d85bb04ad1908d35c317052e94ba9f6ab0195fa9ea715b129898ebe8b862273d

Analysis

max time kernel
111s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 949KB
Sample260629-vr2fbab16r
SHA256 d85bb04ad1908d35c317052e94ba9f6ab0195fa9ea715b129898ebe8b862273d
MD5 2da0d8b964f4784ed525ed0bd4d11d91
SHA1 bb137e5ed67fbf9047858006affbebde58884ce7
SHA512 8ffe74df2687f27d4512d9098d51b7f6f2054528d49b6b872acd3da4e87eb6af23411cf353f5e7ad9fbb15f99fe9806a80a1ca1b383115e2b252b07d1959160f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSw:A3k03kHRJARJp
TLSH
T1B3259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 38 IoCs

resource	yara_rule
behavioral2/memory/824-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b6e5-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/824-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3596-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2cd-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-284.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-472.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-498.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198e0-589.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-717.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-880.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-999.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1079.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1397.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 35 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001b6e5-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2cd-41.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-284.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-472.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-498.dat	aspack_v212_v242
behavioral2/files/0x00040000000198e0-589.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-717.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-880.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-925.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-999.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1042.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1079.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1130.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1327.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1346.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1397.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3596	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
824	2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3596	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_2da0d8b964f4784ed525ed0bd4d11d91_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:824

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 949KB
SHA256 d85bb04ad1908d35c317052e94ba9f6ab0195fa9ea715b129898ebe8b862273d
MD5 2da0d8b964f4784ed525ed0bd4d11d91
SHA1 bb137e5ed67fbf9047858006affbebde58884ce7
SHA512 8ffe74df2687f27d4512d9098d51b7f6f2054528d49b6b872acd3da4e87eb6af23411cf353f5e7ad9fbb15f99fe9806a80a1ca1b383115e2b252b07d1959160f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSw:A3k03kHRJARJp
TLSH
T1B3259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 c6a68abcebb3e1a2916a8b3b4bf9bba98112225c54b8481a234cb7ca20555f48
MD5 c60f6458baf9109a2972f7bc78d59be4
SHA1 6b7213c6547e1aab478e8052bbd8b1ecd7249906
SHA512 24534b13ad1a78f7545662a2fd67bd788eaf71b111e9cea5a8b64ddf0bdb1161508a921128da514afc97703d1c0863eef3782d7beebcf2b047435d39d39ea6ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSI0Le5ji0hmxNrM:A3k03kHRJARJVPji0Aj
TLSH
T1BD657B17F6A802B5D067C1B8C5D29A5AEA723842173087CF1394C7292F67BE19F3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 963KB
SHA256 8640ad403fad3c406d4f387768dd1fb7491b814b0cdf6059cefc710d5c0b0b01
MD5 93798f8cb6c3cdbfa04f9879c03342e9
SHA1 df5be50c6c18efec62c77189c375c23322e71aad
SHA512 acee81f772309b9599669921dd47996e38508d93b346a42482ea12402c57a7ff92aa46567c875b859a804ae51d9564d0c1db94ff6cfe80213cbdb3698db11327
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSya:A3k03kHRJARJ
TLSH
T13E259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 972KB
SHA256 96c93934e3bac6f1905c87e2bf0458b33a45c8e6d446466c32db2d03b3b2df3d
MD5 00e4fb9094dfb675dfdc98f5b2631a8d
SHA1 3ababe2cd231bf4517b86f81004b57d9acd650a9
SHA512 74b3b0a80065e224fcde96670f330872829b0ebbb311fb9731e75797c1966125ec2f1c161e92cb392ac9363d5bc2bafed10ce12397879f7b349d4781c00d5acb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSj9:A3k03kHRJARJ+
TLSH
T127259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 972KB
SHA256 f6e38ea5bcb08528bec871c7101577b29826a1cab5db823b7089d69ec63647fe
MD5 21034059c3d1f16dcc5c44f19cb6e611
SHA1 6957f8b63c72e7fe92ae158117dab3ba78acb0e9
SHA512 6be2ba902583253f0cd3ea0a2ed32e3ff21276c4a4da8b359aebec9a372f87fe0d1a7644846148075fc6c2770c62950f9ea71b4aa2757da14a0b50c92a2ef882
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSPc:A3k03kHRJARJT
TLSH
T193259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 972KB
SHA256 fca3b380788024f23ab19aac1d3745ea3971e308a3c573cbe2830072c977ac7e
MD5 7a13d37173c8ed71d3832a4a84c59663
SHA1 4d8745b67a2d5ab18f40d19d0f240fb9b1345c11
SHA512 42a293da0bab9c05f954137fb25379176bcd0f856ccc0adba64fffb1bb74ef189ef965cb93c86e7a4cec6fae13df24abae78aa22b511dc04c071f57ee6c1613f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSIp:A3k03kHRJARJx
TLSH
T11F259D13F79900E8D10AC1789A969A22FB757C56177093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 972KB
SHA256 d4d58d6f4d5ca4f2146db8d3d8958b47754bf057e5ac5d2e912c162b135703a4
MD5 9a473614dd3076a3a80fff92d1df23b7
SHA1 a8ad16f41559d2a1c3127aa4ae52419b5175563b
SHA512 44c098eca18b84ce00190a1a2fee4c72cf60cf7441749484a2613493137e2362e5a080a8375aa507503bf6e83e0b1e04a6992834723d09928b45435480cf4cca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSfN:A3k03kHRJARJq
TLSH
T17D259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 972KB
SHA256 336c725192c5ad51e7648ff52792371a194ffccba909f41ca4df879980fcf35a
MD5 a7ee575a07cb7649005eca9d6d9970bb
SHA1 cda205ca6e36ff7ce3667a86f214312e1e9ba249
SHA512 fd11024c5f0eed45e5dc7976b57111230767a91156bcc4b5c8f3e3cd48dea6b4d0c149dd7ff240c13cdf2adb27ea31ebe3e0660a63309508e313c0ddb20297ee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSdF:A3k03kHRJARJw
TLSH
T18C259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 972KB
SHA256 57e9ba16141c92808bab931cfa65dcc38939ebe2c3fb964d02e6aa6aa5eb70b8
MD5 024d7f822da99debbfab0e18bd9c53b8
SHA1 602648291208b99e34fb7defd514f62c81c406a0
SHA512 f231ca2a96bcbc6d6a6b5cb4719a5666f7663046ca1ad8f37b35b63ee7db0cb22f56c711674681a3e366c6e88b25e9c9bd15ec52f2f3048a1341e8e7bd555dcf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSuC:A3k03kHRJARJE
TLSH
T1CF259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 972KB
SHA256 8238eb62cab0898bb81731185c2d7e138e6171aced83fb6c5c667501275d1ac3
MD5 1870c7eac0074d83482cfe61e0ce1c24
SHA1 6b61c4b59771a16cba5ffaf1227bff2d94e78f8c
SHA512 5fc53d819e2313714057b090ad71dd30c90dc40d27af81cd07921bcf416c9d23582a2c883a1bb6ad665ead9a955738353a4e5b02f457d5c22ea28a2a7e767731
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSxw:A3k03kHRJARJZ
TLSH
T1D4259D13F79900E8D10AC1789A969A22FB757C56177093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 972KB
SHA256 9af7743afb6899a69e76fc5564db309b1d1e7b605cea5fc35e261d86443fc431
MD5 02cf3c6d0de56ebad95155a963b987d9
SHA1 b912846366d09fbfff03c9300fbb0645aa19e968
SHA512 5214811222bd04196daee569b314b0d52aabddd1262cd4bbcacc989ba54725d2f3d21513a6dff984953cee0b907b131036fae09b85d5736c6fe038a206ba6d8e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSYT:A3k03kHRJARJN
TLSH
T156259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 972KB
SHA256 2a760cecb4c4db94d7d2210d3c31c334da7684f5ef9b1c70ec1c3e1ff019e9ef
MD5 c31db9e5fddc341dbb24a4023c978620
SHA1 a4c32c1de349c9b774b51788ec6aab85db2b64e4
SHA512 4804c1a7d50363cbd00f48b6bbcdf417699aca39422e384c24c4eafa95da2c71a646d8b921c0225199366e39c70e6621e25efb6d218a2dbeeaffba02655d376e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSS0u:A3k03kHRJARJS
TLSH
T193259D13F79900E8D10AC1789A969A22FB757C56177093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 972KB
SHA256 337fb65add2aa23d8afb226d3611a39a6912a4a10bd6fad9e2b5909d2cc7de1a
MD5 0ebbd86b167ad98696243737ec8a87f5
SHA1 1a44ae3001761a40498b8df05b894830ce82d5a1
SHA512 601f874a076f20ce440d82f395438dfa1bfdacc823ac05042fd6c2206d25930e0ca64771def93f451862ef06df16b2121dee054154b4c4360f4e62a0058daacf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSib:A3k03kHRJARJD
TLSH
T1EA259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 972KB
SHA256 a9cad33662dce5638e48906d788e1315e59ac0f1ea19594a46c2f042897fb224
MD5 71a1fa328ffd0924f778e30b44d2c4ff
SHA1 143f1517615fdeefa4f1d8cfc637c7f511fbec4f
SHA512 eaa7654d30e07eb4715fc249f5d561a64ecd5c09e8fabe85237201998e63b543c0d63a0e49823df304713387a853c83d1cd129477aff99871ab2884e6a1bcd78
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSkf:A3k03kHRJARJ7
TLSH
T145259D13F79900E8D10AC1789A969A22FB757C56177093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 972KB
SHA256 8a00e76425eac80ac94110517ddf79dd1550491666b7800f5d91d308a1291ea2
MD5 26acb39afa54058da3832118910292e2
SHA1 0655ebac4b4529ffb25df7f9a0d00126317e25a8
SHA512 9ed9ed1722d454fc7b95324b2bfad7c26f9bfeec7681236dda82d71b52b7b03ea84acf59fbd4c625e9db390cc932c317e7e756e76c0d9375d622f1f1b3bda1c9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSBK:A3k03kHRJARJr
TLSH
T10D259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 972KB
SHA256 aff1d29a1004fbc73bddc31dee4d0113cbbb4abd79ed6bc1bf9e85ff028fbbee
MD5 6564077de1cc21e7c439948bbed21d39
SHA1 ea2a831a0ed3b2eb7e93a650da7f61de3cdf94e3
SHA512 7e33b2523797000747b153b913a47291c71abe7fadf16a3c0c7a7f72449075970ee94c09e4d826d6d61d670e31de9e4acfa3b06f2f0f8c05d507b3b6cdc23a1a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSS6k:A3k03kHRJARJm
TLSH
T108259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 972KB
SHA256 9c4d21952ba9b0e5f9d258e53dd275b8f112fd43885fb3f30af82fc7a37cb577
MD5 f36c504b4f74d751c0311f895572def0
SHA1 e0a8e6409b0616567b13d125b215a0330f581589
SHA512 6778e880e4df9d3b8d944398ee7954c1c8d96566f90174c8696e36385e78f87f6b899852087f0781c7ca06fce1094f3dc25cc506b6162cb8283a58914136fb91
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSf0:A3k03kHRJARJb
TLSH
T1F6259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 972KB
SHA256 4c92420f538a1a4f416bbcd7e1cbf0e9a104710bd8358f4e418c9e8accec406b
MD5 42a5c62f7a9cf4358a6659efcb76c375
SHA1 e013141a90a1e507acbeffac1716ae0d2bb1836e
SHA512 b0da55a56af0a9e264c225ad8a8816b0821b1caf27db5dcd3193a4fd680cc4cf40283e27a35d81474165af9cac2b9695bc2546f62d8b92f4c96cabbe74864225
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSug:A3k03kHRJARJu
TLSH
T132259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 972KB
SHA256 674e09a1d6ca7cab627bf670abb523f8615e121d18eb6a5c63dc3ce20257d70d
MD5 811e38393c76fc3ee830688946838cd7
SHA1 544a18e7f71d550a939c5cd00126630685956423
SHA512 0ac8859ab3bf660071063a60090be664d0f7f9ce46b3deee05c027dd5785b9e11a3e4ff8a0b7dfafcfaa1cd2354cc0aa90803cb8aa1ebcf51f3eb75a2881931d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSS3r:A3k03kHRJARJw
TLSH
T171259E17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 972KB
SHA256 8a31789793c259c62986c5eb43ddbbf0188dc077a3b5ea3f546d7f7e6ef4e370
MD5 825ecef2331416083dac453dfffbcac9
SHA1 5cb6892090e7cc92569ced074149bfb49ff9e31d
SHA512 9821fc3df3a510e8983dc938889a7abc29582b22128fc2c345701e850ffaeb36c5c9e04e0e7d15b1e8a7235f46896537c2c4c153585a4ac3eb113e3ed4aa60ff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSBn:A3k03kHRJARJi
TLSH
T13D259D13F79900E8D10AC1789A969A22FB757C56177093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 972KB
SHA256 a373f6fa97415e0e30ed140c83549fe46486c3296faa47f7e3848ff57d3339b4
MD5 a3b7191d98257723b2b3207be24d83fd
SHA1 0a66bff85b17c1947912698d64aaedf9ef182080
SHA512 765d91136c49365384d5be9134461a12f756e7730831be6cf63fc75e04c79761e6fc824472846842c50f7bd9f20c158d9ac8399e8e83e8566158421e5ecbb6c6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSStx:A3k03kHRJARJQ
TLSH
T1AA259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 972KB
SHA256 fd2d3faf36287edf387047ca642d96e68d5272874d353d83fc81a74ff3b08bd6
MD5 bac4e8774edfd8b865803f3210855df4
SHA1 d814580f6235a9c46ebdc7e9df775e24d8ce228a
SHA512 29aea42ef927fb819b5461e8fb3f99c2f1fb65b8d5bcefdea2456cddede89dae9525cf0136e7e8c5d77fe17dd756d96de22c787df8d47f1e9ac74dd638371e14
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSzA:A3k03kHRJARJz
TLSH
T1FC259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 972KB
SHA256 326bdd72ad6bca030656ee53079c953f57a3beca92877f67710877b0464c167e
MD5 ffe2a3ac31911764310aecd25d448d07
SHA1 a2a66b227248b41aa13e00840c62b24eb453a849
SHA512 b5a86a55c17b9e1718570248f71cb893eb35a746bebfcf221a9904551ee659f14434df4b6219a6f8eb2207e5f7360193814fba8059a0ec4860f9a1d38c63c1fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSE9Q:A3k03kHRJARJe
TLSH
T1D4259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 972KB
SHA256 44e0b9e40aad20cd49707eb9960a4929456bd79caa68f950290cea1dbc421681
MD5 62694effee94e8838059075f75a7e454
SHA1 39fa391e5caf269588f34301b4dfc48ce21e13b8
SHA512 26d03995e8469fbb0f1e17aec762ee1962e4b5732c4cdfe6b50521076566bdc79f284dab0d7bb26f231b94e57128340b272a54e8a90157a9ec7d5a55ad0740cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSd4:A3k03kHRJARJd
TLSH
T185259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 972KB
SHA256 36173a265ce04e0334f12bc4f90539a2f0fdf128e9a035e7ae0edd200d893176
MD5 c25ad32ef2bebf32350b3caa4819defd
SHA1 b3e8b45503133ebe4d2ab88d2ef020ea4d5f73b1
SHA512 45824fad50bff7866ef30bb41204754933ea852278e5109bf75e2208eff348550a27ed51161ba913f8649841eb17504252cea2065fdabe9eb3341e6e09a499ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSS4u:A3k03kHRJARJ4
TLSH
T10B259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 972KB
SHA256 8c4fb4fab8b6e407d7317c514770fcbc3f7f9549c48e1f53effdf147839f0167
MD5 90f1f0d1ed6b0385a08cb7a5928cd749
SHA1 19eff3b3a661d9e5c1c83b390ac8c4249f1bfbc4
SHA512 70c9f3fac3a5089ed537858c38e7c695f39f1ece2aa111b910d9cd82b9f017975ec0fbc13e2ae9e101645ab4395a3aef75d3ca0bfc371772cd26152f523d58e7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSZj:A3k03kHRJARJS
TLSH
T133259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 972KB
SHA256 8a70d63efc664ea4542bb28d8185c161e29e345d078980f998a51839856a8ae8
MD5 6f720da2a6639bf159b2ee3f8cca0e35
SHA1 e4594b8b87805a2d393fb5fb593bb0d9c705e336
SHA512 c193ff361483ea4ec8e0a313350944c2e929c28b402471cd992df17d63302ef966c7a008f5b2f489ca1b54c838502c2a5841aa040ccc3607667e193b9935fb87
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSAg:A3k03kHRJARJW
TLSH
T14D259E17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 972KB
SHA256 30199b74738d6d8f2a41b340bf68a4a35a5dfecb1b033ac7ed6799b0d27d3549
MD5 d4d7dddfc0826f8ca84441a71266f6b9
SHA1 3c62a4541af187fd7256e93085622ddae2e54c83
SHA512 910e91f0f80732f8b20b4b319ac88ac06b47b8506ac46a41c4ed608e5d9c3a3efc700bc77d74c3709a49491eb399c6d3c89d1808d110f62e9e43f7e733da2e80
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSvI:A3k03kHRJARJ/
TLSH
T13C259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 972KB
SHA256 210d0fa64812ba24712914c4f57d6cbaae10d3b1763671b314d2191b0924deaf
MD5 8f3da0b8a0479afa884c2b1bc9b858f1
SHA1 0bc73e9f6fc1d3f4be3a717950ec2bc9c73fea04
SHA512 e6a94450f16d16a07bd5a758178fa1ebab386308af09fd9243477bd19e0bc93c4196a3192c7ff412140cd8762eede2777954003a33213db4624c3316ece810ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSVo:A3k03kHRJARJp
TLSH
T129259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 972KB
SHA256 2d2346adc4c7b835cdbfa12a5598eb175cb4b05b41beeeb2b6719ba8923e2efb
MD5 007203973ee4e21c26759d081d8dd17c
SHA1 4ea645d016e46d30813c9bf31455bf12aa3f8462
SHA512 16f4adb8833001d45f0d8a3629e3fd3bad58da2e7b83cc3be7cb98df8f215f94012465814f68ea014b8b21ff49041d666ba3cf163bcc25bbb9af26eb54c8e60a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSG+:A3k03kHRJARJM
TLSH
T152259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 972KB
SHA256 436b6de540da516194803210d2dd1bbe4c2ff7b15a4de6d2a23b94cecb6e9823
MD5 51d93e2ce26f93458b0a3a58f1e69f3d
SHA1 90af61c3c60cd2659963d4935749f3b18ba9330c
SHA512 79d3dc29ae2fbfe5a5ea2bfa4799d9a8a8ce0660e67289b6ecdae024b5444c8e58b181b557be830499d6383c25e25a105d5250483f6f28f1f025a36345e9c7ed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSGQ:A3k03kHRJARJk
TLSH
T12E259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 972KB
SHA256 9692453f5bd4dbfededa196aec5a77b859a678d5ca2ad64dd37726ec5b248518
MD5 c8e277dc77598a1180e3204167b367f4
SHA1 0dac7539dc71f030fc7b7eed9b8bc6800773337c
SHA512 c76cb9dda90566637c635c32f43a6725a216858e1e617a9c37809520f886baa4de6f8dec7f975cc2b11126b94dc90f68c3315dbd7ae5af9cd87ab13b79ac6a02
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSXX:A3k03kHRJARJE
TLSH
T181259D13F79900E8D10AC1789A969A22FB757C56177093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 972KB
SHA256 e6d00968440d904d4277ec89a9fbbba3fcebbd453eb242224c61bad17ec8264a
MD5 1c79838e137623efcb2948d720efd3f3
SHA1 96a8a13d246a029cfe184478d4936ae7d718458c
SHA512 4b564636e4d93e2c1425a927f95c9e775482536122d9825e1efc8e95703888f57f6e16d7d8c26f8a18097839bde411de657b4d1d80b66e5cc95fdca9da570b5f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSNL:A3k03kHRJARJe
TLSH
T1C6259D13F79900E8D10AC1789A969A22FB757C56177093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 972KB
SHA256 6bcabf9868386417d457242b3acafa5ad1bf53762063c983a71bdf73e9d13f10
MD5 f742312bf75183550e05971513a1fad6
SHA1 9f8a019efc1ec99d05591fef2980820ed33e1bd3
SHA512 7ef98cb6994e6d4ce6aea3385b472464b74e443dd5dabb049d9298b0770996cefcb96ec345c567bbf11fd22e86296814a8caa2b6d3a8dd25e8b75301004d414a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSLM:A3k03kHRJARJr
TLSH
T1DB259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 972KB
SHA256 e5ec0c12f1c1b922ef471a8d94d06011f579b427476faf2f94a81ecf074154d3
MD5 aa0d583c7dc9c8d95e3f272aed6b56d7
SHA1 c80655f0a3b4de94d6b057c20a504d23cb1e8b2a
SHA512 eadb596589754556461d44837f6989bac83935f4522a9fafed1f04d8dc22fd4276ad87d63c052c233331ab478dd02b052830d6d21c04fe0c6ae0129f3ca978e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFsLJSSMh:A3k03kHRJARJl
TLSH
T127259D13F79900E8D10AC1789A969A22FB757C56177093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/824-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/824-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3596-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads