b18005874d58afdcb1db34cc166f53cec31af1ca701fb2c5191cbc51062e48b9

Analysis

max time kernel
86s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 924KB
Sample260720-tckctaft2r
SHA256 b18005874d58afdcb1db34cc166f53cec31af1ca701fb2c5191cbc51062e48b9
MD5 664f72798143a2e63b65f28c596f91a2
SHA1 0257e9f3629fa5bbc10e063df692947b0a202471
SHA512 f83e9730283a3342422d36f3a94e27310c88cc6a5215d87af06ee867601995e7d4da6cceefc68d37edaaaabd33867276c44309662771fa4bc10243face9bc1e0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaif:A3k03kB56rU
TLSH
T16C157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5192-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c495-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5192-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1008-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-672.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-777.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1085.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1159.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1288.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1350.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c495-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a55-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-672.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-777.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-797.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1004.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1085.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1159.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1288.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1325.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1350.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1370.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1378.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1008	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File created	C:\Program Files\dotnet\dotnet.exe	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{4F64B9FE-D791-490C-9F74-D185F13EE27D}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5192	2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1008	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_664f72798143a2e63b65f28c596f91a2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5192

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 924KB
SHA256 b18005874d58afdcb1db34cc166f53cec31af1ca701fb2c5191cbc51062e48b9
MD5 664f72798143a2e63b65f28c596f91a2
SHA1 0257e9f3629fa5bbc10e063df692947b0a202471
SHA512 f83e9730283a3342422d36f3a94e27310c88cc6a5215d87af06ee867601995e7d4da6cceefc68d37edaaaabd33867276c44309662771fa4bc10243face9bc1e0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaif:A3k03kB56rU
TLSH
T16C157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 cd012112d6d3ee6ce30f9420cbd1a6da8bbdd513de85f88f518a2dcab077e12e
MD5 9e5643977153819965d6a5652a6603e0
SHA1 9ed32ef8e52d47b59767e1bf7801e2841e36c780
SHA512 c1232cc079bb3fbbf46133205c9bd0bcb373397dd61b7fbec747e871b3a30eef792733764dee03c4a5b942054ed587fbef50c0b16f638022b4a6c381fd43e4fa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiL0Le5ji0hmxNrM:A3k03kB56rMPji0Aj
TLSH
T191655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 938KB
SHA256 9422de28d9ca3fbe8dde29e0b186f7156990fc5fdbf459b182eeebe939281cfc
MD5 db647c658cfb6be65ce699554cf77d2e
SHA1 ca73bd5987be41fd43e85a5467e170294f4f739a
SHA512 2c5c1491bd3eadb1d81706cd53a05619d967e21db525a44762fd8872e2cba14b0b252c4e989cfe431a274e7ba53aa3fb75fa8cba83ca11019fc24323b51da84a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiNa:A3k03kB56r
TLSH
T130157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 947KB
SHA256 7b34799c266a6aedd2ce8fe1470d8b6a186cab3ce4ccb261dad38539e5ada882
MD5 125dcecfc10e64f0321620644fe65ea2
SHA1 b4616a16c300a605e4d94d09379e4adc80d89e15
SHA512 71de504a856f9232ee13f6e82011840cc88c6ffd3e1cd2f9fdcaf19a71916f18be7156eb77c9ac31e15c57b9c57ce77002881c5ae2466ae10639c35ac734fb11
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiE6:A3k03kB56r6
TLSH
T1E9257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 947KB
SHA256 462565a9eaac8fd669e68d3eaf574cbb400f4c8db6d46b16302ce3296120bf12
MD5 5aa0246bbf6769e9c5dd3b29cc2f34d6
SHA1 ab672f1d6d63b47a7256023655a791dd0550f05d
SHA512 1f37a7ef15ae22ebde22f107cc4939df0b8075ae8c921f8ff2e22d936245650ad1b964797aa978895464cfc84a784b5670775e6dfcaf14fa61476ca5a58859f9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaigN:A3k03kB56rz
TLSH
T148257B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 947KB
SHA256 bb6e08f508b8a5ecc8dc10b39cbeff9af3bbda617c690b7c99fedbdc06c3f8d4
MD5 721e3be36f6a4ef6730fb01ae6bd0896
SHA1 1d72a2b1fa42852a7d8facd6711ab9b9f17cf3d6
SHA512 b49006f7f31c625bf3be92ab22e4f4b044c99ba56b760ef9c5e14ad19692389eab9a87bd05c51c8b98d12ba801a47a3756ce21511a51992cab13bdf366c00ce3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiOf:A3k03kB56rX
TLSH
T128257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 947KB
SHA256 6370139a924f6ffe458b0c880beed503c3a6cc1ab42ed13a3bc1e7bad2687c95
MD5 add58e6efc86f55760b414cab2cbc838
SHA1 f00273f3397cda031ac2d5a59d6654de0fc3fc6a
SHA512 ae58f16ff4695ec40d54e00278096173c3211965378fbdc0ea53a83332bb473348849f7d4d43e6eae1e68006f2571f353afc79b18f97ef7fbe2493eaf2e90eca
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYai4o:A3k03kB56rO
TLSH
T1BD257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 947KB
SHA256 5138fffe97579a4fc49037c5ada47625ff9d540bad76508f234449856e2b83dd
MD5 13c079b57ab21c27ead318c7af2a79cb
SHA1 562ffe6bd24154269fd535ba8d1bcde4f22c70df
SHA512 bbc2d1f0d7c9dc9081bb6bf596553d872a070078bc3b63063d0da03d7fbe9a5ea6d7df458506e858415852f060dbd15f1eed6a36b36f6c3bbf9828f7a65aade1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiIu:A3k03kB56ro
TLSH
T1B5257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 947KB
SHA256 3bc65d10e5248bf605d81117d52256bd989cd57256e4934fc530e01fa3ee799d
MD5 132be33297158c778cac1c1751256040
SHA1 c6557f7d96f66e95e989cb98abf6da19fb3fac33
SHA512 2ca8c0cf887fa65434da7318b48adbbc65f4044854217f5720eaabac72eefc6ed1f6e319701b9c8df1797568918767f71e68d8c9b791a179be1bf76b0e11c1dd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaic9:A3k03kB56r9
TLSH
T1B0257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 947KB
SHA256 2243b52878427379373e5a9253b9b6d30e9c4f32e415f93cdd5aa8e5d5f30a24
MD5 75d7ed4d16a9d7a29df85f03154b5e41
SHA1 411c16734756577ac66711a95c57d943f93ce473
SHA512 3bf0bb4f0450e8c8c3c469bf5d6e349002173183e76babfda05c6e7cd66a9246f0815ef8a74c07c407c254f54721c544b561cc500531a7a810638c33e46eade6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiEc:A3k03kB56ro
TLSH
T102257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 947KB
SHA256 1aba826823bea3aed6a16a0eb0dbaff84fa8a4550aeeaafaacdac2d3d480fd34
MD5 0794c03101e6dc71f47f8b7f9918b5df
SHA1 468ba049d31a475b5feaedc2ecd260c25c99606f
SHA512 4e468b9d9377f1ffc64dd146032a6fb34f35d7c02af8f51a1ef8181a0eb91d415824de9ec773a4c179a1403b88c0288502eb599b8d3d92e69302571e6fa9ecde
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaidp:A3k03kB56r+
TLSH
T15B257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 947KB
SHA256 445f2f488355e6aac43a83417f270016f6285a3980bf3f43bfc7e0a0c71569c4
MD5 274ca3ff4a5ad6eee17d9ef31a5dbfa7
SHA1 0895b2e9e06f387fc995d29569d80a8e09f89dc0
SHA512 8854265af0e4d4058c672948d3cc8b2ea12674769885118180786b76cbe8e9dbe60b0054b24c44ae5f4888615ffdf8b732d24efb2ac85a9583db7457227b171b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiiN:A3k03kB56rx
TLSH
T163257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 947KB
SHA256 437db3fce0c5fda57078ead6c51685b3e5701bfe83d178d9fdff55ff1c46bc09
MD5 e9d5f3139f529440609aff1ad74b5c4b
SHA1 e31f8ef4709213268c5163a706d83dd688dee42b
SHA512 138c4dc1fd71c0e04f512e766f2ea6dd55870a2954604ac658ec8779b679bfe393b2af0ac6ce4034f19f4101c0e55004222dd3a08293c5be00fab533984f98b1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiGF:A3k03kB56rD
TLSH
T141257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 947KB
SHA256 f1fc6403f585c93e75ba286147ba5669f1602b2b0467d09e9a704dc8de0565ab
MD5 184720db08ae4d0d46e1f3cf97c6f799
SHA1 886467dddc5d94bb005e4330a5fede877f7d28a3
SHA512 ca7460eea2cc3d5c64c85bd3503d04fb0fa98f686179cf4c18357dd6b8802bc550383625a6f4022fe1f9aa1c55c45febd6f8a05f44efbd39ffc2f6ef71609667
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiTC:A3k03kB56r/
TLSH
T14D257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 947KB
SHA256 032223e0696e26fd59c7703146c0d09d5e9aebad40b4dc6cda1bbff455eabbea
MD5 049497ecc25e6abfa44a07e004a774cd
SHA1 8deef0e6cdee220e4ed4dc06d5b2367c75919578
SHA512 71087dac49c7a5915618e55285ee0b53b9f0a75409eb12c4e39275cf95c49e305f90feae0c452c369369d73d595a0fb1a847553a6295a35dbfbccfccf0a8e534
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaicw:A3k03kB56ra
TLSH
T10D257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 947KB
SHA256 2e46e2096aff2c59368eab5fce388d601cb1046a41b87cde19af302817e9cfc1
MD5 6c47fd49858881d3315cd8b98d4f9337
SHA1 a9cf36d338b6e8de1355b3daaacc9bbf4d6f36ab
SHA512 7ff9dad5ce81aaef05384e643006ea7876003d0eaf28ef9e0c8d4c1df55d634affa0b9f4522c1568a68bf72f0d18863d8f5c2a605e96dd234371046670872161
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiTT:A3k03kB56rK
TLSH
T148257B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 947KB
SHA256 0e18dd7744be4a931ccd88b363e427156c1517cd509ab2fa3dbbaeedd946702f
MD5 164ab2d07874928e7c69d94077e8e227
SHA1 cbdb48fd0b5617a3568f914598c27889f1badc1c
SHA512 81ee0fa8fd302db015f3722230f455d815d24304a91b6ce9effc9f548eb0cd0dde4c09d428d2a960f0c3a54122f0972fa50d5b4a787a198437d5433aea92b1db
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYailu:A3k03kB56rF
TLSH
T1F5257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 947KB
SHA256 69f7f80e665d478ff92a75f0d5845422a4d09895e2ba1aef02285477e4528b27
MD5 91973293069854860fcdf7d089537fe8
SHA1 4bb1b1ace5a38ab8a855d288b99a81d692090887
SHA512 4d860c0597e617237e15fe068614ee8592377313d8edfee6730b2fb49e536ef635837253bbe45c70c876e2991884d29c6bebe2efbd99685f07159efb21c3ee42
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaitb:A3k03kB56rk
TLSH
T1B7257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 947KB
SHA256 c87b1f57ca34bb256900925098bff5cf540ad7db463001fefff126e667e0baa7
MD5 3d1f83362e7e50d2d0b724c134041554
SHA1 923904c665b1ee77a8ec369633ffa99029bd0982
SHA512 1143e32234b01b996e2711881b611f9b4a6894fb7f0fa7f5046866a0ff4024730f0e1c31e80633d7c34bf58c3275e8291e2961ff7fbdaf0c47801d1a476f85ef
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaidf:A3k03kB56r0
TLSH
T1A6257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 947KB
SHA256 7dcb886b49bf7a2fa90cbf22fc31d610d9ebfda5c1dddd36735df523b2b7a07b
MD5 64e80ec4c93acb108836287af1d4e9fe
SHA1 86c63e47fca026e562789046a2ab3ceb3b9e0374
SHA512 4fc6cff9173288568ce77adb108eda51a9fc96a2c6eec2393d069c174a8e3b9028e373be9966c493cc3b475d81d6d0c277b3f71c5a1b6112ed3979cda1e98956
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiGK:A3k03kB56rk
TLSH
T193257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 947KB
SHA256 5e39cd8fbb92c6e53f77b3860b33fd9b69171d21b177ac11938bd6547d701a0f
MD5 9dd5114885b37e680b25c25876594f59
SHA1 79f8b512dfa447e7f30f9026b30365470b776c18
SHA512 99ad56cf96279d3f9e3e33fa1d57c96f83cf2a883b18151e89c1394cf4c932f86f1529ef6588d999113c5464ea7aa3916857f1ba7b48506f4fdb2a3138ad48f7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaizk:A3k03kB56r9
TLSH
T1A7257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 947KB
SHA256 9805c611f0d1c88cf08b920bb3b282cd5704f91a9b192ec35f4eb1c05440c9a1
MD5 08dc9e4987dee95bbfd2693daf708c79
SHA1 11365d821d5ad64647b56c5c47270cdb7d1f30c9
SHA512 883934f41d8a9eba3cbb5a4f68281101b0f115c9501f09c633f69db721a279c67b66c4df28d9b223bb5e4ba777d4b578645dc58d05812756aae4fe27953401ef
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiE0:A3k03kB56rA
TLSH
T1B8257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 947KB
SHA256 a7ca8d2ce487e41f86d4080dc1e70c66e68c791876b25f3e781e551bce73fe8f
MD5 1a853976972ecb56bb43b1f2d7ce0945
SHA1 f3d562714828ba1f52af19f9da50962663c79833
SHA512 b1cf27a2e6dca4f63a0487dd138b59589ad9339209eb087185d73e72dfdafe05d923a849d46b5494914979b1f34c35eaea70fc40145a634cac6695189db0ce30
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYai/g:A3k03kB56r1
TLSH
T1E6257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 947KB
SHA256 813ef79e70f720af42b72c5cc93064cfed5dfa829fc75716343d4787687f34b5
MD5 f3c8c4811cf0616040f184681e1f886b
SHA1 9647b51c1c0bc33273d76bbcb139743f5552be71
SHA512 58b01d1acd4a84c0a73390e69ccbd6f91cd37ed1dc82ee050956e4ec3c2057637b48a783d8e85e98e62cf34303fbb3c5a4c24c096764f59e66440365d20b581c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiSr:A3k03kB56r3
TLSH
T13F257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 947KB
SHA256 14fd45c061f142e10655cfe18cd2128a54ed5795f27502a347f59bc97b735547
MD5 2de6fe242ff39c752a5268e88837c48f
SHA1 bb03037c314c5a4208e638018ca631f5496634c1
SHA512 b7b0ce6ed58cdbab8645168174be4c56a54583836eb98f8f61b973092b92a1774bd7f0067e45c2de6cccf8355cd1359a97e7bbec1d41f6d8a5ea301e52235519
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiwn:A3k03kB56rB
TLSH
T186257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 947KB
SHA256 f9dbfb9f893b729cd8abeb45c8b28e53d2f1261505b50d853b1057603132e0ea
MD5 5c3ef969ff026aa179acda1234324a48
SHA1 5da6af674f0b7fa03723b532675d42846a1bcfa5
SHA512 122837083f5cf85b39995facf79b7de3b9ad26137c373d5711dd658a1d5030cce9666e1a0894c1ce973bdb2ad83f2b0bcec6888a9f15a5af76b4b3e75e23a8ab
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiOx:A3k03kB56rv
TLSH
T188257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 947KB
SHA256 a0bf4ee0bfca4c159f8f268e9756a05a90abeb084b26aca54572560a17eb080b
MD5 0049a7ce3d805532d2fb43ba373c24ee
SHA1 ccdfcc6d32db8db2f4d56a3f0104107e5d4e1f39
SHA512 d82d5ab4476cb19131b4586389d35218530235c74d827643fc731ccad0ce6dfb23ee9adc46ce26ed9db0f69e21343ce7e9857250d72b7f7e3cc055d6188048e8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaioA:A3k03kB56rw
TLSH
T122257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 947KB
SHA256 44af84e475836761fa434769ac39920c48a012f3280abeaae4d785e273e218b1
MD5 88102c7273648545af7cf5316f903b34
SHA1 a952b96a6e063407fc08ce66311a69533606c382
SHA512 db1b0ef4b9870974942c95ddab5d427a399d87ddb36e4bd86176f3a1af8865995deee6f48f48e4c6ca65df6aaa17bad4d94ab8dc923bc3c9049cdff94eb05bdf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiB9Q:A3k03kB56rJ
TLSH
T179257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 947KB
SHA256 fe1ff83329c8f0e38abc4f069c68f75ee5748b3869a4b68405cb4af67f035406
MD5 76e962f75f2d80ca4cc6c0ccc7df50a2
SHA1 4e7ba8e0e52c6051564f8c5e2991ed34333e3096
SHA512 bcec9426c2694d5f88905e1c429830145277ac4de39e0d990493be6861ac23938d55e38b05ad4dff38dd8d98933f197c92905b5fd5de38283fadfde187439c73
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYai04:A3k03kB56re
TLSH
T120257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 947KB
SHA256 16846188ee8f6f8880d48f160489510c73657da55c986b89a7788b57404bfa4d
MD5 573ef3d456e6eadb70a4714619922dce
SHA1 75a45a2e499f288272b5708390a994cff30966ac
SHA512 3b6272d4f91b493b8cb59158579e0793bca1c6254f473df3d8a226b6b3b037f094fa85efaed8b62c0dfa0a6ed91b62d58c8628ab3688b67607b047f012d29db0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaifu:A3k03kB56r/
TLSH
T1F4257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 947KB
SHA256 31e82f6cc65ca713c39a8b6efb0bb54b13a54d10530993b11797edef64adbc90
MD5 708773090c4219d45dec7cc2d8305d75
SHA1 fa937c9a1d2a8eece604d1364901f10d021332cd
SHA512 28420ea859047dd35bc0d08ae4f3033a1413097d73b8da8a1da5380db037f5d7a1c009f9962020c52b5a6bc8ff5369ab25b1bfa1edac7e2d41432e03371ae34d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYai6j:A3k03kB56rh
TLSH
T106257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 947KB
SHA256 066aacc0e6660ae0f3f89613bba0680ef644a8d8a5dcd12559cbf2c4cf4754fb
MD5 93dc1c20b9bcd6da81f331143348abf8
SHA1 3755ecea425c2f99b6bf8a11e3651e0e6fdffceb
SHA512 2a3de7861751c6f92547d85788a7e8d077e891cafa841ba0069f1befccd849e5e08f711f2590a7841e27681067b0797522d192b791cd02bee97804cf91cc55f9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaing:A3k03kB56rl
TLSH
T123257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 947KB
SHA256 54583c30d5837227d04c944cc1f6f9684f6cd170c280a53f2327236c2041d6a2
MD5 a6e7d762c4080c0c8c718d95b08b34a3
SHA1 73540cc1c9e3d8673a37f080df524a31a859a1b0
SHA512 133535cdd455bc47439e8df4fd7ba3b54b0275d31e42d0113a67a50959fe0e98ee64a461115ce8c157ae075cff2de45af13513fdeb420a211abb1bd387d22c0a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYai6I:A3k03kB56rM
TLSH
T126257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 947KB
SHA256 d44ce4c345d7bbebaba03dc99977432bd019abca1f99a5307e8f58ec6c1579e4
MD5 390ed295b06c544e61e15d5f1b689e44
SHA1 9a417d64496975909e8387c1bb94d7bff25ef8cf
SHA512 9962375b764b0db7279cb5311cba00bdf1ff7ddf02d3c6e4991ea5b51979832e3272aa4d950018dfaf1af8b84f04a256ae718708dc90914f6c435c9d74e22729
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYai4o:A3k03kB56rO
TLSH
T197257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 947KB
SHA256 ba7d676cf25ea7c86f277ba23f01b8d52ef6bde0bed7deab33e2200c73b35a58
MD5 e5ffa46e6be58acd7edfc7e51cc36721
SHA1 11e40a95aac12a97de6aa1d2e5de20403b759380
SHA512 a7a3667efd44ea9870aadf68d368b24c153c5fcce30da10b4856220b7acc47db3b7b4acac155d35e0e2fb270413c7c8ad09e17e3e2eb28990ec80c749d0aa40a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiL+:A3k03kB56rb
TLSH
T109257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 947KB
SHA256 4a5bf7477f08a5abf0d81e08ab7c8eb5e6a8965805159865a20e9a41e5d984f8
MD5 0b265597e9be5e9db944acb4eccd8767
SHA1 c35803d4dca3cc9d1f998b1be06fd11f202e5d63
SHA512 381531b63746b2bc0ebce779dabdb3d5c174b62ee271730d5bb06bd7599db29c21e63f8c24b67fa3194386d68641a96fc6bcc3101e1332ab25c6da378c06fcf3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiBQ:A3k03kB56rf
TLSH
T1C5257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 947KB
SHA256 5ff6f24eab8f77da557dec784137eb273a8e98e4c940f8db873c8f1ee0c5fc54
MD5 ccab8af50a1b725551e56d0384aa5f65
SHA1 e3bd213ca28e9e0fceaa7466b7229c270afc1b7b
SHA512 49262d8a800b157af0cf4c511d168a65f56b0b1934631fd009326fcf4a9872965e6862c538419b6e91f619bec8654e73e9e587c80d6404feb19e13a3014cc86e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiGX:A3k03kB56rz
TLSH
T1C4257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 947KB
SHA256 dc92f5d6d66e4e644756bcf3d6f74e20af7832969f7da9c4c1cbda7bdf5789cf
MD5 f176d138b8bee7d8a525bcc2c405227c
SHA1 b98b72d82b8f66076c7e6eb48907a90a42751e4a
SHA512 98edb3d076a91ece84b7c632d09e4526874f7fe3914e8e504c27c577d3598e5291f412f102f0521f7573616b1e8ab4895f06e59607f2926c5f976fdd96e5793c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaiAL:A3k03kB56r9
TLSH
T157257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 947KB
SHA256 89cabb670ee446920c101b825178adc2b597619cdbd88a15164e38a636391b3a
MD5 4ffa326d1fedbdc926f41c05c64894be
SHA1 65b406daff362c365de25594fbe5aa328c2fcef2
SHA512 362d7bfdb90490fd6474448b2399fe2337bb4271483910b12d9d5dbfa9ea63fa03359197e26a7a4eb73441bd91509b3991f6a4486e8cba46f1a047842ed85e08
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaisM:A3k03kB56rE
TLSH
T184257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 947KB
SHA256 7fd9d798e0acdde175ee008e9fa14ea620addd0af5fd1356133ab61a7c5edd43
MD5 077d7c347f50fcf9b822b5662094bd5b
SHA1 3b448356e1d98343538d16865203b83984adf500
SHA512 9c6771f7e274023ca9de53468f711384f626e127a3d889cc2f0bff589daef30706a644bc4faf66097352429ad7183dacee9c2011a2c7f529a8008a5ea64099e5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYai1h:A3k03kB56r+
TLSH
T1F9257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1008-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5192-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5192-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads