fc8045aa598d2c9459a55d045ae8db08e8b4bc0abe637a553a10fb13ef1e3a92

Analysis

max time kernel
108s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 20:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 892KB
Sample260720-zf838set9j
SHA256 fc8045aa598d2c9459a55d045ae8db08e8b4bc0abe637a553a10fb13ef1e3a92
MD5 28c05285c0f1929b39b5cd46ed3f3dcf
SHA1 db1b1504411cf82eb235d0fd60f477dbf5a0608c
SHA512 f3b2475b6c267da1b88d0747340c7dc9e17b53a82434707d80b9f5e013e09b344b36ea1d9ad685896002609bb454d7c3df12a74ee98cc77737a2788b0f76ec67
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5g9:A3k03kHRJQ
TLSH
T1AB15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/3360-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c46c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3360-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5436-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb6-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c472-264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-445.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-567.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-622.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-641.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-726.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-796.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-845.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-858.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-909.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-978.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1096.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1294.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1356.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019929-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c46c-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb6-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-222.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c472-264.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-445.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-494.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-567.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-622.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-641.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-726.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-746.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-796.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-845.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-858.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-883.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-896.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-909.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-922.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-935.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-978.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1009.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1052.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1096.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1140.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1171.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1178.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1185.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1294.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1331.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1356.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1375.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1382.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019929-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5436	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3360	2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5436	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_28c05285c0f1929b39b5cd46ed3f3dcf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3360

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 892KB
SHA256 fc8045aa598d2c9459a55d045ae8db08e8b4bc0abe637a553a10fb13ef1e3a92
MD5 28c05285c0f1929b39b5cd46ed3f3dcf
SHA1 db1b1504411cf82eb235d0fd60f477dbf5a0608c
SHA512 f3b2475b6c267da1b88d0747340c7dc9e17b53a82434707d80b9f5e013e09b344b36ea1d9ad685896002609bb454d7c3df12a74ee98cc77737a2788b0f76ec67
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5g9:A3k03kHRJQ
TLSH
T1AB15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 c3967f53cffb67f1bc32745c1c601facdfe94421bd6147a5ea72afc2dc1b807e
MD5 984e722ae8df94d0d52f848a81e8d81e
SHA1 6ce04d77808d086507364319525621ac798ae059
SHA512 ba5560b73fa9dde20bc3ac588ae8755e4682c699317431cdf76aba124ac50358f3c16eb52327448a68af3b8fb59785be420a8ae8866603cc67e5faa02f3664b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gJ0Le5ji0hmxNrM:A3k03kHRJoPji0Aj
TLSH
T195658C17F6A402B5D027C0B9C6D69A6AFA713842173086CF1359C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 907KB
SHA256 b3d722c868a60c85eb9f3793ece886eb36b77ddb51c1c519727a953d95c8e241
MD5 c19328af76be5e724597da5de796e5f0
SHA1 1400e15eb2dc5a54dac43ec7887ac1a2ef808c8e
SHA512 ee91b07399612a9cf75df192c16685d4c975f26e274d22ec6161fa08495932637354642297b6d485e8fac3aa2428e5b92b887306a88dc8c1d9844921b4b65486
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gba:A3k03kHRJ
TLSH
T17815AE13EB9500E8D10AC1749AE69A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 940KB
SHA256 b3547cc5f27581a8cd416f4832ee47ecbbcbda947c7e7e8333dd10650a314f8e
MD5 e916be21a7699b7fdcea5122f2eefdd9
SHA1 aa59918f5160372e2433169ce87c923cb70f0e33
SHA512 a1cb35f9b2fb5e9a105bd8a60162a70a20d92d7972df011a470ab9426311419376e37de8262d1eb3cad1f844ed3034e9e4631d4205413973e05ad1d63062aea0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5g4b:A3k03kHRJxb
TLSH
T12325AE03EB9400E9D10AC1749AE58A23EB75BD56177093DF2358C6152F72BD0AF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 916KB
SHA256 d23ffab8084fc62c835dfd67f6e68feb6ba72bfaa387d0e3a13e7a0657bf095c
MD5 f2d71d3c1e6a42674c9be520511e4108
SHA1 4ee4d0a22f73943ef463226b1f55a8e19128ecd3
SHA512 98aa9bd04fea325e003081fd1260bf3bb035ff9f3360d67eb7a8a4923d73041815a27186edf135cc4b3dd23e8d8c57f40f12018c884dafc077c4020bb0406b01
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5g66:A3k03kHRJW
TLSH
T10115AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 916KB
SHA256 10b13ccc4beeeb3d29b5e3c876519a44df47b8ee08b8bf633c1087ed547529ee
MD5 1d7abedf2a7b550e71140db0e930eec2
SHA1 da377a80254efd0c5e22809f0c4a5aee756080c4
SHA512 1d11bd89496c72388f3902501c0f49a63dc54d99e92ba0c78e24514bd895f6abbd08972a5dcce61a4847998897780dfc32c3001e30ae78a33cc9c0eee11237c1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gyN:A3k03kHRJn
TLSH
T1DE15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 916KB
SHA256 5063022b2f5e7cef95a3a117a8f2065be1b5eb0b88babf73e2da1e2507ad9685
MD5 f0280fe97377c1c63444c4d09544f44b
SHA1 1459a629f49957583c3b84b9f3d9bddea99ca2d6
SHA512 6bf4a0dbf1b7ad5b38e970cd4978878e57d3d19e7c05930a9227ee7a88e508dc346cbb367ee798b2d2ece4302350418f96e609c3adc33595ff950b7854dc1f5e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gof:A3k03kHRJD
TLSH
T14B15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 916KB
SHA256 96e954629f4e0bc5728675c0c383e820100bdf6c37535a4c534d2d1a4748f54f
MD5 1d5dd1140ab1743b8ad8c5bdf05220da
SHA1 d82934ef336009e42e9ed3744f0aeab6fcc06ea4
SHA512 bb3ef0c24d5ce093d778c52c98dc92963c8456c82f76a48772cd80618ab479b97a9f7d845f1f55cc345447bdd0fd175bf8e59f30f1344f17c94a90f7cabc1f7f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gCo:A3k03kHRJy
TLSH
T11015AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 916KB
SHA256 98fc9806f7eeca2032e8467bce8d1f8a1522ba5e6bdb1d0e1cfbea3e0803c3c3
MD5 338ab2e86c54f2684c7c9600452f0db0
SHA1 dbcb74bf6ecad9fa3bca111d7ccebbd45952c0d4
SHA512 6f52e906413c2f14d89963e6c601acc9153233e6290635fcb7c7560843fb060f2620c7675137785e28408315cba47874fc8748976896d0ffc6ab48d4f00a1ba8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5g2u:A3k03kHRJc
TLSH
T16615AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 916KB
SHA256 b795846612d496e1476dcd11942446e83da90663f42df1ba3517d0cd5f09717a
MD5 9ff6d311ab08148a2c4c9aae65e6dcd6
SHA1 8355a4d679e9b7df23d8922791fab5b16e53f2e3
SHA512 7e432aaa98d06acc413376a10f315d792f1428bd6213b9d4ef3c639eaaae46fa240bc36f311d69f9e47f3f13bd0de7f4576fe9174ebdb6422b030bcd71aa911a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gq9:A3k03kHRJB
TLSH
T1DC15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 916KB
SHA256 2f347ed05d424ae2f51212c1f977338742b525bc35077d08b6256f63c4d3d07a
MD5 a62748add6b2034ecc6774989d48d421
SHA1 b02e02e34669313d246f4ffb6ac1e3e3ffac100e
SHA512 0c92475ff660357f21fb49f43fc7ab43d1e94fab9ec1f221d28cf0aa59c1294f0b96b791d4692c78d84b74dc6ee825a8dc36eef59d0cfc892544e69985ea8d0a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gqc:A3k03kHRJU
TLSH
T1F415AE13EB9500E9D10AC1749AE68A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 916KB
SHA256 c799dbd5587849422a532e741e00654f6a65a68806ea64ccd5b03aaa00c99422
MD5 624c4fcd613774bc10be76026b6d5441
SHA1 1e20bf403e5aa450cf319f76e996748e4b4ed609
SHA512 d957f7b179186800636cc49b6daa51e7a0e2f29664b7cec9f16e5dda697d75aea622006bcbaf26f2d2077cfeea4a658f6a7df32b67b30a237b08c7cb51e3175e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gjp:A3k03kHRJC
TLSH
T16515AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 916KB
SHA256 6e4e9727e87ab70b3a59fde750adea7583c4d28fb967b816026e5f66aa62393e
MD5 c4a4683dd137f7fb816a1421f58abe9b
SHA1 4aeb381171a4012843f83efa3b9e7f350713f284
SHA512 819e217ee8f237cf8e752e59f88c5127e58234e0cb422fda230435f03ddd240ab4dcd41a871ca662135415bc0aa02ac6414d85e5fa2f85192b622a69f90bfc2c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gEN:A3k03kHRJl
TLSH
T14515AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 916KB
SHA256 1ae33332c87c1188e49547f89a59159c13b1cc4e98ff06afb4c300e0b49ca75a
MD5 6ca9e838a32e3e11fc3c01e2da41f2f4
SHA1 320eb7603a46e22559a56545064b106801ec52b6
SHA512 5f572494eb11eda4995fa41df7836b58c0687e1ad0880ee882708e6d1382b86a67123fa44f37a4899a3ab7e2fd43db8515e2e02741c18ce44caec6374f706c4a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gsF:A3k03kHRJv
TLSH
T1A215AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 916KB
SHA256 1b24458ceeea5adaf1ebf28f7fbb6bc7f0b24487db1b4616b693b9bca9a2f134
MD5 c2ea59767de7e3196bd2e7fa31324626
SHA1 533950121f5cf2a35d55d260a8f3345bc063b7a8
SHA512 c445267bc506a27354a9c0d191361c55f9cf70f5db699cd1729b5ba764d06df8f1d31a97cb64f8e28e7dbda24c914c4caf3f9fb78cfbd48ef683641e6ab5cf24
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gZC:A3k03kHRJj
TLSH
T10D15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 916KB
SHA256 2a85f1eadce8b159ec1c5864680574a1ab8bce4b6449d12c2f12a79cd3069b4d
MD5 e161b96eb4f2619502b2840a3f1fe5f8
SHA1 f0d5e1a83d6c83fe6af5e88d85fc8f0e641e4c89
SHA512 ff01f199698deee87e323d2f1fea187dcca7206f076126f0983c50cf53b80a113157d7cd3e9e1aa0b8e6da1fd9f71b856af81bd519e81c67d4a95d2bb5f17b1a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gaw:A3k03kHRJm
TLSH
T1BB15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 916KB
SHA256 3115461a481ba48dcd19842a43bb3c05e71bedd43247516d56b43c0cefee86a8
MD5 2f393f2470fe37e0f4c1c70d211a4224
SHA1 15303ff36d05dac9c35b41af4471f0501d493efe
SHA512 33094c5ecbe5e94cc2523f29112eb666ee0b7376df0566a106eaf24112042260a2eb17766e48f24eb64578e7b2e9bb7bfd80240a987cbdd2322727bac1d49d7d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5ghT:A3k03kHRJm
TLSH
T12D15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 916KB
SHA256 e54c04ecdef3aa683a02560f24713b4c75534e6a0ef877b7d994790a844fe9e6
MD5 c7be50a9486a128cf53955ed10bdab36
SHA1 5ff88c940e87fd12dcc69eb4f85ff15300419fc7
SHA512 49ba8355370eec9559f4376e8d40ef04f44258320d1a225588b87dced665f63382e9cda2062f130d8d28787f37a2caab9c9fa6ef7cdc4ffac87bf63e4837f79f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gPu:A3k03kHRJB
TLSH
T1CC15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 916KB
SHA256 59832a7470b2ceaa13616cfc6fa80a890dd0d75fc181b2e2a1d78c040dacfc0a
MD5 50f44ff096d6c4e5d1eaebf23f1b9593
SHA1 b4bb69092da08e24f30d1b45db8351964204c78b
SHA512 3220f06cc6555214244d14394482af5f43990d0bcfec5e1d3443773cd6fbb6c85cef154c5ea2a7565c9bee5ef8bbfd68ac9f7ba5dbbd5844a62d57da6a4255e7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gzb:A3k03kHRJg
TLSH
T1F815AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 916KB
SHA256 d28437de0fd03cef41a6c2b906ef8d35a8ddb6d11279b8be3ed8c66074ad00a3
MD5 9ead209e3055961b953dbefde52b15c2
SHA1 b9cf1467c81473e1e32e7bea4abb60a3953293a7
SHA512 971180cd287aaf94f0d47eaadbb17d63486617c6c5652218403deaf90386a1cb2c9085b5f34c8a8cb1864c47c74bdd344c9bca90ee77b5993b0f0d3c1f950ef6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gHf:A3k03kHRJQ
TLSH
T19115AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 916KB
SHA256 3d06bfa9260a4d86bb5ccb970ee87322f8ae323011198e67f24c23afa08ce614
MD5 bda84c79551d897ff50f410e454694df
SHA1 c4c5c8214e7a893ac8d8be3e29809acc37aba637
SHA512 bd09a84e1a7498a2a53f8bda53bdaded717acf2df5d38c991fb9c9366623db11588a1db54bd420eb44de9c6a2b5c56fb577fb999fcd7f178b5632afe4c5b39fe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gwK:A3k03kHRJw
TLSH
T11515AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 916KB
SHA256 d6de63e8287583e5da3c10e1028126d2115df95c36efea3c616a9a6df7562e14
MD5 1af7d66e5c113a8810771f609d97b75c
SHA1 100824f7942a008c591caffe19c23396fa1ccf0b
SHA512 7c165430cae6848b7b3cc676bd3fd54e5871b3dca39c7225c7cbc8692a01783f5dfb5bd60c6230aca0d176b4296a532c91660dbb9cf4c6113e30f25f13b6ad8c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gtk:A3k03kHRJZ
TLSH
T17215AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 916KB
SHA256 007d7cb82619349cf69b8cca6b30d30d4977fbee74b0e6aa7c7c8a58b005d353
MD5 201ecf0b891f7682c0509948f7727460
SHA1 3244f911627ec49a9259d31ebeae49bcd0752343
SHA512 705ba232d1d7eb46c93920af653feffaf8c5e02c4b784ba20b6a92d4b8eec2a8de62d0cdb1027681dfe7164a431cb0c994a866fb0c878673df3ba408ba1a1943
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gy0:A3k03kHRJs
TLSH
T11D15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 916KB
SHA256 b463e1afbe3a16a6adbcda908af8714dc706123d6b081180d143e7b399a02eda
MD5 e19e91cd1f9a90a338725bdcb886e350
SHA1 d70f4642d0703f2f2a1d8b18a90d32c118b6884f
SHA512 68f8ecd25a7ae8a6da9895eee7b9f18f0c80813aaa3515c92624047a29ba6ff59c5a6616ebd18401a31d86b27ace48071730ce4ad82c41cfed12f912d1003da4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gBg:A3k03kHRJR
TLSH
T1EB15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 916KB
SHA256 19d1e360ff7bb3451b30eb0c12304527a7541c15b9230e9415c50e62900bf8db
MD5 386e277568608af55e081d4827575a4d
SHA1 da510b3edb96f368aff08a8640bf2ee50169fda5
SHA512 f608262489c148e565283568342ab176d98f8e91674968476a9703b7015fe9850d40676e17da802b440482678b979e00890884e420aa607dd91ce67279761ff4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gor:A3k03kHRJ7
TLSH
T18315AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 916KB
SHA256 6c2b987fac9ccf9a0fef961f01e25c8270efd4330b9775a182cd07fedb764959
MD5 9bb9e17fda8cc7df1188d2280f7edd8f
SHA1 3be09c90d240ced5d87147bed3cee94a012b75d6
SHA512 c1e7f05ebb6a1470be237f285423468c7ae53439f3183bf9a0f2a9522ffee0630b40d0387cd885936c3b96e73511e36ccb7f3c85131fe92ae5274d1d5231db4b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gGn:A3k03kHRJN
TLSH
T1DB15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 916KB
SHA256 4b78ef920331037e1d7e641dda46cb8458b786fd5cbb865c057ffc6b8c519d5a
MD5 53ddb32bc821bc0eb0137daeb4bcafed
SHA1 9290d9a02c211394c133990316c533652fe23bc3
SHA512 d89371c67939360e1349558ccf7eeb2cfd5c9fe9565b3a0758209c80c9d6ced8e43a522be0d845d5a2837ee65248a91809846e5e4c6c1698389e3652911c2fa6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gMx:A3k03kHRJz
TLSH
T11F15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 916KB
SHA256 05f0c853093f45cd1cc658ebc8b7b5152d26563399f8eb15bcf135992ccb1ab4
MD5 8d041397500e575d3ee89abbc9d7fd96
SHA1 09b3d36844de471e339cff6bcf5cca7dca5c64e7
SHA512 53e284f53607c72a3bbf2d08a1dbbd27dd9064231e976565e425b2e0acf7c09bd7b88ccf73325298e8119de974b1f6bee4643441fed8cf38698f35a37e365009
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gGA:A3k03kHRJM
TLSH
T12915AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 916KB
SHA256 f9efac7212018dfb722fa1257ea2a552243e1f0fa58ebee734d58fd148a2ec4b
MD5 e72447821db8944f5714e3885bc3d7bc
SHA1 b2e79ac03d9bdeb9e7a05a454b550b32b8ea0981
SHA512 bb35b8884aaf9c6aae0d4109f5df009c0ea676772fb28491cf45d2a2283fa7fb7fc342e0745b2eab76fdcd31b2a272291c0e06aebb97c1ef00e8f39f2e039133
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gf9Q:A3k03kHRJt
TLSH
T10E15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 916KB
SHA256 28700e7bbde1dd1d4559684c15300aeed24dbece8e04aad8c74ed5691d44bdce
MD5 55c19bad4fa63b529c733d400ff0a8c8
SHA1 fa89a91f49870ec77b60443421198256003de4d3
SHA512 a967d00795d1fec233f685bdc1700e2635a4d2184cbb68657f32508bb15af6519f8d495afdb99b8e72eadb80287ebe6889bbd313b2de8fc61b14b562a3d42405
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gW4:A3k03kHRJy
TLSH
T1D215AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 916KB
SHA256 112d514db137f3c5b0485996c9e6585ba34e19855b594166018ef0e8e21d8d40
MD5 5a6f2723c11d1ee602a767906aa68516
SHA1 49b77f504703d91791980310dbdfd0794770707f
SHA512 c9aa2a79b8f5a82be7363595f7c7b5d80fbcf67e900b4c6a22cf50adfb84e660b31ea5c674ccf791af9998c3a3b62f89b3db1dacccf94201458ab8d3e91d9b3f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gFu:A3k03kHRJj
TLSH
T1A315AE13EB9500E9D10AC1749AD68A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 916KB
SHA256 ed9ecafe183b0c00c418cc582df8161dfa94dddfd7e2d39877207c28a63f0573
MD5 da29c6864610de5debdb70379d12806e
SHA1 0eaab556b24e88dc01ca3b9111a6087fda4d5632
SHA512 c5593c984016d92debc8521bf4c777894d9a2db494f2668790c73e3393de9e7579b1885de9e3d5bab2799b4ffd71b1d10820f2c35ce335fda1771931e023cf5d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gYj:A3k03kHRJN
TLSH
T15715AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 916KB
SHA256 80d7140fb0942053ff76ff9cbba7066259f85a9ae5adaab1eaff106cec06b154
MD5 f893f2e3ea143b70efac0f56bb496cda
SHA1 776eac52e5aabb4551542f2d42dd452a4e428456
SHA512 0a4e03da52e66361869eb7d41c4dc56a40598bf930db0a13c511a8b0816b15b1ab6a71b87d1538cd83dee469cc16fd4314b06f4f1076fee827298903d44922bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gpg:A3k03kHRJR
TLSH
T1D515AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 916KB
SHA256 268512bdde64661ede7abd06f3d5a02fe6b619401da2d194494e84d85aab61f0
MD5 ff4ab93b95319276e925a7210bc2618c
SHA1 f4a3b38cca598e50ebea3250c692a7bfeea606b2
SHA512 7cd33937b95ac40daf7701b817798cfd6ca7b6be77b78eb3a4e8f0409d4f188a2ce6000ccc867a7ed1ac7109440f498f78db0a4fe22a61418cd107ca459cfcb1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gwI:A3k03kHRJA
TLSH
T1DC15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 916KB
SHA256 86d5d081d2497783fe08d5963ec58a69c8e851b2f45a3796c482d20eb35de373
MD5 eca0b07760eada2b96b6749c8372aa6a
SHA1 3514c2c773e8c7fa19d9454cd056f4f36cc2f549
SHA512 9ebaa08dc3923b7a00d01577f5c5aeec53cda870c1c129d473d758fed701ff839fdd107818005e80c688b663edc42f4689574d2ee8487c06b4bd09fd7dd1563d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gyo:A3k03kHRJi
TLSH
T1F515AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 916KB
SHA256 9ecd086bbf1c8deb71a06cdffad5b52c47d2db09b0b3dad3db7b4f6aa5962013
MD5 f02daf01ea152fff8f0e12f7ce95791a
SHA1 dcb7bbedceb43bfce09eb24c6317d792e81d8582
SHA512 c031f50b8cb5af9753b35108d59f791cdefa07ca09d013f8eb7b6d589ed135a6ddc68c74696e07222fb39962d5cf13515dc9a19d1f2732617ed7b2315d91f0ce
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gp+:A3k03kHRJH
TLSH
T1C515AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 916KB
SHA256 4e4b68aa591f7999ba458ef7bb26783be51a6c60a8861fdfb2d104b432ed09f6
MD5 260aa2af98b3417f3082ef3431ba8db2
SHA1 3c68a08765f1e58df15d0abce3484d2020708fcc
SHA512 241da28b90133e8c117008cbcdd0f7093973d67c4d7e18d6cae307f582cae101471b24034d255898f5709f90c71408f5dd814a06b22908e877217e73a30d9fab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gXQ:A3k03kHRJz
TLSH
T1E215AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 916KB
SHA256 20d07734124ab878a051c95e01db18deaf9b2b8d467a0889d7d1c10769a59a61
MD5 fa19893fded8f0b6cd358af9b46e7e01
SHA1 6f745e6f7ac5a8b96cf9d46c9fa45e30d9a2a29b
SHA512 dc8322695e3a3868c7ce45af212e1180f82d60ff10f81e65cdc6db7adc42e2e43c85d5f056441ff5e965cfb5c76f4427573eafa2f0ec6632516901e47e7736d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gsX:A3k03kHRJn
TLSH
T11715AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 916KB
SHA256 186d121f810b3232fd0a45c0ec1c15121eebd89b4e2462c7f65ead8188aec93c
MD5 572acbfcead67db16806fc9b566cc234
SHA1 8878e1da2e029d5b59fc014898ae2d42372b1e07
SHA512 87d1078a19cbb8d4d6681ff63442626d4ad4e5ba59b6c6a5d5d4aee884b055d2b30a9eeaab91503f9920cf83ad3ce5123374a67841ce0e183808dc19b2ab3eb5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5gKL:A3k03kHRJJ
TLSH
T1F915AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 916KB
SHA256 b036169ae15daf49305a0e9f996691bc4683d14ce28c7fb900e48f47fea032dd
MD5 021b97224236ca801474509ccbe305b3
SHA1 9706f5a949e4ffe7c5b599f4c77f50534131c3b1
SHA512 5f1978bb9dbb96d6e9cfff87df975ba41ce9e5eda94d8ec65b245969ecf182697b6e75293a81c4bbcf43a9ceda9c073fd787500aed9f1ad2679ba425e13cd57f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5guM:A3k03kHRJw
TLSH
T1AB15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 916KB
SHA256 43b5f304fbdf8592beb2849058171a8668ea02dcd7f3d80258a1f66aaaddbd42
MD5 228f08f9ec681e8f67615101a16856f0
SHA1 770126fe01727745d8fd8d783175f4a669b2090d
SHA512 9d4688ad32834063a656e3b27683054c53d148f69ceb056a0eb04956eb8b8ff0407da6af6faef145168562ace4a76fd7e08697f3707da7dceeba9a3aa36a96a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRavi1W5g3h:A3k03kHRJi
TLSH
T11915AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3360-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3360-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5436-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads