770e7ea6ddda8470419aef19f2985067e71a7c2411959d6fbbaaaad10dfe82fa

Analysis

max time kernel
102s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 20:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 940KB
Sample260712-za862sav8x
SHA256 770e7ea6ddda8470419aef19f2985067e71a7c2411959d6fbbaaaad10dfe82fa
MD5 bbba97f62a29304c938d93235a7150d6
SHA1 96824e16988afbab54d6588c7ceec1f8224ce77e
SHA512 04ddf52954c8e0e565d278de367054aa18af2ec2176bdd58ff030df4e44ab49fa9ab674320cf62a67d420740b0e2bebb82eeefbf6dc1ebad4e8bc1ab1319bcff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJw:A3k03kHRJARJr
TLSH
T12E259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3536-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c518-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3536-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5980-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-577.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-676.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-731.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-976.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1037.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c518-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-577.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-676.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-731.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-920.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-976.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1037.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1062.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1123.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1219.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1322.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1372.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5980	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3536	2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5980	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_bbba97f62a29304c938d93235a7150d6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3536

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 940KB
SHA256 770e7ea6ddda8470419aef19f2985067e71a7c2411959d6fbbaaaad10dfe82fa
MD5 bbba97f62a29304c938d93235a7150d6
SHA1 96824e16988afbab54d6588c7ceec1f8224ce77e
SHA512 04ddf52954c8e0e565d278de367054aa18af2ec2176bdd58ff030df4e44ab49fa9ab674320cf62a67d420740b0e2bebb82eeefbf6dc1ebad4e8bc1ab1319bcff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJw:A3k03kHRJARJr
TLSH
T12E259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 c269652242c654839c13a232b34273ef581fa3ad4a29454eca2e23d98ce005fe
MD5 778e7c03191bfe621b36c352ce61a7c1
SHA1 adc580180f459e90ec65d7fa1b38599f51bb1639
SHA512 5f31843999ece75e6e01f2c959db3314f9149505673faaa0761f6af85ebc5c9f0fa77ea9697ddc0be571b3c8d114d05e8c1c258105a9ee592aae279d0004e903
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJI0Le5ji0hmxNrM:A3k03kHRJARJXPji0Aj
TLSH
T1E9657B17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 2731ed45510623fea9429fbcf3fbfc00453d72e7425963db683628c32f042a4c
MD5 37f302529f5e8fd4132bb73d2d977ae6
SHA1 a8dc302f24d835174808535cdf0b6b7efeab4ed7
SHA512 ace697cd7b5464e8caeb2e5f0d105da638c11e699db19f0bc57656b0a539d553908605480e0b1960796063e0181283c5c844c34791539bab29eb77eb240715d5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJya:A3k03kHRJARJ
TLSH
T1FB259C03E79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 6caa1dcb856882ff56a5c5becd9121240ef68512af79dd4916ec8128e3281264
MD5 0a94d108b302bdf19750b52b8047554a
SHA1 26fe8688bc5bb9cfb4972c0e371be2b0b70a772f
SHA512 2560ebd235a6d1e1f15d728cc4d0add5a512349f1beabffabd9f61f00bacb3a8174fe3ecea660193023826f5adaa5779d4912ef4ca6d4d1d48339601cb618ae4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJD6:A3k03kHRJARJf
TLSH
T1B0259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 963KB
SHA256 7e924c51f7e3ba9cd1beca676481d790386699e97266027109d560472645c77e
MD5 1da6c3f3779442cbbc065af38a498763
SHA1 bae3079b9246cb3766fdbff2cc4a914c1728cd17
SHA512 0a73e64bfff3343cf65e65010fbdaec446c42dc7af8cf80729b906b30d6dbcc064f240a79bf9a4daafe34f6887c778e58b976f8a9a37c53a3fa51a52afcb402b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJtN:A3k03kHRJARJC
TLSH
T1E7259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 963KB
SHA256 a6d6adc31743a5968ae1536974418e08790b283479c8b10debf54a46b23e84fe
MD5 ceb581479a3aecaaad4838aa5acaa832
SHA1 752fe5011bc2154e8008cce31d1491f6fc246364
SHA512 fea9c0f6cabfb344f9e4e9e24e6335f24596a7a9cf22a2e9255b759489c6d44907ce436343049b6d44a6a3d6386f1543a6d1a3f27dab264e0588352f8bb9d363
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJbf:A3k03kHRJARJ+
TLSH
T126259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 963KB
SHA256 00191bda02b2a1f2b7dc910d3545f9493057e4d3409d5890781c3ef3d69bf7cf
MD5 32198028ed57c4039b70e8f6961b1acc
SHA1 83ccd158b22060646eee2f0e9304a94350c3d6d1
SHA512 08d023438af772b5f854425e7d884be39fd94fec8435f3853c59770a88f28fd26fa95b048c97244192fbec3571cf687f4917f046edcf28a440c5ee5e8f777558
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJNo:A3k03kHRJARJf
TLSH
T19A259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 963KB
SHA256 11e624c6d62c02810fef8279b3c0bfd4b61ef471421b9ab17b685b02325ad9b8
MD5 05ed74ff47b2170a3cc54892d3a32f8a
SHA1 d99be807edd3d68151d435cbd0b6de7fa82706a0
SHA512 0470ad931852386bea6fa35feb95b27f9e9e03c51f94e28224aadda89f337d565b334341070c097c7487902955feb2f8d76047ce5f43298a491137ea64f47541
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJNu:A3k03kHRJARJx
TLSH
T14D259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 c9ba48b26efa2125df70ccbe852036802a64809d705e2a51943e11dd1a7cee7c
MD5 5d5611ec8abcbbd5f757f93d812e4006
SHA1 c5d25ebd6d7a804e47665d91d1f01d1f2e9e92df
SHA512 50d06a6bd4c943c0dd953492773a703bce86f39d69736948406600a0a22ff93929009f29a36c090dfa24106f5aac6be725e5e85e5e092d569d4bd8cd493514c9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJj9:A3k03kHRJARJM
TLSH
T149259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 423457d95b1e17a79b700f36f5722e982588b76e9b52bdf108dba82c845a1db8
MD5 0a32bd341facac5c3a6a2b74a6b3ac08
SHA1 3ee582010b45933a49cbb64b2578726a100adee3
SHA512 70db5e569f187bfcab5bd0b1dfcb5325265b686902e91c3d94223c143e0a1273cec3a52d9258b431833de4fbbdb6d829a53479683876926dc879c97e72c23910
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJPc:A3k03kHRJARJF
TLSH
T1C5259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 955d4c8b807da822617b893e9698d6b03c95998467551204bc5ccc71a4d3fe81
MD5 b992e2f82d7c34fb3bd288f4237e65e3
SHA1 0df42a9ce811987b973bc0d1b7e296f3fd9a82b8
SHA512 dd9b252b8df1fa4265cec50c25a4e7f10c28ee353fdc62aae4610465891705e5ec19eeec87f00070c48d8189672485ef1051469af77cfe6b00007921002001b2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJIp:A3k03kHRJARJr
TLSH
T12C259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 ff83e80670b046fdb67f7c77601949b0ecb458a6263f63058500997b7ed3d979
MD5 456e837b3271c265e14782df4fd60739
SHA1 208ee4750ed8bdd3d2ce2acbd802b574d41f2937
SHA512 81a291c5552c8b67365249f1c5926b1e5afdc6f76031d6cf9cf95e555874a6bbc47c55565e264e2e8a2269a64b1aa457c9ccc20d02a37c4c3abefb090bf98eb6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJfN:A3k03kHRJARJQ
TLSH
T1E6259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 20027802c01351441d6301d3ff04e686925d623339f1fd664876f8ccc32bbcd1
MD5 30df5e00fe09c00b42f2dde07e62cd67
SHA1 08d4991acda2880181d364704a774a1d622a7576
SHA512 3d458d522f3607c7146262fde3e9d6f964f41526df50d7fca67aa9d9dfc46f6ce8aab7b7cc76958552788ef8a7259bde42e094aea82b23c17065f33ce2239477
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJdF:A3k03kHRJARJG
TLSH
T1AD259D03F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 a8b95c1c4ba0aaf5d38b4e71ee8ada78549b04e448ecf5a0c31b6218e66d47ea
MD5 87c58ad2cb989dd49b9b9ecd454a4f8c
SHA1 61bad888d2040f1baebae8cd0c13dc0f1b476e4a
SHA512 80c99315a32012781f95abc5d339730d3ed7106497f6e4b1a7facc3a856a0b5cc57581ef88cee27505063f8a83c59c05ab7db87def10771b484a297bb03d4d15
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJuC:A3k03kHRJARJC
TLSH
T172259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 f005e20a77e617a3e9322fcb5909c40ee6ee7e5de8605ac12b6f94722fb606d2
MD5 8a63f9da6a6f7c0460aa94f924dff541
SHA1 27a1bbad84b15fba3b36c1ffbcc0e5ea23ef0b8b
SHA512 98e8907c2dc310c909a6bc3e03b65eda95269789c1e8ad307f08b93e8bb18b463b2e92f44d2cae7d00529c8e6ceb7b5510a61140c4d095239f6bbd520ef90cfb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJxw:A3k03kHRJARJX
TLSH
T1E7259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 7d64ba43ef14f4ff4039491fe37b8e8e6bd7b72f5f0d6047aa684c8af0aa7b25
MD5 eaf9ed572f88b603145dbd75e93e7330
SHA1 f2fde552ea5b36b3cfe4c10235fa4217886166ac
SHA512 0e7e5fa3dc872eabf2390d4ec1bd3f6df5ba2555b575ac6023d6a802df031467689778b34bebc2a438d3d8f32ed5e60beeefbb19569084fb2bcf34b34a4c0149
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJYT:A3k03kHRJARJT
TLSH
T137259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 c7861ebc41c01f180d454dda293c4ccb6cf9d194eaeab0d99d502bd275c500ae
MD5 9190d7dace1aa9231c997f6fb07e729b
SHA1 941c3088e1adcbd6db9d140fdedc6ba50821d0e4
SHA512 877786fe992de5029717a6a3da58ab931505bea5ff37c0b58b845d1feb56bc57c3b995b20700b62a72e357651e0ecd11e65508d2e63e214eb8d20c82461c26e0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJ0u:A3k03kHRJARJE
TLSH
T113259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 689857fdd3bbdec461ec8db29f716ed0619f06823c6b311c5aeee2d3918cd89f
MD5 fa91170a02cfe2aa14dda0882bdbee47
SHA1 16dd1c13fce403951b104550ca9d06673f20b71e
SHA512 b295b6b9226e50fe09d841a9aefba8a1fad2b4acb0dae4002e8b0ed59179d9f6b0129fb3064393664f9af02890cb18c668fa8edc9357d6cd4c9c465213d6a2a8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJib:A3k03kHRJARJt
TLSH
T12F259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 40eb06674f2120967c8ec9375a6461cd67b6991099a3b964120870be35e5543d
MD5 6196ddfd77c4638b8a52dc6f18d218fc
SHA1 a8d0ff78bbc0ceccbc05a1dc067fe28e6c99059c
SHA512 8d82ccd520e36bbdfd9a75cce6d43e7137a666c8e51630f3e0fead1cc74e022c03178660ab37fa435f1ff2f521f83d6c74780ae759ba0c880ded4feae3a2e996
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJkf:A3k03kHRJARJd
TLSH
T1F1259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 c66d5a52eda32b7562203b92dd9a4357d51e8dee587d8295021acf88aedbe5c7
MD5 3a8bdd6e267b7f2e75ae4ce2623481f0
SHA1 51b20532df504c7cb2cee4821e1833b12ec54477
SHA512 0cfeb3b80e31da9270ec1fa091e17c7cd92727ff099be55d94341d766e7c7413c9904280da1560f14e7c12a522760e22edcb810eb325335282bcb2b4568c9b2f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJBK:A3k03kHRJARJV
TLSH
T156259D03F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 6568f3b04ed64756c54d91427e79a62d8307a67f29d880f8efb1925c20a01892
MD5 43f8d10d1bf4c4fc879dc1e42f4592d2
SHA1 828aacd7a995dae752647ccab61d07648148cc2d
SHA512 370936d6b6beb2d1d95b2e5358d93c2d034c6917cbd2bc60aee754bbe0851c54b72ced3d8730d71405314ea214a45140daefa730f49d2d09667346d4cad27f13
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJ6k:A3k03kHRJARJ8
TLSH
T19B259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 9ff6a52ada59c666f483625de69557f88de9f239282ac223287fd69a09db0eb7
MD5 5f03fed63b76c60c42572a87699161e8
SHA1 c59fc93c4d1a744a1ef6e54f5cc02b538b5ac687
SHA512 40ecbe5b6fc5d4968567e27fdc366b6dc5967d3d8d424bced29fd2df3355914479c8a6a60da7ee7a0e26a5301b07191a099e8cb053496298acd727b5f7567c0e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJf0:A3k03kHRJARJ1
TLSH
T125259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 6e5ccab4b44b951dd5dea47eeb11b4488af62a3ed73adc80e820b37979a7fc83
MD5 413b4ab5271d02f6bb1e842957317346
SHA1 058df1227cea793baf2d0a279cc7f58428a66f74
SHA512 534218bcc75e1115765c39ee0146dd31a1841403eabad2d1fed0f903d1e41b4c2130944bea087a21f53c712d0da39111fff9c23dabed5397ccbc089bc3555c40
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJug:A3k03kHRJARJ0
TLSH
T1D8259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 dce46cf628fec8e21f1865b07d5a2fd25c77d96f8a31993d729b417ccb61843a
MD5 190b1e797ecf121b03325c3893560531
SHA1 168ef0989c72a6b09d4a8932edb26a2151605fa8
SHA512 afe3a022ffc4563eb6394905e4d6e1d05fb63e3ee9519103b49cbe5a7389abcb46bda5b40e003a37adf19aaf3507bdab0cb984b3e40def29f81f5043ac151598
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJ3r:A3k03kHRJARJG
TLSH
T1D5259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 09e16d5a7741cd434ca2cc601d20bf18d4f0accced8e9b2ba7d6a6fe2210df26
MD5 4633334b73f4f2c06cc83ea75966f83f
SHA1 816b819e2c3ef93ced49644e3cee36937cc5a616
SHA512 26b3fb2dec1d081a38726ec93aa07c1bcba5c73189c7ce42c4b0c9df763368a92336e970102cd638e3b5c415e6f368121c320389fdc83453cc5d349f620346dc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJBn:A3k03kHRJARJg
TLSH
T1AB259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 357405ea0ad3b26a22cce8725f7c070f7f02ddec55f967649ceb89ad1d3af9e8
MD5 62ef707dad3dfdd358d5c7780e40d467
SHA1 766be21ad72fb2494dc2a3d9090e0cd0766211a3
SHA512 0a3178e574a2746a4a5f9685d0bc136e29a91cc69e26953519a999ce149a610a57f59e0f51f3d999fb5050352404ccdaea040dfed26a56a4236e3c024fdcfc7d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJtx:A3k03kHRJARJm
TLSH
T1E2259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 400f191dbb8c240a6167be0b0dd7cc07a3a2c2962c3764fdcbe48f76a32ff759
MD5 4251f2585e1337cfe486cf701af4c4ec
SHA1 044ea03fd7dcf9f0e64a6c3e3cc1b99c2ab37e17
SHA512 9028a6a0c1f20c95081fb1c8eee9479714bcb54d2d709c19c051002495623e2a542164bb99db016cb5583a6775d8138a056077e28527e30a2663645cc536a1c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJzA:A3k03kHRJARJd
TLSH
T1AB259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 3a2babb2396f5a344feefda111e3707cf6ee940c3f123217ad32a5586685bff2
MD5 5fe48e83bcd4b5a0192fec48e9ab3592
SHA1 47a4f24678ff43158720721f08b0f1463266b38a
SHA512 63529ffff769be6e263a030aa0da9d640d74565dac462c9bbb22f4d85ba5072c2a5adfc7865c51036b14c125275e7286e0b494961c533ab81746eff5b91f5067
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJE9Q:A3k03kHRJARJM
TLSH
T1D7259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 897b5642ba00d0c558fb0ca72c8e8b4eb3c2566379c38191b86e6aec2568cd1d
MD5 ee93a9049e9c1f01e92b766ec6a21dfe
SHA1 d6bdaac43ed9337548391b1403409e4d36ee311b
SHA512 7ccc4adb2338606188ef40a90bc09ca1bba35b7c3bb1242edaf71cd6f871a78970bc2d86b89ac7bfaea2ec94b6e5cbadced045b7e2ade1ae8af9813b49bd2657
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJd4:A3k03kHRJARJH
TLSH
T1CB259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 6df7dbd24629413ceda65f1755dffe1c40a6de57d0be4955d5dac8091fb9d808
MD5 faf9fdf6bd14a182f0407dffd978095d
SHA1 09a9821a7e280a38952d889235462f79bf013cf9
SHA512 d448792069cba2df4f34aba12ba65bdcf105c57bed2241ad4e8ad3cddd90ffa05784b72fe338c5d46bf0628bab28107a3bc84eb5f820b2fec663e0d558a548a1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJ4u:A3k03kHRJARJK
TLSH
T1F8259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 7c10d0ca06b542a2a3f519135cdcd881f5bca3b568f3c7fefd7bca6a0cabd6f2
MD5 ade59961bb9a1b5d71b428a436301380
SHA1 d3096469698494ffd99c3c99bd0a944c0511cb3a
SHA512 0fb14081bf8a79fc74c687567f730de481243abecaf12fa72e7e72f5f8e0815f26b8fda6e69a55f60da04975b3b564cdcb60a4186b328cc2cb8d813202ab46aa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJZj:A3k03kHRJARJE
TLSH
T11F259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 7c7aa5f28dcac3e166ba1512cade6f7a45ea93d26b1c8b12906a758f71bc1433
MD5 a93590b63342e2154c883737a5a44874
SHA1 f52df025704651bb26399d566986f9f419f16c74
SHA512 16984036bdd406a6420af9e5b94262542044d78a6b97174a674e75b49d7bfd8e3811dcd6a253a118d07dfc2229a72be615c0a7a07078c548cf9b2b5a00b22ebd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJAg:A3k03kHRJARJM
TLSH
T171259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 02b7f295a9295ee5100ec7e96648d657f5ff31863aa53f21b4f8697a3703c4a8
MD5 68e3aa745157a836f1d2c921ddc16366
SHA1 f61e253f1dea4805a69050919b7a5fa3a6923708
SHA512 e7dbea3a51f9ef437480d3b9ccdc56012a89b4c861da1f86c5ba5ea9f34d0cb81b8033b23bcf9b7e0417a3546e0a97a8d812bed6b4d924703e24678641eaaf37
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJvI:A3k03kHRJARJF
TLSH
T154259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 5da1509beefc7b2cecfbf45fef1cfcd0c79a49b319aeed86d4137ead77f03ccd
MD5 db735ab7bab201b9f73afc039eb211fc
SHA1 1de7315198bdcbc5c25099672943301d0c087017
SHA512 d3f3c211eb8657535f753fd9d20c1396af9a65ce2be5aec11c7e1af24ac6bf11f42e8a78a7e88f358b8927d8588e438b47eedc5296e7002a54260c4a6948a8b2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJVo:A3k03kHRJARJz
TLSH
T1C5259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 20fb11c5b08354c62b64ef32ecdba3f6c6cd483ab3dd244d253ef552a076af80
MD5 90e6f7d2009696a89e0da574e9d690a4
SHA1 764000dfb4a6e750f6ab50bd84143634d7df567d
SHA512 d8e9be7d6ffc8e2a8dfed87493572f47bc0f9620768e89a719f294bb096479e8643f94472d6eb7987d03233943b29fb8fb944a15c93422d0cd3b28ee62556a9e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJG+:A3k03kHRJARJW
TLSH
T149259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 10d6546144af555a9f71b8ef7a8ae587d4b2e9f3d77b834cfa9160a9b067fded
MD5 bd3aec9ea2f79f6f19fdacac6f7af162
SHA1 2cd8ebf676180327c8185abb765a8003bcb840e8
SHA512 95b88e82515f226f3e14803ef4929082ec747ba91653ae56e3bf86ebbd1694153cfcb60237a78f29766782273f85402fb1b3f2e85ef7e989e2e1499afafcb32d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJGQ:A3k03kHRJARJS
TLSH
T1E6259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 70361aee897b173013838dd3f2d9efff5598933bb5df7f0de7f0c4f8fadf4040
MD5 73969a653b9e4b0f01273acf71069680
SHA1 33a56ae8108a22bce1426b80d151acf86a2261cd
SHA512 1923ca2520a4c4388121525cf71926a72ac26da29b050436258028d4fef7a861280276d2c774aedd08e79ec860ff54044b4d385880537df5b5d4b08e00106a07
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJXX:A3k03kHRJARJC
TLSH
T1AC259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 0f4f1e55f8ed410300d93acc0f22e597bb226eb7a02a066906a3547abaf3f555
MD5 19e53ef542d865aa7ed703200ab2f103
SHA1 a819f062817ac2555e812a382d91d67bd63f5ce8
SHA512 968369fb2524def370e9dce31d4d468c508a1be26a69e2cb3458cd37e8b6f56cda69059fdd89c1e114e3dc5b1e57a7711e07dd42ce2885d0eac88b865756a052
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJNL:A3k03kHRJARJs
TLSH
T1AF259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 b3d135e4397bbcf86a3f130e78d7ccb22d94bb05d71ea43ed803986b726a1bca
MD5 ba4653695edcf780881bc1745c5df619
SHA1 376219a1103203e9c41b7f5cd3636f6920455e4c
SHA512 74269427ba3e98822f66410490326151bafa007e93caf1ea3fe650d561703429d2f6e809054e15bbe5b10bbf8188f0e4b3ef60a0ae2936c2b2ecfffef2d80d5e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJLM:A3k03kHRJARJd
TLSH
T1F0259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 f29dcbd41d0476b53f2322f220e42e866017b7ba6b1290c2641797dfee651899
MD5 b97949c0e5570ce8e0a88d72c57224d8
SHA1 6028a9a1a31b4cc015b7c8d6777105262ffce693
SHA512 6bc009a351dd50c03197e9fc2baef3bc96bdda70816b6aaf0d0be87164481bbd2022ee8e1f1f651654bee130eb6876aaa7e7d10747de0b18a1add685bd6c3492
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp6m3XJMh:A3k03kHRJARJ3
TLSH
T1AB259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3536-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3536-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5980-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads