b92a31fb05dda72df201b2a2b2d34e6a7f55c319dae3e69d90769c8df069a6bb

Analysis

max time kernel
99s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 879KB
Sample260718-eabwbsfs6j
SHA256 b92a31fb05dda72df201b2a2b2d34e6a7f55c319dae3e69d90769c8df069a6bb
MD5 5c00d9332eff3df14e4ab1e86cd7a646
SHA1 1dd778761fdab7d12a33bad3e870fd067ede1663
SHA512 c30de4b0179031dee0a60bd0b4ba7d1188dd9ee6164113f1bea8ab94e1eb52d8de2ffbd764a8bb301bde3bcd2adce7905897679204b5666df534913cbec1f52d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiw:t/sCv7rTiw2RYwZCUsocuaiw
TLSH
T1C5152A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 42 IoCs

resource	yara_rule
behavioral2/memory/4936-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5e3-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4936-46-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4920-71-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-428.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-490.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-528.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-601.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1086.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1156.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 39 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5e3-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-39.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-428.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-490.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-528.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-601.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-951.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1006.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1049.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1086.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1136.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1156.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1175.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1182.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1219.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1328.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1341.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1372.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1379.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4920	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4936	2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4920	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5c00d9332eff3df14e4ab1e86cd7a646_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4936

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 879KB
SHA256 b92a31fb05dda72df201b2a2b2d34e6a7f55c319dae3e69d90769c8df069a6bb
MD5 5c00d9332eff3df14e4ab1e86cd7a646
SHA1 1dd778761fdab7d12a33bad3e870fd067ede1663
SHA512 c30de4b0179031dee0a60bd0b4ba7d1188dd9ee6164113f1bea8ab94e1eb52d8de2ffbd764a8bb301bde3bcd2adce7905897679204b5666df534913cbec1f52d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiw:t/sCv7rTiw2RYwZCUsocuaiw
TLSH
T1C5152A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 88f55ae95b906fc5b72e3fdb6892c0d0161b0284f209b9c8c48c4cea86994a69
MD5 3092bf21d2dcee13059956b7ca316971
SHA1 38a71f70becd59822b525e6f9a0ce832a3f9573f
SHA512 f99c24d663eda830cc02992202c6247735960f9f023a7a3b96ed7a8a8bf1c00d11bf7a381e99af6d2705f798c64b5130d1756c0047778afb5aa0b910a14a2564
SSDEEP 24576:t/sCv7rTiw2RYwZCUsocuaiI0Le5ji0hmxNrM:x7iw2mPji0Aj
TLSH
T1B4653917B6A84661E073D174C5E6864AEA72B4461B3087CF12A8C73C2F63BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 893KB
SHA256 7cea41e069d54a1fc2afe1e7c9788735406e541329a4f53295e672699d06739f
MD5 2482c136149090f966bb33e3b1701974
SHA1 ddc7c4285e2ab6822e83602bea3c951a6a3ab4e7
SHA512 b57ca356ba6e11e7a39406073d3ff1e8b7a8ded69dd6e5cdeac7a3d5ae0fe52f7c1067e33e644e3cc5b6d2593d7be82e79f1024ac9dba3b7c6997b6a8e92a75d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiya:t/sCv7rTiw2RYwZCUsocuaiya
TLSH
T1F015291766EC4894E5A6613489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 902KB
SHA256 6361b86046117b14656da851c1e458f7e78a43b717668d1efccd271f6f11a53f
MD5 7d9b8fa3cfcdd1d4ec69b3a2cb2f25df
SHA1 2f2fbc909fbd367db4aa7c823da226cd03475113
SHA512 5bc88daa91f9227051d4e89ae6d173782d138432a479cb21bd14e1b4d3bab8fbef8db7398da07e21fdc9dd6c2c07843b6d3f7675183c1e39a32cf3191962fb3a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiD6:t/sCv7rTiw2RYwZCUsocuaiD6
TLSH
T18D153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 902KB
SHA256 01a2966aa9d4b551d25f15319022bd22f32abaa03908006b643a5aed566ad93a
MD5 e7f56bbd186c44811555d3626ddcf25f
SHA1 d6021625e9fa85971d223090fb79418ad3369066
SHA512 c5dc2e42ea98a70b3db9cc5ffeac13337b4fa19b9d26ef677a54650702b370d912c177932f170039c29c68438f4d4bbd19a4e652a8d26d1b1cd3d6db046e3bc6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaibf:t/sCv7rTiw2RYwZCUsocuaibf
TLSH
T10E153A1766EC4894E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 902KB
SHA256 e43bb951fe598d70634bdd66ba0f8febb118bde88a4b7619cb3a091501662700
MD5 b8d652682f319a7b1fd4cb4336857deb
SHA1 c6a642dd1014a1d02dec26a31ff38fa5cc4d8d56
SHA512 f740eee2e5eea214a64c9d9aaddb172462dda326c0961859c8cfb2930cb2a503ffc22ef153a0d0df7b4d7d5dc62bad903fc39d2bf165debdc0e276583d00a22b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiNo:t/sCv7rTiw2RYwZCUsocuaiNo
TLSH
T14D153A1766EC4894E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 902KB
SHA256 9f248a9d63ab6f03fed06a995a798f3c455a0995ba4cba6f301ea4d066a27291
MD5 4e983667b0bdab8c3cd5758c02620d7c
SHA1 5bfcccdd48abfc45fd2b55281650da1c4bcb1b98
SHA512 77b0c8f7114fadea1570b884fcb62e9cf9d6b93193dfad78fa9ce61def81f3a574078230aa2ad0f74890158137ea9ad8a7e5e074d96b345be0596c3756e6a822
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiNu:t/sCv7rTiw2RYwZCUsocuaiNu
TLSH
T103153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 902KB
SHA256 22c67307e3042527da0a32abc6c09580ab2747fcfb4027c6b80d11cba3b68d85
MD5 b668d6545fb2dcc1c798d4e35860cede
SHA1 f0ba4d641c008e81426f57d10ee497f051c0c3b4
SHA512 10af321c6d9aca09c1148768f6265594c57af3d389c6d9056ad9e808fc535f5ed5b7e6af21c0ea6b3e86f551127eba5256909370e94d609d30ca5144302c02e5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaij9:t/sCv7rTiw2RYwZCUsocuaij9
TLSH
T1E5153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 902KB
SHA256 4235c5af5a6f13df9fd4b81a004c318f65e4ae50f068e352e6981c71e702f0a1
MD5 f50cd2d99657ea1c43290725f1e78bfb
SHA1 511fb1638dbf296ca1bed04f36b1f795ba76a5e1
SHA512 8ac7663036dd2a7ce95e2dbaaea17d9995181d6ad54594849205eaf77f5895bde7d6479aa5b401ee01caad842fc38a2ccc8da78736373cdff1f5cd504c693a0d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiPc:t/sCv7rTiw2RYwZCUsocuaiPc
TLSH
T146153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 902KB
SHA256 c06f47f18c3df0ee7d304c6761a28f489929eff8934bac076f46042b3c40bc9c
MD5 28a53dce7c5bee1d02240485e3f7229e
SHA1 c5c920a45d17e1c82d97b5f64a6ed7fb757ab8e4
SHA512 e73b7c8309e25a36da07fa3798e4bc8fcb1996f69c83e251f2d8881ad35063f187f6736afc09b554d90cb3e39ec73779e96975999fcca604bf2e38a94281811d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiIp:t/sCv7rTiw2RYwZCUsocuaiIp
TLSH
T190153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 902KB
SHA256 23c2388863c2c5ecb87cb14aedbfc2159eb5c4228152d3508b2ee9f6271e73f1
MD5 f331348077af11d79dc99b51b7830849
SHA1 a97ca02564a0765ad39d1005c3d0bdca9721c03c
SHA512 e732f7201783bac61ae8bfd02bdb37f1f87795c6228f76d7a7ea985b415d90aeff5d5dc2179a1f7bf66dcea6826a31d63f7e8568b7469e9f4375ae455d972635
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaif0a:t/sCv7rTiw2RYwZCUsocuaifN
TLSH
T1D1153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 902KB
SHA256 59deb2c0854bc9499c468364edc5de6d7ae2e24f29e6dee7c8d76137847c3e78
MD5 31e912635e26749d4710534d0877d61b
SHA1 7d3b922a7a77776f3276b5402045d3ac9605ac6b
SHA512 acecdb99261968d57f62bd79b11ed4ddc9f6201daa9d216e0963c2faf6fc860dd1d16d55c8ccd789137651ebeef5f1dfe08cc75407d5a8fa7103f23015115d61
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaidF:t/sCv7rTiw2RYwZCUsocuaidF
TLSH
T157153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 902KB
SHA256 02c5ea6f427974c06f3f06bb7d7bd6c212a4790b2f1f6b0ce17ca1da3513462e
MD5 2a639c52f8a880e268a7c4c0f51969e5
SHA1 23d8f2f74508f69a43c0088870018e593355980f
SHA512 0b6ac014980efb913a3e8ffafea89696d037253b8e0c2192fb767c1e7adbaf0cc4aa2b4ede32a878e1a773a583b103d1c20b1cd6e58ece2ada484e34bfc23091
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiuC:t/sCv7rTiw2RYwZCUsocuaiuC
TLSH
T17F153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 902KB
SHA256 145a7d5b91511a3edfd2c0e2e9aea6c7f607bd821cc96c45ed68f4ee94b9a4c9
MD5 5562ac60643b109808df86ba3b438f22
SHA1 e4b378dec8af8c9b98b4648e274959526548cb14
SHA512 b1f9dcbf674f559f51bd74bb4c3551edae80ac52549d2fb1a09eefee6fda0b0a6b9c1427f6dbeba926d0d8f953bf2e753c4e53b83ef3473036c604d899dae755
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaixw:t/sCv7rTiw2RYwZCUsocuaixw
TLSH
T164153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 902KB
SHA256 26c0933c3091d8fe85458df305870a2ba902d485741315db78bdd6f6d80038ee
MD5 a9c02df02e94331d1e833750ca03dc75
SHA1 0861f90826a4c209f7a049c2fef80eee9149b7c2
SHA512 4aae25340e56fbc6d321546dfc3acc540bb471cd4ac3613d52dc215ab15654871cdbf85b8463f63b17e4d1af9fbec10171ad6c9b2980536bf8f9c3ddd06ceb68
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiYT:t/sCv7rTiw2RYwZCUsocuaiYT
TLSH
T1EE153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 902KB
SHA256 6ed5e29a09eb58665713c6e94f48a65e28c0c5950d02ca420d545f969f12de1b
MD5 75dbd0931f1d672dc79d170fd9b839b6
SHA1 de470472e6f220da733d53f48be0ea78bf64f891
SHA512 0ad30330a353e138046dc1a1cffd27d56cada6df2677a488e4a9769e75aecce802cad3851c93834c9e113b74fb1c8c084e571176636f05222d9e820db2a1ea4f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuai0u:t/sCv7rTiw2RYwZCUsocuai0u
TLSH
T1B8153A1766EC4894E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 902KB
SHA256 a5278fd6ffb76b6a3524c415a33900b59c1c6b346fc52cda94e211731af84b0c
MD5 ba25635069b7f393608f69673eca3efd
SHA1 e4b6ccb022a9909a7aa30b97847c94ff8a9bbede
SHA512 9183f18bacde0b30a30a4927160b1a317f98a5013b6a640aeb663c9896d4ef7ff52230b1d12eb5057593a4212fda106a1dab685e6ef44874c60acfcc7c1c9943
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiib:t/sCv7rTiw2RYwZCUsocuaiib
TLSH
T140153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 902KB
SHA256 81ebb88ee7ac73facd738b646139eabc495bea03115693b328ec04fe000b1575
MD5 975d34bc1d472f75ad24e13c46d41f28
SHA1 d0ef4a0ae0987b11c4e6a3372909cab027ef386a
SHA512 8a2c11c4dc2f0ce0f8f370185b971ec55df3db851caf29b255eb6b73c23ebe02c809ac4161b2fc1575e81e6c35fd0e0944cc9d21e20aa82a4f1b741665bac9ca
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaikf:t/sCv7rTiw2RYwZCUsocuaikf
TLSH
T1F4153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 902KB
SHA256 65db6fb5f723fa54b4393ed4239f6dd0b2d55456518cf3fd41e063762eadc308
MD5 f4768826bed7d726ca6ab56216575155
SHA1 5a865e0db4473638bfcef83244aea04a1a957ac5
SHA512 04f395f47800edfabe7f6af53137db8f8755da1b22671974f01a10d6d1ccb613c48b52b58d6cda62b166e898dd350a1d1b5529de19f32580b0153190be51f45f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiBK:t/sCv7rTiw2RYwZCUsocuaiBK
TLSH
T1E5153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 902KB
SHA256 9e00090edea8ed8fd01451d817af7a30acd0151acd769357c87eeff96fdee905
MD5 58e024746045aff18a9a7e2c735af076
SHA1 804520e07a04edd8e82a7eaa9079ceb7efb9077b
SHA512 e2db27e00a09d5837b12778fe2dad7ccb5dbff85cc9471bb3d27962873e4843b9cc3f699cacc573373573d35159e53f393fb6c28acbd1edb0615a29f8f0fd98f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuai6k:t/sCv7rTiw2RYwZCUsocuai6k
TLSH
T1FE153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 902KB
SHA256 76347900a080b09ac11282e7e411399ba8883aa122b8245caf64417bf8b647a6
MD5 796f438ff8a1a713fd3a4a246e1f4007
SHA1 f2ac364aff4d30b38cfcfed79bbaffed75c081dc
SHA512 c67eab110525f9c97fbad55e52281dfb69763b78d8ae6961fbdbebf962f3eaf5fc572707c5b7e007103aa533ecab61ba78e2180d695d4db33e79a298dbf36be1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaif0:t/sCv7rTiw2RYwZCUsocuaif0
TLSH
T116153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 902KB
SHA256 ce7113b3757f0ea5d23176cefd65d5391f7bfc2f5b32c4780f3de3be7eeb478e
MD5 de44097dc2bb091758dddc9da99c23e8
SHA1 e5e64222db93bc205c637a011198ddbc89ee80e0
SHA512 c9c7ef352e174308123452788618eddde8109f5d36d795f6686b8a88d65b375a7d092ee2cc8c482813ba0a540c3da92bfe8ee95408dd4ceb293457d7624ce4b8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiu70:t/sCv7rTiw2RYwZCUsocuaiug
TLSH
T171153A1766EC4894E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 902KB
SHA256 6d35190d056ee29889f85530af2a380e3d3c8043ee90614e51d481feec5ece48
MD5 1374fd34d6ade5397ca306906f85da75
SHA1 9ef1b8a37d056e262f440ef776c96e83af14ffea
SHA512 5d5b6015f3a48ec8fe224c6602f6f63f87d7fa608e2eb555ea82dcc9382636ce80dfbc11fc8ac5ef02352ad3a9f18d8f5a709af8d15217759a8dd1e7853c1419
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuai3r:t/sCv7rTiw2RYwZCUsocuai3r
TLSH
T1B2153A1766EC0895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 902KB
SHA256 456df5698ce7c9b0eeffd9629d3bad7ef3537ab78cadb8a4e23878458e0ac7b3
MD5 b8fa8f2b62eb84522ad01bb007613f78
SHA1 114bb5ff0f97f71332b6e98b03c079d0269f8375
SHA512 e6e4e63a9371e60d138cfc13558a1e8148b458a34e96c888ed98793d7ed877fa8ca80e3b1b8d10e4c656c5baa4e1add88db62ed3d142e077030723792c6e1aed
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiBn:t/sCv7rTiw2RYwZCUsocuaiBn
TLSH
T1E7153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 902KB
SHA256 e79cab84493c5c5a2ff07650ed32d82a4cde5a004e241705a67349cdabc3872d
MD5 a17abf3b9530a2e14eb911d8d3a71a8b
SHA1 27d4b57c25e39ebf6ce2ab313be28c0f5c0f0016
SHA512 fc3bfcb688ec5bb4c92540c619c1eba124060d1824743db5fda8133b5d75d5329bdebe136a49d38196d763d1432a501d4b948f4f73bbd3cf607d04a70c8b6ba5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaitx:t/sCv7rTiw2RYwZCUsocuaitx
TLSH
T199153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 902KB
SHA256 6e79d30df983433a712a682c0eaf24c99706070ee0fe99f63f798cb81945e368
MD5 2aaefb8e2a43caf37493a11c76f4a4c3
SHA1 5015a361a3685c14856f49c8092635dfc4674ccd
SHA512 8e0bd50a105e3a7ef02bb1d5176a51cee4115cd96213ee327ef13aa2cd177b1abbe83cb1cf6c8ff065665519870bb454027ab3f5456b07a6f4d473d6401a700f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaizA:t/sCv7rTiw2RYwZCUsocuaizA
TLSH
T1B9153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 902KB
SHA256 4c9f7b370dc8d1653f6c63c5844b088e09c776f70ce183d70bcd378ef05bb0ef
MD5 e6d5cb7131ea03b4202c405c89bc3d1d
SHA1 44c56f9f01d09275079603762ba191f25f6f941e
SHA512 4004012f8bd5a1e08e1fad7de255bbd5e98bff6e53925225573a2e6f8126bda0bd790e2802223358278fb2e6f0a6421f81004ca2501ac5304d0192e61aa9812b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiE9Q:t/sCv7rTiw2RYwZCUsocuaiE9Q
TLSH
T172153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 902KB
SHA256 a6f0172e205fcf9cff42b6c7d07a0a845762b0739942d5ec810847b44ee4918b
MD5 cddee34c709f7c78839c565e8ad4554f
SHA1 5f2662df4ca6edeed79cf657b777a83c858c3dd8
SHA512 4971731dff0a9697a085afb5194a4391c81d7396505d273924b4b553172bb81a95c3cfda831b7dd1d94bd13c546f3fe646795d97b1c7cd227cd2cf7960477d52
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaid4:t/sCv7rTiw2RYwZCUsocuaid4
TLSH
T158153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 902KB
SHA256 b599ac23ad9db717b87b5652cccdb65f4bc0d95e76f1ff39322afef21581aeec
MD5 04ba5e0fa78a38edf3ab7abae93376a0
SHA1 886821abcb47c8e6ea4498d67ad55f21ff510d0b
SHA512 8629372fdc55149f506bfaaf70f42ec931ec699c3aac0b9632525988cc7790f3d34e4d1b2fdc4579b9ecfbca45d7989dabb34c3a5c5166bd1c5cc15cccf4334e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuai4u:t/sCv7rTiw2RYwZCUsocuai4u
TLSH
T1AA153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 902KB
SHA256 91fba9b742427f8b2f1fe8f127f5dd0fd0de4fd27371225696cf362de067ee6f
MD5 975bef09a36fe6662c8f93f36e328f91
SHA1 fc8464b27212182dc7e51b883a961bc81a6445e3
SHA512 3e115c7a9d42d278f70662246a99d97696c9f1878b881db3314d33f68b528b27936292e3eba9253d7ffe8fb103a237a0e72c2ed8657edd7f58bf8f1e0897ff09
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiZj:t/sCv7rTiw2RYwZCUsocuaiZj
TLSH
T15F153A1766EC4894E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 902KB
SHA256 0b5e4adb0b8c51f0eb87bbd24b048bc665e80691a70075387a7c9e2efabd4f58
MD5 8d82be5fd9471b98e28b83ec5b1feb21
SHA1 5569a382599e461eea813321ecc75154b5551aff
SHA512 d5f3254014c1e454e97da51d0d3d1feb86de66dc8165a619acebbaae0e47fc0e176fc6c6ee5b7bc51d657afd3c1f664064123f0fac2f03691df0b1a71b1206f3
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiAg:t/sCv7rTiw2RYwZCUsocuaiAg
TLSH
T11E153A1766EC4894E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 902KB
SHA256 35b10bd319ecd046bc51a2f9f4fa4e77dd7ba8a82ea42acc48498b59b2fdeb8d
MD5 a1e561e6e64f1cfd0695396c4c45dd5f
SHA1 913f06ad1fd5dcecbf7a212a89adc0abc0135ace
SHA512 c43ac1d7b37c9e3aa2a4bce5f99e38bdc021d0ef5ad627b24a44eaf958a932ec95b4a95c8a206c6adbe38004692868124efe96853a817c6d36b96b3184d08545
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaivI:t/sCv7rTiw2RYwZCUsocuaivI
TLSH
T1BC153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 902KB
SHA256 4c2654322a214b7acc96fdc9884a51052b8c7385807adbfef41a5b57ecbcb5f1
MD5 f33138d0c682caad8a628b223b5545d4
SHA1 196d9347f599d1082cdb00e5de6b2d24643f7ac5
SHA512 c2a698702b2e51b0677c305daae7ee9166d7b25ded7cb20a36a67b9bbf4e36995822cb6bcccbabe55ec4e711c49d9a6ee840907de1dad2f6dfc16c04f8d0a21a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiVo:t/sCv7rTiw2RYwZCUsocuaiVo
TLSH
T1E1153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 902KB
SHA256 10baefedc8f3831e5cdec4ff63f5318985b81a97f4d6bc1b55f5bf4edfdce48f
MD5 2684060e507c09076bedf54c467f1f5d
SHA1 67bb41cb19bd9401d5f8a5f50ff8ad0ad0e14a83
SHA512 5a715590363da8ca0a770b925cf2ff2d8360bd4583216f7ae9748e2affb236fe1302313c5bbcba54f2026271c9556f4ba0ba4d2eddb9756d63cdbf773b2fb17b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiG+:t/sCv7rTiw2RYwZCUsocuaiG+
TLSH
T1B1153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 902KB
SHA256 2dd24460ddf797cad2b6c3a26a9287dad36a9728e81817062918e75aca40553c
MD5 30222c047fd2f9b276895b70464f698f
SHA1 b3bb31c55d46d343200584d741801bef4c5f6186
SHA512 16b5449bc5d0a06c69a13c7ec98b5fd585d8cf051540ab92e40888eb3786368602f906008796079cf5dc05008a70e8a1f02a768fb9c06ad5fa2da07f97fff672
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiGQ:t/sCv7rTiw2RYwZCUsocuaiGQ
TLSH
T196153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 902KB
SHA256 d83b9403d528aed23515c49380774602e146b73587cf2945aa0eeb58e63887c7
MD5 be511f62fe0ced6cbcfa47cbc0450b3b
SHA1 a8b2b4e40b1b2e820fc798b3118c947be6653ad8
SHA512 6cc31d6b437816d02bb3b6e64d398849af49e18668f2fa647e7f1ffc1b9f0af486e8998712ea6e7c4b19b9caa6417bc0999f60e9205f9346947afc25d661c557
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiXX:t/sCv7rTiw2RYwZCUsocuaiXX
TLSH
T136153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 902KB
SHA256 6e62f28a90d68b14bb5809b280c50824db9eaa5f914a3f519fa301054479457a
MD5 c1683001a7a6159672493ecd18d1d30a
SHA1 5bb36a57caa5a11d2842f0ebfc6f27a44e8fc435
SHA512 2b263750eb589d6927c9df569b82132cb9c66b459165852c8d3e8970182b4ee8c3b4efa0823a1bf32afc553c78823b8d9aac0db98bd1bdbe076e9e303c4b481c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiNL:t/sCv7rTiw2RYwZCUsocuaiNL
TLSH
T188153A1766EC4894E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 902KB
SHA256 ae4cdf41c4f54c1877c26083b80c5249e4c95e90d8d3090f53de8ae763c72a3d
MD5 a77b0eb7be68f4e0a0f410f4a55050f5
SHA1 31360246c13aebba0608428908db85297c5f9c22
SHA512 5fb9883a6c5eb1e0828ef054029e2e943030a3641321e4e47001a185229e6c9b823a1c60ef643b9e89ea72a2d58dd77acb5807d5de1befba8f305280384e8983
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiLFC:t/sCv7rTiw2RYwZCUsocuaiLM
TLSH
T11E153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 902KB
SHA256 42a4bd6b769663e6e9205c535b603ea3437ef30c6adbb5879426f2f424611ae1
MD5 c91bed2777c16a6020d075d90286df52
SHA1 da7e6420ce0254f46eea4ad123ae6164923db844
SHA512 a6206983990587af3c8c238b7c8e8993f29d3a419cf15ed90742e65b7cd1fed0ddaacfd5de3ef1ba2f2f2aedbd1e15db4129e6db5d99b194f04952b86545be30
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaiMh:t/sCv7rTiw2RYwZCUsocuaiMh
TLSH
T162153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4920-71-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4936-46-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4936-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads