f9a18acd8f169ac10b4477138c8919134ef59f10c20aa8f7deb135c1c016dbcc

Analysis

max time kernel
112s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 1.7MB
Sample260723-k96smsgn91
SHA256 f9a18acd8f169ac10b4477138c8919134ef59f10c20aa8f7deb135c1c016dbcc
MD5 365c84f4ea687e56733c525ebb685355
SHA1 c32151f6fbeeb9e759be1398ed7960a893bc659d
SHA512 c8969191a64fddf94d7aa1e54d6cc85ea70164f5acd07c25540518ca5c578bd5a0c7dd5ab6e2d062607e59858274fe4e36bb67b34df520ac710f44d8001e187a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaEaOf3mnXoZ643mnXoZ6i6cMJliLaL:A3k03kHRJ83k03kHRJB
TLSH
T14885AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 13 IoCs

resource	yara_rule
behavioral2/memory/4716-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c48a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4716-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4132-40-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e000000017627-182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019983-536.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019982-538.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019bb3-719.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001a7ba-1028.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001e0000000188ba-1535.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4b4-1678.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4b5-1677.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 10 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c48a-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000e000000017627-182.dat	aspack_v212_v242
behavioral2/files/0x0003000000019983-536.dat	aspack_v212_v242
behavioral2/files/0x0003000000019982-538.dat	aspack_v212_v242
behavioral2/files/0x0003000000019bb3-719.dat	aspack_v212_v242
behavioral2/files/0x000300000001a7ba-1028.dat	aspack_v212_v242
behavioral2/files/0x001e0000000188ba-1535.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4b4-1678.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4b5-1677.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4132	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9A8DEEB6-1F0A-4CF4-BD83-A8EC662094A8}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4716	2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
4132	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_365c84f4ea687e56733c525ebb685355_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4716

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.7MB
SHA256 f9a18acd8f169ac10b4477138c8919134ef59f10c20aa8f7deb135c1c016dbcc
MD5 365c84f4ea687e56733c525ebb685355
SHA1 c32151f6fbeeb9e759be1398ed7960a893bc659d
SHA512 c8969191a64fddf94d7aa1e54d6cc85ea70164f5acd07c25540518ca5c578bd5a0c7dd5ab6e2d062607e59858274fe4e36bb67b34df520ac710f44d8001e187a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaEaOf3mnXoZ643mnXoZ6i6cMJliLaL:A3k03kHRJ83k03kHRJB
TLSH
T14885AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe$

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
Size 2.2MB
SHA256 9af18eea8581f559535293c5d9d92eeb954aae0183b3aa726725a31d65a2912d
MD5 e82382c6a40831a1edf472ab858d5207
SHA1 84f449cb2e4ac4cf32e7f046704f53890357d57e
SHA512 7cc4182e08c09777330d9b6e5a0a848d522e0df87a7801257f106bf8c547b8a25d250c804f3c32784d163e9c38de18b0f3b105a99b017f0024140a33860938ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaEaOf3mnXoZ643mnXoZ6i6cMJliLaA:A3k03kHRJ83k03kHRJxTd9CHKyao
TLSH
T149B59D13E7D400E8E12BC2349AA64622EA757C561B70D7CF136896152F33BD0AF3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe
Size 1.9MB
SHA256 a78fd8e75a69f2244a1f8c8f7a463a2db268fceba9689c61053e48b52ddea2ba
MD5 9eeee118c35dd8d350c147bc23a37da8
SHA1 37bdada81a03c9c0e24df5474ab1ac8f1c398e75
SHA512 4d7e23d126d5891e1186f0bf4264b42b59b500e757cc2852b497ca2cd63aa3ea060d961178461cb864242bba68b0d55bab86b70a4e5f74d2906dff63e4b68e8e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaEaOf3mnXoZ643mnXoZ6i6cMJliLab:A3k03kHRJ83k03kHRJX7gi
TLSH
T1A195AE13E79500E9D10AC1749AE68A23FB75BC52176097DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe$

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$
Size 2.3MB
SHA256 f8e9f8f2cec25d48961c33fc711dc070be5acbe368969c078b0f6a0802f3339e
MD5 9880703bce285b82f9c1c68d0c3e98e7
SHA1 7351aa9e607791b6cc7e71b134cbeeddded0e1be
SHA512 3f622a6601f88c90d12732e35fd973ae947aedf030f1edc8c7d9b9e27eec1374ccc2385bbab2cc48cf599334cf2e53acf175afeb2aa8f70564c7cc2726a2303a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaEaOf3mnXoZ643mnXoZ6i6cMJliLaH:A3k03kHRJ83k03kHRJMT9t2
TLSH
T13BB5AE03E79400E9E11AC1749A968622EB757C561B70E7DF1368C6252F73BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 2.3MB
SHA256 0cc0505234026bda3d613336b2c4a881417c5894b79aaedf4f644d64e6cd7e4e
MD5 531594baa1cd6c001495d5863a13c800
SHA1 32367d7272c58fb4027e6e99c29734aeee6ffb1e
SHA512 d727cf7cfdf253ac88cea89ac865278d37de4d91d5a7168400dba15d33871f74536a3494869c04ceff55db9be5abb56a27b98b74a8ed9701ec05ad9b7e95cd97
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaEaOf3mnXoZ643mnXoZ6i6cMJliLaT:A3k03kHRJ83k03kHRJdPji0Aj
TLSH
T18EB58D17F6A401B5D026C178CAE69A67FA7178421B3096CF1358C7293F63BD0AB3E365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe$

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe$
Size 1.8MB
SHA256 352344613f9da5c6b01f20252e5eb5f16f8acbf44e7c4688f0d9453d01fd7ab5
MD5 dfab14c3b6602645cdc95be1cd717aad
SHA1 ade3a7b7279f2f68fc70b259ed8fb5df425086f6
SHA512 77e854e6991cf9e4848bfbc747821803d5f9861b91f8b6b0102fb78c6bf07ddc3311ef703405277ec331a34b0b80e96a1190addaf81c4cee24aab45986aad714
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaEaOf3mnXoZ643mnXoZ6i6cMJliLav:A3k03kHRJ83k03kHRJB
TLSH
T14E85AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
Size 1.8MB
SHA256 e151561a145f280c089837a493a997d564e09a8a0db852370132a8f3504a061c
MD5 b3ee9b5ee3ce8b3895458fdc98a982cc
SHA1 a46135b64539eb86d93fa8f0996feb07fffa4c0d
SHA512 328a4ff44b115ec24942a8264a3455f3fc829122405e55a8dd86422b64d4d018f1b66c153d430ce159b7d89ebaf12b5a4f7ed8f78c445d303ff1cafed0add2c4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaEaOf3mnXoZ643mnXoZ6i6cMJliLav:A3k03kHRJ83k03kHRJR
TLSH
T1C185AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$
Size 1.8MB
SHA256 098a0453132454cb9a986ee0d5b18735cda7b7562e7ee7d81cca49f1e4d2a5cc
MD5 f7816435d60d03f7592452c072283589
SHA1 887a51beeb2fe84a099433eaa9ed636e18b93c9b
SHA512 edfe3b66d10aea1d8410189e075d1a3353d9e4f1552d0625b80ea420788a381cf78c50123eaf4a0b8e8507e638d0b627501a788633aa076bd39cc82da8ee16b2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaEaOf3mnXoZ643mnXoZ6i6cMJliLa0:A3k03kHRJ83k03kHRJ+
TLSH
T1D885AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
Size 1.8MB
SHA256 90a13363b1f4d7052adda9a39a65a3efb45b5d585156da323851c3cddf53b0e1
MD5 dbf0a2bd61692de07078de1e7307b49e
SHA1 d575f7532986a75ad91361c606455834867c2705
SHA512 6961828b7ab4259c12aa72ec2853c30b9b7a8a95f964f95f2bb1e7761998cceacd201467aed0fe2f08d4016c202a77d6f5fb0d122d43a081513a41ab42221a27
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaEaOf3mnXoZ643mnXoZ6i6cMJliLaV:A3k03kHRJ83k03kHRJT
TLSH
T11F85AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XLICONS.EXE$

Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$
Size 1.8MB
SHA256 1b2d9a199c4373d707a172d3b277da125262080ff7524c324d8bf97813bb2b97
MD5 998a75df1343abf69ffae89fab9b11f8
SHA1 25644ad84ad07b54b71157687d0368475a62f929
SHA512 b96f152af11b79827a174475210c55079b528dcebc2dc8efcfb0120b504be13485d08b4fa24e34fd1a003898738ad019ccfaf59de9ca6165a7c6a0dfd1733a34
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaEaOf3mnXoZ643mnXoZ6i6cMJliLaQ:A3k03kHRJ83k03kHRJy
TLSH
T14085AE13EB9500E9D10AC1749AE69A23FB757C52176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4132-40-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4716-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4716-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads