3f57515d5c71e6ce825580f48ebf488249bbd36c0abfc97158e84ff5398dc39c

Analysis

max time kernel
102s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 915KB
Sample260720-nmdecsay2v
SHA256 3f57515d5c71e6ce825580f48ebf488249bbd36c0abfc97158e84ff5398dc39c
MD5 8b339d808dc8f94a08fa0f274eb92ca4
SHA1 5abcef83b7194f44966d00e6b92ce4f518a7403e
SHA512 6d8904e6aa8b511ea7ca5a9fec15306a4b92e55184b2bad3eae23c487dc4bf2fab3956674d50964e20d8fe79145c50172e7254c69680df7fb7aa537ad48c7ad4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYa:A3k03kB56r
TLSH
T1EC157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5112-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c511-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5112-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3872-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-419.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b000000018a56-522.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-607.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-793.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-842.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-867.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-999.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1124.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c511-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-419.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-491.dat	aspack_v212_v242
behavioral2/files/0x000b000000018a56-522.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-607.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-793.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-842.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-867.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-999.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1042.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1062.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1124.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1381.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3872	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5112	2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3872	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_8b339d808dc8f94a08fa0f274eb92ca4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5112

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 915KB
SHA256 3f57515d5c71e6ce825580f48ebf488249bbd36c0abfc97158e84ff5398dc39c
MD5 8b339d808dc8f94a08fa0f274eb92ca4
SHA1 5abcef83b7194f44966d00e6b92ce4f518a7403e
SHA512 6d8904e6aa8b511ea7ca5a9fec15306a4b92e55184b2bad3eae23c487dc4bf2fab3956674d50964e20d8fe79145c50172e7254c69680df7fb7aa537ad48c7ad4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYa:A3k03kB56r
TLSH
T1EC157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 b981f8cb88d11d44b1f26458d4075b3d21ca4870fd37e50093da9440d57dfbbf
MD5 6a720cb5fc7af3b8f232df33c4d9388a
SHA1 3f0a02dfe922b21380302a29b28559b8e59b9a09
SHA512 9b524adbfdd666dbcea05cec6e6657b515999676b618088d47d4f630f63d93e6f31455b0223cdef58bac77d6cd9916c656a0fd9eb9627aa49bb28f111f5ac4ec
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaP0Le5ji0hmxNrM:A3k03kB56rFPji0Aj
TLSH
T1B7655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 929KB
SHA256 25761a5dd12d35be566436c386ad0aa269d2baddf68ec48e0acb39757c051ccd
MD5 13512e85155033cf1528ee1a4acdac5c
SHA1 f58a7d1a737ea1184b5eaf7ed413b22e1231311b
SHA512 b6e3e81f78373501a4d13d82111f571824be5c56f11231cc88c185f44cf632f9c3f553954c2cad34a72b25d33035b58ec0dcf1a1c68be64f0bebcaf33f34fd12
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaRa:A3k03kB56r
TLSH
T1A5157B13E6840FA5D10F81749A964662EA737C025F6093DF2358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 938KB
SHA256 9d3370e534bff096fb1f54bae9c339b542b67da101ac0243c86c1c065f32679a
MD5 8b44f7dfcab573b562cbf13e8a6a6889
SHA1 1f3053ad7ff1bea8d191643ae46345a7eb9b5367
SHA512 ca8d7dc6250d72ba50d63d4c0a4b46284b1bdfed8c39fd1e3dbc247ef64b114859117cf298c66bd5b28395b84c0a101178d99616da3d9e4fb1b104b6da194b5c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYao6:A3k03kB56rB
TLSH
T165157B13E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 938KB
SHA256 abbb9ec4e08e48fce1cdfaa7874b1a087788db2743b79b0fdabbb9457161c9d6
MD5 41ddd48f3b100f7a9bf6834c5e199d87
SHA1 0cc665551c3084f7dd27aa8d52fac038b5ccb022
SHA512 e08f44d7ae6e06a58541feac08f901b5f35764e294bb9afe40d2d07967e5db6f52b303b6658774647fd2c74e0386a52729f0b38182c23ee73155875dbf55f76c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYasN:A3k03kB56rY
TLSH
T164157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 938KB
SHA256 d96420828e9a06caced4ae7e01383d7fd6ff59dade161d9ddf4fb45b232b9823
MD5 45c4bf0c739c2fe310ca86eb1ee6d50f
SHA1 15b2b26abb77d55155207ed03305c9eb690b9282
SHA512 a3a1a7fc12da345021899757d4b6c5972ceeaed9028b2bd2624e9fcb824db354052198c4a3cb07e454ceddb0a09f38f00e594ccf313cf05a8957ba417baed11e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaif:A3k03kB56rQ
TLSH
T160157B03E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 938KB
SHA256 b8c031deed728c462f2fd81a5b972113244c7670546998dd10716e2ab2725ff7
MD5 6083ed802a490ca3b4c3a462e513ad1e
SHA1 75f19ba86f42a1d43f6c09001be2f7f38fc85f1d
SHA512 87eb6c6bfc0a86866717128e2044e5ebfbbd0ff16b5ebb7e4336c9977ecfd636a9b9547939d1dccb301ca179463846e0676fbd2eb95a1c3d644ce89279bb7d18
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYa8o:A3k03kB56rd
TLSH
T11F157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 938KB
SHA256 82d0cd3c9a66a4abbb5187655793d3eb5c6c0e2ef93892479d968027f0d84e31
MD5 0d9c57a6a15461c84aba1329ff865958
SHA1 da8f53ad5fbb12ab2c2af379ffce084d767c55ff
SHA512 ca022e8661ff2de57551ec056b1bd0f763b44e2dc6d7bce45f40e44374290384d873b4812c197353c4f446d08be44f126a0d60069f7455199bdda598cae3141a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYacu:A3k03kB56rv
TLSH
T113157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 938KB
SHA256 2854d78290b9b0ad6afcf2c50221571a7e62fd3c444dc6b6722a6646bd66d558
MD5 fb96c4c9dd27fbe1ccd74728a5873726
SHA1 99e64796fedcd05461db05ff28ed47fbbbc43274
SHA512 8f30592e79c2c7ccb14b14f51bd12b741bc848eff2d7c2bd5c6d6c9662b6dd8390cf89d5aae14fba3d91e37de0a1ec755739c5392c9c8e2537f1aab3ae54953e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYag9:A3k03kB56rO
TLSH
T1B8157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 938KB
SHA256 931c01f344841fbe4c450a8fbf7d7f3698713bfcf366030d03895dbb1095b506
MD5 1ac5479739a56389f4ae5d6d3dc4d02e
SHA1 69cdedad9913770dcafc51cabeced4aaacc71934
SHA512 e77afa80ae1ceaf58be18b325cc26af0619bc455c5cbfa3161253e36e146f6f478bfd09d08dbc5c3ebf6afa5d780409ed084e32aa18e9eb73eca3b898bf2744e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaoc:A3k03kB56rj
TLSH
T16E157B13E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 938KB
SHA256 d9da0d9b4e5aa92a4962ac8b98a0ca662873b4568ca1e749cc5a2cb39363f66b
MD5 118d33224a927065b50966606d278f78
SHA1 5ffb2726a33672a9069c6ad9dc2d934c756c0659
SHA512 875ef71b9758337884c6b110c52549c1c3177ec9b0deba5e69c6b6b9c836cd9a95e6b40ec38c375a62ad2622acc34c7412d5c76405b0ebfe03dfb79c0ebf38c2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaBp:A3k03kB56rh
TLSH
T1AF157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 938KB
SHA256 047afca0fef571451cedb559b9d93ac575228134df23272965b136fe000fd285
MD5 c2e67230854671262f884f86f3480f63
SHA1 edaae807fdcd452ccc4ef19b9f95c88360e08a36
SHA512 d8444d026f7fb8c4cbd61a3ae87b0e1be0855d7c152d675866c531f72606eb3bb4351547864feed859ab866e212cbaaeee3f47bedb8698c37ec90fbcfd7e0497
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaWN:A3k03kB56r6
TLSH
T1D2157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 938KB
SHA256 28cc0673007169fe7b6db8e46d5eac7ebae4776a3ccc3793cd6e4e5650fb492a
MD5 8145d46f63ff595bf2f40b3d823aab08
SHA1 2ac99c903a49c371342d0b17ff929bde71d33d98
SHA512 d12265cbcb6e2cf5fcfdc55388cc14818874b671cc06544ad72aa8cf608e30f377ba7a51ea6e8dd1368224c265742ed49da3ab1fd433af1b644281e59bcc17a6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaaF:A3k03kB56rA
TLSH
T188157B13E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 938KB
SHA256 73337f0ae4bcc7aa8f4e6bb8cc07747542089f5cc1c7d1346ac791cb832104b8
MD5 72f46e664be4214322c19361497392f3
SHA1 c7aa0a3beca78551d59394b741b114930b8479e4
SHA512 ebb6cefa7e6bb289557bc6234623f5a689b1749b76de1a4907d6defa8b3a56e1f0e867d206e48bb948b272285a922505b0ec6011b58cfe855b0b6273eb0f18e1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYavC:A3k03kB56rU
TLSH
T19F157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 938KB
SHA256 9d0395cbdda8d6fca84b2287d74f9bcc767461af88fef219ad90f1293a3580c0
MD5 47f97d2b71411b4b231380ae997e9f12
SHA1 423b61caaf12449e85500db9014156def1b25fa8
SHA512 f655cf1aff0bed530d437ddac1bb18462f195686573e1400d091f9198f30ba3576455d829071ecaf000db661482c602be7b3e0475eed9e80aa5b75bdfe42942f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaQw:A3k03kB56rp
TLSH
T1D2157B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BD06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 938KB
SHA256 4e2adc1d10fc29cf9babfa7f6b4fcec6be65a8d89d0fd6e34b2805c11094a735
MD5 b3a54375fc0654bc49c96136e7f85d23
SHA1 1e4fee6f494b66fba19d4d5fd3d9f9dd5928979b
SHA512 37ae825487fa36b710fa3b91c8e2c2a31dbc22107668711e86bb30b437b82febadf502f0eacf385b9b4bdbf4e9861cc150877190d42a4ec8fafa269435a2fd5c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYavT:A3k03kB56rd
TLSH
T123157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 938KB
SHA256 5d78ef0efcc67cd6852db87e21eb966f9bb52338e8c8fdad7177025b484f3fde
MD5 4ac1a708c1c7ebf099d902cdba7b7a0a
SHA1 ccd425dfb114f9c0044222b85ffe857265ab3b1a
SHA512 8d67959ff822d1f0faeb4ce85e9e4fa4d0cff289e21186af35a477583ab167e9ee85ad9583aa3fa86d21c4b4b8d1bc5e0b0637e8f63b6a97a06bc61abcfa5ab4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYapu:A3k03kB56ri
TLSH
T1E2157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 938KB
SHA256 79404f553dc5a55a469fc6c089618dc211e904e394c30c1f66539fc499de7777
MD5 9aaa8ef13f3311ded5d992bef7b81ea2
SHA1 b1e61cbb7f061abe77969edfd480cea38dba1ea9
SHA512 5c1f048d5762b637b252539569402aaa92513394d5fc698ba77c71de1d3fe69d63bd46ecf3c7f0c4423d6ef9f3d681beba8d1d57d93ecfdb0410bc168f3ea351
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYahb:A3k03kB56rT
TLSH
T17D157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 938KB
SHA256 5e9682e45e474da16dc2f344a24821b93fc137e0cf0f97bbd0274c3fc678829c
MD5 c2a157a7d448a327f57d05118d9c931e
SHA1 8142f69b64b11e0535b79af223313fe5def9c278
SHA512 be5c5378ef7a57a1a8a346ecbddab5da9af85af3d553a6d032736d97d0997315b9681f45846e45ab4b2ca027f0730fc2d7d377d4872860e37de3517d85c8977f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYapf:A3k03kB56rL
TLSH
T19F157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 938KB
SHA256 736058305ff749ad820bb91d1e026bda8ef282096ab6449cb4ddd8f8e6cec959
MD5 61ea700a44ffab1f92eddc2dabe2dc45
SHA1 1b21dbf8c0178b05eb5b29e12435072e951107eb
SHA512 cc0d246e1f9dd5c94121ba480a10ac819bc185481aca54d88a7632bd9aa7c7f46c30f9009e9d9e9f6d228d45461f68c7789acc1ed8f2b625dd45840f4b1e277e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaSK:A3k03kB56r7
TLSH
T1CE157B13E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 938KB
SHA256 0218fc39b1fe18be4522babb5640ac20d72cfeb4dd9332a86be6aecc67832e87
MD5 259ff705b9afeddb86e4c6243dd2b3a6
SHA1 ce22ae65bd383c23a41ac30ebc823854a03f1d28
SHA512 9e7d64257f30f5c4c0b534e1d2c378c58d1bb3aaac8c97f68e135824a43289a54bf7c130963974a59c982f6cc8dfbb1ae7f8a4c36a85144be53103d5cac986ad
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYa3k:A3k03kB56r2
TLSH
T11B157B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 938KB
SHA256 965d3629c172ef4f9afae6b52dfab036ed66668714ef6941e8dcb92049595cfa
MD5 be50dcefd66c615db3082dba3cd5819c
SHA1 9166659c44be5c35f399368721cff403dc88ebaa
SHA512 0dfb27a88a88bc7d12de25bca2fda53fab79de4d36ef04369f393232a75f0090f9aaae4b8b4cab6c0d62d9d0b6fc9c52844ec7c3a8fb8519d248b6f12ed33092
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaA0:A3k03kB56rL
TLSH
T1BA157B03E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 938KB
SHA256 afffbc5fceadc37dbc5c5b77eef025ce09bd5d9c64175a52e697b581f7b3c091
MD5 ccee0a159451179d46354b1ed82922f5
SHA1 385dcd0591c8d819737ba9014835f054c7d91f32
SHA512 6a13b832be2cb4fd67473bee1f591df923ce4740f440e24bf8b384c4bd916b50af6c85ab4848e38e5a2a8f031284e5ec7f9982f986db6e67895d6eae84f506a1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYabg:A3k03kB56r+
TLSH
T1E1157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 938KB
SHA256 5eab82e27cad8888dd740ed481e5aa214de3d934516d032a69f64732a8249efc
MD5 87e58650cb6a1621844e6a5b404c22e6
SHA1 d349f4605f6f61e63bd984638f58c1650d6fea16
SHA512 ed50e3b5a6c358d87d0f80c0a017f212b12eb551a408799b94dc6e5b5a1458e04d050caae641acb99f8764222e5a2efef5e6a50300d5b3056dadf969a24e942c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaWr:A3k03kB56rA
TLSH
T17E157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 938KB
SHA256 ea6de5ca338db88f55b440d98717629c8b62102c099afc9cbc17f2698ff70a9c
MD5 af43bbce7e7b2aa532a1e738b39c7f15
SHA1 72523e25058353ef16a9e78e685e2f0051714c69
SHA512 fc2503f0bd743cefd0cdacbcf42220a66ea21e97619c7359bd5481d5e5bed108c1dc86b363857d846d25187472ae889788679f9c22a2b5a028c532d5c550b031
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYa8n:A3k03kB56rS
TLSH
T1EA157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 938KB
SHA256 0fa0661b23c410726e224f5cbc7f7eb8fdeda2aa77cac13be3ac3baa9d3cab3d
MD5 df5343107b2b144199aee9669c44957d
SHA1 7d4bd5a85316b6a3cb25edae86f293a05af3a19c
SHA512 620314ac12d73e2e096db682615c26e7ff9effc46b644e9ccaf0c8a47e42c57617a7bc1b460b7923c0a84d421b626b68761b22947c2d9c25baf65142f12d858e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYa6x:A3k03kB56rg
TLSH
T1EB157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 938KB
SHA256 e48b5bdd7adaaf9960c6cc885d406e44a9dd67808af6261d1f2040cf94ed0e20
MD5 916bafc4393fd99a4fb4f298b18df915
SHA1 1d4a6561c12bf6037b6d0b5c252d6289af5c06ec
SHA512 82975d8ed311cc5feacfe3187292779c9c3f12eefbb7263305fef17c388409be8ac9202bde51a58074ae2278c44e65698bd7c714930055223301c4a4b5701cd4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYa8A:A3k03kB56rD
TLSH
T19F157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 938KB
SHA256 5e7c3e312de2e670afe1f0e5ae3630085bb38b46d3888fab575fa20be7f3e9da
MD5 ad0c2f109fe1ecb6c952e2975c66b050
SHA1 5ba1722358fe119528c5c8ddbb561c7a9a38467e
SHA512 0354e8a1d555cc4c514f5b679992cc8b3be566aa1babf5b2cb6e1ecb67e332a3ba7a6438e27a31f1e93f44f5bfdb485939b3cacf885fde4e89c969177a39b7b7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYal9Q:A3k03kB56rO
TLSH
T15D157B03E6840FA5D10F81749A968662EA777C425F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 938KB
SHA256 9e6b906c17941bee3eff80d682bab13191181a94821fed2f09d75d55e67345bb
MD5 19d487210b7285027b88ebf6b648e614
SHA1 a1e9f8cacc9674c383e4741acf098099d0a6bf26
SHA512 c9b5e4e5917212d5576b5d060e6f4419816f02ce3b8e7c9a15477a55c8f9cb7ece8f9e96d93f1e437652b9571b1d3ee9fa38534e847f0caeec8a0b8ab315f23d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaQ4:A3k03kB56rt
TLSH
T11E157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 938KB
SHA256 6c80f2f11ca9e1830307c3be4802963f0e49f285da7bd29978ca0e1c9904936e
MD5 5d621342c31e95a9736e663b90662ca4
SHA1 d645e124ae9ba7206b98084522ae1df5cab44e96
SHA512 91b6adea247dd86c2e0208230e2fd3c03d7026b4b863bea88c6b1d039eca3d7efebdfd14c0c41548f06ef9e9844d7b320f362eda0c20f59648e051d103105212
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaTu:A3k03kB56rI
TLSH
T1FB157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 938KB
SHA256 47eed2845826e7916c854ab05902e86b7db7254d325e587787d1346388c672ff
MD5 a9a192240d0be92bf0c91fc83419ca13
SHA1 bec1bdc51c4bbf68113e528248e38cd937bb2bd3
SHA512 7657ee4d85130b4ed1a685229edaa36f458bfa4e0baf3d69de31b1aa15c397a7e6da8663e5da7a6dc45ff8784630ca496ccf520117bfeda53c092eb439f562e4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaOj:A3k03kB56rC
TLSH
T10A157B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BD06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 938KB
SHA256 2beb2048431e09bc661566519a7c4e22a30d3a4c6ef8abebd6548c16ed53e80a
MD5 eee4efb2cfbc1960f4139ca69453a84b
SHA1 231c9ec98dfa7d045934601f83ab08fd1875408a
SHA512 b96d4f0d2264c07163ca16d3e53a172c44a5c6ac9cf898f15d2d4be156e2b1b5fd140fcf4c180c340406179f34a8d45709c2eea051510deb8c2938eca1b8a737
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYa7g:A3k03kB56rG
TLSH
T1CD157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 938KB
SHA256 8091df9eff25676c12eecd4985c046dfc04de1ebc43fbc22707f3f7ad91ecfb8
MD5 40acb2e9ed0cf068a9f4d328a02ef351
SHA1 3b23311a7c54661a2dec180060e073863a9bf77c
SHA512 a1cc7eca50c92f8ce3309babb0d7a5c71bae315e6f3d563b2c866008752075a3e34f6b05c8cbb26530ad5011d05872bf73420b59ff7de98aed84f811dfae46b3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYamI:A3k03kB56rP
TLSH
T143157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 938KB
SHA256 918cb6192b0976eae7998340aab84c5fc7685f111c08be945852379258d7c4e2
MD5 2cd97e96983eb5b48d9c63985b10132d
SHA1 6903a1767ba749c398fdcac8306d6ef2c5a2b855
SHA512 c8032aa857a4a546db8f9c8155000df10f69c59973695bb110cd100a4a91dfac6cf6f676885c3cecf0e250897898d053a0aabd75ff2b40c2bd855c79b2954aaf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaUo:A3k03kB56r5
TLSH
T13B157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 938KB
SHA256 12e85270a1c14430b7bf24357e2e82b0d940ad1282bcc894e303c1e5ccb4c6c2
MD5 287a8b24521a40efff5807657d0052a7
SHA1 7a1c780dccd165022468398b49713c74a31fae51
SHA512 67437d44834d8d87186e355e3a673b917adfc80a3f71b1b65a61c12dc8739f5d92eff94e050103625ada5bb29f21bd64ba0e498ebc4b14023197630ab66d9fb2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYa3+:A3k03kB56r8
TLSH
T169157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 938KB
SHA256 350cc10629d19706786987aebd15361e6e0269b5c09df003697f8b0f420cf428
MD5 e403e24eff9b4b983a6e44c374e5665a
SHA1 ed9d263bf2e0d2d505498289a0d33201054df29a
SHA512 6766dce81796688fc6d565ecb2e49e863c1c456c6028fd04a9ff24b6100bf5b3bef0ff3bdecf3eb5db8c6050bb4427b8b7b61eec058225cbed683d489ef0d2c0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaNQ:A3k03kB56rU
TLSH
T19E157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 938KB
SHA256 cb9348b363aff6814d967c37aec22f4a0e095c686ebcaa90c59d2524ace3aade
MD5 7c257604a26b934b8d9339caec9b0ee0
SHA1 c94cfab4631fceff0d22ff0843be6bc0a49d28e9
SHA512 1cb68be050b8b2bf1c4cd713570a54bb6e29a4dcd521faa762cb9a0431385fec87c9fddd4faabd53e26b0553be8bfce53a8c3da1868249e4f03084ecbd5cd5f0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaCX:A3k03kB56rU
TLSH
T1C5157B03E6840FA5D10F81749A968662EA777C425F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 938KB
SHA256 2719d04d26afbbda45e17033719921c1e82acece37a60fc32d6c6eae49b76368
MD5 09bf010f5eb7f0b441f032c239b92404
SHA1 ac4d4250d4674e6b4b6c9062d53a7c47247fa29f
SHA512 ff93329e04610db091afbdd0dec3f5ef62fd2ec5bd2916c00a971ae352a507c364f183eb9a3a41be1533cc9ca2c86d6d83576f2a33cad8e9dc938058ed2de288
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYakL:A3k03kB56ru
TLSH
T105157B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BD06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 938KB
SHA256 4d4e5a6ab115191e7eb135b36d658c5f82a315d344c82187560c61f20290c26c
MD5 a9a01d346b117842f589e00ac43f55a4
SHA1 208673775bab8f4edaf9d5d863fc7be958b85d04
SHA512 7907e097cc6ae567ef2e0418be5f4d78b2ca7b14fdd4d85602fa582030d9d6b3a0d8ebf1845eecb2ffd97d99bbd2433e8ed8183fee83174751c14499ff216a49
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYaAM:A3k03kB56rb
TLSH
T170157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 938KB
SHA256 d839b00b3f2a5124433ec96f29fa679b2acaddfe6bf2da349a87caba1d83ca69
MD5 34ca0fb578de48b3c00f9f894883acb2
SHA1 d5d049ab46685c83816d1f42216f57f36f567ba9
SHA512 3a2f69efd15a9b7b8d21d47424348c701a38ebf12ad4949f0229652191942f1f3431c3f66d28b37dbd58b59a866bdaf7491ab5ed123db5480e430b755ff5402d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsEOYahh:A3k03kB56rV
TLSH
T138157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3872-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5112-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5112-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads