61e067e838945f41eec59a78e9fd10e2917d63763031de2a2f13db7c3e074bb0

Analysis

max time kernel
115s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 939KB
Sample260709-vc2grsey4s
SHA256 61e067e838945f41eec59a78e9fd10e2917d63763031de2a2f13db7c3e074bb0
MD5 9d04b597a0be221217ca828f2cb11903
SHA1 057a02cc4a604d37daecd0e3f967bc10dc6f70fa
SHA512 48bfe7900c8ffa3768b53e4eea2b035f6b107a1883f9895b5f5186051884fe7028643f6736f50dcef89312dbd4b6eeb118b00e267964ea20ee165a9e5f5a01ef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapru:A3k03kHRJ
TLSH
T14C15AE03E79500E9D10AC1749AE69A23FB75BC52176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3056-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c521-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3056-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1092-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-499.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-578.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-670.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-731.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-780.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-874.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-976.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1124.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1150.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c521-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-499.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-578.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-670.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-731.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-780.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-874.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-920.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-976.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1062.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1124.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1150.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1175.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1219.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1322.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1366.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1380.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1092	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3056	2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1092	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_9d04b597a0be221217ca828f2cb11903_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3056

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 61e067e838945f41eec59a78e9fd10e2917d63763031de2a2f13db7c3e074bb0
MD5 9d04b597a0be221217ca828f2cb11903
SHA1 057a02cc4a604d37daecd0e3f967bc10dc6f70fa
SHA512 48bfe7900c8ffa3768b53e4eea2b035f6b107a1883f9895b5f5186051884fe7028643f6736f50dcef89312dbd4b6eeb118b00e267964ea20ee165a9e5f5a01ef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapru:A3k03kHRJ
TLSH
T14C15AE03E79500E9D10AC1749AE69A23FB75BC52176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 326bacf3b764696b45a0bdd829ac53bd910703f05d84707df5d6edf29688800a
MD5 3d7b2c1b550024d81c8213720d60ee02
SHA1 d06748643cf2638563e8cafc6a401322fbc2e1b9
SHA512 ba5e7a0a51df916d6de4c152e29b1fa86410253c130b89da872a252780f164613e4fe49ff16f9345c07b71b1d4b9fcc38f3c6daf7dee389155ad85048870be17
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruP0Le5ji0hmxNrM:A3k03kHRJuPji0Aj
TLSH
T1D5658C17F6A402B5D067C1B9C5E69A5AFA713842173086CF1398C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 953KB
SHA256 eb7cd97c35030b2906a67d3184edfc85b2e36296e7009773cf13ae4f63edd0f6
MD5 83be39d2a4271d11974c9d8f81c9ec1b
SHA1 a0fa3dd6c55580ed98bb08454493c8a5c67a436e
SHA512 853087bb27f6e009c561de80ef592a985f3cca4a4dbc234e0a264c18b4389aa6eba930f11c5eae91f7b0945056bf985dcdcd49c17555eea55fe88e00922f2de2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruRa:A3k03kHRJ
TLSH
T14025AE03E79400E9E10AC1749AE69A23FB75BC52176097DF1368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 962KB
SHA256 d3db5c88a0701910025288629420dfbc6a8e4c39882fa35a7ee351a63cd0cd7f
MD5 c402157a716accf99347538cb15b1e46
SHA1 d9f3bf4f7ead53829d448c795f2fac3da79abeaa
SHA512 f2ec28504439082a3d9e577940ba60bfb3bc4c1210f45348d8426fa0e2b1211af3dca4e3e5be523414f2e565c74587e67c4e4baa29c645120bc129c4e6b9daeb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruo6:A3k03kHRJY
TLSH
T1BE25AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 962KB
SHA256 822a4a760b7f8e50ce2eb3a0e7880327e3ec81aa7e16a92e585f1c77bbbf07bd
MD5 df784661e9d03283a6f28e605a280239
SHA1 dbb37d946b0671b262cd47955794f71cc96c8a07
SHA512 38d3d57e6cd58dd5d89df578c4d8352c04390288d23f64a4ca97c44f9ba69e651f483a17ad9206085239cbe2a1e1a850e95269444052b0f40b0fd94fe69c6abe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprusN:A3k03kHRJF
TLSH
T14425AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 962KB
SHA256 1e0faa1798e8246d4ff1ed48b2346fe54d659cb141e2a4c3d52a994df9354722
MD5 b4a627bc8df5ef680ac799ad7e74de00
SHA1 f4c58c15dc74a6c12cc1fa1ca2587b48cad20243
SHA512 631cc41ca918ec4dd04eba7cf14f2ca2ebb6dd317b8868d98c691f474f4ae3ce9dc5b03e35e8391473128fd5867b29818f1717c665e3d34e174d3e1d38587788
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruif:A3k03kHRJd
TLSH
T12425AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 962KB
SHA256 2c42ce4aa2cdb52085ac73f53a28716f8a5cb4ad5f8f6013fa91602ddd89e9f0
MD5 9329a551a4bdcc18885b9bb91dba433a
SHA1 872cfe1de5997bb7861ec3a8383e5ac3f6a8d385
SHA512 89597585372cb7485a68a6faeba238fee61335a639469cb0abb62ec56f9f6892cf70bd1ed63bb369e4502a343138ff98154de3a50b6231e2f457c84753c6ecf0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapru8o:A3k03kHRJI
TLSH
T1ED25AF03E79500E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 962KB
SHA256 31650d58b4de8e16ed4b9080ca99e046dcda270e09e8e7a5aabb390139f0355f
MD5 73b21697cbfde2899187130a91f5bc1c
SHA1 e7523390362debbdf3eebcc35f36331a98703c4f
SHA512 e85cfd0e1922f0ddb428a13a45c2768d19d72f0d0749c1c61738018b1fbfa7ba09099a1c2868a0f2ec3af7a25864aaf5b48072cded9080e7a51a7310ef9d7514
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprucu:A3k03kHRJ6
TLSH
T1E125AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 962KB
SHA256 00e9215d88a41146e2895686ce73f7f3e9853b25a28870c2aad32f7f11c2af4a
MD5 446d3e2ff0bd0f46a159857f984a8143
SHA1 64d3f4d82cbd27ec05ad374f562f7c06aa056ddc
SHA512 b6a9b3fa1c197d2d809018636175ff09f88f8614890c55881a1c2e8b9d50fc07b5034d11dfd07f4e198b2279331d7f345552e87afbc0a0efb67ef5118e333f45
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprug9:A3k03kHRJ7
TLSH
T13D25AF03E79500E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 962KB
SHA256 a7c01824dddcea0fb287f1603ff2057d1ef4d095e91b1bc6e3998389a3f1a159
MD5 e0f8f6cc67c2bbd46841c41b277f9442
SHA1 fd05556e337167ee59947bcdbc330fd14f97beb6
SHA512 d4b74babe852235926ca74c2c9a24f6555ef67224503eaa401c2c20620a3713e2f510fa0bdefcd0de0f44a6cfbd4bd195e4add016b60a1bda6fcf289c233c9b1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruoc:A3k03kHRJy
TLSH
T11825AE03E79400E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 962KB
SHA256 80d894dddef2f37cef5e24224cd141071d9fb4f365f19ce9a8e15fc3f1111701
MD5 f7a8d6b18ad50b5ea9b5c53bb220bcf1
SHA1 b0c88d402c5e20669834cdd7b8adb78ff4dc5e17
SHA512 f57ca6f3bd7993bdc8ea11ff2703c101167e454447d37722175117a0a01f152295bee0695b97f1ac10c4a5806d76afba7d4b7e546cb3a4f6a6dbc706098cc236
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruBp:A3k03kHRJ4
TLSH
T1B625AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 962KB
SHA256 5a5172e3ec8a1519b5d8a9628136882119dd553f18d72b0e3ed5a46a1a71df0b
MD5 1f680d266687ec927040c74409be6562
SHA1 ae82b971adab9bb97498f0d0bd3634963e35aaf2
SHA512 bef0933cda13f3d0bebfdfdf6a5bef6b6f209de269796c92554fc7873dca3287f002444b9be3afd9f69d4f3713fe79814e678a14f29e907c5eecbce0df42245e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruWN:A3k03kHRJn
TLSH
T19A25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 962KB
SHA256 5dd65f30f9a660d10b42261b504bd39b584c1b5469be38a37118aa17c9401c84
MD5 64501037cd9cd863e7e0554b91b125b2
SHA1 d17c9935b7486da89cbcc6d63abd26c48eca4f81
SHA512 d0adcb74986a0e733af9a8e0718f485715b8170265eddcf3fd0f3a47ad3eeb155c7f2d64b5c0b93a5e5d836e04315791adb87f926637374abe86e0f9989774bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruaF:A3k03kHRJh
TLSH
T1EE25AF03E79500E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 962KB
SHA256 381c0129c79fc79f2a3217770ada693e72e070273bb1341d72a78b0213ddfa0b
MD5 57865d7c6d10d9e4cdda649ed8b616b0
SHA1 ac7c0977b63832a058fb0e29c42aaf17dfd1e9bc
SHA512 17f118b2d2f7ecd0ae3de55633b9fe9ba60d70b1631658fbc6531c2d956a9c3c0490d4d0c0cb0db8691c2d4868cdbf0e1e8ae7d299398bd2b84e02d074d734e0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruvC:A3k03kHRJN
TLSH
T1A725AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 962KB
SHA256 60278b100f1d8ff3622be2f8609e0cf7b657f5eb5a99450e5d8311238a34b6f9
MD5 588d34beadf025016ae5fbde55a3c3e3
SHA1 f533b82bb54f7da0619a280f3520d912fd20c5a4
SHA512 ea6a1f26b2a71d916d05e59ed4dd87b97f407d6d20b2ab0eaf29c52a246c8bcbd9afac24ba642762781328466cf6ce38ed523f0e7b6180e8e06edd44302f3c2f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruQw:A3k03kHRJQ
TLSH
T1ED25AF03E79500E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 962KB
SHA256 616b71ef52d7b386492c6ed40d671bcde294fcdb80a00f2d4fc9520c41336318
MD5 d4cfc73b81d1a71883b7a59f70c17890
SHA1 a650a76103f2b770315ad76114cd61ea0461cb5f
SHA512 305bde2765a3c6578cdbb6478ae08189cb7b2427348d66bd6ae2484dce2be4024fd326c8106221d941cdf7ba9e7885dd0c63ae669ba27d7a570f7a8d1e38194c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruvT:A3k03kHRJo
TLSH
T14025AF03E79500E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 962KB
SHA256 5ebfe77609daf1b197378102b9ef03a282057f3e2b3288adb1840c307a56f485
MD5 0f5cc7e9f561ed4e74c985342ffec13c
SHA1 3d640e68924273e007375878b33c27588eb0ae86
SHA512 bae26f70b974db17016acdccc2bccc32911427d82f2582afc6d967437d1287f37f1b0c3c436b8952403665579c86b37efc453d55113e0638b0cb381f7fdee071
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprupu:A3k03kHRJ3
TLSH
T13A25AF03E79500E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 962KB
SHA256 7c4d6e5ba9bc83f0b28a486f4b88b6e344903cfccff3a295703a91a1302cab12
MD5 435e5da93c63047f1952d2cea0b09ffa
SHA1 0e56fb2e1768e36df6e89e86bdcb23653d2553e9
SHA512 29ccdc4f3e69347bb1c93e9c163cd87bf1a04209b3e72987b97f3f8a3eab0daee7885783d27bcfa5431b6503ef406ee569d589c54ad70253bc273dacdf0dab66
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruhb:A3k03kHRJu
TLSH
T1A225AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 962KB
SHA256 24060f8f10a89cbbff673fecc769dd1f76daa3b5efba2686482df8970e817dc8
MD5 ba267f9b2e49251482db6e3220f0765b
SHA1 fac72f2470b6d8936953e467f72aa5b2bf632ba5
SHA512 9d5e2d5c97f614e0671b5b206ef09261da5b46214ee860db9a5bf7c3f8dccc4e2331875a6edbf637fcb75e750abc774728e4f8889747100f68c88f6bcd582e53
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprupf:A3k03kHRJO
TLSH
T18325AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 962KB
SHA256 688e52ad690db1407a3a5ad24d5c731680106eaffa16c95a87a33ff60002cb5c
MD5 235a450a87b54621259c3c318d0aec42
SHA1 d192a5024f4ca370d95e4048532ff3a2271612a7
SHA512 48d95a236ac0f7162a7e6021f42adbf745c96df5a68b6bb488eee61ff2645154fd6f40ae962335ca2c66257e4c929f6502cada264a25565d6d47eed16db1f1a8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruSK:A3k03kHRJu
TLSH
T14825AF03E79500E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 962KB
SHA256 f6dc9132363b5c38ea761cf59f527645b4899743df75cfea260ec0a1fc5c0634
MD5 5231cc2819c8ebb118a238bfe274124d
SHA1 3ef45078840fd816a3e6f910408d0424d1940cd0
SHA512 08ce1739a7eac476e5989c38e02e50b21e9254e0cfa37a0d22445d7a5ae841fff1ea3108c25a4935750f70815172a995faf1843aec9a6c0405555b7f2d688301
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapru3k:A3k03kHRJT
TLSH
T13D25AF03E79500E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 962KB
SHA256 f2701b0a1700458cfa4ef1d895e0dd91e2c2df8f7da7716362d0ea58ca34c53f
MD5 fec91e8616547d3fa6c56601afb5ba4c
SHA1 606cd3177935c455903b533c856380aa1b7e66a0
SHA512 a5f5ceea19c3129e595d53820fbd647bd5e1ab646cae0d72688b1f850a9fc32021861527e9949c923b6ed3261a0977f46316d0c79ea59c0b400f15f027a1abc3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruA0:A3k03kHRJy
TLSH
T11A25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 962KB
SHA256 52fdffadbee62c5f6dd30d0308401aa9677e0cda79d0e3f8832a0cf9fe904e54
MD5 440b6a30c0f8e3ae9c6e1655fe0ee598
SHA1 2a7ae9afd3f7325959fcaa4d1b88f4c26d9ce259
SHA512 aaa87ce0c72dfc5dcd19047adfc987c82985f3bc842218ac88136d62838bd4a4d378b8e81ca439cffa17b7c9f1cadd0e75868d2f0bbb389f93fcaed8ec6d1547
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprubg:A3k03kHRJL
TLSH
T11525AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 962KB
SHA256 91db52950d93c230191c0d6c5c533361f58240cbb0368ae0ab9cc0f909a72d0a
MD5 4dfe152aa0741d97a7f9108ffe542e53
SHA1 ad273be78f472933206bd4a727b07760172acacc
SHA512 f76d6c05bfbcd2ea7ee5b9afb8c11e4d04180f9f3dda76db1fb84bee58c4e6fd71b30dcb8df66ce6f3d8360c2c14743c1cfd4b34a6fb7f043da2affde9abd9ec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruWr:A3k03kHRJ9
TLSH
T16225AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 962KB
SHA256 00b70a10f68713c206458635f190dfc13b5035b27b87da4cf9dcd121d7a632c7
MD5 1eb3b7fd421a4179a13e417f5c6015db
SHA1 329029010740c13f56d5d64c24478f5c4dc0c759
SHA512 f969132f73204b45e3c624844d6dc5d96ac83863d252780d68d3a7cd6314a025321b6378467a4a3dcf3908a7682db03a3b325b1c8577c3322a3a16809f6c88a1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapru8n:A3k03kHRJf
TLSH
T1CE25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 962KB
SHA256 2bcad2ebf9389ea13ffd4359f044630c8f506983b2e4a5f73b3819c2f537b39b
MD5 300bf3c7063852a36dd7733493c794a7
SHA1 4ead7120cabff22aea269a82bcfc78b31d1323c2
SHA512 f82166d3394eb665f47387d801556ea9b2c627837f25d0e56a7d8d89573b2747fce9e881b2227fc5aadf0cd7e2a7d6fca80cc61cc9f1643538f9c1e389f54740
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapru6x:A3k03kHRJl
TLSH
T14625AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 962KB
SHA256 2414587b667e8d1294b035b236b79389e78cc1fdf9b6cab3affefeb28c52e8d5
MD5 6ed87a28224a25a0f117ffb98cac4358
SHA1 ccf7e9fd841ecfc6336de9d6723a422043567be9
SHA512 a04139cee29a20787cbb183783f91c32405ecc8dd1bce3b232e607ef396ca4f03a3a096315177456324658ebce92d01fa8620650663d15686a72c6b60fe18a1b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapru8A:A3k03kHRJq
TLSH
T1A625AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 962KB
SHA256 e8057b5089edbbd20ffa0bf64b4f8994fae6c4b2cce5a5b7b0f88c65cdfeb88f
MD5 889944ea160558bb48984e140aad74ba
SHA1 b26539e0889eb305185a7eb10da632dbd34d1b25
SHA512 6f7f249edebf9c52039733005f420137ddbf35f10b5d7cb150b742c7d12896ac41e5e04195161108d4b0965ab51b190588aba9288b25196d57dc215747aebf7b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprul9Q:A3k03kHRJX
TLSH
T13825AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 962KB
SHA256 8fa4a6cfb401b0f7a5882b004c73c3dbb608ee70f41547c6a7b18c8e1e4159b4
MD5 d862f9e259f61d9454225b599820d9a7
SHA1 e5a8fd2ea12721521f71d09e512c923218642a65
SHA512 f988c1021f48919399521bf6a915e8d66a6d9352edd06cace89e8480ff60c17e053350258b4b21f57722279516cf0df1214c6cce6facc5c236b94b1bf8733a0e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruQ4:A3k03kHRJI
TLSH
T1B525AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 962KB
SHA256 f3868bf43df2ab6f082a07b811361da00bfedd872f66fef3e834d0be930ff30f
MD5 23e6c3486eb302c31e1b33144b5a6986
SHA1 fad25d9c85b1f85ae8b1bd535eb189e303e417da
SHA512 37a2b5abc5db22aee9748f01da36b13df09db1e8cc57246bed6fcf53da8b05d9f3a1864e006f50ec92370ad4ca133347b3d18506d7ce86290ae724e3abd722d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruTu:A3k03kHRJZ
TLSH
T19E25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 962KB
SHA256 0affb8fbc6dedc15ab74e2ecea30a108fcf91384c33c17e391e0ddbda8ed8cb2
MD5 13c24519649446234ac13b5741de4ed9
SHA1 e21fd71a47b33a92433dea13fb0bb49488602636
SHA512 5c1522b0f38ddaf557acded3846971a33d070dae95e34fab56fcd20723da673138a42f052d739a5502320d8d02e0c83a61c3ee07d8e42830d3ebc958c4e9c7ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruOj:A3k03kHRJD
TLSH
T1B125AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 962KB
SHA256 32b657c2aba1c5aea5c97c603c81b4186c1bd2a07bcc34c9d7d47041820ef9b4
MD5 0cdbaab7bcebb00eeb6d419ed9a2ef43
SHA1 f198c142091ec94146cf70e94edd81156224ca80
SHA512 db4a09251d35e12f541209df286e2df7d9162dcdf87bad8f66c8b6aad99971cb6c2103f82c5cf10106986c1e247febdafd2ee4e0acfdad766bf5b710dc481222
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapru7g:A3k03kHRJr
TLSH
T1CC25AE03E79500E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 962KB
SHA256 5daab63b6046eaaf5b4cb115c6cde3253b1bdccc01ab6a81d214403e516b6294
MD5 fba05340f09a12ee5ff010836aedc43f
SHA1 f18bf156327d71203666757f27c102a0c67be00f
SHA512 781c9c729fa6bc266933960ddab1b93bf7de485a84acde15cc57ecfffed381ee5db8db98223c6e438ae936ed064f9e12580e04c4aef750f41901caf54215f752
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprumI:A3k03kHRJC
TLSH
T1B925AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 962KB
SHA256 3eb870f7ddc00c718d5f0e0674aa4f7d6e5e7fceee8ff4fb7d573e9d19433d2b
MD5 e692d47ccbbb4d497e43cc25997a3f44
SHA1 75b72ae606ade21d012a0ac88a744fb4e4100583
SHA512 191bc21d1d4bbff0d7c22bfb466761ef6fed4d345e70ff035c71f0e935ec27bff79c453d2616c73e680a3bf91e865e2f37f8b561ad12f8990eca769149298a63
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruUo:A3k03kHRJg
TLSH
T16525AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 962KB
SHA256 c7e7ff0f61f8a3ea606108cd9571c6221ce8de7f0745f0dcd2202787ca8f28d1
MD5 a89055c427dae92772e87e980bce567b
SHA1 3707d0d33d714e0b54fa0dee3b9f9903d75f11ec
SHA512 2af292c285a5436dc344a5be2926bea548264589e0b666e05463b1129b304fb3851c87598364ee20a199747116b3d1f7a22e7cb09cf9ac6c5924676722266df4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapru3+:A3k03kHRJN
TLSH
T1CC25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 962KB
SHA256 ba92bf17b86a4428bc9fe02b8df7fefc0055540e6fc9341ad0688db4e974a311
MD5 f4d95e62c6dcb55d060e49223524a6cd
SHA1 f84957a124329304cb54cfb15da8435a50963986
SHA512 110e6fdf258537d3653d3f70079789ecc4903a2128cf063f1a2a4fdddf9ffeadcf132b1f71911d9d54959dd62ee5f8a3835981a0db19a2beee1423c9fb53a201
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruNQ:A3k03kHRJF
TLSH
T13A25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 962KB
SHA256 d2a9405ea2dc7dec4e192ed43b5f949a6eb35640041115bbd80bf69e982e15ec
MD5 902e96d72fd010dd8c8d91c1132ec429
SHA1 efe39e50b071e6d0e86994d2275f6453725ecd65
SHA512 e95c19667e44b366df29f4ed594016fb49eb1ec57faac870be38e22f6499d032083d3df4ada18a1707a97e8f5309fed0a66496749b7d2076c997b4a7b00dcbe4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruCX:A3k03kHRJR
TLSH
T16425AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 962KB
SHA256 0f85be3ecdb090448bb70609dc201d88dcec28e4ca49011c17c304642f714ce7
MD5 a8733efaedb555ad7462c04a63838003
SHA1 134db2fe1c6af363118e8699f2a7fe4d62d0cbe7
SHA512 aa2820251d13b60c32bb1bc2c006f9da9881ac6dab79cfd3db38c2e4311ffc54f9cf984fc7f0fd29a766b246f7bcfc65f55fa0d0ee8a3dd7b4da3753eaa52822
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprukL:A3k03kHRJb
TLSH
T19625AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 962KB
SHA256 bb64de7edbed8c912950555adbf703a9ec1de7debf58ea2441f6822c881ccebf
MD5 d489f28938ba6a1bc6c41e5dac216dec
SHA1 a512f6f27e7197d9b669a799e520b4225672c377
SHA512 1580334e0ad6693b3452a2037b83d1c0c2bf903226a244057901ede6b96979d924bb4c7e630b8f4f89de7e1c06535aa99e33b0147fe9afed2192968b413b623c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruAM:A3k03kHRJ2
TLSH
T10E25AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 962KB
SHA256 dee268448d96fb3caad9dfed4f729889b12043634dedbb3f1d02fd8772a6d35d
MD5 e6bfc28b1b8fbe07ab5d95c338fc3fc2
SHA1 0aac37d8bcbfedf4f3f3863583e9aba1c972d6c2
SHA512 78bff7c03b6c093004cd43e66fa175aa8f05ec07efe18c3ca0b5205324eaad65f558c26160be3c26c1d12eb40cdb6dabda61fdd13a8714188a8539df0475bae4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruhh:A3k03kHRJI
TLSH
T1B225AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1092-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3056-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3056-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads