2217551cb1d7a1d928b7f779eb27f177fa0468b0caa38308aba2aab85bde301d

Analysis

max time kernel
104s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 948KB
Sample260715-dky8yaav9k
SHA256 2217551cb1d7a1d928b7f779eb27f177fa0468b0caa38308aba2aab85bde301d
MD5 38455dd937df932f5fbbd185cab548b4
SHA1 1758e3b2ab9a75c7a0864fb8bfd198fa028014cf
SHA512 b8405feacc0fd9f96a515748266c5a5862d9e27ffa5a7024e6fb00161bf8836ac7fb20a206b93f848d0db3d5895e695e7590554dd7f4ce47a003ba3cf06e3729
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3F:A3k03kB56r
TLSH
T148257B03E6940FA4D10F81749A968662EA777C065F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/4988-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c457-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4988-27-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5360-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001895f-202.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018961-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982b-481.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-512.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bc-603.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-628.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-725.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-744.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-795.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-844.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-908.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-1083.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1151.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1304.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1335.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1354.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c457-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e6-40.dat	aspack_v212_v242
behavioral2/files/0x000400000001895f-202.dat	aspack_v212_v242
behavioral2/files/0x0004000000018961-257.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a3e-366.dat	aspack_v212_v242
behavioral2/files/0x000400000001982b-481.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bb-512.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bc-603.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-628.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-725.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-744.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-795.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-844.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-869.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-908.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-1083.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-1132.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1151.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1176.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1304.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1335.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1354.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1403.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5360	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4988	2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5360	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_38455dd937df932f5fbbd185cab548b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4988

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 2217551cb1d7a1d928b7f779eb27f177fa0468b0caa38308aba2aab85bde301d
MD5 38455dd937df932f5fbbd185cab548b4
SHA1 1758e3b2ab9a75c7a0864fb8bfd198fa028014cf
SHA512 b8405feacc0fd9f96a515748266c5a5862d9e27ffa5a7024e6fb00161bf8836ac7fb20a206b93f848d0db3d5895e695e7590554dd7f4ce47a003ba3cf06e3729
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3F:A3k03kB56r
TLSH
T148257B03E6940FA4D10F81749A968662EA777C065F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 5649bbf1382814ca7e2406fe498eaf0403c7043262b80180f7e05fe2a7c0aaa6
MD5 9c8887863bbea968cb72d144792c0a1b
SHA1 1d46fa4cfac7f315e377102272d22033ce45ae8d
SHA512 b39af95ae8480c6984a7078d07aa410f7a6fd616c689b33f8c2428bce89df3e94bd32c60552dce2e347278fe049241c84f56e5acdbdf93bdb9cdb87a030607eb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FP0Le5ji0hmxNrM:A3k03kB56r2Pji0Aj
TLSH
T18E655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 962KB
SHA256 2e8167eb7b072ec118fa85077737215a12baf3ec7e7c519182bd0c65c74c423a
MD5 014dd7ca6340558011a20fcc6c512c8b
SHA1 9a63c24111d831e6a5022e8f6fbb959f3842dbb8
SHA512 697171da70369f4abc3a50e18572d140301c34f0afa80f633c34b937121f31184e7aefc87ab39da7c01f0d96d6d8e90f39ee3bc2cdd2447b87013326b6ac9f28
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FRa:A3k03kB56r
TLSH
T153258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 972KB
SHA256 c1bcd9195ec74199652dc1c9c95f536b5f60dea03a046afb7b356b701515d0f4
MD5 8e63d2a165424028ac0e3bd781679452
SHA1 82dc7699a700d1f8c498e07f76d2460d4cd25736
SHA512 35a265c0759ca013b7e69c5b7978a9dd8c9e5910123648c3d6436b528bc2ce6b9f419b5206a664937428a4baf190026987f9654f51929ff5a6eba6ef046cfa3a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FpZ:A3k03kB56r0
TLSH
T1BB258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 972KB
SHA256 def725d5bb8338edd4c8b948636152acfbd986c6727487526d31b3fa68e38f4b
MD5 50cbcdadabc8c08270fc06cf30540dc2
SHA1 b03dca7cbfa9d0ffdd2faaa67b7c86f95e2b3301
SHA512 1a4a78257dd71d32230b40f2a3428943005b51968dc7691be4efa3d1aeced987c152e70167b7da4c57c26d9eed6a591bad6874259f3963fddc381763531c491e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FC1:A3k03kB56rL
TLSH
T146258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 972KB
SHA256 b80a4d31fb561ae2ed0e2d83f5d76b79c129321e259dfb48e9f3a5fd94849685
MD5 f862760f937eede0dda5256a45ceb056
SHA1 8f1745f2de4a70886e63710e7027fc0330cb5570
SHA512 db4983807218d8ecdbcb6387af500b35e39ebd59fe3645d67390a15c65e77d8abbd2a32cae5987785727738ce77949b78d601476ea22e2233780e55bc1a86f13
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3Fo6:A3k03kB56rg
TLSH
T14B258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 972KB
SHA256 2acad0efb2dbd477b8cf37d9528f04a3f7b71499bca52ca6d1ebc9c7856a59c7
MD5 893e3cb316f9f2feb96f161e36484c63
SHA1 7c2cb6202d96e99c9f368eb93c17ec086dbcde69
SHA512 c7378f52daf655e3101b8ae2e353185b838bf2d5fea64df193333774c3ec88ce65ffd723cccdd816b5ee3083abb9f130a9b9fac31689f382fb30c96602c722f5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FsN:A3k03kB56rd
TLSH
T1FA258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 972KB
SHA256 b082ac652252a6bc53e69e7e0f0bba075e35d7ee7d16ee804564862b39fbd5d7
MD5 eadc1f0e219977b26a9aeaa264e40a89
SHA1 3e2cbd627a7e380e4d41ca1f322a0137084104cc
SHA512 cc0710a50ac9fa75092598be5c70454d5923e1d1aaf1cc7bb68231c851ab0fb737f1a4db822b20ba950db75266cca3253a79bec8c67bf1af2133ddda314d331d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3Fif:A3k03kB56rV
TLSH
T121258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 972KB
SHA256 04b69dbf7edc39f29507e9644b344f2c708900015f6bec5ec860bcdadba1ccac
MD5 075e4c1afa5e8383130908b1fb5de714
SHA1 07228d10657fee67ac3eee219fe192e6b6b0ce4e
SHA512 44a24770ac357b927ca4fd1fbb147050fea1b257dc79936bb6c44d58715990b4f4505518386d051a4f666ade7ffa9e9a7cd738fb8f226681cc360259b30ffc72
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3F8o:A3k03kB56rg
TLSH
T108258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 972KB
SHA256 efde251763171001d20e749b5bdc4ed2c5f9db463de63d1fe6b25a8658a4bc78
MD5 16d7383fb5a00f14eb2e16eeed9de2bb
SHA1 658175924afd2e77dd2905187ce0cfd700ac230b
SHA512 9cc9bcf01086c204b759f63b92e10e5bca0f4ed5914d5daf01b858ced8882046fd1d71420be197645d92abc0294b1d4daaa3380513e59d872133ca97042c2060
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3Fcu:A3k03kB56rC
TLSH
T10D258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 972KB
SHA256 82b5917382515c457c39222d1dbe862bcfb2999c78be46c5f7c59d324faa4b98
MD5 a67150c6dbb3d48f436393d854344c93
SHA1 810fd1a6ce8ee687ebbbb5bad57c57b25e235a64
SHA512 f6c9db7b2a26503ba5d9e3a41d099b89016aa7b36cb75661779ae94b351b952bdd502325efbdf7d0b3b2acf81578221d1d18e1b340fb820695256d7d5f4ddfcf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3Fg9:A3k03kB56rj
TLSH
T115258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 972KB
SHA256 2a0fae69565240a4ffd522aef4b218b682a181b4dae96620fa4fe901f053ffd7
MD5 3207c87e6550be5e86f7ad834015cd88
SHA1 ca1349cf51d7ac178bc012245646a55f1bada902
SHA512 81276fe35856c6416616d3893c89658b15d8fb436c55a8f2f109b7dc037a79a11c7494e7a1c877ba74897fbcb524eccdc28b5e724a8a00bb711de2878abab0d1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3Foc:A3k03kB56rK
TLSH
T1AC258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 972KB
SHA256 f4993c5d33ec4a8206a296e3982a0bd285af2803dddb02e48d8bd08eddb3f850
MD5 9c2354a3969e0589cd964fcdfdececb2
SHA1 801096135e1e6ffe13b222ca2ef49d8cf2bab501
SHA512 d92dca0e7483fd88a21fb8c54f348e6d278446cff8dfc69b8217757d1669875857f2d5392878b8256f59315a673f766b4c285b8d188ced02baf3192fc2a8033c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FBp:A3k03kB56rQ
TLSH
T1F9258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 972KB
SHA256 6bf1df28e7a5ce1b01c99eb711183023374c9612acb817f8d000c632e1303aa6
MD5 c8c0a86be30a7e36b1ce349af1bc9b5d
SHA1 45af7b132d2938e30bbc4b112b9e82d7cd37413b
SHA512 b464244d72b39eaaa27da8e5468eb98ec1d9b7e8c56303a71a5af0d9ef14df8f6d4ef64c880fe707db672d32840350e7a886503e4351a8f3d9cbd1aec0c52bbb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FWN:A3k03kB56rv
TLSH
T173258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 972KB
SHA256 073170734d5407c271a246e6b08c90bf553c1678f2d944a60d906a0a7ea79464
MD5 dcd07547d705c22d4d5dd6567ecf6942
SHA1 1ce0dec4605a5b1b1175d6c8e5c234476702c5c7
SHA512 4217164f4d6706ca9a09e0c2d6c273ee0765bc53314082875730e048a489d216972c31b6d8d0fe2fad7905002f4dcc1b4881417b533f7acd83812c7223f77b5d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FaF:A3k03kB56rJ
TLSH
T1A6258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 972KB
SHA256 0a15a1d30a807a17dda6942c72a8f6f19f55137a21184d08ce69ad2e9c55b59d
MD5 dbb7696d7cdf7f1a3bdddce34d29a924
SHA1 936d8b86ab72ecfbe8a02fad5ffd42b190fe4a76
SHA512 114479331c1bf9aa4cb40acf6bffae73e486f67438e2e27b0644bf1e5d2300d8bce63c9991776aa3bc972f54e5f37252f3f11c40641144f634e90776a379365f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FvC:A3k03kB56rV
TLSH
T1ED258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 972KB
SHA256 2f15bc507866a3f52de60a0f7e6c93de96ca8e5206e16326b84fedd75cfdf2c3
MD5 0b71697afd9e2b26a7bb17e4e45996fd
SHA1 0983954bfbcdefa26486013276a6e58bad89834c
SHA512 7eef2111c2c5b8b6ae849573acbea4affdd133a13d8246f7cb81eba316f1bde880a8b498bcbc2187acec8076f2884a2ab8984cf5aa6a79892bd2313a695536ef
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FQw:A3k03kB56r4
TLSH
T171258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 972KB
SHA256 4a3de463eac219abfd4e5fac2d1670f2ee0e1aa9f425092e25142eb1c0530243
MD5 312f2b2492a21c18ee3836f0610261af
SHA1 954d060fb224ba8e9e18770eeb79c254cd8f6770
SHA512 5691804143decbc19a0e7f6d5975deeb5c5b6fbef896fff42bf0adaa74e8a62c2f40d121e76f4afbeaa6bd343596bd6a670afcc6617870168605cc1b9db70bd2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FvT:A3k03kB56rw
TLSH
T1C2258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 972KB
SHA256 15999e580365e8c99ddc6697283b15e7b3e7058161a6c2bb3b3653dbd1aca3b3
MD5 0b64793bf2be21c07ed725427393459d
SHA1 94a6eccb611ddc2217324d3ad8a664c633e323f0
SHA512 fd9910cb2aa8d4ca5e4ce4b2ec742a6d62bc3c4ec313cf5f73fe51c17a3cda8c3be1d3fc780d92ee36c3779b514fa6489f2f998044976397f39b3429cfdedfdf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3Fpu:A3k03kB56rv
TLSH
T130258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 972KB
SHA256 5e9613f150b282c9ece1d3e86b5d678bbe2bd848bb99442675908db746feef09
MD5 83b1cbec706d549cc072f07dca27f2ad
SHA1 5f01d27705581c113032586badb984ccf6a7a1d0
SHA512 ea05d29432414f2681558055a589771c5149e580a49c0902000edc6e977a75a6553c0eadce51b7917f74e00f80a1b2af378a40f13b81d5d25878add70ad77ff2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3Fhb:A3k03kB56rW
TLSH
T18C258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 972KB
SHA256 79d220485adfcd8d2b4c8c5ada45993445ec056abb7488304a2b0c6d1f3f2234
MD5 8f739c55513172c1280dd55c714c2bc8
SHA1 787dc70de8bb8d7762804ce9b93fea9e8c4c96cf
SHA512 700958d30701d875d5ba1a1d8e7871c8bab57314bc206a501f1b0029774ce5c57f15f712108d5397041f9813901506e1e4174e2be33ad26cccd014e12a9a0a65
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3Fpf:A3k03kB56rm
TLSH
T1C8258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 972KB
SHA256 641e69ccf2117dac7878c285693c0cb402552e82fcbb45d6f4ba726e3317540b
MD5 32c36a52085c4e6608fcd19f916baf58
SHA1 72c9ac2b0f00f852e3db54d74ac4fe7609fd9080
SHA512 b456e5149842174d2a3f748d440b6761ac7f15398dd97ac01267974056bee10ee6dca9832c84761cca74ddb389d0d70b5c97ec173c4feeda6e7d31c1bb43bd9f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FSK:A3k03kB56rG
TLSH
T14A258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 972KB
SHA256 0d51f8c27679567afcbf9ff45d803ad445b68e086e636476bf6b4666e63ab73f
MD5 c99a3b8a8601ec3bfb8044a44344693e
SHA1 bd6247c75db7ab122267bde7e59edf12252a6e0a
SHA512 a53ba464becf3efc581ded1a2522d040e345a6a2a1968ba605807ed561592cd40412772b346c9e628351333ad474e3548e4e8cff3fad783f114323e644c9e819
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3F3k:A3k03kB56r7
TLSH
T18B258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 972KB
SHA256 dc87b778f075ad58b017520a59d67ef047a6cd14eff98654b1c9419008c66cc2
MD5 e6606a6c692263c70eb250a38d41110f
SHA1 79c6180a42b569425d1b11c31249801081232961
SHA512 981f5fe81af2983c369dd69887b06b8c97bc71cf7730f1696d90a358745cb000629309b5f39cf8836628b8b67e5da0fa8a3444daef24f05e0aab35643da469e4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FA0:A3k03kB56rq
TLSH
T188258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 972KB
SHA256 24a56bdce0b70292a03d79687849f2ec4a018281fe030bd3efcee441f895bb1a
MD5 d0bbcabf2be0cda8d96c65296c304436
SHA1 602f51070ce4e33798354156e4af9a9177c0de75
SHA512 6893eb21e8b05986c8bf893d98f175e387970ee4b551bdc81209be11b96ac02265c622d01b9f1c2e4c468c7bad5dcdb36020654f4749cabe0e090d4c344731c4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3Fbg:A3k03kB56rT
TLSH
T196258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 972KB
SHA256 25d966b87ec087e1c598c455280b90cef8cf108e999fb3d6ce0b0d820a761530
MD5 2b72c522ffb217e3958f665321241df2
SHA1 df36900e5891c80b6702b2a5a86b567a41fccfde
SHA512 276f65806b9e92fbbc44d3741adb12a68c710f724c10158027249ac8184718cda536c45612972b5f30cca05482cba31d33a39778b16f5d5bcbe49489e0e65b20
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FWr:A3k03kB56rl
TLSH
T184258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 972KB
SHA256 27e6ee0c92292aee197f0f5af3eeccb3cb5d32f370f0da5705646d1331fe6f6e
MD5 0a0020c50bad4de613a5db7396a06751
SHA1 986d0100d8f33807386a46819b1c1748b5063e2c
SHA512 017f3d83ddac2198dfe9d43ced3327201de5d2a1ed9dc1f87dfa82babdb26a1b872216b48d9310fe188d9dc3edd2dcc800e33bfed9d37008a047f0e2dbc98f50
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3F8n:A3k03kB56r3
TLSH
T129258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 972KB
SHA256 5a1bc921054a7336f3e72953b355fc176399b35ec8878ab641d687afbdf992a4
MD5 9f7d3e07d5b11287eacaf2696c56d363
SHA1 9fd96cd95fa7124b4a024d937aa384e683d49ea8
SHA512 b10ccdebf7cdf2f3a31e5af54cf96152b6c15af515969dee7f234317ba56f3266777272e3c1ff23636ffdad3b86cc6b85882b3d28da779db3ee5a6d64efc43ed
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3F6x:A3k03kB56rt
TLSH
T13E258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 972KB
SHA256 ea5e12137baae74e85e7b70fa09a19558edcf9b398f620baba62465211199747
MD5 d02054debc63a08227cbcaf8cc5b76f3
SHA1 83a7abfe87ad1d9b1387094db98bf1de80df9326
SHA512 b33e914509500d8ae55aa3d40b9796e1d8d7d8601bb533e4096eee2adc7187b943f701e2dbded5603bc1c50fc94eb03bc0b3226c6c2b39143d48e8060dea1f1b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3F8A:A3k03kB56rS
TLSH
T1CE258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 972KB
SHA256 b32fdcc2edf8989dce8f8ffb34c1b435fbdd51e38e4c7156a9adc75bac0f2471
MD5 e6f94bb859c48e6a3ba7e3a9ea982c2e
SHA1 e73c1031f242e97e12e3a8e769ea9f266e42076a
SHA512 6229a9247c7db729886ca37adb84ec2f50e5af31afd42890c6bedef7abdacf16bd9052de8b0729f0a60abc0590c68777aa2b7904c1709940f31439a9a8e71f07
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3Fl9Q:A3k03kB56rP
TLSH
T1AF258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 972KB
SHA256 fac638fddeb1d7eb615d1f5603f3453193a0fb06ea1acee6c09af36ceee66c24
MD5 d241f3a3fca1f9a3395c9e1d372af881
SHA1 78da7d64d56f9c7db77f1bba5c05f3971432da72
SHA512 62923035decc586d9151529d5b8e4c87908b518dd175ec6201abe302b05621a0b9d762c9f0221d39a8d36e79f01171476cfc8f4f129faa65034d716f2ac07ecf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FQ4:A3k03kB56rw
TLSH
T13E258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 972KB
SHA256 64ee03bb1e473295f45c7f168c103c3bdc611148957b026715bc8552453a83c4
MD5 49b7797b34e40249becb530d1989a94c
SHA1 3063932f7694c611e066e9f1d2347ff5483f20f4
SHA512 ed3e570a60cff21c03932732181cc0f5deceb999977b30aca73b36051d97856a2ff1c2b671ed5822eb264e795a0425b2923b71e99d6789cc08713a3703a74e50
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FTu:A3k03kB56rR
TLSH
T1BA258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 972KB
SHA256 5fa2458017df3cd7f98e618f31aaa954a5e6eaf9fe0c206cdff1ae56cade3378
MD5 6358bd1f16359c1e02ba08550b5019df
SHA1 21dc1f17b8077f43e119fa196ec09f2473c0805d
SHA512 9f688ee52199d9f5fff41c02320e42a8598565470441a3e6a1f8800a0616ce47905daa4cba4dd86f378186bcba692206750f46488d770eeb70e90d768d82d512
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FOj:A3k03kB56rb
TLSH
T1E7258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 972KB
SHA256 c6db911043a442a71219f8881c596243c5544f8b7dce1cd09e364a972a681a06
MD5 607a242d90e1d05abf1e581c42974b90
SHA1 7974864a11bc72aa33a7b91dc93ffa5e3f0c5bee
SHA512 a881342820bd373d0169f70416a1baea18c4d62b980230f57ce97f0312d9bdb1968613ff5b7d1599e6175db12d1fee404549e24f572ed4199a956244a3c665a9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3F7g:A3k03kB56rT
TLSH
T113258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 972KB
SHA256 02eacafec33812b6be03fad212faafca0432e58a620ad25e7891a381ee314ed8
MD5 728eb610777fbfbdce5da5df25521df2
SHA1 428f10528c7775e20c326ca1164b30e2a3d9c12f
SHA512 414927621d8a954f6d5f873c0dc2cea0742e7b1ebd43d35afc7828940d173b27b31e63192ea9d6803faa30b853a5cc1c1ff8b7ce8229bf5ea751f2f132f7d1d1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FmI:A3k03kB56r6
TLSH
T18A258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 972KB
SHA256 fb715eba6042a7ae9aa6d084cb9815876ec146e4b1abfa5be19171a8229cd79f
MD5 ca7868138b567e1290e273db357583de
SHA1 635d469b592254f48f32a897b9bf32a6f84de377
SHA512 ece30e7b45bf1e4ca562555fa365a7896360ff8d9fc6ea94d0e14e9fd8274c6a8544ae9508d3cf73ad99744573b51f50a018c8f5b7055a346ca39276665b5e1e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FUo:A3k03kB56rI
TLSH
T1B9258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 972KB
SHA256 bfb6b3241d35b7d352a88c46a451a5d0358d3a6f637aa1bf4ff645f2d5b50b07
MD5 427115a58a1140371f26089d16b2d5e8
SHA1 f2b861ed684a1bd68d9c2ff0dde965a7fb45e34f
SHA512 6be0e6e28cf3d65412bdb39005292ed4cfdd686f2d4b8351de98ba06827097b2b2e2f74cbc8c0b6618aa3556ffb7ade709d33caa58130808215d0e2da01733dd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3F3+:A3k03kB56r1
TLSH
T12E258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 972KB
SHA256 a9a214858595b871383b117b899aa18fb9e7e9e234d78b53bf111f2ac0923b13
MD5 3ffcf1221cf4707c22d1e01a182b3327
SHA1 546abbb226bbba66724c87b2eb78892f988ee34b
SHA512 241bae851bd846edf0dfa699fdf9248b62312b09e17915c17b7e6a0cecf6a2187873222074fd351ea8b34109b1ca0304f784e1f13cd23224dd66d11308dcfe82
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FNQ:A3k03kB56r9
TLSH
T1C9258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 972KB
SHA256 f7ea0f7959aa9a87b84148b559b29a0b495159868cef4043f0e0ea7a353a9f03
MD5 2b4f0e3be459a5a54478c95c2354894e
SHA1 fd81846e4fdadf0a14d7c1faae03337df46ca5ae
SHA512 1f2a9a894fc39ae40f37a196e8217dab766d0f0de910c9329b196ceb08823e21dc129b667264a8df38ff444984e74ebafc1cdde505b2de2d528e97a5535bd54c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FCX:A3k03kB56rJ
TLSH
T121258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 972KB
SHA256 6a742b193774d5cdd5538346c289432dba229fa71118e974c01241b689bf3821
MD5 a79cea4a5cc0bc6abc74de23882a024d
SHA1 43503f895a1cb03e083fe6e49e358032f0e4b01d
SHA512 60a93b3805dcf45744d1d9cc2d99078524cb6fec062f6f51e9d1325b1f4d7ba208e0c57efcc33a9f595aebfb1ec80e8ac4e28a832406a433f1f28758daccddb7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FkL:A3k03kB56rD
TLSH
T1BF258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 972KB
SHA256 183d9d8651aa2a5eb6f554daa701fa2687a26ef58aecc8fd8199fc1a723f649d
MD5 4635ac37e6ef338c4fd9d2abad1bcf6e
SHA1 e462f8bc42d650ac8880bc6381f7490dd01814fb
SHA512 263008570c4ee4f0a45ea81c618d7fdfc3a6dcb499e7f480b8ed64ab95a08e51ebab1b57b6eb158142231f5b2a5099d4d6b40251a675eec9e3cdaa847a87faad
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3FAM:A3k03kB56ru
TLSH
T1B8258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 972KB
SHA256 21b9ddb7b9da8176159d90fa4e916110659b66fb86bee81705e760a8bbb992e5
MD5 24ced759a2163882c15eaf4fc26f99ea
SHA1 2037c88abf78122d768ea0095a0d3e07fdd6fa94
SHA512 97f73fc0f5876238037438f4539169d097075fb12f37b991f4ca451a7445c995511525675be78d963e0eaf4887a86fbc598fa14d0738d434ceaa1b6d2a856dbd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iy3Fhh:A3k03kB56rA
TLSH
T1ED258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4988-27-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4988-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5360-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads