8dfcb252b26df6fe08e33e8874d9bed50f2771bb1716f424a99f25b1b953e502

Analysis

max time kernel
124s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_b497d53bc3861fd8ba7b68109e603c3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 830KB
Sample260629-d8v67act9s
SHA256 8dfcb252b26df6fe08e33e8874d9bed50f2771bb1716f424a99f25b1b953e502
MD5 b497d53bc3861fd8ba7b68109e603c3a
SHA1 39fe6611c681a10e165965f26e5bfd3207467e2b
SHA512 1b5ed901c03ee12a9a2f7d4d22b1b64f67ed7b39affd90a8d82b60ef9004f9d7a8916865466fea6c1e94b75eec22da96bb4e4456bbe646829953dec911f269ce
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiN:A3k03kHRJz
TLSH
T12305AE13E79500E8D10AC1749AEA9A23FB757C561770A3DF2358C6152F62BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 52 IoCs

resource	yara_rule
behavioral2/memory/4684-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b80b-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000016cfe-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4684-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30e-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2600-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c80-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-201.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-208.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001bab3-229.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-230.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-249.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-256.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00080000000198ce-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-288.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-313.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-350.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-407.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-433.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-458.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-483.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-514.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-593.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-649.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-760.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-803.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-841.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-943.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-968.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1001.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1026.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1069.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1106.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1155.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1168.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1193.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1200.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1237.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b8ab-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b31b-1409.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000900000001890d-1498.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000800000001891c-1541.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000018924-1578.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000066b1-1863.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 49 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001b80b-5.dat	aspack_v212_v242
behavioral2/files/0x0005000000016cfe-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30e-40.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c80-60.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-201.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-208.dat	aspack_v212_v242
behavioral2/files/0x000200000001bab3-229.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-230.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-249.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-256.dat	aspack_v212_v242
behavioral2/files/0x00080000000198ce-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-288.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-313.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-350.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-381.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-407.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-433.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-458.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-483.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-514.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-593.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-649.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-760.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-803.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-841.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-911.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-924.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-943.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-968.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1001.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1026.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1069.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1106.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1155.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1168.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1193.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1200.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1237.dat	aspack_v212_v242
behavioral2/files/0x000200000001b8ab-1384.dat	aspack_v212_v242
behavioral2/files/0x000200000001b31b-1409.dat	aspack_v212_v242
behavioral2/files/0x000900000001890d-1498.dat	aspack_v212_v242
behavioral2/files/0x000800000001891c-1541.dat	aspack_v212_v242
behavioral2/files/0x0008000000018924-1578.dat	aspack_v212_v242
behavioral2/files/0x00020000000066b1-1863.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2600	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-06-27_b497d53bc3861fd8ba7b68109e603c3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-27_b497d53bc3861fd8ba7b68109e603c3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-06-27_b497d53bc3861fd8ba7b68109e603c3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	2026-06-27_b497d53bc3861fd8ba7b68109e603c3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-06-27_b497d53bc3861fd8ba7b68109e603c3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-06-27_b497d53bc3861fd8ba7b68109e603c3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{FBD3C60C-8667-4116-A56C-F908B0B98E68}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-06-27_b497d53bc3861fd8ba7b68109e603c3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-06-27_b497d53bc3861fd8ba7b68109e603c3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-06-27_b497d53bc3861fd8ba7b68109e603c3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_b497d53bc3861fd8ba7b68109e603c3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-27_b497d53bc3861fd8ba7b68109e603c3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4684	2026-06-27_b497d53bc3861fd8ba7b68109e603c3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2600	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_b497d53bc3861fd8ba7b68109e603c3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_b497d53bc3861fd8ba7b68109e603c3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4684

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 830KB
SHA256 8dfcb252b26df6fe08e33e8874d9bed50f2771bb1716f424a99f25b1b953e502
MD5 b497d53bc3861fd8ba7b68109e603c3a
SHA1 39fe6611c681a10e165965f26e5bfd3207467e2b
SHA512 1b5ed901c03ee12a9a2f7d4d22b1b64f67ed7b39affd90a8d82b60ef9004f9d7a8916865466fea6c1e94b75eec22da96bb4e4456bbe646829953dec911f269ce
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiN:A3k03kHRJz
TLSH
T12305AE13E79500E8D10AC1749AEA9A23FB757C561770A3DF2358C6152F62BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
Size 921KB
SHA256 ccf4ba97637d7161b5525de9a97129ba30a09ec99cae7a24af4742a2f7d93f90
MD5 748f76c9afe922a81ba35da25e430c4c
SHA1 0b13a250d181124008a318046c89a38a5834dad6
SHA512 90e8bfa4aab86295a7d707465d6e0ee41fd6ad1497d41583779c35d61bcecec8b8c12a84cf93de7714226221eef0c458893fca1f93481f3a4806aaf03791a7ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQi5:A3k03kHRJ/
TLSH
T15815AE13FB9500F5D10AC2749AA69A23EB75BC62177093DF235886152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 882KB
SHA256 5aca66053efc7267f3afdca68e7766410c7ead50b4849673e290e06290f6f8a8
MD5 9572cbaffa8778e9442902a13153a9e9
SHA1 39e77b99c85ccec27d559bcb13b35a227c6ae614
SHA512 0752c1b8aae790a6d97aef09841fbcf7840659c42a393eb5986d4615ba7018835fb3a06ef1268c32adfa102597d0c9011a85d1737560ad51c8631c91a0a27197
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQisfj:A3k03kHRJQj
TLSH
T1ED15AE03EB9500E5D10AC1745AEA9A32FB75BC521760A3DF2358C6152F72BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wow_helper.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
Size 937KB
SHA256 e58072925d99f4aecc50a7e5dd099b4adf556218aeec2111e6bf8c6594c349f8
MD5 b410c5c2d722dc16cc25e407983d8be5
SHA1 d1a12590e7a552e190aee6845213944239dea491
SHA512 ef7455dbd8be66168cc6968d43f1e74e7afa12f818227dddf1ec6d93917243b7a600015146e7a645d98b1c15dba17173f509e8b443ad6f412a101b1205b94549
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQixhk:A3k03kHRJfW
TLSH
T12215AE03E79500F8D10AC1749AA68A22FB75BC66177097DF2358C6152F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
Size 928KB
SHA256 bd318b2dc11049161e9a5be78718e4a4bbd9f94e4784db795c63c87819fbc37b
MD5 2a7288c3d700f84bb67b1a7671ba93c2
SHA1 080f6e659e541a8371b490d3c1885ab580004710
SHA512 033644365ef613f27013080c6ccfb035215f410d6c74c4eba1c4f2925ddd91626133467d73c5ea83b881b073aca05c754dbde3707e7dd19e001da208e1dc51df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiq2MqDBxc:A3k03kHRJzMqlxc
TLSH
T1D015AE13E79500E8D10AC1349AE59A32FB75BC521760A7DF2358C6152F72BD0AF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 67766d049ad1661d83ee3b62cbd5537c463ffb90e4af686d29f58f5dc5208833
MD5 2f412941ef500bb3b03af9a9fd664615
SHA1 4c04d6fc21db2ab471ae741d8f81fd42485c81eb
SHA512 533523ba83a7ed128a00c3af04dbf598ce91d006d5f4a03171a2eda873da4c1b05aa7e8e4cc30f8a9c860dcae3d7c1c2de7599181e46c8ed0b64b438243b03b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiZ0Le5ji0hmxNrM:A3k03kHRJvPji0Aj
TLSH
T11D658C17F6A402B5D067C0B9C6D6A65AFA713842173086CF1399C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 844KB
SHA256 9b62b943b55afe7985c6d20d633d8910674e9a83385df4f87c41c23e3c31f341
MD5 4b056511c039d575705afeb1b91d775c
SHA1 637dae29813ac767c412bf484e2c275155804fac
SHA512 a51d9b82c2d3ce8bd44731bf962737d3579018e1f8909ee0cc928510834adfa13309e941da4c732e9ec40d245313233fcf34eec84f7815a3df3eff9a5c0f5757
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiLa:A3k03kHRJ
TLSH
T1A4059D13E79500E8D10AC1749AEA9A23FB75BC561760A3DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 878KB
SHA256 9dea017e069f6050098871abd0e92d9c353a95080fbf96efa419c30362f1b46c
MD5 05eac30ceadaa30094a86002b29993d4
SHA1 7ace599390754523336543cdf373b063710a0e83
SHA512 ba779e16e604ff2ae28c51744110b481a9f11ee2e5361852f7da8367103215f44115f0b21c52efdd129bea06118e9e7394ca9779b293eea2446593ab5de7bb61
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiIb:A3k03kHRJSb
TLSH
T1E0159D03E79400E9D10AC1749AE68A22FB75BC56177093DF2358D6152F63BD0AF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 853KB
SHA256 86ab3c771a9d43d6f23e854e6623410f4c966b899565d8352649a8d7a4e88c68
MD5 c5bc8d9c972bad2bad4f8f0d1e868cfc
SHA1 b0e91ca7275666f2031d8311906b4d40a024e8b9
SHA512 be6b264c25939157ff7643118e54f2623fdf6956eff7657f87320b43814dfc4ce8aeb297ed171e59f05f684c2852c53fea5044c2317546f9efcfcc3acafea9fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQizZ:A3k03kHRJD
TLSH
T18005AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 853KB
SHA256 cc88127135cbad61bb837d918d10ac868a70c2689130922023a282a630178624
MD5 d64d600c619467a03f0caf3105bd8816
SHA1 5efcb947435b3f62b9e82cb02ba8c845896e0b65
SHA512 c96cc84063a30ead9d432dc9d68c8a408caf93ed813556713f0d88822d5e63cdf679a91cfda8ee4164524e5d2f69d96ec2dde7e63338692f26efb6f55a18c812
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQio1:A3k03kHRJs
TLSH
T1D805AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 853KB
SHA256 1d96148567b9633b87e48f3eee93d7215c5b4d4f6ff25c213b0bcf2a7c145c22
MD5 16bcc606cf0f4225d7f9181fc065de13
SHA1 2909b4d8734739e8c5e4841f304fa371ba4ca327
SHA512 b9c2477304c46fe913bd3c7d4d84ba71221cc78468e228a68278a9630eeb1bc0f8882c8765aa082a8aa651e2e6df145df7dc466e710c5eb2634a486962d63a76
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiK6:A3k03kHRJ3
TLSH
T18E05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 853KB
SHA256 d7128d63c052c5369d24bc1193c68c3e4d5e042bc5a87d59d93ec13ce535db49
MD5 9a91964ecc64b8ab9fbd9668548e1057
SHA1 317ee4292fb9d9bbea1c78eac741345ea70ca64e
SHA512 aed6de3c429aeacf09af446db77d5587c9f4aae5f208c2ce4a6e817b00951a33e8ceb50a34b5ead35b617ce1a98904b79272c751c418a5234bc5ccf8249b505d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiiN:A3k03kHRJK
TLSH
T11005AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 853KB
SHA256 f2512b950a36b0cdbc148b6b79b0f605ac7bd3c1c00a39b6f0a4f46c7d6a1be0
MD5 10893b6ed3a1ca9b9d185ccc480e4218
SHA1 14b4f590115507603745e380644ca5298cf944ef
SHA512 38e41f5ce4d0241d17d35be9570305ed703deb179c06e654aad31c203e20729a36da41019dbee56230af80106eaff0d12022470ffd01139f0a933e0a4b551fa6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiYf:A3k03kHRJm
TLSH
T10905AE13E79500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 853KB
SHA256 3950de3aa57aa3d4b9fe2492e05edb2775525d303f59005e2738dae72b453907
MD5 c8cf00e417026dc6dff87223a712cd92
SHA1 9560743bbe47a3d066c3bd568358b324d2182e57
SHA512 d08a4839ecc2feb3d8990a6a573aaea6fc0e94248c17e3926bdb686f62ff25e01ff20486304018e5af7fb6ce44f6c433507bc2e55c76d16edb1a9794d271092b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiyo:A3k03kHRJH
TLSH
T14605AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 853KB
SHA256 f70209866e5275ccc4002797e2341eaaa79e91aa03c99cb63e47ddb6585c500f
MD5 e54211aa89cf67932758f8964663446f
SHA1 0b61870453f9aca44e4cd35d8aa282aed9fc4c77
SHA512 30aae3758ac99eb867ee90110df6d3b8675a3c4501f86903355eb5aaaa0ed149705b6c23b6d6f46a1ccb9a81624cb966c421acd1690062c726565dc60fbba346
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQimu:A3k03kHRJp
TLSH
T14205AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 853KB
SHA256 c3e9aa899215db64fb783bac834c3b82303695237e541a7bc67ad65bf5b023b7
MD5 5d47722479327cec21c49ad39c9e79fb
SHA1 5385c90d28024f6e27d4a452fb014b02c689d795
SHA512 6ee55262bae30e396576611ab32e166ccf575187f6148cf82fe236d01b44315fed2ccf87b78965676a4b8ccf8c380b818db8f3a533ca40b42c742e386f26bb2d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQia9:A3k03kHRJE
TLSH
T18505AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 853KB
SHA256 d8358fe8a16007226549ade69be68bf788d5f9485c0ac2021f18cfc43fc26d97
MD5 b324e886b59872c2c435f0fbeea5fb61
SHA1 50ba7dd1d6e116b4f8565d18679a5c5f96c7c97b
SHA512 3e48183cfbbbdf4133891467f5265086b974719293d57035e4da6147d91ff0eaf52e24b811e39f99649a8cd6a0aefd81a79d986d7c8227158e2ca7a20a04860e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiac:A3k03kHRJt
TLSH
T1DC05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 853KB
SHA256 3a810d9c1df3fb90b2613a77d0d593a5f8b2f65f0720600dff87b303816eb660
MD5 a461eeb65a230bf8f847a74f7eff2831
SHA1 99d1a665fa58d3f745fa67e0f9c28b28e4922daa
SHA512 6d22a893f40df5acf589013b9b6142fc0a25a8a7a33cecebad15594b821e7db20adb838ae47d57e35f87543182d42afee17362b0b6a3c9c75ec176139b1357fe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiTp:A3k03kHRJz
TLSH
T1FE05AE13E79500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 853KB
SHA256 675cf132fe42c9a1b4c5949dde2ba08f46a58ce43b9dc1221f587a0938e0a5e1
MD5 85ec36cb72dd84ba47226a30718d335e
SHA1 06f4599e53a1a22dc4fde27ee083dd56998c3013
SHA512 878fcc86fe6f1e75c0868720ee409c05dfef603ebffcc2cee1e4c4eb002100fc3d3eec9c68ebab9a9116a44a89625fc8e1a1478ffc523c948728e2c5bc68ecbb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQi0N:A3k03kHRJI
TLSH
T11205AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 853KB
SHA256 0363277ebac5ecb6fc123ae3f9a632be74c0da388b2b48cf7905a1e47c3b8b10
MD5 aa5fd2f3c08104e4ff838f4cdfdb379b
SHA1 3a9051eea98280d2b8a5a993593ab8a08f2a9abc
SHA512 31a0b39cb18fc210752ffc99941dfa99eadda3ce8baf4e6ff0abcba7e44331394dc3db41a537da673b739bce33b1062f77c6b451f665d146733bbfeaf6122caf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQicF:A3k03kHRJe
TLSH
T1BB05AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 853KB
SHA256 207888c3dfd45e755055b037c21289eb273f1fa0114aed81a11b40fe1d42309e
MD5 3b26786c569df306ff1eaf053e6b5c32
SHA1 5c694938be813662995b9fd4632dc242fceed146
SHA512 7f2fdcf7c3756d2920c1adf965c3ef9e46591999675a2902332c94050f196046946d622f12239ff65c4d47de56bf1310ecf80dde5dcf0aadcd43ae55ac127c54
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiJC:A3k03kHRJ6
TLSH
T11505AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 853KB
SHA256 9f15d492826755d02e78e637a91ffea27fb0aecb75cbc9e390c44b87e1fccb3b
MD5 4a24d9af6e5c2b2ae8beeb1a4dd8c120
SHA1 69e19738668e59610e2fca697415d076c65a802c
SHA512 964937127bf980bc67c4d52729027e1b147becafce503742d825c51c8b817c774277ea24ac9bca43e7728b1224b8ad3087bb962cc72a70b50d18f8212e393a96
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiqw:A3k03kHRJP
TLSH
T15705AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 853KB
SHA256 ceb6f1c48a3b241ab83322be4b0517a06823935e48962b1d0c48c32b18491054
MD5 9c625993b0a074b905082cad7a96381a
SHA1 d6a1bd51ef9dc804ecd0f134ad4dc61e4db21c73
SHA512 5ce05b5f0c054bc8006258bb1488d954c8507a3f671408bacd86fec6491412589e0d66cf8773d485ff1fd3cd6e6a796095f214534a3d0a18a523f5445fc3b771
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQixT:A3k03kHRJr
TLSH
T10005AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 853KB
SHA256 536c7cd728aaea228b2549b89d80132bdb625f274dc6fbb9508cb9ae4ae3de04
MD5 ed0a76f2168b6b32e983580d5487b310
SHA1 45947be2edaddf44fdcff570540a300f81b73383
SHA512 d7c6b902cb8e79ce247775f2f806cbd66a6d9cefa7dae98ba339c338afd0e28f76584d7cd3221a29df57d8d65aa21b014274156f25c3d344f1b5d3273e687419
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQifu:A3k03kHRJs
TLSH
T11005AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 853KB
SHA256 761918b00608327c97d15238ee11ed26612086900216adcad16434f8dd9e9ac4
MD5 f020259f8b4a0a03a466714d9162f2b3
SHA1 3b30f051239bccc67abe74136d7c07b8784d2deb
SHA512 aae23e1863521efa0180c0bfd42adca43a5c6ab2bf1d842c72f8c1823984c7a0e62d7906f86fdea882e6633d53809ef1614a73bae51a868c813ba4250aedf034
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiDb:A3k03kHRJF
TLSH
T10705AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 853KB
SHA256 ffcd2e587513de572175af00258109f2870dabcfdef68e82b601fa01f0864fa0
MD5 7516427dcda320b15ecf189fea496031
SHA1 5e94c79f6b7fc2d94819d54ff0a579dac3dd200c
SHA512 2f91346d60dc2bff9c9216376ecac0e354dcd9885b5771d5d7a84c77e06e845bd9507a3c32c8f32fa289095849905431595dd6969f7dd805b6db58b386f17d27
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiXf:A3k03kHRJF
TLSH
T16605AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 853KB
SHA256 7c82321f84d246d52c5e22c8a7dc8d382295a80b72bebbb1b72d28edc1cd7fbb
MD5 47e84b185ac3dc7125129c0a91908dce
SHA1 d454d695da6627cdae58c4ce6c0782f148306177
SHA512 dca66091dd0d59d89f64176c0ac3933fe76622ca8eb6ab47e1a54b8f24b9d6527573d98bac71aa784a1f5de721bcfefb92876b52d1177c91ea105bbc45cce558
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQigK:A3k03kHRJ9
TLSH
T10F05AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 853KB
SHA256 b374a188c66e7a66c700cd8f5743e10f04d4d801d7b8e9d028ee508635953535
MD5 969d0e2c4592c65d3ea712ff5c339d19
SHA1 6dc63befca5c7cf0b1b08ed8fed16fd78c81d671
SHA512 607d0c63356f713f2414f2f8b5012254874a56b570a052d532a98808984710b38d9bf1b674773babecd9167d8f0ee1414795ea334e6cb0e7f91c079923fc7edc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQidk:A3k03kHRJU
TLSH
T1CC05AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 853KB
SHA256 f119b277dfc81b28d56919ebd52bf713c88f5c7e330871add3e111e7ad42c29a
MD5 d1deeb3fb811b3bb50468de6321d8c87
SHA1 021dd0576ae37cab62451b94307bab17cdae61a6
SHA512 cd123ad3b31c01c0ce61b845333f466145f5324ded08871382ac2d46bc4125d99c0f8c4fd0047b40b255db1918e4931f90aef2e350efa499c0a86316ed1a74cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiC0:A3k03kHRJd
TLSH
T19105AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 853KB
SHA256 a36eaf04b1682294442261fb78182c96f7c90b3903f77f074178e595896b4c2d
MD5 94397324e56cbf4be3db2f8f88d11110
SHA1 d05dca68dd383eb4324837411341857a87e58ad1
SHA512 a24ca6b7e0f0f25e522c31d1419701b0dec5c57645ddaf35b320d2d1a381f9d84ceaa4d3fdda0703148676f562b746cb2acbff37d89e9a303a2a65ef11aa82d6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiRg:A3k03kHRJs
TLSH
T18A05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 853KB
SHA256 06e0acc62377073962343fca4a35b971e09b295cd3e1602a07279c062f6d242f
MD5 78f444500566e2660b830a87f0820d0b
SHA1 5b66b03b539aa124376445d2403527044976961f
SHA512 0a6e8fb5893ff24a8d205a24fc3845fb69625b3d530c613f7a4c521e59426af42664040596a779e0eb8a68908217bd476f3c3116b3177db5027fb92684f855dd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQi4r:A3k03kHRJ+
TLSH
T1E105AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 853KB
SHA256 8c74f0c880c9a8965289657623e13eb30c15903eaad154f19841b72c8da7e5fa
MD5 297047e4342fc2fadf34f53c958c883f
SHA1 58b483d3f87d51d360f2e18775f7db3304dbe4f9
SHA512 62c61b8af5ba1061437c107a190bc7bb69cd1238b8037f0cfe503e23dd84711bd432e3eccfe4f9ea30e580b2f1dcc4927e7694bf39ecc9f5b3d517c314c86819
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiWn:A3k03kHRJI
TLSH
T1FF05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 853KB
SHA256 cc81e8293e32bd4eed9bf72043b853cf92d84ab61ae99d7fd7159c967da86b14
MD5 9c65e66036a5d52ffc6377b0a67f53f6
SHA1 1664efa8c2ff98da4fa26e97a612fa81e1176f59
SHA512 0ce716f80c3b6ba6323beb942ed8586c208511682704d8b1a3f45fa24df490bc913fdf516125108cacbc38830f1108275d098f461fd4c7cf91883752c59eb15c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQi8x:A3k03kHRJe
TLSH
T1BF05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 853KB
SHA256 0fdff6aa024b3a0e571c4e70af41076ae778449deaa88a110e28500d9eb284cb
MD5 20cb74a5ea78974f72cd0781c4e1cac8
SHA1 c8c615b1fbb5681e2a999137412e7c962c27772b
SHA512 5e4c1f44d6e399138b9557e2382aa6f4c3d45b1374dd2718f95b4517bbe9570556b86535830ddf6e84a7d108723dfaa3d83b2a85082fca890df8c1b28d195082
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQi2A:A3k03kHRJV
TLSH
T16A05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 853KB
SHA256 ca6bc618446b512118579d85c04960c8fbee1c94fd7d3043a2c3309bdb8905c4
MD5 3bf921be575f043df65eb94dd6e30ae9
SHA1 37c5757583bb0ced74cf5938963653e068655f0c
SHA512 1be181530aba5bde3f9c01465312dfd17f3087f908f26acaccbdd1671f315faea5609bd256426e19bb578d92e7630267067b417a34e35f220cc0eb13eac440dd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiv9Q:A3k03kHRJU
TLSH
T11405AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 853KB
SHA256 75febc148cff00b73cc0e1695d7fd9f54859c960909954c8be463ff593ea9ee3
MD5 bfb44f70b10f2e2137d0d6afa2e7febc
SHA1 f3d92a6bd170b2cb12ed3f6f702122cc20242565
SHA512 f64050329cd5a5bf9580f2a9fdd23b47bd94b7afe70fcffc2f9978e21eb92a938b4c32216fff7971748dc1ff58ec420c18efe0d661d329f105511c19dcface17
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiG4:A3k03kHRJf
TLSH
T1A205AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 853KB
SHA256 c1b9022fa1741e6ad431adc3a1d6e9f23911de40ec118d86234774cfbb08c106
MD5 61c22bc7b8a0ce8404205d3be938a8e7
SHA1 3b8684174d23d35bd6e81a6a9b9d430b4bc8f3e2
SHA512 07dc761575a3b48bd2831ed7e61ae6ceea2e4c79d96c34aa3a345235a03ef843d2008596495b570f2d793daeadd5c70ccbb4a1066d0ee36e21952abebb7edb3c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiVu:A3k03kHRJS
TLSH
T14A05AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 853KB
SHA256 c5113d5f30abbe713b363d337eedc92b53923e1620aa8ea25262e50e9e2768df
MD5 3d5e1c24479e6d84d7a367f35eba38d7
SHA1 486e08de660f39584d5e2985b4bb10d649ac89a5
SHA512 e8a331c438ddec3d727afd0da62a21a632aeb2dedcde5f87b2cad4beac10d4bd2284b86f88c57e72e2ecab7b1d8cec9acc36c6717acfd03061410ad2777d4b6f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiIj:A3k03kHRJM
TLSH
T17D05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 853KB
SHA256 b04e15fed2964760c26745534d1f54090786618d9c53c7fe191dabf41b5fbe48
MD5 c7f35b9304e1b2940d2cde89c3d70869
SHA1 e59f6441e19f2465c2c4f82d41f951bf8177deeb
SHA512 74af483de372991a4c835eedc8dcf8e91d65f080a12f4d794600b16d252d5a3b2e02f69238ecb0d2536e787fbc0e081d39485ded106c1cafb24761e1f63c8e3e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQi5g:A3k03kHRJE
TLSH
T19605AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 853KB
SHA256 21f13ac9c8beeee14c38ab7e40fb6e7a8ecee48274455868c8e5604fff41190e
MD5 98dd643fcfea0cbda9731731dc8a6f20
SHA1 1ade714c72d1de22784c1fe926912858b85b7dad
SHA512 03605cfcf0e31b6ee9176e587babb846dbb43b1e9485440d8fb053d4e2d666147d1d45ca97651bcd5674bdeb7f881fcb829cfd96041d0b74471ca5a962bada5c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQigI:A3k03kHRJt
TLSH
T15C05AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 853KB
SHA256 84aa8de5274fa6dbf1aceadf1fffbef32b2f5281682f5e1c54dfea498387893c
MD5 18dac774e91af65cc0f40600d076e1f8
SHA1 00db075ca0e3e7b6a6573ddb3b2e04474befd165
SHA512 6d4eddf8360f3baa33c46a2e2fda34b638cf7a780a828da9058588fbeaa97a65e95968a4e3a1b3dc86beafe2c302c6d29d5eb5003fa19b6038a83ce16ec6c474
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiio:A3k03kHRJL
TLSH
T1C905AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 853KB
SHA256 ada7973ca5ec8973c26b21faf722c3326dc80562f0d70e272ac249f80e65d4bd
MD5 ddbc317033db0f287af161a1f7e247e2
SHA1 c6de7d12d0315570ebd7ecdfc4650e3125d2d8f1
SHA512 3be218377430974ed5ec1ca3d3ec78e66a76b5f6c8c0a69fe88a9f0ba0d03a1615a28535adc319abf645235cda8f87a254b08d795a3dfb741ce6a9a402ba6a1b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiZ+:A3k03kHRJO
TLSH
T19005AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 853KB
SHA256 12a89d227103ec9e7518be231933728a3531bfc97a7bf3c2cf29ec9381a1f5f0
MD5 30a7c3ee280be4c6cfec9ab830f3b634
SHA1 51741be1dbc2b99ff1409941072256a6820a3ef1
SHA512 fcc26d4bb5a99b660a12cffe42824f76d5f5a3b6dcba933b745e0908a603a03a232b5067a5ad724ecd7b20d5b3fa664620222de76830e05ebe1155cebf6f3d10
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiHQ:A3k03kHRJ6
TLSH
T1E805AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 853KB
SHA256 e9443cb259b32b15ab6b12b007501d3aa23f8381a284254a3c61d6c27c7b3378
MD5 b9659c83eb96f4e5bb18632b110a3857
SHA1 950f20125999f766055f4b9493add3f42a471459
SHA512 78bdc7340a02e9fe54d7655698e063039b4df19a8ef3ae9ea7a1467a0417b4469a8a781abf1c5a8d093e82c506a40b18a277c1ca5cab0101ad6ce60ee3683989
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQicX:A3k03kHRJq
TLSH
T14905AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 853KB
SHA256 a9d3f10cab996de7d22156fa47d7af9321a2c5fdcce1540dca4e4351eaff63d3
MD5 07909ae00ecaf4fa3f0fd6c6f57acaa4
SHA1 d72492d8cefe3e73b3f0e01eeb74134a2d465657
SHA512 9e831bae23ede7715f1d4903c597a154bcb2901fb0b96cd20a46d4ee6567a4cb484dfe87006fddeb95836deeaf6663c86bd0496c85799d4d90723be0dc2e6f85
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiaL:A3k03kHRJE
TLSH
T13105AE13E79500E8D10AC1749AEA9A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 853KB
SHA256 118ef9684ebbd43d387bc3dde1675e230efc9624b31ea7b6bf37a3cecc5fba2c
MD5 4cad40a65c59e54921d12d323ab7634e
SHA1 09091fec98fc8a42f2eab8079f1266608eb0eb9e
SHA512 e9b908a95e30261ca95d9f91b025574feb1306fd9884da5035797d703bf81891c8e6121715f850a59d2bfe2033e506dd3aab62151f98bc8c416ac46cac5ff610
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQi+M:A3k03kHRJF
TLSH
T13705AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 853KB
SHA256 f4294d23f334bd081dcf31081f15638b6886f0cdb085fc3cddf026ca820fce6f
MD5 ff06d9f276cec4e2f6f01a5c5680cdb1
SHA1 486b5f86fb934560cd11a3eef6d2e52f34728a9e
SHA512 c681ef772e739b4f44b4d4831873ed2dc92b9270afe3b0c04a3646eee4c4c65c14a7391017d74b092468500fad1af63b1261351fbcecfa7754967672496beb99
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQinh:A3k03kHRJf
TLSH
T15905AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

private_browsing.exe

Path C:\Program Files\Mozilla Firefox\private_browsing.exe
Size 894KB
SHA256 be80038bb01c566bc3819e1206cf9c0ece37677c3bc49963639203cf5b0c5111
MD5 59510f6a60e4c3d50afcb894313eb1c0
SHA1 86ac65755227b81b8e08710fb0254c530a8a9137
SHA512 3efff62202a1167b831130947b38e670bf5c4245461e6a2cf6ddf8c0e11daf9d7d63fdd02b9b02bd441c3561965641db97d47963f3f11ad59661ee505648e15d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQiYp:A3k03kHRJWp
TLSH
T16F159E03E79500E8D10AD17496D56A22EB757C561B2093DF23A8E7292F72BD06F3E3B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc-cache-gen.exe

Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
Size 970KB
SHA256 5530aaa08ee4754ea00ee44625cd26e2642475bab36b94326b04178360a800cc
MD5 fd26930c526d952ca451236b06767ce0
SHA1 bbe64e91cbe9eb34a58f23b1c18cd4c1ca995c2c
SHA512 38fff05fa9a52ab341319620193869e19b497c6ccae98ea66bef5c462a03bc9206f8eebc3cf9728ae1ff3d8a8389efba5d1fda0bb734963790dd8a50a4ff61d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQihu9:A3k03kHRJa9
TLSH
T18125AE13E79500E9D10AC1789AE68A32FB757C52176097DF2368C6153F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2600-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4684-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4684-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads