7b4dbf88084ea5719a7fbc0973d3ac81c42feed2dbc5b7c070c4aa1101e09223

Analysis

max time kernel
99s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 879KB
Sample260719-t7kbasex5l
SHA256 7b4dbf88084ea5719a7fbc0973d3ac81c42feed2dbc5b7c070c4aa1101e09223
MD5 ace3fb6a0fcc643eaf619685154d9820
SHA1 5f74e996bcd0379d74cbcae75c8f80203688985e
SHA512 7459ab5a6430db8e5c1de954c0e7e59e1d9c5cbc61ce325da27864a978918b6431b778a810ac93fd7057654206b4b04a091cdc33181645fe8df63302658ae445
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEF:t/sCv7rTiw2RYwZCUsocuaEF
TLSH
T16C152A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2560-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c52a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2560-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1336-22-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-436.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-534.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-607.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-638.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-842.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-867.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-981.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1018.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1051.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1094.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1137.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1168.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1353.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c52a-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-436.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-534.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-607.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-638.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-842.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-867.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-925.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-981.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1018.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1051.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1094.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1137.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1168.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1175.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1182.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1321.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1334.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1353.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1373.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1381.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1336	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2560	2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1336	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_ace3fb6a0fcc643eaf619685154d9820_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2560

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 879KB
SHA256 7b4dbf88084ea5719a7fbc0973d3ac81c42feed2dbc5b7c070c4aa1101e09223
MD5 ace3fb6a0fcc643eaf619685154d9820
SHA1 5f74e996bcd0379d74cbcae75c8f80203688985e
SHA512 7459ab5a6430db8e5c1de954c0e7e59e1d9c5cbc61ce325da27864a978918b6431b778a810ac93fd7057654206b4b04a091cdc33181645fe8df63302658ae445
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEF:t/sCv7rTiw2RYwZCUsocuaEF
TLSH
T16C152A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 3a1105b8ba107b609ad365c162456e369d17841afc04aeff9ca706f4610612e0
MD5 80ac0dc6985a80bc87ce3e0f053b6e92
SHA1 9bd38ded8df1e38aad6ca3aba6cfad22ab613d25
SHA512 63c0b23b379642205e5d620ca7d5ab14479b4f47cc0ff20baf2cb1c960dbc4dd47a92b6a200c731834d079911f1c5c2fa5016782b541ac1a1d7db1cb4757023d
SSDEEP 24576:t/sCv7rTiw2RYwZCUsocuaEB0Le5ji0hmxNrM:x7iw2bPji0Aj
TLSH
T191653917B6A84661E073D174C5E6864AEA72B4461B3087CF12A8C73C2F63BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 893KB
SHA256 d626489f77fac0cd0fbd10fd7730f0513a30e66a10f6aac72f3e99c7e0bee36f
MD5 31ba302f3a4d0282b51892f028895238
SHA1 884d75738057737795fe107c11acf4b7e682e983
SHA512 c466e1ffb9add75d38786c92e7484217b8f1ef567129e9488c53b3a54fd21c4c8707f7718b860ca682b4e8626b9832cebd864515eae4f7433346fae078e93dfa
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEDa:t/sCv7rTiw2RYwZCUsocuaEDa
TLSH
T13015291766EC4894E5A6613489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 902KB
SHA256 68ebe4d79ddcd8194209f90042970cab8659ef46fa8a1ade8a3f718f7d64b51c
MD5 d78b24ff41d88be1ffadae749ace0416
SHA1 cfcbca3ac670f680032eb7a27559da6a65e90cbe
SHA512 04dd52596902fe39157fcb833a6e284f735bc155d103ff213969079098b81c3abcfdcce1f8ef3ca6b9ed32db42948c9ae43ca667c181702cb7b648a44f166e3d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEi6:t/sCv7rTiw2RYwZCUsocuaEi6
TLSH
T1E9153A1766EC0895E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 902KB
SHA256 27ba8d8a491bf0b36b31ff68713f7c7bf61e0ba18438b9828c39fe691657d653
MD5 3c31cd23c356c9dcb56e527e50e4c793
SHA1 61ba9712ab3382579b713176ac23b6500218f9e3
SHA512 b94c4076b1661e2a057a68ff3fd39ecee9b1e7e2e2cffcc736c0987dcdba0767339e8d8b90e87e501f20e90d85fab1ac8f5d130445e41a2b65971e2c4da76fb6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaE6N:t/sCv7rTiw2RYwZCUsocuaE6N
TLSH
T148153A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 902KB
SHA256 509a690ddcda8b2604abe971ffc9fa7b58c273cc6dfecd1d0d4fb2167e31ba41
MD5 45b5a5a9ac9e3e5246f14c91273f7253
SHA1 e14f70438ab54d259e569416035d35cf016ae568
SHA512 efd498b091cd277a4fc77b8df70bb95ed6bb95564cabef77736d621085276beac1c27714655a942a60c09bfc45ae33203f94afe0e94373702cf3ffe75dca0e54
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEgf:t/sCv7rTiw2RYwZCUsocuaEgf
TLSH
T128153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 902KB
SHA256 e65381e4080088491cce452dee9000721b3b2b18af4b1e1b6c1153fa6d0b2bf5
MD5 dd82f1c21bcf2d4daf1e22913bd71225
SHA1 d665a2d26d13bebb631ef30d57f55f86358cf0ad
SHA512 f78b8d5aee60383bcf0894f2f109b734bbe3775e9d18dc11647e39f02a4e0f4be942d4bbeeb29b5c14b3dc4b4a160319f7fe57c822a92c808530ec5f3becd838
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaE6o:t/sCv7rTiw2RYwZCUsocuaE6o
TLSH
T1BD153A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 902KB
SHA256 ab33f38d616cf931f6c9b2b21867595302924ac170a1f63399017ab102c83653
MD5 687a86f17eb592648053e7b5b2f693ea
SHA1 0870a2c567e04bf5069263b09bbef222f87b2417
SHA512 c39bec7df9dc3c4e0efc416fe094b259df06ebd9837a73f772e05c491b2d5646077dd450caccb55e0938e03a45da5f4f7ac8988dfc046371e77e74585513e7a8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEOu:t/sCv7rTiw2RYwZCUsocuaEOu
TLSH
T1B5153A1766EC0895E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 902KB
SHA256 082f86a0aecb499d10c221c4f43cf7aa9743055e064e5dbb03093c157396ca5c
MD5 f724cad80e9affdb2fcfe837e167ec74
SHA1 851cddb612d13093e515fac029c33ab5dcb66bb0
SHA512 e5faa67cece8a5e3dbef5e87b4c05d986b83fc1136194bf669099483830021fb1bc35109bf787ddef578c6188b6c1b951771c5c72ab86e493c2419b804d59a40
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEC9:t/sCv7rTiw2RYwZCUsocuaEC9
TLSH
T1B0153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 902KB
SHA256 0a48df98da161fd2d17590c419df51c8dfaf270b7700c656106d08f9de7d8825
MD5 0bd5b9990cdeaeb0d6be441487a93ce7
SHA1 319a1d914065294ebdc43f81fd4d483863f535b8
SHA512 e01b23bbaf36ba2c2427d4f27e4350072d0136688acb07c061c208039afa1cc91ddfc7b62bcb4d8a21917ca3e18b19d5ce6000439686afc220f911abe58a1b49
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaECc:t/sCv7rTiw2RYwZCUsocuaECc
TLSH
T102153A1766EC0895E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 902KB
SHA256 6169688bcf8a567ca73aaee91f01709206510a4af39d17fcf8afa9313f4d6857
MD5 83da734433332cd5e012f0fce748143b
SHA1 6455df74c7559b86a399f4cb425e4fabbd01b1ce
SHA512 d6015305d6bf601654b8bf76ad2d5ca11615f1b9e785a5e83b1a0c3ced9113bd41c7bdd27b40b7016182e265f4d013c46bde706fc1652f0bb300c71a6f21d8e2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaELp:t/sCv7rTiw2RYwZCUsocuaELp
TLSH
T15B153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 902KB
SHA256 e28ade660ed4e4fad26d5b3a75c1d5eb53afe666c5b1ebdc81b906c7888209c8
MD5 e80aad8b4e84661e801174f4693a4352
SHA1 58af49f2e9d4faf2214cd09c322cecff6f862dac
SHA512 8df0dc147f3384effdd9dc9521725d91304c46444432918cc923cc677ff16e5c4dcfe7e05434b5e4b8ef0873127e8910aae1db984a01c03f446ac2b463a89d3a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEc0a:t/sCv7rTiw2RYwZCUsocuaEcN
TLSH
T163153A1766EC0894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 902KB
SHA256 2350242dec773b498b20abda3e853174373a668061b357abdafe5f4d11a9b794
MD5 721b04dc01b097123b0c8936e3fe1d3c
SHA1 2720c690b5eb6e78768872f2035da97ba718b452
SHA512 3a5f59c056ea936e34ec6ba1af55c9eda4058c6cb6b173bfa9491f7778af01fff2b4eb7a17f0435439cde848bb25aa71e2b095fed647dad57dfb8cc471e3033e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEEF:t/sCv7rTiw2RYwZCUsocuaEEF
TLSH
T141153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 902KB
SHA256 15c30a61facea296d830d4505a0f6c33ae35724d2c1e6089d349c03a8c022eeb
MD5 217bdaf6048f65a7b6bfcf121a3bf021
SHA1 32b9fa7f46d14d1f1758dc861dc01d9878292c13
SHA512 d92fcb8b7ce253d19551f3cb97f6b1ced8a7bd72e48f91bccdc58fe778a9a0e978954f77405592e3bda0176b3bf5ac494cecdf7da9c0698895eeabe2c992f143
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEhC:t/sCv7rTiw2RYwZCUsocuaEhC
TLSH
T14D153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 902KB
SHA256 a8c3252585ba50f53cae03ffb1e7bd64bdb3f7ea390a22758c65c7022f08b2e7
MD5 b7bd4170407812a8b386943b309c1357
SHA1 10c5d099d4cd4add2fc79a36bd4148dd7fba46ff
SHA512 f5021893b2d7329e3bbb8d1f247f45b7162bc698a147b16ff2704fc4bd0b78396d940ba572916b5e2293ae7f030274b7271b1e7cc5afe0b118f47dd5a3d8db25
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEiw:t/sCv7rTiw2RYwZCUsocuaEiw
TLSH
T10D153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 902KB
SHA256 b1a9abffd05c7def57156699fb1f58167f66d93bc42b369a1984eda6e705cde1
MD5 9234f6742723cee23496d76c1735c726
SHA1 3575a0e95a4a7799b65fd054c616e36b95fdde19
SHA512 01aab820ca3a74d19bdc41c4db4c76c6abdfa2782b66446bc97dc6f346504ccec05497570c03d188f1c30ebac345a80e462695a5b621a0d87b72bac4cf04f255
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEpT:t/sCv7rTiw2RYwZCUsocuaEpT
TLSH
T148153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 902KB
SHA256 cc2cf3f15785d8dbe11d8daf15d84aa55bc479d5318927794a17d182c354e324
MD5 102fb57bf17d1bf641395b6cfa29ab37
SHA1 64b24d5974dfc165ae3289e51e620d14ce5f1cfa
SHA512 3e350f843f5eff4b3ab1f40405b2007451d5aa8b87a8f37e941aa5f9ea0b7ce4efcb2b7febf84955d086791401e5046e192dc24b13c77da2b8dbae707483871b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEHu:t/sCv7rTiw2RYwZCUsocuaEHu
TLSH
T1F5153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 902KB
SHA256 8d9300088deac0e4a3750e4c184c564509845ee93530b503ac6a0c7039b2bc42
MD5 90ecaa63efd26977e6e9b38e896fc483
SHA1 74760a61b65a8248b5b42a1cf2eaa761c11add0c
SHA512 2b3206c19559e5e7ab5b7f07d03232c07283b96fcc1f446bbf16f0f8fb8bb763384466d3814beacee5c791a6ffd0d2135e4c65133f9c3f4d33d582a956d064bb
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEbb:t/sCv7rTiw2RYwZCUsocuaEbb
TLSH
T1B7153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 902KB
SHA256 dd2f866ca3410be21b66bf45414c4b15240f0d2465ff5f64dd4cd00f7206f83e
MD5 f1064ab490d1c366a6079670ce3461a2
SHA1 3822a97e8d322afe418b1163a51b9b99fe20cd68
SHA512 85346b959dfae7568e51eb4f26c070f4b2f8c47567f6035cfbc5320bd34c90853ca943c2f7752008da1b616b871a4b5ce15a09540c8c81e5d05978d8c491cef8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEvf:t/sCv7rTiw2RYwZCUsocuaEvf
TLSH
T1A6153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 902KB
SHA256 51342354c8e04eee7d736fa0074bb6c33cf1a93d4a5eaab8690d7c600b98e946
MD5 159bf0a9e6a40bf9a07e221d0779c2f5
SHA1 438120fe442d373d239eccdf6014131fe591b370
SHA512 d1aa137bdf43a0a6a9f558c31415e7998265605d3544e63f0344704baf246a869119f0430c77d8bc68608be438bd4f55bfe5fd57aa4d6086863f8b08a50d31b3
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaE4K:t/sCv7rTiw2RYwZCUsocuaE4K
TLSH
T193153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 902KB
SHA256 98d11a4fbfd7390161ca76e7557bc423657ac401e051549ab87e555fd1f98138
MD5 a1ce043bc516332f3bcb3eb2c2b121e9
SHA1 46b13aaaa4bd3c89fc76db432721ed91a6bb7a5f
SHA512 29fa205b37ee615911d3fde9bae00b53b69a2a12df360d48cbf06900ba12a606d20848e0affbf5b4af8a2b3d32861c6300a55e55e845904612e20834930d3c42
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaElk:t/sCv7rTiw2RYwZCUsocuaElk
TLSH
T1A7153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 902KB
SHA256 098508b5097c483cdaae32c68058222c8d1d198ed31318277d3cf228389f5488
MD5 6e31903ccdda9bef84eca45239347684
SHA1 42f5ed69205f07e3fee00e5b889d22093862fa14
SHA512 7879e0062ead47c06a6822e212ab225580f24455efba881a757189f36ee11bab4be03c17e2d58be6ae5f744d7bab073b5694d117ed0e40ee40dfb76043051262
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaE60:t/sCv7rTiw2RYwZCUsocuaE60
TLSH
T1B8153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 902KB
SHA256 4dd28ef5f4c2831ec16dc1caf03df70d835c1a01cabedcb040c38b27dc7b3507
MD5 65884027e376f28e0c3942e725969c50
SHA1 136729a2c6072052dc295e87ce5b19c72f7299be
SHA512 7906f3ee3b3ca4b9e0988afd4d8b237bf3d63ea548f57ff7e4b4b38bc3451f2067be76c2c90aaaec13782ddb4dd1c8b359c63a7037a8bc15e61e21f041ad1b79
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEp70:t/sCv7rTiw2RYwZCUsocuaEpg
TLSH
T1E6153A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 902KB
SHA256 3a31e07e921d7345333c2f21944b05aaeab9142bebedb2ff071722456977612e
MD5 a4023ad5cacbf48903860a0a77a589bc
SHA1 14337f5c694de7c019713f8685aea9117194bc00
SHA512 5a059b212bbc7e0ea8273cce8dbde30dfabca7171b6c400d7e6a83bcf16aa2c750bfc99f9eb4c66d7f3676842aa8f2265ae0ede053ba7a3fdcd64523f5b2f6df
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEQr:t/sCv7rTiw2RYwZCUsocuaEQr
TLSH
T13F153A1766EC0894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 902KB
SHA256 c843a16677b0c2e748d2ab612ade6541f66eb5df18fa5c822414edaf3d210505
MD5 5ab66803c50b0f53109052aff62c8c87
SHA1 7cab08cb2ef0ad1bc9c26099bf7682d39a8f1c05
SHA512 a6f667b08e7cf5048f440ba947a63335889158f1babc8147b9ac516be523e1cf75231d790da1a8d4bef0cbe3bae40d9d7f2ab0f91a2414159e36b6d6ff4aedf5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEOn:t/sCv7rTiw2RYwZCUsocuaEOn
TLSH
T186153A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 902KB
SHA256 24f8a45fe8dd0df45fa306fa6b0cf67e9550f01540378aab77c2e2071fd6bed9
MD5 4ea2d1a748bd8c937a155bbc59e634f3
SHA1 e3727b39026e84590fdcb355f9649ac91ded26f9
SHA512 4e20192eb73fa1ece0b6149eaf975231c9c545eaa71d06f2f1910cc38e775b71e0deb2c0633d049e947016693cfe269a43bf7c980295d026ccf8883025b2fdcc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEEx:t/sCv7rTiw2RYwZCUsocuaEEx
TLSH
T188153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 902KB
SHA256 96e09834fac3a741c56f6279d364ccfcb5b0704c11e66e8b608c0f52a662b85b
MD5 b18374e660dbf08c1f9c08dd2c7b59ac
SHA1 24f8114dd60705281a1af16bf14d9728be349798
SHA512 8afbd94b4ce46da194cb323cf82916e162ed5fbf99d7e6422da5b60d4d0eaea61dc1827dc18672085c3c06a2cdccce7831ffee1abb6a233783d5e91f54d0eb02
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEOA:t/sCv7rTiw2RYwZCUsocuaEOA
TLSH
T122153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 902KB
SHA256 cb5be8753df6d008766cdf154451cefa9d1896c1dccf8482df12aa89774db2e9
MD5 2fc04db69d9fe31def6ee19b1bb5fb8b
SHA1 69ce182d8a888b9f3b3fec2d44e47a160d62432d
SHA512 b17742a896a300251d14ae20e30fe0631e76a0a51c9f40ef468f0fec9d9768c0dc715a21f4607e083c9bcf9d4f1f4fd9f19487e5de121687c37c1f52973f9f85
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEH9Q:t/sCv7rTiw2RYwZCUsocuaEH9Q
TLSH
T179153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 902KB
SHA256 2d30e7f3fb88e6b0817c9a1f140cba07964b7b9b379e1387f7be85912ecf55cd
MD5 f0ce88cce1edbb2a9f40a0d94b3f5542
SHA1 1ee08ac3ce5575761eaa0b394fb7eb4cbcd33765
SHA512 5427c57b0bcfb4ba62ec3b02782d4f782eafbccf1c942a43ce12bff714de0ee8f55774574a0b69e94b9fb492ca4eb711f556a9ff24388cc75c180b91865e6399
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEO4:t/sCv7rTiw2RYwZCUsocuaEO4
TLSH
T120153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 902KB
SHA256 ff5a6d394f27d6573ff8e9906b28f789256de52fb2edddb87ed57b628b9a133d
MD5 34c5e607a07e6d3660745f08e850ace5
SHA1 6bfcecebcf2b41912fd2f6c94e31d01dcbafddff
SHA512 9dea8536cc761352d666d12ff0502289a9db5c290fc62cd9b75545d8e5f366ec8325508331f915d6c65bb6c20b51195c8559a9b3a869f48278e91f4b0d345e33
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEtu:t/sCv7rTiw2RYwZCUsocuaEtu
TLSH
T1F4153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 902KB
SHA256 ab59a75e71725d483e64e6f97cbc3414a124a7395923ef4d8fdebd8370677d28
MD5 a2b18985f2cd657000888ca7f36ba32e
SHA1 e03404b97e00ef011b328bb239a6c269118f7dca
SHA512 4e9d8abd13393e38508be1965abee08ffb7143513e6c7a2a6c5d66e646a8e87db06befd1b94160cb3bca666af86461d95d9034acd97a35b0dcc2afa28ad60751
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEgj:t/sCv7rTiw2RYwZCUsocuaEgj
TLSH
T106153A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 902KB
SHA256 86b33a823e974848ded753475f290d83a3c874554fda431df36a3138c68b8442
MD5 10289bf7a83e67b896fa6ee2693152a3
SHA1 16cf5d9264a2fdba2449a4df47768e3db6c9dcf7
SHA512 3b5095233e44a7d97c7064be1c43034ff1c72cd18b578b2bbcbafbad854bd3c772c2a54018a7ce36bf1ce51f3ba9352a17fe8ee93925380c4ba636f84a50b8f2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaERg:t/sCv7rTiw2RYwZCUsocuaERg
TLSH
T123153A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 902KB
SHA256 8362b6fb69bb4017b6d452786724c2b840b8413d4bb4358b9109eeab8da0af8a
MD5 048e632eeb675e41445c384f56b44f7f
SHA1 a179cb7916fc21616a121928cd3a1b436075cc88
SHA512 a0afd7551131313e58137792d12a7d3a7f9764c8de51db6fe1e4e96e5da4c1c6fbeca3478fbec876cf657b8166de43166c1a093aa35899284cdfdd0311527195
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEII:t/sCv7rTiw2RYwZCUsocuaEII
TLSH
T126153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 902KB
SHA256 4bac1de83cc4e2a2fd9b9ca3c613ec62446d3d5e945a136095238e814c427c6b
MD5 af6dd52f35b8e8c51de26e3e7d62baf2
SHA1 558359d835a5ec5c02f5fc39ab59a307d3c103e5
SHA512 f0077bc076b418f93d12561998819335497f7976c3c4655f34edaa5b3664d64b838f9ce237895c3492968f76a18db00e3a42ac605aa1c6ea309137693f25243e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEqo:t/sCv7rTiw2RYwZCUsocuaEqo
TLSH
T197153A1766EC0895E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 902KB
SHA256 c4d182b520350a57f5be7dd61c2e56c3e087792772f23fa4aa73c45ce57515ab
MD5 6d16fa31a7fa3d46061c0dbe4edcdd68
SHA1 991e96fa0f34fa9d2b8e60a87ced031f54e78b5d
SHA512 adb3762f747bd5c81ca0a3d307148989d329a16859d38c93ea32e08b3ee9ff09d330577163638f14323fcc225031f439158e3efa31c79aac6e819c718c47da4a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEB+:t/sCv7rTiw2RYwZCUsocuaEB+
TLSH
T109153A1766EC0895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 902KB
SHA256 f5afa60a10abcfa29fa523256c55720aa8c15cbab62ac55435fc4d4216052436
MD5 c7f074a04adb05be5dd10528736c3e04
SHA1 170fb567bb9e2beabf69fff65f267c4b00588398
SHA512 1b02fb312023073215373def5cc8379ab2311765d4eef06a084e44c425f16f90b8088f05ea45818fb40e964ff65ea02fab39b58afe10db681d7c4ade9628faad
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEPQ:t/sCv7rTiw2RYwZCUsocuaEPQ
TLSH
T1C5153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 902KB
SHA256 03898fa68f2cb37a38d37a73edc7d44174c070e21d8fca5028d7518bdcc2a8f4
MD5 b89f314ce439651ad0281719fbc1fb21
SHA1 bc03d32ec4545a2caded2c7fa695f641d9c360d3
SHA512 0cf230a914356250e475e343b8cea1dff93b19f74eec6bde91b8c531ed2d916ffc0787f33bd23237f2cf2373fbf09102c74980e09c400a8771ace4d15f52db8c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEUX:t/sCv7rTiw2RYwZCUsocuaEUX
TLSH
T1C4153A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 902KB
SHA256 e3b9b89f7d35f34d035c6bb7a971e68a6ddeb8a734ee15d88d2668f1b66343e8
MD5 bf17ecab5db0d56b12c62f5becc63316
SHA1 9c56aa9914054976d81a53bef258376530aeea90
SHA512 cf744faf68176605af202eaf385c074be20ffd92756b99b54c1a5575cde7f4bf65c25bd46b048682c87d3c8ebf11f005802bf7bccd5b1f6ace988e7e0463193d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEyL:t/sCv7rTiw2RYwZCUsocuaEyL
TLSH
T157153A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 902KB
SHA256 ff86415760d0beb76c0a409e26fb3c7f218a446fed3983949e2558b6594b1333
MD5 2470270f92e59517d78159a10c2c4403
SHA1 921b69a6399ea7a1c2a641dc6985f7cbfd141d05
SHA512 1c659621aaf310fbbaf2257c8b8745fbdd4293c9cd797d3cd9f8cd009178f364aa69aa04945c0762f1a7aacf03320f0129fb3652102b866c1010d14db9826c6f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEWFC:t/sCv7rTiw2RYwZCUsocuaEWM
TLSH
T184153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 902KB
SHA256 e73670f89370711cc91d88cd854eacb5986ba931fbf74b722881ae910e6cf83c
MD5 5f7e55951521637a947df4327634bcf9
SHA1 96ebf79cc9b536c30a34e756329aa6040420061b
SHA512 fd8e13b553f515c5499f0f87485b1d24d740728e8ba2c1927f7e9fc6d77a4cd010efec923aad895ab992e200073c46210847954606547fea6a1f684764d9726e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuaEfh:t/sCv7rTiw2RYwZCUsocuaEfh
TLSH
T1F9153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1336-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2560-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2560-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads