03a1a4d1ee513f834f64ba03acc12858077b25cbcc33783f7ca32a9b5045316f

Analysis

max time kernel
106s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_a1e53713925d01979a65f0514cc3da09_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 951KB
Sample260818-28kmfssdrd
SHA256 03a1a4d1ee513f834f64ba03acc12858077b25cbcc33783f7ca32a9b5045316f
MD5 a1e53713925d01979a65f0514cc3da09
SHA1 94f97a2a280733317ba433277507d3edc0754beb
SHA512 9060f0ab46243718b5ff89955687460d3f285ff7eb38912ba7cd63e57e924e34dddf73080d62f3e74d066761e03d413300e2b9a817079144f32ac48f24b02c61
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2u:A3k03kHRJsW
TLSH
T1B3259D03E79500F8D15AC1349AA65A22FB75BC26173097DF136486262F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2396-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4a1-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2396-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/236-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-675.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-976.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1037.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4a1-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-224.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-261.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-442.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-576.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-619.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-675.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-737.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-786.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-823.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-854.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-873.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-892.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-905.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-918.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-932.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-976.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1037.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1062.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1123.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1148.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1173.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1180.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1217.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1321.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1372.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
236	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-18_a1e53713925d01979a65f0514cc3da09_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_a1e53713925d01979a65f0514cc3da09_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-18_a1e53713925d01979a65f0514cc3da09_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-08-18_a1e53713925d01979a65f0514cc3da09_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-08-18_a1e53713925d01979a65f0514cc3da09_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-18_a1e53713925d01979a65f0514cc3da09_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_a1e53713925d01979a65f0514cc3da09_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_a1e53713925d01979a65f0514cc3da09_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2396	2026-08-18_a1e53713925d01979a65f0514cc3da09_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
236	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-18_a1e53713925d01979a65f0514cc3da09_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_a1e53713925d01979a65f0514cc3da09_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2396

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 951KB
SHA256 03a1a4d1ee513f834f64ba03acc12858077b25cbcc33783f7ca32a9b5045316f
MD5 a1e53713925d01979a65f0514cc3da09
SHA1 94f97a2a280733317ba433277507d3edc0754beb
SHA512 9060f0ab46243718b5ff89955687460d3f285ff7eb38912ba7cd63e57e924e34dddf73080d62f3e74d066761e03d413300e2b9a817079144f32ac48f24b02c61
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2u:A3k03kHRJsW
TLSH
T1B3259D03E79500F8D15AC1349AA65A22FB75BC26173097DF136486262F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 df82d714ff6a2c66eed0373bbd10ee049ea2466d1e63f861e71dcce606881a3c
MD5 f062470507037f5f3c98ce0920d01538
SHA1 ebe1d397b14026ddb67f3bfc228a8af1c4fbb68c
SHA512 35a254f00663f3f88044e5f8dd2548da8e08a6869b27ec63baf481fe76f5fc1c2bcbefe7cfe4bac4f26b2e417f8b0a0b7ac528c0664b6b6e43b36b8b57f902de
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2e0Le5ji0hmxNrM:A3k03kHRJsWPji0Aj
TLSH
T1BD657B17F6A402B5D067C178C9E29A5AFB71384217308ACF1394C7292F67BE19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 966KB
SHA256 0539ed672b4f2a13b3b2a14b87e56972e5e0484ae38bff79370066d6174d643f
MD5 089557cd334aaa1354cb4df9c9d0f254
SHA1 f0f3bfafe60ec609c4ee94121b9949a7b5fe3cda
SHA512 805b7369c74c47c6e7759f6ed12591be8dd62ffe3d91b93b7b1d6813179018498e8e5f3507123b7747393459c4f6eadbeb26a65be52fe574c06ed4ebeea48382
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2Ya:A3k03kHRJs
TLSH
T13E259D03E79500F8D15AC1349AA65A23FB75BC22173097DF136496262F72BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 975KB
SHA256 99cdd70346e905678a7d23e97b5bb239371536f42f52374a2551432175074f01
MD5 f2f3ed51b81c5df1016e0df2febcc392
SHA1 27fe5c1a20f46f8816ded86d4c8f1eaf07b653a2
SHA512 204c362b0aac3f2e1e95b8f6e827c4c1d8998400ee5846d5094a8138087ed0d11f414062cbb94cd1497972d728e14be5a8cd47255c6a309ebc1b3892dcd548ba
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2x6:A3k03kHRJsA
TLSH
T1C4259E03E79500F8D11AC1349AA65A22FB75BC66173097DF2368C6152F72BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 975KB
SHA256 b9752d4ed5ee2b4b03f0c63e24b44c1e8861a2621df297ccb883c96123bf4cae
MD5 1012e191a61f5b2bac0eaf77d32302b3
SHA1 0ef7e55c7d50ba2b1e133154778c9a464fadc176
SHA512 945536ab856713ce64dcbcf7f9bc30aea1922801ce1c59418631f5bffe93505143310cefc1377091d7702d7cfcafea12aae6cf92dfded06041a4b273e129b5dc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2vN:A3k03kHRJs9
TLSH
T19F259D03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F72BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 975KB
SHA256 65059b4e936041d50868a69db333f73b21325470cc339fe5e7bc03ec56d187cb
MD5 0adb18918ca348ee9042e645ac290605
SHA1 0e3a9dbec9711df1c5fdb3e6ceec0d9db5644e7a
SHA512 23b8fd6e1f41bd8a330b3de3f9a038ce4d2dd1b9f789603c90d462c357866a708d20cb5907daa4731447b46c2db8ace922714b4d245234adeddc299fd775b56b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2Vf:A3k03kHRJs1
TLSH
T15D259E03E79500F8D11AC1349AA65A22FB75BC66173097DF1368C6162F72BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 975KB
SHA256 d5fd777df66099a1ddc614c58c357d8443cb5cf2e8156e30e7834ff9a3b72175
MD5 ff9630e1d887500e91067e5c89e875eb
SHA1 0b49bf35269687506ef24361af8ff0410325d88b
SHA512 c487e2bcc5c700d5ed2442ac667b0a59c1b45230c54ea0e4f3076f1f871a1e525a1b1fcda99cf86e649d39a0de1a8b308e86af4616e7adb883038f22340abbc6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2Xo:A3k03kHRJsA
TLSH
T17A259D03E79500F8D11AC1349AA65A22FB75BC66173097DF1368C6162F72BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 975KB
SHA256 1c3c438a1573cb5d4af4bfc683de0d22c09fb190d078439f1960c1785e9004a1
MD5 d6fb1197ac3e12bffe0aa8b22447a751
SHA1 f4c155f69406c183fda69e92c910362626271805
SHA512 f427eedcbdf0390ad9bbf946897538e206ec54138ee956a71a03b224d9fb59716e64cafa6b0f945d2b695a974f17d022243362232dc4de67a74933f466d7ebcb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2bu:A3k03kHRJsi
TLSH
T14F259E03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 975KB
SHA256 cfa7997497cce9a6eed181dbf80007e15c85bd897e94cf4436ef7d170e3306a1
MD5 3a6809513cb126e2b48f315d019de342
SHA1 25246763e183ef7d71e36745dc6cb21ed490ea39
SHA512 eda254fe7b1c2c574a72f05e1830bf80e0110cde5d2239cf65181c836eead9f7f9ec13bd3523e1fe4fa0c47ddc10bddbd6bcdb58cad211c14672dda12233c2cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2J9:A3k03kHRJsD
TLSH
T127259D03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 975KB
SHA256 50db864ee5f80f0593ccc9a8893c3276c38bf3df887b3f404dfac34e8795c1c7
MD5 8635813e8bed56604eeda35ed496c33d
SHA1 1f793f6f775b2f33a87a5c6d1a442ba9f56962b9
SHA512 c2fde68dd06be9836497476632bd268636d9f191a5b73f757da62274db1513a105b04c081d261506a91eee3186896b91ffb945e76164837b606a81e43844323b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2lc:A3k03kHRJsq
TLSH
T193259E03E79500F8D11AC1749AA65A22FB75BC26173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 975KB
SHA256 f8762d0d6a921c6eaddede0397f8b37226a6f8623ab714227f49ec4cdd0d937f
MD5 99dcdc13c5cac3b8b99796b2374ade7a
SHA1 cb72d478fc55a8a522902458d4e5dcd3b04721bf
SHA512 05d7dc6296b2f9cb93fa756a94692acc3870755790b7b0188c14e5f9ab05240284f6ab125b521f227b605999be27b5424723f0ca75df48f59438b7886beb490a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2ep:A3k03kHRJsw
TLSH
T11F259E03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 975KB
SHA256 21bc67db1d05a4308fe6958dd44abd28926bbeeb1ab2627c8adbab669209587e
MD5 ce7591b53625cfc7402c73f079d8a632
SHA1 028e60fdcecc5ee4fdb23d588eb5e1520cadf60a
SHA512 b23532d547208cd6b3dc68aa381ab1b185f388e601af5d94531aa648df75413eae2d666263cac542f04b3351bc79e4b1d965a2e497111b66bb73450524caa3ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2RN:A3k03kHRJsP
TLSH
T17D259E03E79500F8D11AC1349AA65A22FB75BC66173097DF236886152F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 975KB
SHA256 dca8b7e6266598cc207adc945fa724346478533bc9e2e105492f33134dcc8e85
MD5 0a11cafc9b28ff23d4e36d38c3848235
SHA1 dd15aa4fa802457f2b2ea70aeafaa24ad41f09ad
SHA512 c69e54e59500151facf92d7f25325875f1b1032fcd241e022fc59a6feb961d0f1428d9edc50892f0c00a4801f4ac86992e04f3690017e628151fcec57d889faf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2zF:A3k03kHRJsp
TLSH
T18C259E03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 975KB
SHA256 18637b787559a495717182ed3d2e88de96671099bb472d3ccf3719a7a2d41245
MD5 e5b5791dcea1d261a71d374c698630de
SHA1 578a2e0d26565c038cdcd3bf158ee284893012de
SHA512 ee04e62df07386142142b4ff87ee3336317ea7510356cb1caa004f88a65b5d5da533af51eff4774aa09eb59017ad9eb91d149a730ec43d1012423f3e6b9664b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2cC:A3k03kHRJs1
TLSH
T1CF259D03E79500F8D11AC1349AA65A22FB75BC62173097DF1368C6162F72BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 975KB
SHA256 e89d8cb9c37ca51dddd09c59adabc59e026c50635cb8917a6aecd22fe7a30b1d
MD5 b522eda7b05c836e036a1b2bb316be66
SHA1 b1c54ce1d1f1faf006ee11b9f3cad6f371a5df91
SHA512 19fce713addcfdbc301ab674cf6724cd10da53fdca3422df9308e4021838f89580fa80df8c353fd841b5431875330e89ff50a942ffb032ae2f73b20c05eee672
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh23w:A3k03kHRJsY
TLSH
T1D4259E03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 975KB
SHA256 123cdcadeea8aabd55fec40dc7510201082b1164018aa27e82da8be628acd2f7
MD5 b3bb0596728764ae4145384fea70edcf
SHA1 5aa8fd9c110e99c17a403580fefbc98fc127d5f5
SHA512 0e1f1d495aee4172ab3d4684c102639e0ac61443b5065b16785780c2f4ce8176863eecfbc41f77379b9bdb449aff2bfed75328e400861e32841bdfb50677a376
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2mT:A3k03kHRJsQ
TLSH
T156259E03E79500F8D11AC1749AA65A22FB75BC62173097DF1368C6162F72BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 975KB
SHA256 7ca87fcd63952be05347fd60b4d4eff2cfe0a8e4800d4ff40d0db2296ceda124
MD5 a04c34f3f76da19b7e4dd13fe2290255
SHA1 acb66cb3b827cd871d8fdb166747d2efd9e62432
SHA512 8c74a3067e87f59be37cb285427b1f0ce4f6fd443aa363ff9eb2a335275606c004fc9d570bddeb50e0e18c8b78bdfbb3b1fb82624fed7e41247cd9e3b6d93575
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2eu:A3k03kHRJsP
TLSH
T193259D03E79500F8D11AC1349AA65A22FB75BC66173097DF1368C6162F72BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 975KB
SHA256 9b70ae33903ebe185d0f970bd82520a12dc29594f942b94c108bbeb1c9b31412
MD5 c59af967fbb7e2bcc9da0bfa63354c65
SHA1 f18529632b99ed8c707171d0d53e1f7307afdb1b
SHA512 ddc28ab5d8f4e2cf199ac18ad5dc9292f3109e67e8010786a73943db765e55548262a52ef9b7993cb46b8249aa7b0147d100cffc0a9db9da01a77de8aa523d14
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2Yb:A3k03kHRJs2
TLSH
T1EA259E03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 975KB
SHA256 6c2f92ea5f3f43358c592215fb8879b765e34a39ebfefd91d006acb1bd54edc2
MD5 261907d79cb38631f447a261c9c90438
SHA1 7e7752d77c144bb456977c33eb9afa374580acbe
SHA512 9bc7578267a4a825247754480e863cbab3b34902debd2be14fd69e915f29a1cda0650af30f4b950fe3ac7da634bc4918cd0c6ef62f30075a0465bf60b45c25c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2Gf:A3k03kHRJsG
TLSH
T145259E03E79500F8D11AC1349AA65A22FB75BC66173097DF1368C6162F72BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 975KB
SHA256 251eb652256756044f806df4e3d3ae50a34ffc459ff43c2cfa927839588a3120
MD5 004ae4d846cc0f03f33f81b5d6c28288
SHA1 061761b0b60b83165c91510aa33c6f779e953bf2
SHA512 cb29d6df71c9ee3c31284aa9edf0672ced09100fe6dd6d944fb675014374da526f76fa32cc763767dfacdc0d351181f4edb1c55f635a70dfe8912049a62b0197
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2DK:A3k03kHRJsm
TLSH
T10D259E03E79500F8D11AC1749AA65A22FB75BC26173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 975KB
SHA256 32bae6993d2d216200de0131370c32d1659e99f8b47b16128d8e262458ab81e9
MD5 6091958d2fb5b3115ca47c8479f7e7a6
SHA1 771a028f75cca5ca57521afa13c7a485fce25c6f
SHA512 b938823f44838c0ec5333277b4aad741eff02a5da7ab9e8e45c5911d4885705daaa549c1cd78580c129e967cefb8636bad711e622a53d0278c2cda873d2a70da
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2kk:A3k03kHRJsb
TLSH
T108259E03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 975KB
SHA256 7f9b385ce82a3f47f2672c1a153e958cd4264322d4a920b83214fd4c71184812
MD5 61151a1c93e369e90b1e8d3fd7b0fcfb
SHA1 c705fb8dd5c80628d3ca795cddb2b54bf6f47e2b
SHA512 ad0e5783d469b329b1546a476dc582bf1a93371eb3a565a299c1432460005f47542ffcab757ad86af6cb94dbd6815831734f3aec397a403e32c7b3ff0bee4e56
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2t0:A3k03kHRJsK
TLSH
T1F6259E03E79500F8D11AC1349AA65A22FB75BC66173097DF1368C6162F72BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 975KB
SHA256 ea0b0578a8ea273cfe1cf3577c497d97af6fd0512c03eb8cfc4280adb19b176e
MD5 e4cdcf9af36bf1ec5d6a033891a1e950
SHA1 8540afa020874376e466fe68945669f3e9384cb8
SHA512 30e90f2bb304475941db839eda51c86ffdc6969a8a3cbe5d64d833778fa2f8bf0e7edc63920bcad97aa29a00ac4e07885c662f40a9684292a50871af65139da1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2wg:A3k03kHRJsz
TLSH
T132259E03E79500F8D11AC1349AA65A22FB75BC66173097DF1368C6162F72BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 975KB
SHA256 1b4b08f3ba778e8f5e458a6b284ff7f405e3f2e76265efc5f689dce290c23bc2
MD5 2a6be6f0e2c48bf48e803f3f20bbb11b
SHA1 b57d21fac1e13294463032872d0e2ab39dc59256
SHA512 48731bb88010fb66654fc75b01898c986226f88c95300aaeb8419a834e56e974ad4dc35d14e26f6077bc75eea9ecad8f1b7a9c765c7d2c7a72ea172553e7f56f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2Fr:A3k03kHRJsF
TLSH
T171259E03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 975KB
SHA256 1b319385f90e8474951871fb78154999187f9e1767eacc1531c3957855404780
MD5 b4d7ebc0fa1d908187eaf73106d0c32c
SHA1 0e46a2553a32ff63e165743a3d2aa00f669ce76c
SHA512 882eb9a4ef4cfc86794cce542905eacc3af61fd79f296ff8c3dd884e0532cc8c29c083bd1315629d30538d9d22e20cc3ae35020de4ea9d8815909bf22c3e970b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2Pn:A3k03kHRJsX
TLSH
T13D259E03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 975KB
SHA256 dafcbe8fddd5aab86276cf330e475663178f79c23e126d175893968d9ba2c403
MD5 d3f8e91e9b58d871cf035d3b6da2d1cc
SHA1 4521d43e5bc982c1068bc2b3ef5542363579f677
SHA512 f7da528de139cdcb93ad4d3e7f84a14da94017aac3a13c921a9436eb279d9e7db0c9df52737507f8c900f80afccd479f88797ade5ec500f3320bca981e780ef1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh27x:A3k03kHRJsN
TLSH
T1AA259E03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 975KB
SHA256 f025c5ddd81a8be1694c1fcd397e2dfcde17d097ef9948806050e46506cf23a6
MD5 30452f87523de9474e762419d19fad5a
SHA1 524ee31df315b6df8c4526b27024bf6f692f3f93
SHA512 85994f8bdcb612699d8b71cf3b8ea7f73c46c49aec75f6bfa6dcd599c81affab80dc900688a841c16c3c1b1f0e691dde577b44ff2cd26a85ae4964ca6d367c6a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2pA:A3k03kHRJsy
TLSH
T1FC259E03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 975KB
SHA256 6d278354505ceaba21f323b57f7ccfc491dbcfae25fafc2c46bc7115cbcfd306
MD5 1424e9538a48c8fb68de38d1279ce1bb
SHA1 f60a0f347e4f26b2d6b64ade0ad382c6153801f0
SHA512 540bff59946fb209be9a9059e4f703bdd56a8c7db03022813297d936f27929304b7c89b6c6056d765cf9d8298800ab7312035727d6d929bd261e09908b278434
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2i9Q:A3k03kHRJsv
TLSH
T1D4259D03E79500F8D11AC1749AA65A22FB75BC62173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 975KB
SHA256 07d1cfef1b13332dad4998166ad1d22d731dd9d0800ea2d337a5670f712668bf
MD5 9e1901350a75a8dd5957ea9578fbbc49
SHA1 77cec03daf801e49fbb0a98073aff7f033d401cd
SHA512 e5b1d71dbe12cf8ded086b1bb5e49bc04519b0b105d2d185d0dd2d6cf4d9e0ba32d3609d2bc8134b5342a9f6c7b8ff25a8ee7af05c1bac27d151ec3fd5b68c89
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2H4:A3k03kHRJsQ
TLSH
T185259E03E79500F8D11AC1749AA65A22FB75BC26173097DF1368C6162F72BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 975KB
SHA256 8460bfc6a3260f7c49229da36e3f35966da1d5389eb32bde1760998424b2299e
MD5 53656d9575e101b2f8a62d27328d96c2
SHA1 0021647a7b36faacadf9020d21eb00867414a962
SHA512 9bf760c01f03594c1cfcd9d1a9b2ca16ddf6d6ee96aaf284e03d5eea945fbb1e250a9c3e53331cb2051abf0ef2fbd0f5356f179ae94299f88d8dcefbb71de873
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2mu:A3k03kHRJsx
TLSH
T10B259E03E79500F8D15AC1349AA65A22FB75BC62173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 975KB
SHA256 a7f7d5d42f664fe45357bfb5e624bd503f1c17aafdf8ae7c56da4646791b8c90
MD5 556a3d3aec2c29426099564285f7a641
SHA1 e1cb3f07f0ab91fb16150845336eb89d6f969dd8
SHA512 cc02a83d6445c8f6c1d20bb4a89d4d987bbd11489873f872c6fe163063d424b61fe3aaf9e4d15fa10754ce605b0a13cfcfadf8a926e57b8728c9832ffd34cbcd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2Xj:A3k03kHRJs7
TLSH
T133259E03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 975KB
SHA256 d6def873a587a99e549d775fd39114182e4c2674357a6b08bee55a56f8d0b248
MD5 4485672fef36ec516b25ea9ac5ba298e
SHA1 77114eef267b2480018c7a455915a00af3cff096
SHA512 381eb128cc5c800787668555f89eb30ab3df44b6c9698abee6a0453f3b2ee475722a96d71e3895935161cea9931a06ee6bb127bc46ea1995c9181055c968b6a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2Cg:A3k03kHRJsz
TLSH
T14D259E03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 975KB
SHA256 8e0b2b46643afde87d93c0a2ea426314d5de68b3bf3fd075c7a37fcc63ffe4da
MD5 b84feb4f16f98210d48bc31adb508d36
SHA1 f15f014e4bf41944131d841554c3a4f18630c344
SHA512 e845177329c8f7c168bdffedb2c4dd94eefe6d7c501156cd56fc5807fbac0309342067dc651841895b4739c2e431432a0c1a2cf8283bbb12fca2c0c4ea547307
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh29I:A3k03kHRJsa
TLSH
T13C259E03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 975KB
SHA256 4c71bb9bbb16953dcf852911a32a2f6ba033fecf77ca7350c9564c1bc4bb2803
MD5 dce966d8f630a90c0c89015cc5723c79
SHA1 93e837aa8702f56c7d9f32f930ba533e92161afe
SHA512 3ff4fc6c6c06c0d093e3d2391ccd6bc21b3ea2620bb2665fb95b396a047f86996aea01880c83f429379155bb5d8b39b4e23fc34c2148d460f22ea40693854979
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2vo:A3k03kHRJso
TLSH
T129259E03E79500F8D11AC1349AA65A22FB75BC66173097DF1368C6162F72BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 975KB
SHA256 9b1bc7803d8644306dcbcf35661375b96b0d1eb6789a4ba6a49d2ad9fcdb06d2
MD5 975bb55488d4a793d4f9c76ae5158d9d
SHA1 b6f6572a50e46ec385c4791367f63639ac67212d
SHA512 80dd7c8152a2092b8f93730b13e58934ce11d599778b32ab94fefa5f75dc9210382e9c39d9a4172b16a70bffda6c29b98dd1a7c45171e7adf841d4e8dc7af52b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh20+:A3k03kHRJsV
TLSH
T152259D03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 975KB
SHA256 5315cca99d7713e2b098dc40cec0e6d226a7f4482694c3b9c82c40b9a86c0737
MD5 0634a7a39efac5532a8b724844c4cf8f
SHA1 b29654882487698c0110112ce2b5eb10cae4b808
SHA512 cf9fe38ab04aaff01dc871d022c8458f0389171006974affd3d961d733a36d8a80bd4561388c902688ec0c891d844b5b0e897c97699e7cf6746ee00d05e042d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh28Q:A3k03kHRJsd
TLSH
T12E259E03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 975KB
SHA256 09ee819baeca293d98f1f338435fe02220535ff2b8f2909961295c5d0a68a512
MD5 27ff220ceaacfcdf25972c1e9c1054b3
SHA1 61131a200b0ffa08d169bbf5f74cc54ccd927c6b
SHA512 64b963fbcdfeab24e826a25b6ce00569ad45a89b1b862d4649d0fc11227b85d813bd9434f83bf0f8258f305f75bce32d998e99f57d6a5fb3845d13566cd3fe2e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2lX:A3k03kHRJsp
TLSH
T181259E03E79500F8D11AC1749AA65A22FB75BC62173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 975KB
SHA256 cdf5de09a4738920533c12404568515c4d2be24650fdf5e9bcff4217c5792ed6
MD5 352355363fb69c19d9911f2e0b5ef8b6
SHA1 a69a308918180582206c1df90fe3c6fe3f696586
SHA512 5405fb4a36d9c01dd8e93019d59fcef055f343555e856a399f922bc782f8fcb1380237c981f42e34942eb4bf5dd5650c4af1d03675c295b34398fa54e686c0ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2HL:A3k03kHRJsj
TLSH
T1C6259D03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 975KB
SHA256 ae1a68d0aa095abd964fd7a1fa86a8d3cb2cb67f0fd0d646f2919ad32f389de8
MD5 45b95cb49605e062035eb813882f1b9a
SHA1 e70ef0eb73e6daab7a76f35923f3ab5c4f4c4a8d
SHA512 774108ce56ef683ad66c6cb3f2938c0020b0f46b92dafee9563a73489db0012a64cadfed6e9f5be20810123a4694f0656ad3891eb1cac0cc015162a291cd165b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh29M:A3k03kHRJsO
TLSH
T1DB259E03E79500F8D11AC1349AA65A22FB75BC66173097DF1368C6162F72BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 975KB
SHA256 e61bf8d1b637486097dd3041b88fa95ca821744a2fa99927562b8e824be5995f
MD5 45cb82bf059da5bdf6de6f1c02e40648
SHA1 d1616605dd577554904113e1d551cc94b0099079
SHA512 e81ca2b419856724df6f41dec8f4f6a170d3c214861400fb8ba2ed2fb8cb165ce37b559548acae51101d9de98ec863d54d8ddd639a6ef840655767f9d5e3aa41
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55EwzylEEh2uh:A3k03kHRJsg
TLSH
T127259E03E79500F8D11AC1349AA65A22FB75BC66173097DF136886162F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2396-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2396-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads