5f06d77da7211cc089ce51a7486775bb918ac06677be6eec91aad8f26a93b7b5

Analysis

max time kernel
106s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 933KB
Sample260709-pradyaav3k
SHA256 5f06d77da7211cc089ce51a7486775bb918ac06677be6eec91aad8f26a93b7b5
MD5 a07c55481f21d0dd3833c8aafe71e94d
SHA1 cbce23e7efaf906317137b2716fe8e7d992e947f
SHA512 1d90919328793e821a12a2f636871b85ff1c809efc7a09c55aec6ba29bed7ed985cda20183792ba444ac85cb3b1f1b9ae8450d437841de736aac964d0177dcdd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEN:A3k03kHRJ1
TLSH
T18B15AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3436-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000016ccd-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b316-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3436-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2864-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b31b-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985e-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a72-578.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-682.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-976.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1019.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0005000000016ccd-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b316-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b31b-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001985e-224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a72-578.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-682.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-737.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-907.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-920.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-951.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-976.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1019.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1062.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1123.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1148.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1175.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1182.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1219.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1322.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1341.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1372.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1379.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2864	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3436	2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2864	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_a07c55481f21d0dd3833c8aafe71e94d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3436

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 5f06d77da7211cc089ce51a7486775bb918ac06677be6eec91aad8f26a93b7b5
MD5 a07c55481f21d0dd3833c8aafe71e94d
SHA1 cbce23e7efaf906317137b2716fe8e7d992e947f
SHA512 1d90919328793e821a12a2f636871b85ff1c809efc7a09c55aec6ba29bed7ed985cda20183792ba444ac85cb3b1f1b9ae8450d437841de736aac964d0177dcdd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEN:A3k03kHRJ1
TLSH
T18B15AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 1da4e548d67f7ce69f706291dc9832eb688adb48048571516711909630a5f468
MD5 042f115474925a8146cf2bc38b0ec7ee
SHA1 c8523e7a51957bf6ed6f34ff0dc9c8f606dc2f5e
SHA512 9182197f90c3cc98d4adb634dea060ca022069b740a0e7b05735eac831752351610ffb06fc5baca1c31e3301165c623c8da307a662ef830befdeb0f15d1a0724
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEZ0Le5ji0hmxNrM:A3k03kHRJxPji0Aj
TLSH
T18B657C17F6A402B5D027C0B9C6D6965AFA713882173086CF1399C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 947KB
SHA256 097e3f056af6a51bd488c0d24595672d0281476797c87fd6446a6aa4de72d50e
MD5 f749ae8d844bbfe3bd3f00c47a58ee98
SHA1 ad3809d41fc7ba071b9086e8bcc2bfd455c6f90f
SHA512 1347a2a97c916def9de8b5d4a7bed672d0da5ea314b4e7e5d45d74a696b7157a1b7a18d4f0a1746d1cb79a058b346b4d77acb0536c73e10330f4ee77f21164a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrELa:A3k03kHRJ
TLSH
T12725AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 956KB
SHA256 1f9f5ab151170087d7f746b76c4f544205c7eee6e2959c4be09d3999a92131f4
MD5 de23190c625d7abd9d1d71399a10855e
SHA1 4808dded4aa8e7696604177185d3a17a00c6f8ad
SHA512 408a65e2cd927b6021d2d29b8e5af290219168cdbfb6e471baa90e3e1975f04fd2952dd63be90504a4fbebf7b3f30292032648727a9f3ca642daae9ac04cea7a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEK6:A3k03kHRJ9
TLSH
T13125AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 956KB
SHA256 beed4a55280d71d1fea6221764f9076fb13cc6457429aaa090a5ce70ddbcbd6f
MD5 481ac48d8366bd003d1d675eb44d2015
SHA1 9e7a477734804ba7f3dca6363234dff896cb9c90
SHA512 d5f24e1217b20436f01edf2c4eb8699dc83a1cb6d26ad06b92b2c7b5cf43a14c4d63540fd82c3d2375e2f26168f6f7139127fbff1e4d1d2df24b31f2cda7a47c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEiN:A3k03kHRJc
TLSH
T19625AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 956KB
SHA256 2ad1a7bf6da7c13009210669a1ac1249ed25b79b551525e75e45292baf0cfe4b
MD5 9fcdebcff2fcc2613a2daeb111787ff9
SHA1 f64aff2bacd7088a9f7e6fb30f53ca2bb27ab8d1
SHA512 8c4aa9590bcf738b520f79ceef5c55e0cbbd8673ddb8b3d6528e086e29407e431606a4f583f6f97e9d9e049b54a0f44b4ffee0837491e770d651fe4f2f3eefdb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEYf:A3k03kHRJc
TLSH
T1C125AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 956KB
SHA256 49fadd3398c85d9a1d16fd09df2487c141e37d57ed620cba310a93c40506207c
MD5 65fec193b42e0ad4cf9041a0dc78d85a
SHA1 4463b43a6a196343f608e6e924cb3b89313fa714
SHA512 f18c65fa11c49795d39527fd481a4bc3c61ebaa12a56bab114cf98f9156163774c34956f212e367954a3b2e1682bdad1d08a71914afab212245971c4bf0f6310
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEyo:A3k03kHRJR
TLSH
T14C25AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 956KB
SHA256 458de1693bdcd117b5919c3ff140bd758311ece03a09360f8235dc2892574447
MD5 a47989d038dd06833168f877344c4d73
SHA1 e67750755afb3215f96ff5ac67677a800f962d42
SHA512 e381e0bcd3ab190c00710f40ea596732d88a07f8692bf44bbbc32ec483bff78907b1122f0fdf5a69d41cab32a6e3b3f6aaf730b0cdd82febd94ed8f9bff438c5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEmu:A3k03kHRJD
TLSH
T1C025AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 956KB
SHA256 bbf96530842e516db269ea92c90151ca5d8bbb9467577bdddef4c4d8798676c5
MD5 45d41b6fd558153b870a7a8ea8e825da
SHA1 f114830952f622ff72869d4a4260b2cce19ebe86
SHA512 5e09acc17c4813bfcce5636c2ff32c3e07786dccabf43ed9fda9b124480856b8f5381221f9dd0ee62f98d7d6586aea98b65bfd26ecb0fe2fd4f5d1d08cd0a733
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEa9:A3k03kHRJi
TLSH
T19225AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 956KB
SHA256 8bfafb54059bc639e0300d67457ec4b42aa5fe4ab4cd47cec7c46cbaf7996b99
MD5 039c83091977d26b22ca3b5366824162
SHA1 8aa6c2ff3633162468ff64b1d3fbc9d6af8ae378
SHA512 3045068e006039ec62e254c037eb1bf37643c091654ffdb3fef1d629882ba0514aa6ed63573306d9c3948b775a7d1458d45ea932fd67d02d598523bceb9ba842
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEac:A3k03kHRJP
TLSH
T19825AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 956KB
SHA256 7cf03f35a52265272b28c4f179ebef46a430b3649ffac2b55e62f4c81ce3ba92
MD5 d8372cea4c797fabc3e7dcf5bdd6b867
SHA1 28741004ee8cf8731818af1efd0972ea40cd8921
SHA512 4fb45a0d28622407309bd043b6f11f635bbfd34f2acf9e9fbe7019741f282108ed0b98cd8924de498345cae18e98c4e2c3431425538172cb5dd8cbe6a736b730
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrETp:A3k03kHRJF
TLSH
T1C225AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 956KB
SHA256 832ff734ea715d482ea6cf8a8306cdf401052c5bd35f7179b4c0ebb3a78c15c0
MD5 8385277d31fc7d57c353a370dca55caa
SHA1 1c99b6951f6e45cc140718fa671b31fd4f0f46c4
SHA512 351f1d33e25f3d4eca3ad90a063adde34e65d56d5cb8f9399da364ab0268d7254ba6d9223e104aa776bfd0429ac70eb56759d68914599ee06ca73343ce6aa661
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrE0N:A3k03kHRJ+
TLSH
T12125AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 956KB
SHA256 369ed2be566ddcd92eede06dcc35b8f413d88057a090e106b81422a88b18efdb
MD5 d2bf3be4a57b1f5db637171c9f9e0567
SHA1 47dc56428180befc9a43cdbc993b083ac30ffcf0
SHA512 f3816742af87ae25eda37e7992758b06cd7e07cb9cf0ef53309164a9ba898ef0dd1eedb6db638a3fd8560783a52786c18c7e47ffa9363b3bc33624ffff9ec98a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEcF:A3k03kHRJ8
TLSH
T10A25AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 956KB
SHA256 c7e0fbe764fdf08f5cb693198805e28d028a2e9986dca20b790d6df93500c6aa
MD5 ce811f5bd22e10892e361761083519b9
SHA1 280ae547a63a9f392180801a70aca49cb5e851fe
SHA512 a6a54cbf980e36dbed30a2d5689814d7b31f7c0176b66dcfa44ae71ff719f22651358ffdb0e8e3301dd3869ad41f04e1d81fdf5d1550e7d9ad5495a7b936e2fe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEJC:A3k03kHRJI
TLSH
T16825AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 956KB
SHA256 70529a70b9de5871ae6fd0e8a7d9a7ffaaa5829569c284d19d77727cece867f5
MD5 07eae43ac20042909d2c7f8ad8c7990a
SHA1 4e87cc03ac6edc52c0199d1d15b0c536a6e2bea7
SHA512 12e1a4c82fd73da4434e93e3e495142f6c8c7aeb64296d745f4767a9ba2a218e997548644dc89152d48c2ab089e83367dfbcc9739ee17d69eecff777dee6c6b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEqw:A3k03kHRJl
TLSH
T11325AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 956KB
SHA256 54ea1f52511e243639b569cae41224d73ec8ec9eff7a5a9255dc8743a7c827ba
MD5 cfdedc9bf79dbec923a4ede614628283
SHA1 666be6a5b283b32af47087479bae94f10f2b085d
SHA512 1d23c89ee9244832308583c9a11114aefaee8aa4cac1f331d75f33f0004463ae7d11c49b4349a9a74159c007de23b294b8368826e6be06b56bbf29baf25e0739
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrExT:A3k03kHRJZ
TLSH
T17325AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 956KB
SHA256 21834789e7fd9589219296718c594b6be7c0fd143cb6e1ef1afff5d74fd15cb4
MD5 5e9157d81f3a30862d61966c982832a9
SHA1 c3dbefc4537696d65d7d9578d7435caa48ce811e
SHA512 ab8cbc4384d5c18939e2ebbea3c68bb14f47a9c7b710ca1234fb962a43a9d7a8f7bb1578d041697d7bc940aad59477991850637f9aad95cb51312e81e4f3bd06
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEfu:A3k03kHRJe
TLSH
T1FF25AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 956KB
SHA256 85325072f7a018926a1fe86f5a502315a7bab9c059b1d43619d9571cace2ffdc
MD5 7daf6e86b78e5872d0403709c3f0e21f
SHA1 55e42a7fb7cf4ab54e232b685be871426afb2d48
SHA512 e4b31e450c8f223d370a246604e25c3e035b0a94629e9ce2e3cdc29d00632def319ef2b8e4cb0200730341d8ae36a847ae192b1e72caca644a8117acdedc8e9e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEDb:A3k03kHRJf
TLSH
T15E25AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 956KB
SHA256 4f0684bc1af9153deb9565507b89dc5342c6370052180077c09abf1c324a94c2
MD5 7ee0a21ec067bb2868fecca1a09398c5
SHA1 f06045c76e39bed4d5feccc0c3d3dfd54255792b
SHA512 321b5fa5989eebadf3f2ecc7b4c7526c1d15ca1bfa4c86e6491e94f532b5e61c56e5e17198793d90e86e5a2a8422ce2cac18827f073716d575e70931aafe13a3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEXf:A3k03kHRJX
TLSH
T19725AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 956KB
SHA256 ddb1648f93f7178c46c88619a7a4b775add4029373f13ce53b4dc20a89ee6795
MD5 3622e04100ae7a0a8d33d8f27f839dd0
SHA1 14fb718e9e7ac0279ad2cc7deb3111020c606caf
SHA512 6f778c2711bf3273c6e6e46f0adde8730781f639321f9cfdf9f34338f5b2e7d81b90c6de2ae13883c272a304c3137a2289bfd5e5a793fe60b0d9a082fd74d979
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEgK:A3k03kHRJX
TLSH
T19E25AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 956KB
SHA256 cf20120b3729c6baf48afd6bd92de582fcb95917639532fb7dd921776619c31a
MD5 710877dd01aad7bb42349041dedaf899
SHA1 5809f4607292469edd2c1a5203c68284ec0ba33e
SHA512 ba63239bd55a00d4928ce411064c9cab8673d77b1d1f56c8fa850d9651472ad5132a3405802b0ee00e46918d6b16c9844405ec40fcfb005498a7e11a050cbdef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEdk:A3k03kHRJy
TLSH
T1D525AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 956KB
SHA256 68aad9af1d445769aaba64c5609c3f47633239684415b9dec3e9173356eef3bb
MD5 9141a2ae715b1b08cee3f933f0c515df
SHA1 ae48381a8e5f09bebb9b062bf70b36b6b20a5234
SHA512 a3c0a67f170f6738c13cb915001c205ca6e250dc3146f38ed3d9054bb1804af7f4ad9d57dc4811e8e0562026e99eda263850dd28c60fd14df6087174b2d00403
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEC0:A3k03kHRJ3
TLSH
T12125AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 956KB
SHA256 33ced1a7d75a30f0c35d168a74e3698462c11999129a03deae7b57c29c889804
MD5 ecb028c062609ee6597df4739a609537
SHA1 567dc5f049511caeb7b9de1d47317f5182e44723
SHA512 d282b1e7024dcde763180e7978b6421d84be47f5f4bbc252aa937f3cfc4231257db45f39f376cf6f26e5ad4b1587b441ad1514522a374254db1c9cccc0bb6c40
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrERg:A3k03kHRJK
TLSH
T12B25AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 956KB
SHA256 6c9303b6e837b3cc6a77646f61e7548fbc1a92a79b2594d406a338a673e0adba
MD5 203ab8e2b5575a15c7b63378ac23b612
SHA1 1ec872cdeb824cbbeea54799b9a02fd7355ebad0
SHA512 77f074fb2e7b1668709e57d58613d79cc253ac04f02a5a08e708f59a07686e18c7238aaa0152df4af764e1e2bb69a5240ec5463322281b9b2c39c93f0afd4fed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrE4r:A3k03kHRJU
TLSH
T1DD25AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 956KB
SHA256 7bbedf7951ef8b0429bbef677668f7a4e560f95d826ebbdd87936e537c8e42b6
MD5 28751663efdd13416739cfded60d29c8
SHA1 8b9aecb59a8119c0d6de03f28ba35105fb7a21b6
SHA512 77813e82e79761adad620a97ff4138e1ec5389f473a7e2834094d85c3213ac8d79a5bf1a9502abb45a60ef8a77a913610fd120ccc40b851a62d64e76dec747cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEWn:A3k03kHRJO
TLSH
T1D725AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 956KB
SHA256 72a915694c377137a4ef04ed78b7638c23fb528da9f684a3161482a1647e3e79
MD5 714cf9e0a55d9c125c28162cad83cc17
SHA1 d38b33877f4f9de728bbb8f2764f2e5169dcb1b5
SHA512 00d7a7b2a3947d73ea7b0385675a4cb7068029525ff3cdf970bd93e9dbef59a77bed0824d0bd246cba82a087ece59c35aacf368ec8a2343415f11ddbc0ee59d6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrE8x:A3k03kHRJU
TLSH
T1D725AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 956KB
SHA256 4032f8d378eab9127b4865854f003a17960286592288d53b0a57efddf5ee85b7
MD5 29d4b9423a159b9d24a12e0709900f84
SHA1 9c2705d81795ec6b5d440062eda925514f5014a7
SHA512 7ac5e7d43ed04e08964514c2efde7398dde73d00addf3dc5ef3fa684ef57362e78481c1a1b3fb9ef8b52d23b3b57ab206a83f6c876d7725ae5aede3b29e2c193
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrE2A:A3k03kHRJ/
TLSH
T1D625AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 956KB
SHA256 0a297985f639ddbc7b9841437b2eb259ca7456d2cbc7ce5a7bbca4cecc303e0a
MD5 79e1a90d065200f843b3344373c75345
SHA1 94212ac6216f54d299412d9b0b085aa860c44b46
SHA512 d7051d845853641709e70bd8c7bf5626d487443dcd35aa77fc1bf27e529a14808ae78b58c55b63b977bacba94607e8dfcfe62af9465811fd4c044a29e9457595
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEv9Q:A3k03kHRJS
TLSH
T1B425AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 956KB
SHA256 2923899d686367a32f145c7ed33c9924e78a9f8778e5007570cc47d29b9bf6c6
MD5 4bbfa0b1b9c08074a473dd9eb42e03c7
SHA1 3df3dc121ba4f94649e6eecace75c58cf89c1816
SHA512 93aee276fb1cba6b1f3fbdb4c62d85836e58e37e79ba98825502df0576d81d24279a3741158eb5c64880953d45f0847c965447181ceb0ce55f7cd192c9d1a95d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEG4:A3k03kHRJh
TLSH
T19525AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 956KB
SHA256 ab4d5865759c4237338cce58429bf2b9a1b84c319eb2d7cd05ac4174f4691e9c
MD5 f08b2bcacddd254bcf9f3bf8c692b35f
SHA1 2a61d6365096766718cb810a00b6a96ade58bf80
SHA512 d9fc32fd77cf7b6d3a02569cf250ecc431685c4cd438621f8017dae79c8dfb86d735e7e5fd8ada167f1dc99a6a4843813d18e5c6a66722fbfe7a416364455efb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEVu:A3k03kHRJ8
TLSH
T18725AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 956KB
SHA256 a2967097281d57b1837440128e5b1b45e65ebe1511ab46eabec3e21cf9a01e08
MD5 5326493e2ef882d218d8e69a7569a9cb
SHA1 774ed0cc9660861b6ad426f5e4e922a68e6aa67d
SHA512 2ac711e5f1a730c64a2cba4e07703829373e8cea83badb1f0ef6b273f811f81b1cedb4b5859546f833cc109fdd3bc81d22d1e49d8852b06348faa306a92fa95f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEIj:A3k03kHRJe
TLSH
T1F425AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 956KB
SHA256 1c7e01b749a256921308fa8d2b5689c93527c6f37b09a57358da2ae4821f4036
MD5 d1cf8ca639ae0a92c505eaac18a6ef86
SHA1 3f3c9dec16646a5969ad600d743dc45468683377
SHA512 3a03c71d53f0dfdc3a4c6283f2afa3e339dadbaac7ccfb1d9d1baa4865a0c93ea5142eeba79e5fca9543983124f0562feb101ef98c666102714282d5e5b5ba1f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrE5g:A3k03kHRJS
TLSH
T19225AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 956KB
SHA256 e54331cb22d3190b1b1745faadd060a7588d1d68b8a0f87d95eafcf24b05fd32
MD5 f281a27cf9f2681f775132e3b8760640
SHA1 d497b4f12407531f492f7a45061a59660dfa1f10
SHA512 753e5ca0a9e1e1df56955d406727f80795d4383e32a0c3eec0c386722c4d132b04259e47bab834b2d6ce9518025b854b5f3965b072eab9f7803af013b444de9e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEgI:A3k03kHRJj
TLSH
T17625AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 956KB
SHA256 8e11c97d8336eba1cb812a4468a41a4523cd12d133135d6c2fd90abccd98cef8
MD5 8b40fe751bdfff93f70b2fd2ea7a4ec4
SHA1 03ad8c5de7a0b01e41716c1644c11dc55a663be2
SHA512 d2ea57cf535ac4daef46fa44de6f10de92e05542f7e7d628620abd261b420c2f5c5e22a3601256cd395145ddfd9e247889ade7903b59d85dae9a5286363c8401
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEio:A3k03kHRJ9
TLSH
T19E25AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 956KB
SHA256 ff761df29b9fc213629e8cf724bdb798e75523f189ae1960c1506e8585d83c09
MD5 6c3d7060d6bac853a97f213692882e52
SHA1 256a0b5325b703240852dc42f1de24d74492914c
SHA512 90ec40afa24da5c4e2c1d1bc3a3f23d2f0b7a919998c5cc511a5af31cef8d58b9ca2f2be5340ab00ced61e231941e148aa0add09e22383c175fb3ef30acaf5b2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEZ+:A3k03kHRJ4
TLSH
T17425AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 956KB
SHA256 0bb2081c8c1d471c65d3f79eb05106e5c16ea8230b70c71b2809537af6a6e6f0
MD5 ce96b34037a245ea1bdad487f21d74be
SHA1 6400a0dafe664e4a24cf4d2bc8463fc63524e57f
SHA512 7039dc3b5549ce9605f1bd44c5d10ba13f3bf87026d9b6f1851ed3d75264492a5cb8418987b81e7ef5fe0bdf34eb9c1ce1c107f6371cc23185d39bfb5c3a7780
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEHQ:A3k03kHRJ4
TLSH
T1B925AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 956KB
SHA256 b688760cc11ac71ce6dbe151e96cd3a0068320dbea67c0bedcc9328acd88d1b9
MD5 f8bd920b1ee7a626551c661f40cc9023
SHA1 65f82cf34db7ee39181064934da5449d4970f9a6
SHA512 bad793b7c0836539b1fd42cfba002f82f7ed9548e2a8cf5de8f7dd6710f5c1a6914a6ee76f5ca9ea7442cc42be96c2b70590f8988816d6069256dc786b4a3c5c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEcX:A3k03kHRJI
TLSH
T16825AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 956KB
SHA256 46aea74e4b276e9515202ba9d4073b7e7d02763056e5dea487aa6571f544ab73
MD5 3b15f15ba6f6f3c4c8ddbf2277bd4f3b
SHA1 14c05e6a7b68f3a46ab1ed5951fa6ff53ce44043
SHA512 f0ff2a890bf6b837da50e61435ccb0bdca268ba41c80b229bd4c9ce5ac17c4112f6dbf2e7594f19bee214ef6769c5bf0b3fd86066f293a9627b4bbc29a0876f9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEaL:A3k03kHRJa
TLSH
T1E425AF03EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 956KB
SHA256 3f53aa1b21a6d3735391d0d24c1f9e4740f9abb264eac9d4e232a411bc04c90d
MD5 be0cf4f240651df87347da70b37ec2ae
SHA1 7cbe749e066b7db8791ba3a317b021e83aef7064
SHA512 380289af227f302e5b3060548d0197899e5b9fc8d0a57bd1831b30d7d538e94c03e419ca01939adc12959a4551356e4516db5921e62f82c694a181900f383102
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrE+M:A3k03kHRJ3
TLSH
T19625AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 956KB
SHA256 730c1341f9722a24fb500ad6db36490136a22a02b2d9711efafdbc0598280d4e
MD5 c95b537899972dbe71efec17c76d52e6
SHA1 b6736f1f43f86798b98beaaa0170107f32c38bb9
SHA512 13a566f75ab46266441160cd0bc8b1f18dec6d419649eba92bc4030ee7aee625a8b33c90f83e75377d16acdef820d2b4059871cddbfb2ecff433e264bc2bb910
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTOrEnh:A3k03kHRJp
TLSH
T10A25AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2864-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3436-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads