH
T1E625BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 953KB
SHA256 a6a98021254c6769448031850eb0a3bfd0593b6e51acfcb58da5ecc8e604ec00
MD5 4ebcbe4691bd68c8643c801d2ba65f2f
SHA1 315d15fe5df3a6d0f44c9619fe0dc077e791d913
SHA512 48ae00b7e22362c46b7bf1ff0559fecb7284b7b4e1985da0b79120448025ad482a278c03f1211f560d07920a75787621bfdb1959c964e596c5c13ed83b704ecf
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJ2u:A3kMjKsT1Llj1
TLSH
T19825BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 953KB
SHA256 877d15d2f8264597bc4c104d95bd5dad95be9aa53ee6d3f7346924144c0614c7
MD5 64795009cf52f49f51c97893ec53b837
SHA1 22d7386735773e18399b98e8927114cbcd96fc5d
SHA512 f69118ef100ee23ebda6ab49fb33f9e16c5614a37bef9b878c1d8585d21417b4c71223b5dd9229c7d952d3ef403513c6b78c4a61e8740ffd8f9eac6ed62fb198
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJq9:A3kMjKsT1LljA
TLSH
T18D25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 953KB
SHA256 2a0025a636127bfde3db03489c70c5a8041d4487f1506fd1c4dbc6a475476494
MD5 439c11fe529722b8a325753fb2c68ce7
SHA1 bcc2742fc8353ef8cec3701818978bfa31e80e86
SHA512 b2d26197efbc920806919bf436d54c5c930581175914a2009179e5825df01cccb53a51e9b91af0fbb4bfa081f7776c35a14e62633f72778ac9643475cdc8cf5d
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJqc:A3kMjKsT1Lljx
TLSH
T13F25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 953KB
SHA256 c95ba62481b6a4faa2f0dbd16b054b4d6f2cb07a35db36dde64a45d806993b85
MD5 b29b854005ecd4d6149ddabfdb6d06aa
SHA1 955ebb25159f3808aed7364c866699124a60567f
SHA512 f56ace274175275f030b7193f0bc50af00a5b9ea1deef507206f20c7a5ea07de61ba9a7eb7fa1811305304723b366062e26b8e9eeb1c3af9bb7729ce1c4b5488
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJjp:A3kMjKsT1LljP
TLSH
T11B25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 953KB
SHA256 86805e95e80bfb80de375183da5a59b59cc04b2cb8c23ea39898b546f943a88b
MD5 5a1fe65ab58c707ac40d8e7a3d1ec701
SHA1 db7cb142e5a42cbcdf6b2660d9d06c28fcaf7a98
SHA512 2e3845db6b66440f92792da98bf4624ac842920ba333cd0bdd875d4a529c23fbeb1bacd48584195adb85393ba8dc15fd1a0f8b3bb70df030993b4ee58e983e0c
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJEN:A3kMjKsT1LljE
TLSH
T17625BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 953KB
SHA256 f6d6fe3803a3abc85e9042b260529c69001150122526dedc9e48cb44262af3d8
MD5 3f75115d6f739a9b6b58ad947d0e726a
SHA1 e5cc100678d8ef05822e831109831654984cd38a
SHA512 183c7f7bff43b1cf306e7b2fd19d0fb42a865d72eca183abaddfc3455a4c740e35ef6a7c005e69f27e5e737497759962e6cde5e3ddb76e57ebc7ee80dd609597
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJsF:A3kMjKsT1Lljy
TLSH
T19D25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 953KB
SHA256 4adb84a34e9d5adeb2031ca6a0e5c129a6d9129ba18d4a5a8194fee4dd5c5284
MD5 c6b6dbd06628005fa49ea5c321c74c0f
SHA1 a78054fe4c4083522bce3d2160004fe55a9bd838
SHA512 d2ef60d55c9c6bff18c82ba7d4bc3dd417278739e840ab41d1f0a7f67009b602001b1e5765e52349372019072e0e05472880fda2fea54824386e8c67b9f7f17d
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJZC:A3kMjKsT1LljG
TLSH
T1A525BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 953KB
SHA256 2b698a009c591529913788a1d1a9ffdea2c0b7a9f707c72ac1a8cf7371cdd70f
MD5 3a23f8011961b7f9a7a9ac1763d60abd
SHA1 593402e32f439107d756a9ec5590936181725eb3
SHA512 37008a633f14af0e3942e64caac38e36de65844cc2f62c050b4bccb8ef829641584a1c4d61be51ab7e23955400325adbf3820dbbf207acf59968eb4637fe6543
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJaw:A3kMjKsT1Lljz
TLSH
T10525BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 953KB
SHA256 35a18dde34f434e9fac4d1795f9932740f3f44d1a0fd295972447a967d327ae8
MD5 f1e14f918fb16150db2fd829dc3c085d
SHA1 572a933ee21ea7cec7a5c4c74f576cdadd6b2d95
SHA512 ef21f1be1a8f5b28f3a01311df67834d692d1a7b90cb50fe01a5fdcccd0bec6cb20835918de23ef99dc18c59098e9191a9bfb12e809459f63f13a0bf02b375b3
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJhT:A3kMjKsT1Llj/
TLSH
T1C025BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 953KB
SHA256 fc3d13f119910968534ab14d3bcd12d435d42f33140a6b2ac63348ea6cd1fed1
MD5 83e3dbf2379e7280066ee4e38288b16e
SHA1 ea815e65c1149076d9ba011fdb2c3c24facfaf1a
SHA512 71a1f5fd9f60ac45f70b49820dbdad4764079b863afbd8f33ddc3b166f32ab9af6cd12c6df696acfa5db15410b2d12af3e5a95f9d514d1fb9ebcc7079f189e22
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJPu:A3kMjKsT1LljQ
TLSH
T1BE25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 953KB
SHA256 9b8bcccf3944e8d99afee8aef8bc4bdee8c9afeb754178d08020a62fa3f80c74
MD5 ff5c2082590cdce99f989bf72882f341
SHA1 5b4cab0594735ee7453c54068cbcbc581933e612
SHA512 7a55476383874ee4daafd2b99e84022d051d5c694395fd28ae86434d9a58ba68e20a61be11ae78392085528e2af4d06190fe90dda783f6b87031a56679318db0
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJzb:A3kMjKsT1LljJ
TLSH
T12625BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 953KB
SHA256 6fb97ee398d2ff0c2f67a1a78944b40594094ecfd00383c4d5a5bb641d8865c3
MD5 171a762adb29f1d6443ec8b7ba894e62
SHA1 60f7351dfa6f9fd12c7cd631337738df4c2b9746
SHA512 af4513cd5eca73c4fb8209bd4b9545d837d6918271373c6b8dec7663ae0bbb5b404286147ba28dd23abc2f6f60369a567c7b1f059b5234d33339e3641b899fe4
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJHf:A3kMjKsT1LljZ
TLSH
T1C425BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 953KB
SHA256 53756303f8be84a6cb064ab16c1b481aece77637f7d08472f761e81371b4853f
MD5 aaa1891a2d0d063bcadb61e511ce15af
SHA1 d2f7ab16345875e5b3004110d0023553b73c8a50
SHA512 2cb37815db0b1268da11727bf0f685c101afa26281100d91269ece15903309d10515d4f298a960d35f04d868cfc1bbf60511087a6da32e92337b8f5880bff34e
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJwK:A3kMjKsT1Lljx
TLSH
T1D025BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 953KB
SHA256 2e25434c36d731f6653368c2085211ab9b60ce3652bfbfb538ef6aa35f04b3ac
MD5 88e9f51f61b3430b33aaddb4d795901b
SHA1 27b55b5eeb70b861da71272b4fc19aeb13129bb5
SHA512 ba0d432ed0e023a2ba314cc07c5a6dae2301e0fba54d856dea1177fb99ad172600186c508719b96c5bf284ad77583c322b6e9c8ae7653430e5f75eb2ce758033
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJtk:A3kMjKsT1LljY
TLSH
T10E25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 953KB
SHA256 70891877e10c9cff56e65cc1e0190a830e5b4860f79ca02829bb9a4a0b7339ae
MD5 8503bc5dfee272c538eb93ac2961eb15
SHA1 b932782fcccba49e6944d61d6ad1f8098cc0d7e8
SHA512 1ba03e05d8fd48c873d35bfba7444cc831ca9d84c976a2402aa8645977364ea8fc016f4a9fd98fb81d5ce1770a718afb23cdf6d69005262b110fc5206bdc0856
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJy0:A3kMjKsT1LljR
TLSH
T15A25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 953KB
SHA256 cc63977cd3c47cba2791ffdea3e8a29b5028139b8085d22a55cca56c5ff820e7
MD5 acb6dd2771c8098a2198623bceab0e92
SHA1 258f2e631f5d801b9be4476866ca0822c1702047
SHA512 6e322df43b232b7e1ae3abfd2ae72e9440ffe408ca26a827798e2768f29a4c51cd0ffc7cd6f0d52f944aaeeab64b7bb0802210a291e1b23dc6c6b29f44f8e786
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJBg:A3kMjKsT1Lljw
TLSH
T1FC25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 953KB
SHA256 5ed17685e8a6330d11550bf7c8937e3e26ec02279b9e78494ecd497c243a9fda
MD5 3039d1276b677037552a1f5a694fac8c
SHA1 bebd1e7ae3bd9d05e89da60af4a55ed2b58c5ce0
SHA512 95798c7013f5d65a8384cfda68c754e2a8accb289087236fa6981e9a837193e47bc8402934b44403f54a28b57a9ddff52b0e936843dffa5c4725c7721393385e
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJor:A3kMjKsT1Llj6
TLSH
T17B25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 953KB
SHA256 bcc6ff0ab2e647891508e122c70129d5754fcd5dbb96787ad1b56d86fa03d696
MD5 df6a1ac261259df8f7055e0238c74d1d
SHA1 dcdbf6bee2de6738b77112a62d9937dca9024a4a
SHA512 91c6088c197fa3ceb44db34b8c475806ec9e6dee57d2fe235bdc23c182633830b659c5d054a92a5588b7f7b9af26cb5a2b6bf02548e40d7eccd5ef4a98e5431c
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJGn:A3kMjKsT1Lljc
TLSH
T13A25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 953KB
SHA256 b3b22af1ab35e7d5554e414b56eac1182f6875b1b9f70302fc95c0d5f34f18e9
MD5 c2a1ba624fd1928c2a1ee25e589779be
SHA1 21adaf8f7a18e97e7d665a07dc9703ae81071e0f
SHA512 929da7c445e234bc4bf3038e98aff57143a5740a739fd720c4eb1ff13dcf8b74a5c0fc2bc185535b2b8f38abbbf1c62fa57ae292dd01c83e359a24f8a14aebd4
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJMx:A3kMjKsT1LljK
TLSH
T1E025BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 953KB
SHA256 6de5ba2ffc3f0551f679e6836b32d584e247dc20797278ab5700014538b567c8
MD5 a16f9faa7df7bf7860e72eee0372048c
SHA1 0ea3e20fefe2d75058eab903534bbe6eb827fdaa
SHA512 66f4da1a758e291f8126c52f301370b8de87f5668dbab748f4eaca621db6b5d75896660a64f7672896b2cbe6823d06d91d7a4cd2ac372e3080046f04edb8a815
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJGA:A3kMjKsT1LljJ
TLSH
T14925BF13E79004F9E96B8234D9A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 953KB
SHA256 ee81fa9ac6ef6263f7537ef84bcac777c406db92c2517c9d4eaf577a586eac90
MD5 fe0a80f3f8e659b63304d85429d70764
SHA1 a8d098b4ae42ca7f46d2fa6a3dcbd93d9af8bf3b
SHA512 c6b4c5070129c91cffb4fe2080649c9df62715613f670159ac22d6e711206574ef81025df33836b87989cfa5c4cdb217197fde095786e738a4661c4aa268babc
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJf9Q:A3kMjKsT1LljQ
TLSH
T14625BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 953KB
SHA256 240e9d7aa0ac96cdd8a991657561ffad471829300aa44930e98cad7e714b5bfb
MD5 06d09b662a8b7dfd50528f02db219e05
SHA1 e1f6cde74fc1af52b3f2e2aaa976cb57062b0674
SHA512 9a6221d1bf0bfe92096995eedd8c445f2107442a43865bdc72241df0815fbe36998a6518ec5a8e1b862338aa13aa318c87f70dc8de31626d29e3333aa5f09cc9
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJW4:A3kMjKsT1LljL
TLSH
T16C25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 953KB
SHA256 1d763ca425651c982ff3a9652487e07f7ec6d8e1581cdaf96de98c2a8c1ec95c
MD5 5ae4cc0c7752799c23cb5cabdb1eb3d6
SHA1 083420608bb9354ea73109dcaf8f08abd2e0097c
SHA512 d8f5c261845ec3e6aace7af5269a956d609ddbf5c9cdbb6a8c3eb500a69c63e65d67a0bcab90903b41be39709732d5f138071b673fb40813cf8597954f9dce86
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJFu:A3kMjKsT1Llj+
TLSH
T11C25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 953KB
SHA256 a22b332e2d881df823b12d144b3a751800de67168158c8d4d6c8583f1be746da
MD5 818bb777edcf76619c9939c2028a25d6
SHA1 aa95b20ad9e252858cc00d5831964bc798b65899
SHA512 4c2caa38ea81f5b655e4d9319f4076b3a632072e8e346f06e23e260a6d4206e3748fc00b22a9ead33cc351153e495a6b6a5cb9b2d106b3a2cec286d4e61ac1ca
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJYj:A3kMjKsT1Lljw
TLSH
T13A25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 953KB
SHA256 8ced08d3136ee5b8ae141fa91f5abb4a70901bf6df0c229b8c2c32e8287cbdf5
MD5 930dbdffdd62198f378fdae6e34814af
SHA1 d5c5071ddf4ba317e307624c43fec9e716499751
SHA512 7447e105c2e71f73abbcd6adac28ee1295edcad7ec5d68652d2c8428758616cbe96f0b6af379db650db0072ad5732f86961e2d603d9a78f566cdf78367c364d6
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJpg:A3kMjKsT1LljI
TLSH
T18425BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 953KB
SHA256 443225f9e932260bf4a562eec17a54cd40280a80433d199ec7815d27e0762649
MD5 00cc3da9fed200e2fbd6f77eb4f1b76e
SHA1 f88832fafec68ab9cef8d4597d46d23919d7b07d
SHA512 fb79f0cb3e66ceb11523e921df34daf04324ed84c5005227fa3c07cedbd4f758b016fbcec5616924710577eca8d1a929eafe505ba6af64a8691d9348d2268a1c
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJwI:A3kMjKsT1Llj5
TLSH
T1A325BF13E79004F9E96B8234D9A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 953KB
SHA256 3daf32e4a7b42727888e92ae60d485ed2d6fed2fdf5d467c6beb025a408dd21e
MD5 87deee7c25635693d44c111561046544
SHA1 d33a438801081dd80ad18010888ee9e26b9938c6
SHA512 72f1b1fee6bb228f312c1285ad851fc8b3ac6e1117546795a62398359fb282e1a51cfef834d57609036e7a66e53ca40b9b569687858fe3f69875fe4302625054
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJyo:A3kMjKsT1Lljn
TLSH
T16925BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 953KB
SHA256 a1b743591f851f48cc018167e8dd7386e725bb2df09b6d5d3212c0c13b092aad
MD5 9f45381327be57e9e1deea26cc4ab044
SHA1 b5e8156cbfb74d09cdd82466ba18c88212f18478
SHA512 1831a6ff0aee439bf0ade46d98a59c96afd9a7724bd8f92f0494fb33c0d3ab48b0eef4df89aa0931512674c70e19333f100d1e98cb22ceb7be4974cb0191d616
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJp+:A3kMjKsT1LljS
TLSH
T14625BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 953KB
SHA256 51af121fed34a49c959bbb69b88515d3a1620d12b571d2e5c9cd900e7f91b237
MD5 772e398ff4674a170fcc697ae2e1cc95
SHA1 ed5e9548aab4a5d51bcafbdd09ef293d7485708a
SHA512 a7f7c09d99204210bc9f223ec28bd8d768de178f311b57bea427e4063370e53942211084be8728de1fe17835d87d596e03c49046609520aec1e1019559237cb8
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJXQ:A3kMjKsT1LljG
TLSH
T11125BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 953KB
SHA256 62c152cf2d5392279abe87393f254bb50d499ccaa210b85e1105c866d37a113d
MD5 2b32e64872c694d537b3a92a94f5c186
SHA1 9d8a032174a4cd3071a75b8f94a7fc13c1a96cce
SHA512 6f96a7dce50d4fe259bbce25eea58be13bc173529f94c3ed123b06f86032cbcde8765b65160dc31c5d994c3473c4875dd9d0cf2379cb9f29725873ff1df4aab9
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJsX:A3kMjKsT1Lljm
TLSH
T10425BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 953KB
SHA256 949cc5dde52c205158b4473b38c12c939ff1959c6e835ccb63619013667fbdcf
MD5 305b479b715be7668a34201a437c4ae5
SHA1 d79c5c96a27887297f44e40a341cbf22a191d47d
SHA512 85db07570720f2e269e9572b8a7c14eb9d9d20b5ff6cef8ab22e942809bfc68119b79d71ae00a44071eda715a8cce4b54843e2d2c5c0d9295d46bd30fb4409f5
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJKL:A3kMjKsT1Lljo
TLSH
T12225BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 953KB
SHA256 8b8719b2d37a6ab8d04ade103361cb124456292624825192b1261a59603fcffa
MD5 bf3e0985969a22ea5d693084155f7e4d
SHA1 8ef83f8d397ec71321865eae7ae3d871407cfedd
SHA512 2eb467bda7c17fcd39b60567633b4638dd6bdff90fda7049b220a3d2d76907cdb308dd37bfeb2645e9dfbc5c5a731776ad78e198c185b3cc6018eeb13003dce4
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJuM:A3kMjKsT1Lljp
TLSH
T17E25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 953KB
SHA256 830c090dcb985d2f954cea2dbd1b2061ec55db69cd42b1f1c85b8fe5d7ee96b6
MD5 a090fbe95320caec03c74ce2e830a570
SHA1 5258124df96a2f3000006b6d66f883c8e0ba7107
SHA512 409d5a1446d5e7647def7c5c6dbac40897f7317879440992bab131f73e0b90907b155451e65e9bfe240e562c31f1dd6fa11e9c09feaa81c7aa924d90f1b7bce5
SSDEEP 24576:A3mnXoZjzyaEFyKUJqqTWaLl3z0zDZcJ3h:A3kMjKsT1Lljb
TLSH
T11C25BF13F79004F9E96B823499A54912EB71BC561B70C6DF1368A2262F337C06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4348-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5860-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5860-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads