94ff3a8ce2d0b95679c5a127253e78ceff999d35d8659ea4aa62bac7b5d8536e

Analysis

max time kernel
95s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 931KB
Sample260715-vdf78ag13p
SHA256 94ff3a8ce2d0b95679c5a127253e78ceff999d35d8659ea4aa62bac7b5d8536e
MD5 8ac9a9303de559d7fa47f564212e034c
SHA1 1d7043d2f3eb44217cfb2ca1944a890e5af1a761
SHA512 b84bc6db8a50d9c698787db26bf21e4e10e19d7d14cac614dc3490b5ce750434e14b95d6850f3801f920408d340eb15eccd36b95d0babbcef25c02fb0eeee16a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkf:A3k03kHRJARJI
TLSH
T1CB159C03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4760-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c588-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4760-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4892-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-448.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-588.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-692.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1302.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1333.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1352.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c588-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-223.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-448.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-588.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-692.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1005.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1048.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1080.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1136.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1149.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1174.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1181.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1302.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1333.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1352.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1372.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1380.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4892	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4760	2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4892	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_8ac9a9303de559d7fa47f564212e034c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4760

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 931KB
SHA256 94ff3a8ce2d0b95679c5a127253e78ceff999d35d8659ea4aa62bac7b5d8536e
MD5 8ac9a9303de559d7fa47f564212e034c
SHA1 1d7043d2f3eb44217cfb2ca1944a890e5af1a761
SHA512 b84bc6db8a50d9c698787db26bf21e4e10e19d7d14cac614dc3490b5ce750434e14b95d6850f3801f920408d340eb15eccd36b95d0babbcef25c02fb0eeee16a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkf:A3k03kHRJARJI
TLSH
T1CB159C03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 291938c3f3452a1c5880c6afd1db2362bebd55d9417f01286ea7f2036bbc02a8
MD5 ab66a2ddbff0bcece9cc439172353a0e
SHA1 f734726ebec75a446e59ac0cca45d8bccfc9bc16
SHA512 782bcd6d47382e03322a4a27f09fb43e924ccf962260efc5d5729ea56e901b6ccd44bef92f5d89e4f0dedd790090a0a1260fafd92882dc5c74d99ddd13da94b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkL0Le5ji0hmxNrM:A3k03kHRJARJQPji0Aj
TLSH
T12B657C17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 946KB
SHA256 3e14de8ee368741e92d713a5b2880d9dfe3e194375eade0350671b02df514ada
MD5 e89eb417206d833c6928da9b52b60162
SHA1 c7bbdbc33872edb3fdb615d50146a63e4b26e9f3
SHA512 84da57dd93082a7e39b41698baffac6a482f737a02ef49ccba143fbbf82e8de871e1300061dc949239e18111dc9c5f0149d508848fd31a2fc05926164d496c2c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkNa:A3k03kHRJARJ
TLSH
T1D0259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 955KB
SHA256 9f2f372657117b6820c46089e9c92906a89a502a314ff6a23a95dd63a9df9b44
MD5 48f4c0e03d2153d6a1935477756e2370
SHA1 0fe70fafeec7d5892db3718a6f7419dd370c8a51
SHA512 4562a55245fea74e916aadd5927a443beef8dfc6170a0b3e4717913797d28faa5683234275b0069e2831c65f16c35b3e730a719a7bd206815da439ed9861cf3b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkE6:A3k03kHRJARJe
TLSH
T188259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 955KB
SHA256 33ea23081bc35dab29d80079d79690a32928012cd61b338504a2faa9cfcaaedb
MD5 a965719fa96d7fb5e150345565157b65
SHA1 bcf284cdedd55d5fc64b863b8f1458036eae48ea
SHA512 f013734b77d86d2b5d9f30573bfe11a82952172cd903f9bce56ae11ce28bebba2a61168444c8bc171c0ae2122e4a40a0fb7d1741a4b3a802a2edaf79d5ab506f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkgN:A3k03kHRJARJf
TLSH
T150259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 955KB
SHA256 f5452200fa2c9ec0ec25566fae810a198a414da610424655e2bcc3ad88693148
MD5 9a73c8598a6e91a3fce5e458ca045743
SHA1 b01e0ea6060c4962476cb67f5803e01ebe685ef3
SHA512 65fc45773351c8f2791f99d7fa0d64e7761b780c467e0a5b5c513db894e60c8da1b28a55a3ae67d771203046b0fb0ef9acdf979228678c5b79a8fd303e5234db
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkOf:A3k03kHRJARJ7
TLSH
T148259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 955KB
SHA256 965339fbe8853b903ca4eb00544b8bbe15ae5ea7af70adb32e2808de6967755d
MD5 96992b7778455227bbb7475bdb8bda7f
SHA1 04a8d20be23278622c3ec223104bdb0e0fa02712
SHA512 05492b5fba754379b57de5849dae0beaec013dfaa098af0ac2907cb86f5ed63d77eed81b0b0aaf0a1cb25c4c7fd73eaec336827540fcc1896427949e3c5d5c17
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLk4o:A3k03kHRJARJK
TLSH
T164259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 955KB
SHA256 c5ad220fbde30db56515c4046175bbf4008f05c37f0d8491b54395d23c79482e
MD5 43f21cf1c990eb8b33542a3450502513
SHA1 3eba757b8f4df2fb12f42ba31ba520f8c71cf7f8
SHA512 34e4bb7976e6d0ab4ccac33d0837ec9178a936d3fe7a2c5d3f067001e2894d66d93cd4ee4c059150c1ba19ca3ce0dfc471d46161bfa9eb55c183c86b8214de1b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkIu:A3k03kHRJARJE
TLSH
T1C3259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 955KB
SHA256 37cfe26b2bcafac9ab815e471acc66129250ccc6a985d3ad2cbe39bc305e57e8
MD5 57e0126abab6a8df4be9abe12bf3c603
SHA1 98554d7c9adfce0feb0e759a3f5fa1c5523717db
SHA512 3b2238a263e79eebf281db9af88e16d1ee7519198399b5e86c9dc3622422b7819a8bedc0ebf971474204ced9262d89ca1febbb0d036af73153eca11e1dd50f70
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkc9:A3k03kHRJARJJ
TLSH
T1A8259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 955KB
SHA256 288edbd680e0d3104d6622a4bec03e9e31dcd69086037532b8296564948bcc06
MD5 09cd2d3ca2fd3dd89a470cb57374c95f
SHA1 95aaf7a9a4d2ae3e6bb8313fbdc1427c1ef6c8d6
SHA512 997c076d2c063b934a9057dd23db4ea6b3346ec1f121fe395575b11845b27d439dc94f98314d234f4b82cd9bc6e6b77e0d3cfc355bf3c2d6b647dad791206cef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkEc:A3k03kHRJARJM
TLSH
T1DF259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 955KB
SHA256 9838aad1c4db8a32dbc47d5cafd7478248e92104f4bcb9499e697b2f1701e5aa
MD5 cbe43902419ee607c713f333e9224e62
SHA1 d0040bbc71dcbee3c3039d36d562619ef4e7d235
SHA512 af7592e180174d7db8f90ffb4c16a6a1a0cfa95ef6280d36c65c51445e6554e54c822411bada9aa428c3871cd2a2f898000a7798795335ff98e0322b987821e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkdp:A3k03kHRJARJ6
TLSH
T110259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 955KB
SHA256 472883af24ef74a35d8a29b72f24b538cac279486118ce70e617004e03d1132b
MD5 7a9ebfe8bf4f50af970c1d1217019b26
SHA1 a03e4b74c0cbed90c337e58add94050ecf18aaef
SHA512 abc8d998658b319e307cc3104383ee78832c6b2b1a01d1c6234faeb1a3653b0e75b684e7576a8b784402cae2224712301ee24da1bd9f413d6737e92ced5d7aeb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkiN:A3k03kHRJARJN
TLSH
T18F259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 955KB
SHA256 135efe049972108d0dceef6547bc3677d6354c50ca7831844cf05d4469665bf1
MD5 a5444a4b6fd77ee24745ad1d523e4dfa
SHA1 8c3a0fe1411a2b7ad8856277aca43e6640c3b26e
SHA512 059d50a3aa25239d4f50fe2741e33a911d78e226df862f3560581705acd06a93a9b98586be3b2a7349e41c0ff70aa3d5d3830e94f04eefe28697b82ad6a133e1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkGF:A3k03kHRJARJ3
TLSH
T1D1259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 955KB
SHA256 2337aa3b7b619942592c18c44152f387d2a48eef5dd420b5f0cb2b3a242fff76
MD5 ea3b53875977b21bedecb1c1be627d11
SHA1 bdfb44152782e094dc352144715104d951d62910
SHA512 fc7a072d104feff446cc95a6a29fdce8797cec2230c221d70016ed1ea77aa77385e5536d12df9f28be28e8ebbecc15b8bde5e6112acebe3071446d1905dae74e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkTC:A3k03kHRJARJr
TLSH
T18C259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 955KB
SHA256 bd61a02a9b3342546996d573bd44e3918fedf2ae7aefc14ac2923b2309d2a845
MD5 4a3f008a9f5b0b8cb5512de3f234d1df
SHA1 c69b064e52036fb12c7dcae998dbb45938edf734
SHA512 9c75f48b936f25f188436c92c87adc5832336c10b8e2f3d1134f51450950e502e02ce9a7b448583c58e60876561e9018c66aaefd3752903592674511a3079b8b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkcw:A3k03kHRJARJu
TLSH
T1BA259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 955KB
SHA256 093ec784ae8c81e29b79d68a74155a1e24f7f2c12123a61ab8ad8bb0186494b1
MD5 b1337af2856173f8b69fe6eb918b9647
SHA1 18e853d5f0565538736462e6d88623c748163352
SHA512 835d2daa0e1a1141f653fa4beb0f82714b34200080015a734a2509d9e36fa0bc1457e32f90ebf09e5020dbf3c5428a491388278fc49211ab8275a1fd40d4407a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkTT:A3k03kHRJARJO
TLSH
T131259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 955KB
SHA256 2e33a57d7e1d57e09e88916684372149cf505cac2475305a725136087875bc75
MD5 1a354175ca7e62220017ef83f47804f9
SHA1 4542579fc8f78d80776f9bb533c64bc5938f2c6c
SHA512 1cc4ab8410b6a5eba6a70d369af2d37f8b47915ff4523c08275fda8a64332bb71b6154f0d49803841001da665db3d9995890019465917dd64b8c6f4da2f362ec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLklu:A3k03kHRJARJ5
TLSH
T178259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 955KB
SHA256 72b472ef1e669e41f4b10239ee314db489601f18ce01bbac5a6d3f732f5cd175
MD5 fa35cfe130318395649691c0da563f61
SHA1 94a2059f9cf1ed5444a6b2347e1bf83df78082ef
SHA512 42c9a2cf71982cb12882264ba09635f29c11519a858c9e613588c4bd82268253ddc295038a033b8dc6f92752deffc3bcb91a0ed7b5cc1bca51a5b70029a513f3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLktb:A3k03kHRJARJo
TLSH
T1A3259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 955KB
SHA256 cd285d55cb74ef2952902bf18eaf7c4a438afec5c96f0d0dbedd608ff87237d8
MD5 d62819913d8eb0ebc78a2ec8d59e3672
SHA1 48e1d571042fd6dcc2434216cbe5a633a74ceeda
SHA512 406589a804371539e65346327adf35f251856fb40e10e08cbc96016934f38c7b41f40b7593af7a20759c7cc8301f13750e272624ea605e9d104d23e7babd24a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkdf:A3k03kHRJARJo
TLSH
T1C3259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 955KB
SHA256 31585101b5e8c8277565fddd940f8bf90d15168a6e617290514759c86b352fe0
MD5 dd4cc282db492e32d5fc45ddccddc83f
SHA1 02c54150e8e661e2e287ab0d0f1d0233b7c3a47c
SHA512 89e336a4c024a621c3a32f09d53a444eaab1c09bf6e4a496a8a1c8abfe56dfbdaefd681363a2c482bd3c513431fca9f9a62689947f774b781aa6057346fc4d70
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkGK:A3k03kHRJARJo
TLSH
T1FB259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 955KB
SHA256 5681cebdc2442897f619281b85d71143a2821881b262269cbef4436e9dca203c
MD5 583ec85833898701770d2b3c77f4c95a
SHA1 66b10ed0da65cbc1cb55f2c0abc7fa89cb1f6e94
SHA512 fc89cd0cdd349965bd3fcb8336c75d10343e334b2cec7524ad375b73a98f3b193458480cea5de7919d77eae9af3412e135e7ebd9ad0fd53b5627d996891f9745
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkzk:A3k03kHRJARJB
TLSH
T1EE259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 955KB
SHA256 9e4230ea5523c7c477adfd9e81826206abdd0ed89229457adca7079bbac984db
MD5 034a7a6dc8cd6d0cefbb49df8e16a7bd
SHA1 ab71815b36afaf6eeb9428aecaa21f3ab438215b
SHA512 1c25ca6c8e41e876871915f8b4e177aa12941de4ff35c1a437e26c9bf4463df8494dbbd4dc0c9832e4c774d05f3831a98de3306ccc534ad22544ca43c3dfe97b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkE0:A3k03kHRJARJk
TLSH
T1CF259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 955KB
SHA256 04b9981546cf16be5164aac923a6fc8d76b4aa67aea2db9c23ae1f36a3c5be55
MD5 1cfb48689048100972a86a94a3fd572a
SHA1 a501caea36a665eccd6096f9ef3b42deb59b05cf
SHA512 55fcbe0523ea4841a833a9f1c9b8b0bc0fb31dd11fcf5f359e23921da7994d784035d43e85c12874aabe6b778091d5de075b0eafb29d267d33425a03c8c00860
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLk/g:A3k03kHRJARJZ
TLSH
T1A6259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 955KB
SHA256 615f314d53fe121ee161c9503fe8e1c298b52e5c50a11ba8eff2bb2cf44f29da
MD5 a2059f55d59de993a18dcd1e64422923
SHA1 19a9c98524123a5bd34c9411a35a66b8df963e9a
SHA512 ca5cb78f661ac49d17c830ba968243d4a2011ef6e307eb64bdfadf6c101e9b6df8d6f001aea41674cbd1ca9a2879bc7e8a68a101e1bdc14933ccb1062d4568be
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkSr:A3k03kHRJARJD
TLSH
T104259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 955KB
SHA256 b4d564d665b68ec201279f6655c419ee173f6bea163c4c4e433e2fb22af14e53
MD5 b35c684ca4f64159dc9f92d403c74ebf
SHA1 9ac886941e8aea5f53ac1b94feba47cb4690944d
SHA512 ce3a15d6a05469e1f071413d984913b19a348a936da12d270d7395dbaffeaa1ddf54c0f088240c053f90d9b00a2566d961891c06aa5aa305ec761f4834d25ddb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkwn:A3k03kHRJARJl
TLSH
T180259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 955KB
SHA256 6b9989b363b7f2cfd03d5c75b7932e4e1fe15913bc5ceb2b5766783e616708ee
MD5 d3ccc05f672bab958ab22eac588fdcfa
SHA1 7b3ca182ba7dc4fd943eb458118cd5016d53ff28
SHA512 628d83cfd0d9b2fe3dbed4a5a0607ad91519b79800ca2a5f3f02bf18cfc7d56d4da00d11ad6615baedb4a4ab3e259e6f9acb05998476df16f059791edea3ea78
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkOx:A3k03kHRJARJb
TLSH
T140259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 955KB
SHA256 3e36bcfa85eaa321f6e68f39f8539c8ae14473e4ab9cdf73058c213794e0323e
MD5 ac27d662a87cfc118927a93194d67831
SHA1 d4db094eb978150224726972283fc83941da4b5c
SHA512 553786a94210507e013f7ef78d1f50275c37075d9fbe585db4c89a0ab744eacc8aa4d76c63c348626593add829895ed39bdc74153ddeb7c1d02c4f6a4b3c07e7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkoA:A3k03kHRJARJ0
TLSH
T1C0259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 955KB
SHA256 bae748bb4baacba024dc34037157d593a3afcf53e6bbb1a0408595e85ba1e8b5
MD5 2c7354173f1ee2ac008172ae7c486ce7
SHA1 87c228d3cbf5d1050e8fbc1c6a968da9de29bdee
SHA512 a38c9a27fbbc824512cbcb644f5a59fddbc1158397e0737c2b946703d01c342176d1d42403b7a726d8d90ecb69a82c6d7b0b9920a2ce536169506bfaaf4d8803
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkB9Q:A3k03kHRJARJF
TLSH
T19C259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 955KB
SHA256 ef890600cd01d55ff36a34d430030df03c72d33a8cc0ead001b7ae4a25edc8c8
MD5 c6620d4508e91866efd05c10edf3361d
SHA1 3afb08578a590be1ed9e96e4a7ce83c27008007f
SHA512 b07d5cff93651ffbff40b141040de0fdf836f688397a38bee18ef31fc22a90859d01cd480a5d082977d14d9b13c7056cde2c717bd254890943569d31a037d1ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLk04:A3k03kHRJARJ6
TLSH
T119259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 955KB
SHA256 d299e62df3b971129d5b21ee8670e6021b476f2dbc0c4b4e1fa49a57d3c49e79
MD5 51a857446cfbb4607d4cc4f841d3aa0e
SHA1 4003085e6d73c880bda5228c9c85ade63ffa1d94
SHA512 a483d7cb79534cb23fd3a7f4f28f1fdc9d14ea0986bcca3719d16780e292575a0ec37b4715a9d5b69092426998c570c93cb072b20a9e11390ef467f980968fc8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkfu:A3k03kHRJARJ7
TLSH
T1ED259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 955KB
SHA256 6c5de455fb5f3cecb92c2bce19c24528196b3767a5579687d14713c113453632
MD5 fa81817ed169625430f5edc4426069e0
SHA1 12f194b9ef66c24be9a4b7e13ad0f4908c27a877
SHA512 f1fcac7545d983f7723b5f53b815db7d536ba1753f5b08bbe8260afc82c2b9c02a3d6df1db347f106bfbfda914efbfb41f4ee3e043370fe0809021e23b9d6411
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLk6j:A3k03kHRJARJl
TLSH
T173259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 955KB
SHA256 aa806f75b58f93fc014c126341fda08f8facf9c73643fd226b31bf082b85888f
MD5 20db011366905254ca2b8fd51ddcc8bc
SHA1 e4c3d018c90e9898e19ffaa6f34eeaead2941be9
SHA512 8009f242be921cb736dc5fb5c09c3aa8305ceb9072bff183535be98086cc1e2801c9e01ec04664eef0f9957495d189ca7e47b20787f78ecb75181c0c30f37f4f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkng:A3k03kHRJARJZ
TLSH
T19F259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 955KB
SHA256 04d757c00f59efb150ce246ca05b4ffce92a8f8080324487d7cf2227d594f1ed
MD5 ca2c347ed1cc8e2f3801054279678d85
SHA1 28ea4f876b84fd01151746ee194299b987bc9827
SHA512 38256f62c2f001c802423d086715219b1e7dcd0ec2663b21252cbad0eddcf0fb6617bddd854e58c2dc7eabb4200d215bb07724582cef770f0e3001939bc1fa10
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLk6I:A3k03kHRJARJY
TLSH
T129259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 955KB
SHA256 c3eb3024c0f00f6236bc91675221cf4744d392d9f261d221e3248edd194437cc
MD5 46726a5eb541e4c7d2a7b7991ae0db35
SHA1 c4df5b7fba9a4eb31ad88225bfb69d0cc619a767
SHA512 2c321ef7098349a2ec57847e62663474e625b59e99302d610580f5d3c323a82ab67a139397d74adcf79676945fe9de92fdb3c10f5e18ab7f12abb1d415741055
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLk4o:A3k03kHRJARJK
TLSH
T125259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 955KB
SHA256 86bec75dba92740a91345f561a23a26d6f9ae41602917218e01d27c6aa53e820
MD5 1089cf4125dcd59e2baaaeb6aa7b5461
SHA1 fd1435b864c54716fadef15f640c728868bc4ad9
SHA512 a7dfa9381e35fed18fb491d5420cddceae7a1764fe24237f9107fe5104891b5317fc09bdb067ccb3156e7e5b4db980edf951860eb7ccff4e59c49fb7a03e5a0d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkL+:A3k03kHRJARJP
TLSH
T102259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 955KB
SHA256 126fd354e977eb9e5e88ff544f81eb8f0e144249e70961ed004952d60aa538d8
MD5 18b1a9617273336b75f7d1f1f975df7c
SHA1 38e2dea43a53b68b47ce83daee1d1bb62608ffa7
SHA512 faa4f6b2842fb177e487ccceed0373c9950de91029247ca8a02c82fdf4f807374f1c3cc6200fad7cc75f4279ec6aab07f057388ad7446ad646eb857ab2d19729
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkBQ:A3k03kHRJARJr
TLSH
T110259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 955KB
SHA256 204bc62dbe4219545a47d684b3a8dd156d8a19a59b7605fe9064e0cba9a8d457
MD5 ee0509a572f8079a991476d82dd1d920
SHA1 915741ba8a997536c310d23f06298a19479a4698
SHA512 1819b40ba06c56914488f29d46cc3253ed82f428ac7a56321142b1639e3846e43105ed47f83d9eab892b9187090fb823380dc9b3982a43035d084f185006732d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkGX:A3k03kHRJARJf
TLSH
T17D259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 955KB
SHA256 02e241fa878ab50e25060ebe08e0977f7e17a0ce859c537dc29a5aef2014b479
MD5 99e192482e4a8c0e89a66775b94bcd00
SHA1 b25726f4f3551f6f0f83009daa9f0b11a1eca1d5
SHA512 92b4f67f7452f0fa4b3f6e6a6dd798c96d1a10a46425b7e482228365d78ab910d16524a9507f916475cf1ba1fe4f8cc53765c13f4fb2ccac68801d6141b57ef4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLkAL:A3k03kHRJARJx
TLSH
T11A259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 955KB
SHA256 b70f91378be59351f020dca84eca26bad16fac02a876e45101c2e1cca0467977
MD5 2c1c880aa56099dd6da03c041c483137
SHA1 6b2b8b7f6ef053e75939fda9cebd73d5109f4169
SHA512 4ea7e1abac1c047d4c657a3e57d0a53689f51eb8267474a1f96213faa97b426b828808adad905c4cbcca081f81ebc64e5eb41df2482cd4662b9f36b304b228b5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLksM:A3k03kHRJARJo
TLSH
T102259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 955KB
SHA256 54a273d0707a34dd6de207c184c28f7bda109bbdaf173fda64cac19abab0b938
MD5 30f6e5fad0fdccb568fa440ba21497c8
SHA1 81c8c8b7e2645938cdf26304f058bc1a144013a4
SHA512 2853454b47c3e422c03b42364e2fbc193f1f5304f4d38d2220b293f3203cd4bf09fed1e426b4dad2c83e00a0268f1bf156ff47e335d9bd8735ad1279e1e7912d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaLk1h:A3k03kHRJARJa
TLSH
T1C4259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4760-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4760-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4892-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads