592df18322be0f0f90441a76e92dbbe7ea1f40fd55c7f72ea7b3d87520b97159

Analysis

max time kernel
105s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 939KB
Sample260712-m3d56aat81
SHA256 592df18322be0f0f90441a76e92dbbe7ea1f40fd55c7f72ea7b3d87520b97159
MD5 ead97e6ae70776765a7f8f16617fe734
SHA1 c0d58adb2c72f3114ee5d32cb2b921d759e40b32
SHA512 9e70538d984979e5cd3db254325ae169a7e07412d66103a8619822ef6ef33e23bc9afa877e37338c2539f50b22084c8d2c1b3c77d0a6927a940fbfbb8455f1ad
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOL1:A3k03kB56r2
TLSH
T172157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 39 IoCs

resource	yara_rule
behavioral2/memory/5024-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c531-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5024-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4508-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-254.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-297.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-473.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-499.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-596.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-627.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-718.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-841.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001bb44-866.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1000.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1397.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 36 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c531-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-254.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-297.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-473.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-499.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-596.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-627.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-718.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-743.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-841.dat	aspack_v212_v242
behavioral2/files/0x000300000001bb44-866.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1000.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1043.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1080.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1129.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1148.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1181.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1219.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1322.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1372.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1397.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4508	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5024	2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4508	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_ead97e6ae70776765a7f8f16617fe734_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5024

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 592df18322be0f0f90441a76e92dbbe7ea1f40fd55c7f72ea7b3d87520b97159
MD5 ead97e6ae70776765a7f8f16617fe734
SHA1 c0d58adb2c72f3114ee5d32cb2b921d759e40b32
SHA512 9e70538d984979e5cd3db254325ae169a7e07412d66103a8619822ef6ef33e23bc9afa877e37338c2539f50b22084c8d2c1b3c77d0a6927a940fbfbb8455f1ad
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOL1:A3k03kB56r2
TLSH
T172157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 60fce1cd402081c7cde0cdc02320032ea7ad6ac7a35c2821c272f24c50af937c
MD5 0033235f2111dbbd386f51faae01a12b
SHA1 8a2198312fb19453b1340907fedb7a0e4435eefa
SHA512 c5997751df7b3d3439b54b87dcc15fba92e43ffebd28a688d1fc502d8a2617a7bedafcecbbf336a13e8dfabaa42ce759e576c42006c31a1efad1a6575108c97f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLx0Le5ji0hmxNrM:A3k03kB56r2Pji0Aj
TLSH
T1B8655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 953KB
SHA256 58f9a269ab00e89762acf9eb327988517907e6fc3f68d48256322433afd455e9
MD5 929893f2cc1ba906f2aa972a4d347924
SHA1 bbe02c475861d6372fb1d2b86bb8a62b5ec75f4f
SHA512 259144079853a68e09c4dcd58de60ebb57fb7f27ddf1e7f80dbad5b76041f5c3577ab7acae896f37afa0727dd4011f24e2a132f63f201dab044fc7f7f2126067
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLTa:A3k03kB56r
TLSH
T13F257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 962KB
SHA256 46c2e39d1367c4d2d96d1abc270c0b2690b0fc9e0bfa06766a425500084a95f3
MD5 ab3597c2adcfa9a77526e5bb512f2566
SHA1 6eddc2e1aab192626af5ac17405c497e497728f4
SHA512 551374f8ba5903ad2e847ee55706160916b0b441024a26b8f1a1f298fb6bfa581f61c2b9dd92493484142ddcb819b6a53f0f6c644c65d5cbcae5fa0ad9052190
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLS6:A3k03kB56rg
TLSH
T158257B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 962KB
SHA256 da4ef46adbb0dc1285e5e86e351540c9550ac97c2aa9c421ba1f8ebb5eb6aa7e
MD5 b92a80a5badfae6a416eeb1b834c05a0
SHA1 e64caf80eed441de5a0ffbdbb83f6705be5e77a8
SHA512 bca84ddb778eb6abdeda7e63122664d1605f9949735c852e56667ded91052fb25a53c2aff5a4a79788570ad455f9b07c18f96766b43bc495858e57c341c4553a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLS9:A3k03kB56rj
TLSH
T1BB257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 962KB
SHA256 3187c9da945ea08f90db7936e546fc6d4cccc3e8c5817a2d80096b9fc011b658
MD5 f2fa6ba06abefad0ebaeb0fad25c2887
SHA1 cdf35875bfccdd301af3666f7a0d5a8fbefdccc3
SHA512 718940ee49b7d48af265c4404a67c8a87f590d0ad07da96df2d788b354ceb4f91877e48394ba1041b2698cf0f6a487a8040fedefe19cc9465918f6b0da6d0a94
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLSc:A3k03kB56rK
TLSH
T12E257B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 962KB
SHA256 a76e1423e4e5195fc696a007aee70174237b3eba59639f0bde6a9e4338c1e5a9
MD5 8caa85cd1ed8e4cbdaeed28c19f4007b
SHA1 160dfb424af67fbb2139862bd18f1d65d979e89b
SHA512 528bb8c43f80f6b838966337769b1e34259dd8da00cc4c27ec8cbad45c7c54a97924fed9ec7d58a27434395a034ebf791b68ca100b72ad6a53072be5a52bdd3e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLbp:A3k03kB56rQ
TLSH
T1F4257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 962KB
SHA256 fec10ca26b29711e52ab01b06d2631e5ed8832076d77c51a42a8b70863968171
MD5 9f988d5ba81698e0a35351e5fa4e16ff
SHA1 d9dca4429649b75900d82da2c1577d1c97e5a242
SHA512 d8a4abd983810b0cf672b30d1616ced4f8ba24b0f1e41d92be0fbe0a52bb6f45643716fc1390a4011b3fbb1c29a8a84796faf590cde50278a68d289af32efe8b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLsN:A3k03kB56rv
TLSH
T1A6257B03E6940FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 962KB
SHA256 9650e9f3462c3d93cf7fac6d0c101384d969dffc9652d1ec313223cfc2e2936f
MD5 d3ad27ce5af1b8791b06c6514ebf8a0b
SHA1 3c1492827d2a455f62d8baa4091de4a289ab4b3d
SHA512 255fe2978bd3b4939fa0ce9b229b44939850d6e21a5dfd0cb866ec9fde594f7218fbf177dc3b42f0f8386d338b005342e94bb63dde89ca6b9a5767ef97c71cf2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLUF:A3k03kB56rJ
TLSH
T124257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 962KB
SHA256 cc28957192243d39c0cae39bf2a025789d186f57b09381d9035f6cdbbcc735b2
MD5 bcdb457663c00097237e611db6a5e328
SHA1 bbe752011ed8fc3b63584b3b6fe70e039cb405b0
SHA512 cf7bdfd6e6cfdd51bc738a2e307db029e7c4721a8d5b28225faf5c051de3df6c76d6c7195699f1254cae376c9ca98f5a394782e69e08bdf41b2b927bd4f6500a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLxC:A3k03kB56rV
TLSH
T1EA257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 962KB
SHA256 3477ded0b92258b9b2f9c52cdc82b936098cca7104d1c0de26dcb4626c197458
MD5 9ab1f534fa4600b1066864c483480dca
SHA1 77df37e4b43cc77fa7d905c7f3c06d221035f754
SHA512 9243abb1fc8e95c7f27123f3ea8a42e9f201a8134993779b51664e509db238f9897303abfe98d7a1f499056726285a6c853897f31cf7e0a1090ac07fad44213a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLSw:A3k03kB56r4
TLSH
T1A8257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 962KB
SHA256 eec95bc6483dfd657ed86ba0f01006accfe3a23a88c94318f592fce2d6e2a7f0
MD5 561e38ce7821123645ef0609a3ef4baa
SHA1 11b9f054e4b2c4dd11b3fb98637e0ef0092bac72
SHA512 114ad09d87d59098fbedb8536e051dd001214dfdfbc3aab86d0b1e9701efafe39e4b07979eae1ab827e8107191d6edea27fe8689031187fe0db108e7dd856894
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLZT:A3k03kB56rw
TLSH
T1CD257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 962KB
SHA256 038d8b1cb6ad9cf8829df04815f49893a887ed7bc2aea90daee9eb2fbbcb8852
MD5 e75925a9f343672b6076b7dbcf4517b7
SHA1 047084590c7e4f98a78b28b47bf9212da7b369a4
SHA512 db963d4097c5ac8b694964612d0567667696c3936d0852686b49d4b00eec9f3cd501e75755bae6a15d0f717decd9dbf09dd7efcf4491a99758ad3c63439f6996
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOL3u:A3k03kB56rv
TLSH
T18A257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 962KB
SHA256 5b653352050ce3152c3f439001d44233eb9c920d3b6aff227536e8671659f43c
MD5 545e4512d873839d44c70f10e809d80e
SHA1 ae39088587fc3f97272050237e67fe70007101e8
SHA512 f483ba74f2aabc9a3f8309aff331737ba3523208b86b2e565844b0de6dd37032f8a8eb0490f237e72fc8b6165f34c4cfbc4a1e5ccfc4c9be332af4a4423dfdef
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLLb:A3k03kB56rW
TLSH
T16F257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 962KB
SHA256 cfc86190ac89e34198e43ad1b9e2614720e44e69c7d6e8e0ddfd579087d56ed4
MD5 37c852fd1b900c592d75ddac994c91ad
SHA1 48c4c660cd0a6b5c9ba805e356278ab87393a268
SHA512 5928d113f79733b916de6b3302d9d052a210f033a8dd0cb295f60023fcab5d27b225bf2e49868f773332b885c5ad026a4967d3cab4e63dd9b57e21fb775a73d3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLff:A3k03kB56rm
TLSH
T17D257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 962KB
SHA256 4a5cb2a9e1dcd2856ddad1d9290f33b8cf7fc52b5c77b98ebdfb0eeec5c7b311
MD5 1dd62a332eef75287d05ad31c21acf84
SHA1 4a643e0657e40280f8901f07a2efa8e9ff862b1d
SHA512 830ca085ad382f63a22916299aa60b414f3b4751a1c293c283e67f80c143b87d4603f4d48ebef30ae74a261c7663307272128c42fb52daa10af517299a8d5586
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLIK:A3k03kB56rG
TLSH
T1C8257B03E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 962KB
SHA256 41d9c6c39e3eec235d372217970d05c02f7b0222def77343d03578cd0759eabe
MD5 1890b799af5c5ffd826aedaad5260b73
SHA1 62158ee95a36168b9e6c4b700b387e2151e5985a
SHA512 5f90ae91831822e453155e9f15ae4498b5b20c9650d4c51a32495b2d2bedddca59826623eabca7b53c98a780679a10514336604fc9977c073a5145b98f6c7844
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOL1k:A3k03kB56r7
TLSH
T192257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 962KB
SHA256 f883407185d92261b5cb5a15a279750bea5e5dd3cec31cf81af11250f46119ec
MD5 c54a1873305c048bdcf070895d238cfb
SHA1 a359c114684b40ea976c83bfd14cf00cd89ff954
SHA512 249295814c019842c2125be4cd56a812212a7047a83509dbbbc2daaf2b23c538fe393e470bc4596eeb00f7cd177c6d6942f85c247a6869f6fbb56a597cac981f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLq0:A3k03kB56rq
TLSH
T172257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 962KB
SHA256 096f26fd496ca845eec97245065d741201565ca148668548ba36db035f71be43
MD5 93e156ae1a2c4919a9ccf93e9aa19ab0
SHA1 925aa3998c7d4fe771b5c34919290c61fe43d91f
SHA512 a0d0e4b00ae24ed49598f732e3b3c19ba8c0dee9667f5a3b348aa3da17146e5308cad34a9456966e5d3eaf056eabb834c45ade73ff49c31f6e65280b49f7a89d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLZg:A3k03kB56rT
TLSH
T1B7257B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 962KB
SHA256 ed1b3e4fb45c800e9a2efc222c5555184cd6abf5f73e4012efbe85a031412b22
MD5 6d397917f1c0d1e6caed6de0a34c9685
SHA1 a48df506e012cbff3cd503ac6e3a939a992998a8
SHA512 bc2599173e3763e31d806d257b66ca3e62075316eb9422e90eb7501118aa261e1f64c3a4c0fd6f29a2613343fa9ab01c54275e4a13f4bd11aace2cc2db456a20
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLAr:A3k03kB56rl
TLSH
T156257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 962KB
SHA256 de181f9f44e3cec5fb36db37da0b018de1170046d3402a48ed1488ffde60cf85
MD5 c2b5972337d0e4188c572116e57f30fa
SHA1 4473962df3e5cc0d9cf8a187e073f312461fc0d3
SHA512 641d9be6b4f4432449668942defcceb3b37c49da5a0080665b17ded9cc9c029f7b614079aa90ab6c44443165d4b3edd53b15f1f5ebb41ae6646ef33e0b65e145
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOL+n:A3k03kB56r3
TLSH
T126257B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 962KB
SHA256 737c9045c0a01172b3c451b24f4ee8d0c7d1b0fd8721f4f9d0f74ca2cbf80bc4
MD5 12aa748cafd635ffc5a49335d3354a9b
SHA1 7d7ec511058d86a8dfaddf355317689da26f51b7
SHA512 da3ba8824f607bd842193dc20ccce7337630178039264a127ac9e5cec44695e9aa2ce02430918ded6d688866cd69b3c5c4521ef993cb81045fc7b770e8b55c38
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLUx:A3k03kB56rt
TLSH
T1CE257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 962KB
SHA256 beada83fea4a714e0c6ae2e666fa6aa150b48c0faa096d1334b024b064f11643
MD5 8dfcaed789491136e81e574e2f5a6805
SHA1 a6d34d2f5a0883fae32f0d1ae4d130d8a85739dc
SHA512 d0db16b8b147a54cb8ffe1dc4429ea7b9bf8ce7df6547d8a0a0c55e08a549e54b49e5f2a0b9f0abe7f19e1ad0be014f44cfd14d5a57ee82113b7a03631f76592
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLeA:A3k03kB56rS
TLSH
T142257B03E6940FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 962KB
SHA256 ab7cb5b4a1166cf81e65734132f71497cebf52d203639c21dd8ffdb43e75d9e4
MD5 f87748bda32ebbaf8d35445145f77947
SHA1 7ea90605a306c0cbb2e003e448a6e34f2140c44d
SHA512 3f5f57b0a933ead8c1b65984e8ac88d5a8cc21379d20ba890a8abdaa243920ee257a1eaba14ae5a13f2707f6d96c639f457f27b27a360156f4db017cab239804
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOL39Q:A3k03kB56rP
TLSH
T1B5257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 962KB
SHA256 1d23baf2a564e4a47e343ac92a04ba604a6700fc0d067f9aea238f2b805d983a
MD5 5f7b3253677879900f2cf673ae8acd78
SHA1 1ac898c0cd0000e8a0cd7a27b9937060440349e4
SHA512 1478a873e326061b9698a9812a5d62897a3a1d59fc4ccec7b8b196f47d64f944463c9f1c224f4c78824496ba33ac21140a2a8d02fb063821e4fdd9489ecf0c3a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLe4:A3k03kB56rw
TLSH
T1DB257B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 962KB
SHA256 1f1db9f56dffdbb8592284d184b60381a270a0482e30d3bafb4a3dcc2d2d8c6c
MD5 67dee934cbfd58aee1a5d4c793db1c52
SHA1 e91870776e793566658e1fa07d2d6c8be458756e
SHA512 6b763fac281e7fb1e3df07a9d2446b165c6ce53c59d86ad22c997f81a800fa46f7b7664fdda0abec85c3a429f0988d889edb8d1df09d2d2aa52645e7824dfa50
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLdu:A3k03kB56rR
TLSH
T169257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 962KB
SHA256 400b2d1570293a8d49499d38c3bed870f363f9d59dd2ee3ab5f31deac36d18b6
MD5 49a3fb5282195404c837d8ff54069729
SHA1 30eccae072441067cf059220bf7ef5c80047fd68
SHA512 d7b32f75df1a94eb3a56734e681ab3c4dfd428c076e19de670d592bc90b9efe3bef434b23ef415ac0f21f785d2740ad77e70e38e7ade9d4eb75f6ab8fff62620
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLwj:A3k03kB56rb
TLSH
T1F6257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 962KB
SHA256 4c2e9d4d96ab2e9f52dad0cce7a50fe3e2c7b81cdb32cd3e77c42c141a0b8963
MD5 a8cb4bab32a50de119cc9140c757a141
SHA1 a82bc60fac4634ec909f245cd6399b3dfe38fef3
SHA512 13a84527d5ec67bb0d63bc09679e69b92424106cc44c000ebd54a9f2fa667b9f1d37a10674658bf0cf23c9174b18baa6b3ab280ca39d3c879ce950c9cc214249
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLBg:A3k03kB56rT
TLSH
T1D0257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 962KB
SHA256 85f16ee8f98640f247078c25608ef11d026932cb8767a5f841fa0b023bf793b3
MD5 e4c18c5a426fae62fbc0d6b9dcdd88eb
SHA1 d17e6124192c7a4bb8e1ccb678201e2e3955a9d6
SHA512 e5c5fb6afaecd9de3a58ea4f8b28224b54f7c2b7d111abbc0dbca0a588a6160c7df323a376115c026f5dade75640487262427fe4881d22726621139a201c4454
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLYI:A3k03kB56r6
TLSH
T1ED257B03E6940FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 962KB
SHA256 88c4696272373440a708b6cfaa84ee274ecc1d40cc0488f975adfcb0a6bcb33b
MD5 66628620185b704031bf9629e713be38
SHA1 04465ba7a6921f989bb0557989daa8dc234393c3
SHA512 2b1811c38ff251fa08cf5b15cf3b6bc00d6806956de63f70b0e7014ed17476e2d839def1ec4b230a6f7c388559ee07c6fcd05cd6fd32caf5cbb12db74aa2bf41
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOL6o:A3k03kB56rI
TLSH
T1B2257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 962KB
SHA256 022bda1b8215fb4c9eead68f8cdd908271043fd9cfa0ebfa584b814778528328
MD5 f63ac4239e631d9f1438535d696e31d5
SHA1 c58ac7cada38972abbe48c2de0755a488c60330a
SHA512 cac3d09c79fa7b6fc983d409a57a3728f0cdee2bd12e97a2515f8216203a5fd080500d51e8e56d02eab9f82f571ae6b23f5592481d36f6e846abdf782407e758
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLR+:A3k03kB56r1
TLSH
T100257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 962KB
SHA256 6401fc3d2d33361643e80105c02c3d56309a1728cb06f95af50af0d4ed6994a1
MD5 0cc0ad1bc73771c59693b6d6e3b4fa73
SHA1 cec632e094b6e8ab6c81d44c55116118c590d2dc
SHA512 b0ae9b55060439f185a344e6c5690097d9b94923decdbee074673cb8ee624f2c18d14c24a961ef9997e634c2c64232e3c19f87d1c452d2402358004931751b7d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLfQ:A3k03kB56r9
TLSH
T1B7257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 962KB
SHA256 c146d3c26727e8d77d58cc7c1ffd562c975dda432143f6e89f6b4ee04c17ffbe
MD5 575c1a3109bd596fa9f86fa05c88805c
SHA1 c010a0960f9cba835aafca124c4ddf3e5bf74770
SHA512 5eead9307d4d4dbada0cb8fb4147911bcfd05efe0d063d6a69345eadec349482aaef860df17906784b813ae8c222106105288d4e8650ffc514e73bab8f800936
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLkX:A3k03kB56rJ
TLSH
T1A1257B03E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 962KB
SHA256 b9d4ab6c802f232923e3622535cda2067904900d6b28f49fdd8972efaf3b1c41
MD5 c46a45313d05aae3b8b73ae59bb896b7
SHA1 ad08ddec8e19939095d02f03270a12c7f21b46e1
SHA512 abdea6b555b4ff72eca014d5a4da03ef8c4f1ded787eb460d01f10ea466b4ece75eb1afef2a4513e6e157d6ea3f6711792168fa00eec9d3a715fc4680e2ff35d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLiL:A3k03kB56rD
TLSH
T1D3257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 962KB
SHA256 d0d4f71c0e6e3f5b72a85328dd2c88214d6a70a223e4937e46f213b1816b79ef
MD5 18c6d0b49d867df670523884080395d7
SHA1 48bf392e76638c5b39b380b236e172866cb15a5b
SHA512 33ad375ebd430be538c9d3fd8f22391e70288f51daba7ae6093981f0e432765299da558c3be38ff5ab31fcc9101cb534e54d0ed920dd3fce46ac30e7cf0caff6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLGM:A3k03kB56ru
TLSH
T192257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 962KB
SHA256 82e54e0f2b822bed9ca5fdbc70196a0b74d8ede33b7d83453d8b6057ca342f19
MD5 96b992e23eb03aa02c74e6ccf8f3cf02
SHA1 0eff3f00e4915e2ad48db514c5e35d47d7909ad8
SHA512 1c81190eb3af1763b388e47685611baa25994eec367ec9d88aaf3f70e403dc500b082dcdccf7b43fdeccc76b59d9f1085876dbdbf501b33a207992ebbcf8214f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEEOLvh:A3k03kB56rA
TLSH
T190257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4508-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5024-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5024-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads