00191a0a8a5cb95775d54a2b7c776babe2ab741af74459f729acde6f387f39b4

Analysis

max time kernel
93s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Size 852KB
Sample260827-dm4lfaxtbs
SHA256 00191a0a8a5cb95775d54a2b7c776babe2ab741af74459f729acde6f387f39b4
MD5 f1512b221eaa973baf0805114d97f129
SHA1 4a2609099de5fcc624e8595416c53b67f43ed5e1
SHA512 4828265e36116a1704148ece98fbd10cd264eb6b1dd0e5dac67620be5530ddcd7a94389daa06da559486b31552000393c68d0a8a649d76250cc0bdbd0fb91626
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8Jf:J/sCv7rTiw24gzyJf
TLSH
T1E505191767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4284-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000600000001b7f3-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e5-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019840-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-438.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-487.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000018a52-524.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-597.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-622.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-719.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-738.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-781.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-818.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-849.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-913.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-945.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1000.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1037.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1056.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1105.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1161.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1168.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4284-2099-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1476-2136-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
1476	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4284	2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
1476	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-26_f1512b221eaa973baf0805114d97f129_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4284

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 852KB
SHA256 00191a0a8a5cb95775d54a2b7c776babe2ab741af74459f729acde6f387f39b4
MD5 f1512b221eaa973baf0805114d97f129
SHA1 4a2609099de5fcc624e8595416c53b67f43ed5e1
SHA512 4828265e36116a1704148ece98fbd10cd264eb6b1dd0e5dac67620be5530ddcd7a94389daa06da559486b31552000393c68d0a8a649d76250cc0bdbd0fb91626
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8Jf:J/sCv7rTiw24gzyJf
TLSH
T1E505191767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 0bd0b32d1bc7188d56562d81ab2201238a92ef0abf6ee41194a64c1289256645
MD5 43997c4df0e9352fa6ea69f36897b0ae
SHA1 b86ebbbd160de3169785617664cedd878c4da197
SHA512 6241d6c120c8f90c726b942caacb45f2bd2348993132a97d67266f0c0b36900418559ef4833b8687bc6a985825cade65e07626568f00dd33eda355480f661159
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JlXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:J/sCv7rTiw24gzyJL0Le5ji0hmxNrM
TLSH
T1C5654A17B6B84661D073D174C5E2964AEA72B4560B30C6CF12A9CB3C2E27BF1AD39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 866KB
SHA256 8e54f85aabdf48d18e7a661078df63e8c4843ca5395f251eb37623efd4661cad
MD5 018a10cda1036be0be3cd1a4834cb8d8
SHA1 3d381f24af259b62c2c23deb937119ab7c67f3bf
SHA512 ea975d780a54734ce3138882a0a18ff244cbf32557426a94a7e0f941ac24ad6ec719c608c2459f0536d412f4e5b745ed2a38b5c6e00b455cbeaaf29b2b1a8092
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JNa:J/sCv7rTiw24gzyJNa
TLSH
T14415191767E80895E5A7613089B54605EB72F8551B30C6CF12B88B3D1E73BF0BD39B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 875KB
SHA256 e1fe57cfcbb72582622cedadffd4360f0217145150e36acef0eadc4901f35008
MD5 530ca4a88a1d4fb334868f9f030d43fa
SHA1 4b211ee0adbb67274c04e9d9be4b2a3e0589579b
SHA512 a20a826e5ce87349d7f26b03175cd89d7ba960bb48ae012d50366127f297b45f697a64b6accb1701f37d6176963fd7d02ba9742f6292c89c80138ee56b3fe147
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JE6:J/sCv7rTiw24gzyJE6
TLSH
T1B4152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 875KB
SHA256 fbab41f5bc0f81c51f496782380488c3fa7b16886296147e574c63972a1bb4e8
MD5 ffb4ca9d0ee08236274097779821d00d
SHA1 7589a5fdd9139e48abe242bd803ce69e67e0c5dc
SHA512 06b8653ce9716364609dd845c28a142e9eefeec37bac5e8914da8baf061897b8447ec9e3bd8a4557ea3bffd3b7c13481ea94bf6dfc9f5553d17356006fa3f7d8
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JgN:J/sCv7rTiw24gzyJgN
TLSH
T17C152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 875KB
SHA256 246a5c4dc29fc6c9b22b962e3534764dadc0cedd436854b31b38dcd95ddcaa20
MD5 e8ce3858eb1ed214278dcbb6262c9644
SHA1 69a1181d0e6cc64aaca6195a2bae1daac5e69d1c
SHA512 bef83fcf3c222460bfc178e3175ad6b20d52fe97917a2a811d7789416826de289d2c8ea38aa47f9850124f875c98cbcbfbd5fffe3fbb8e87623565e7b0543e71
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JOf:J/sCv7rTiw24gzyJOf
TLSH
T1EC152A1767E80895E5A3613089B54605EB72F8561B31C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 875KB
SHA256 4254f51775103cf11baf4ecc6b3ee7fde1f36f1d16232bad4b8e44cf1d91b7d4
MD5 2d142357c2688e957eff695638382b41
SHA1 3beafa1c0b9c61c91cf574de557e75900e503099
SHA512 476399e69a4db06fc77c63bc900a10fbe1789665cb9a6f7880643aa0c06c2adc83166596d517483dc4630316ce1cff83720fb89bb961665131ab5b5634d907a2
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8J4o:J/sCv7rTiw24gzyJ4o
TLSH
T198152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 875KB
SHA256 def119b48fdfd227e5a0aa3c6626ead879cf7eb01ad90d157c74603d26c56817
MD5 bb4c3d567fa123e433c0698abc7164e9
SHA1 62e33efa95cbb45696856c313c5c7d123552a1a0
SHA512 9236e6a758ea9531733cd5f0aa74451c9ec6457fdf93a0766b2cee9373c25dfaa382ee2480fb5405b4fc8d57e168828541d4f4637ebe220678900e028bf47ae4
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JIu:J/sCv7rTiw24gzyJIu
TLSH
T128152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 875KB
SHA256 a0010f8b0eada388b400a08761f0a28f1efc631f9e1d90a6d3af9a8f6fed1fd9
MD5 ce9c129e62ff6194686ecb092c60ddfb
SHA1 2d45e5028909e6da875679b96e6a3e2f7f5124d4
SHA512 5542269ea5210c9d5f606d9ae6fa303efcaa5b49a25ac00a03eab1f5bd4c67d85b90e8ba167e8472950d6994423fa78633767b32d70539b7e6a114a5bb7d5c98
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8Jc9:J/sCv7rTiw24gzyJc9
TLSH
T133152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 875KB
SHA256 f01d6877352e1af6b26ac704d3e25054be8aa452abdef420008ec46754bead69
MD5 1293e014991ebdfa12de7544adcccf7b
SHA1 b501936d10d37db91963ee9d22cfad37ffa10bc3
SHA512 fdd2c58a0b283dfaf35bce762cadfae1638c8e6d486164eeb8ed6a0cd8fb619ebf1f79c75413043e84156644245debd7b4d2f18512b1201c504616c58b394877
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JEc:J/sCv7rTiw24gzyJEc
TLSH
T173152A1767E80895E4A7613089B54605EB72F8561B31C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 875KB
SHA256 925b8632b97305b84678045a8ea9826960fb3d9dc43744d88a8ddcf502f22af1
MD5 29ea267e0193d9af1dfc321cadb961e7
SHA1 f64c5729d185b6186618c7614c64df54f32151a1
SHA512 df856d0d5c54c4ee472bf1ccca2c185fd51687a6a41cc950944f3a30093b4e7e28d486599b0a56e2457ed14d207abdd838ad48ff65ba4178b8446befb7db933c
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8Jdp:J/sCv7rTiw24gzyJdp
TLSH
T148152A1767E80895E5A7623089B54605EB72F8561B30C6CF12B88B3D1E73BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 875KB
SHA256 34d51d024a82434ad71cc9f1cab9ead1fa7bf7e79fec9b2fc45ff6ee5f377b68
MD5 6cb4e3685cfed63b282ee15624f1465c
SHA1 1c3e8f783aaebfd813fe0877b2f0c8132ad1c32e
SHA512 dc5d2712734fcb3439638317c6e631c32523b6e56851495eff23a2e61748842f74e90e5d97e77203e420d66d165fec1d5e936314139062cca34c0d5e07abfebd
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8Ji0a:J/sCv7rTiw24gzyJiN
TLSH
T10E152A1767E80895E5A7623089B54605EB72F8561B30C6CF12B88B3D1E73BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 875KB
SHA256 61f24fef221acf5a23e6b90240a4850cb68bfc4a3cae200483dc7be6062aab54
MD5 754d242e9f6fd4a85ff2282b2f5472fe
SHA1 05ac07f8a25fc4b33f3cad5cf3f60197e0853ceb
SHA512 87fa48434787dc6d71d6e3d3c28825c6cd1a4ff81c0d4be13f5f0a90253682e93db7150254a08c272c7bed12c6bc8a474bcdcba9505d4b5548c0d8463696ab5d
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JGF:J/sCv7rTiw24gzyJGF
TLSH
T12F152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 875KB
SHA256 56e1d130852c9a93fbffa0c434530a8a2f9a27e23b345b88380691c0e1bb4503
MD5 c650b97504aa92728b26d1bb3039bf34
SHA1 550c97f3128f649b25053a0ae32413fa066b48dc
SHA512 f8c6d7ce733de54ff61d18e07a2b8c3d299c2806bb3aba0008be70463b48ba9315391d2c08ad3df555b869607bf55410a537230f1cb276676660b8fdad742360
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JTC:J/sCv7rTiw24gzyJTC
TLSH
T10E152A1767E80895E4A7613089B54605EB72F8561B31C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 875KB
SHA256 53a1f0921461757635363f48ed7bf12c865c93671bf5e380d3b1029a4aa11cd5
MD5 85588178eeb6e3caeee20a17c0a777aa
SHA1 2838e30b139404e9d3b114be3d12170e2ef9dd7d
SHA512 f7f6e2df30182c631c101ad68b899d90d77687ba3c7193e9b6b9712686d2c72de88060fb523150ff30f0597d17f59d2e400ed6791a97eeb1e95ee972046d2549
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8Jcw:J/sCv7rTiw24gzyJcw
TLSH
T154152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 875KB
SHA256 ea4e9f05e2d30597ba9dc1193f8499645f16c7f9b63216f4974a85525d7c88ec
MD5 b293fd7e37aa1c3415b2b26c4055f882
SHA1 cf13907b45b78055835f33c0c750637970ddd42c
SHA512 0730bb7d45a31b321db54434fab06063caeed64d317df208c370896c994c0701ce0a5022c9b775f3d458c9c8b135c7af09e3e692d725ac81f55575b901b7eab4
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JTT:J/sCv7rTiw24gzyJTT
TLSH
T1BB152A1767E80895E4A7613089B54605EB72F8561B31C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 875KB
SHA256 85ac59bd339d04810c52a7fb223d202edd43440b69afd5c6095cd1b1ece2679d
MD5 ab4e9f223399d151ca3448232f828402
SHA1 0477c22bf0a3087fe5ad50bf75a14cab96e1df95
SHA512 5c0dbfb0abef1bc82d90fcd799a412d17edf9f12e7f8bc4d82e43c723ad7b7c9f452d64a8102f165c24df223605fb1519963f9960fd09a212d0d7e93b71fbe30
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8Jlu:J/sCv7rTiw24gzyJlu
TLSH
T1EC152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 875KB
SHA256 7a793709171018809d25865321eaadd33f9c6e65885eb2e823a78de0c44973fe
MD5 4b2bcfc33b23dd4b5314b7326eb16ad7
SHA1 f8edb09175cec1ee3785b534cd393bebb7652180
SHA512 2cb7cb70a9d8706ee7c36a74691d251ae3107857d9a9450189fa0160a2b4265ce78edaf1e4ff60d99200ba2494937b145143c7610a2f940fe49701906e86c95c
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8Jtb:J/sCv7rTiw24gzyJtb
TLSH
T170152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 875KB
SHA256 67cef18fac5c99e99a5e2c669ae50ee31fd3d411f7f9a540a24ec6c85ac20414
MD5 389d97ed8ab3f619a0af84fd9e4d4506
SHA1 b6695835eda253ac7690a0906042a1ba493c2a24
SHA512 6bd84eae818117606595952d671e4e9f8ef5dbebd3bb1a1da347ab293a48da2cbee3e61f166300dc41ed0b0f3cb1042bbd52024702cd41280309ed40c3425cf0
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8Jdf:J/sCv7rTiw24gzyJdf
TLSH
T14A152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 875KB
SHA256 fbc3fb46927fd2e6c1353fdd7be871a229fbabf218e375fffadf0c76b2644c8f
MD5 ebaceb60a8ef286492e44056a0d3f15f
SHA1 33eada2480096823c82fe942af092be7dd179fcb
SHA512 79177657f95838f1b9d9348698ad645b5a4a4bed930150ad44c27e18f8b2e3431975087960e841a7ea6edcb0367d5b8cf6eab975f2f632a7f6fba2abf0ee2f7c
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JGK:J/sCv7rTiw24gzyJGK
TLSH
T1D4152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 875KB
SHA256 6cde34e8534569cec95352d17e847f3b5aee4dbfde3af6edcf3aa08bfea97926
MD5 0818e441f4a95767d8503b4da0784ca3
SHA1 d3668a162f375499b7a8cb1da8a4b07f057e6411
SHA512 b56a7aab30ae0a1dbb66c237dec0ab686d77f0f06792fb81ddd83e6147aca21cd9e20704bb24dc0ede6a2530aca15988db682dd91e965ae1374abebb607ce8f3
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8Jzk:J/sCv7rTiw24gzyJzk
TLSH
T11A152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 875KB
SHA256 3b0177c96f23970afd420c5d3873ca1eaa7f8dd2d46373155649f0e4270dd349
MD5 d4f7f46ea6aede960ff906b5320ea146
SHA1 5dc67e3e6ea78e031e9399e30ff782f13e557c1d
SHA512 02f14694562b832aabf7a62dd79e2cd587862b9e696a53b70abbb452a27afef33e841c1bd915ee10258d0fd3ddef9cd2eac6d388f336cda2f552c2c699a961cb
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JE0:J/sCv7rTiw24gzyJE0
TLSH
T1DA152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 875KB
SHA256 a4475c41d27f0bed27f70b649e0cfa4adec32068cfda657f42e6900ef1844899
MD5 d493039b17d886300dc9a6449360f13b
SHA1 df98cc521dd4450252e1201488138969bda5af3c
SHA512 646afff142180b833fc589de83cf1345412a460b46a5314e285eae8e69c42684edf692628fca161071b3de71905da5c0cc1f18486a0957a56f4d06e502847e3e
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8J/70:J/sCv7rTiw24gzyJ/g
TLSH
T155152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 875KB
SHA256 5e34afe1f92663f123fc43e78d5e6709ae60f8a8f2e3f0e20872621766d437a7
MD5 afe42f373976417a895a693e94c50f30
SHA1 dc9ecf8b82a134ac1f150cfd3457fb44c9d0069e
SHA512 5bfaac723840d9721838a6581d44d40af86f1b7bc4aaf95b4b4f53bd40ec540fa3d8ca638474679e26736b6e8401bee1e7ce6de0843aa22568b596bd33d93696
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JSr:J/sCv7rTiw24gzyJSr
TLSH
T18F152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 875KB
SHA256 16ff60e8ff1ee4e3f5b3d2c467ccc3700f1f1397b70b0ba135f111fe7b3f43e1
MD5 874ed520bf34889e21d8ff26f0551e16
SHA1 4b88ee428374b27cc7eafafde7387634fa44f869
SHA512 de1076f0b32a5d4bb63e9bc7e019a093324117c509f661939a02cf5909730cc74a57f37eb6bb094b2fadaf951eab04e693c97307b35fe07971599ade127436e3
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8Jwn:J/sCv7rTiw24gzyJwn
TLSH
T1AE152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 875KB
SHA256 ba33375a536216a42385e4dbc7ba3bb3acf323c03cd72481b812a3dcc64d2e96
MD5 5257e92c12689edda7a315e834eea884
SHA1 c55fd29ab3b456107cd4f978e74760bb69d70646
SHA512 b98adccaa74edeb0ce44a3f299cc3eaa317643cb42e2143b9b6fda77d6b07af591a314aec954343b3e57cd2c4a6080b639298f70abe95a26c46ec31bf3e1f775
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JOx:J/sCv7rTiw24gzyJOx
TLSH
T1CD152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 875KB
SHA256 3503829a660221b7bdd1238155dd9be88c18e3f8b3cebc8c3e8e3e8f8f3459c2
MD5 85a4f746e101e6993b050d1d77fefe7b
SHA1 1102a514a69a1e1a3fff046a1b72a2ec7b34cba9
SHA512 e4bc97f462ca28511b4b9dc065277e2fc75b57d4efecf3669e11d4d0ae4afe629b6b107bb1a308154592d79c5a6aaf3db6f518f8a7d0b5bc35f9941cb3351b0d
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JoA:J/sCv7rTiw24gzyJoA
TLSH
T15A152A1767E80895E5A7623089B54605EB72F8561B30C6CF12B88B3D1E73BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 875KB
SHA256 f8d598aaaadbef203cfbfe6963dc9008317d6074a7f9df6dfc09a512fcdb8d9d
MD5 03966b756d970ac6aee0977238c0c49e
SHA1 4f2c1ad5c00b98abb34e9c1a2f3142b2ae73b8d8
SHA512 88183c47cfbbf2164441e259145e23f2976eb3943c32e38f4c891d725713c704fc81380e28485de0684d4043a9a5f038b6960eae2e89a70b91fa65e8454ec797
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JB9Q:J/sCv7rTiw24gzyJB9Q
TLSH
T1A7152A1767E80895E5A3613089B54605EB72F8561B31C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 875KB
SHA256 167ccb64b3fe8b8a52daf2fd87ed81527500683b5f2d5b2c2b192291b01740f4
MD5 f477330d2c9d8857a5ec913d289f6222
SHA1 f0f3ec1a6006550c2a51cddc3233487556c12b5c
SHA512 15e887c7cc09c47b50ea2a83371c08b9b378773de072c600a2eb268933fe4c126e242b622470f74e5db0aac95c2db20cb037ebefff416f1cb3dc655561f95e3b
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8J04:J/sCv7rTiw24gzyJ04
TLSH
T108152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 875KB
SHA256 cbe2769d3fc047134ab859d71eb0753c0655b7993a9fa35781b1a472f936de61
MD5 4f57e7e3cfa5151c1992d8826dfec822
SHA1 9f7bab87947a31a066b2a5397ef088544e0d509a
SHA512 f4ffa36a3026a56ec725d653cc5d80b29058bab059418b7070343a345f94963506bf7f6262f24029493e2ed92df56460480e3c0d28111474889a3cf89c7ee02e
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8Jfu:J/sCv7rTiw24gzyJfu
TLSH
T162152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 875KB
SHA256 7d16c852884afb81a94269031f935da2c15df0a39eef8df413ba71c5d1f7ec20
MD5 3f11ce7c8331e9312f3e18fd4a959cd7
SHA1 9303a63e228a4d97925def741a7e0bceb93da0aa
SHA512 e6ef7540384d7ab5e4e95821fc0bdce70104656097e929f9b0975effab378b27eaa61380d2d4a2fc463fd5d9137c938c34dd7662762ec6e627d389a7d94c2d57
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8J6j:J/sCv7rTiw24gzyJ6j
TLSH
T16F152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 875KB
SHA256 36f277c82cc0073887ffa7fcdd7b10aeb45ddd64244d3dd9d44084be5b31cb8f
MD5 40524c9511a9ea146ab1ce842b4a763a
SHA1 c93666373806ecbf947e46178bd930bcfcc4db85
SHA512 55ca5da139a0c6544bdcc6e238f906dee3315097771a281eeb94b615617d32ca288310ff2796f504d92dff57e09597047b9cc9e9a30bbd48acccd434557028ad
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8Jng:J/sCv7rTiw24gzyJng
TLSH
T1CB152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 875KB
SHA256 be388194caa0614008f146896460bbcf492f871e014683a8965b35512f16a00f
MD5 2f332b179a55085a401dfc05b3c16838
SHA1 ba1c160c100b78c0cb9c309034387450ee028b0b
SHA512 ef6c2ba87f1a136243e3397d9e88170166120b406a489202fcb8cea9ed293b49cbe0f08a0a721fc2664c0e531a43a96edfbe919649de0708138f896b64e6b425
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8J6I:J/sCv7rTiw24gzyJ6I
TLSH
T1FF152A1767E80895E5A7623089B54605EB72F8561B30C6CF12B88B3D1E73BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 875KB
SHA256 c6658cdc12fc99ee7ce4b111118b0264dc7206eaa5b19bbabb7dd801464b9545
MD5 5c29ebadfa088433850d7d7653b6337c
SHA1 d2416eea2f6dd5475738c7da3776608f92179db8
SHA512 3a145da1b6c75dae55b2401ac5454ae10d0a78f8435a65b0d218b51cd737f77e88d1a2f00b62c7a69016b320777f5cc1f5c63f1727745898b24c33ceee0d89c2
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8J4o:J/sCv7rTiw24gzyJ4o
TLSH
T14A152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 875KB
SHA256 aa909f46b2d37e7553e1751afc0094f91c89495f75a8b90bc90994afa39a7729
MD5 495121023d6ba72933d72dc451901de5
SHA1 e3acb7af6a962358ed3ad148f50b8fd5619a5d9c
SHA512 73392d52c869c3b28aedbc528acdfe95937765fdb39b9fea249fe18b392ae4ed7b48f086681909bb23187c52a8eb1b8fb21f2031517fc5beb28ef0b75c2a28a7
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JL+:J/sCv7rTiw24gzyJL+
TLSH
T138152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 875KB
SHA256 ebfbceae2134a290c110aa9567d0e44ce8cdc9319f923a118b1911475213d3e2
MD5 204413d8a2297e40cbb74f4d08f95463
SHA1 45cb7f95b096916c81440e4ffdee6a7e99854625
SHA512 5e3e56bd17f97d5ee8f058a650717a340e1305f95bce01ecf05a493f0781d1c776c3472a1c86c763ea11ef192467f22c31f775d9e5fc1db98b39381ce072e99d
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JBQ:J/sCv7rTiw24gzyJBQ
TLSH
T1CB152A1767E80895E5A7623089B54605EB72F8561B30C6CF12B88B3D1E73BF07D39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 875KB
SHA256 2edf6bc206fec69be0ea7242eb563f69667257d065bee52db5ae9a14aaf9662a
MD5 554ea12d955f60fc357389bff84a6859
SHA1 aaa61f6974e41b532fc2d2791f1a935bb1019832
SHA512 0526ad8051995a7885571b0a0905dba21c52a606916083cdc5fffea27d57897c223a61bbcf6154f10de1093dd854a7b85bc918e143cd0280bb6779cdeb32e98c
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JGX:J/sCv7rTiw24gzyJGX
TLSH
T11B152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 875KB
SHA256 321c87fbc432729e87f4b5f81824eaa02833a21bbd99ce049ea76bc651e1b126
MD5 51a958c06ddb01d17c2fdca17d0c3683
SHA1 d567c03a7927af07c126328a6b5fbe3f6c12ec6a
SHA512 da39a27c79cd06dd378464cc83962b6e3929d3ec14c066ef6bf91e31961c88be709be0a8c1151b9c63facc20eb520b1f589112c521471626a8227603b09a0ecc
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JAL:J/sCv7rTiw24gzyJAL
TLSH
T166152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 875KB
SHA256 54b7a075dd9e4003b6601e48dd30b67fbee0f231f706853885ba8cd8dc2e37c5
MD5 ae4af5263fc8a0af83f027bc3f69181f
SHA1 f1757194c5c1261c70bbd86c7acd2b3730062da8
SHA512 fd03c95922870adff08de95437e1216e6154c66fa78627cf9f08c435c6089bea2f4a40be162289e160ecacb30c88274c4c90aae2f1df3809eddb20b1399a6285
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8JsFC:J/sCv7rTiw24gzyJsM
TLSH
T1A4152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 875KB
SHA256 7a0fc95b73229594abaa7db4e0abb9a647954d121cc6eeef5963f5e106a05a2f
MD5 5c6ca608546984cb235685cbed698789
SHA1 46761563f1f802a4e3e88139e9958f990e4f1289
SHA512 e2bb9b801389742f4216d7de5e6d53d2016dd1609ffb974a83e26df1c63e5208df282a210f269110c874797a8a4b9c2ea998f5ee6626b12715d78fe89b73a82c
SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/ZyPz5L8J1h:J/sCv7rTiw24gzyJ1h
TLSH
T17A152A1767E80895E5A7613089B54605EB72F8561B30C6CF12B88B3D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1476-2136-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4284-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4284-2099-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads