dcfe6b3fbd649db5c1256c27f7d8409c53fc51ae1cf68cb8d9bdddd757427175

Analysis

max time kernel
91s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 1.5MB
Sample260723-ryrb5sel6x
SHA256 dcfe6b3fbd649db5c1256c27f7d8409c53fc51ae1cf68cb8d9bdddd757427175
MD5 79a76a29d48c77528a68262d894cf5ad
SHA1 4ea8c082302d86286a8e8d0ad760a58a013a6127
SHA512 8bebeb3b40b94b23bbf9d698afb8a64dc6a7bbf4c8db0e1fbc9f0ebcf1be1a4843aabd8adcb74bb8363ac698b9a0b05fddbab63059d96ddbe4789b1bf88d61b8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZK/5SYTqMi8CtBd2QHCHmTBW5:A3k03kHRJ6qJtb2I
TLSH
T156655A16E6A442A5D06EC079C7D29A56FA33384257F086CB13C5D63D2F337D19ABA323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 11 IoCs

resource	yara_rule
behavioral2/memory/4520-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b807-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000016b40-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4520-165-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4176-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-229.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0021000000016b40-232.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0055000000016b40-584.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019993-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019b7e-697.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x003a0000000187ef-1283.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 8 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000300000001b807-5.dat	aspack_v212_v242
behavioral2/files/0x0005000000016b40-11.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-229.dat	aspack_v212_v242
behavioral2/files/0x0021000000016b40-232.dat	aspack_v212_v242
behavioral2/files/0x0055000000016b40-584.dat	aspack_v212_v242
behavioral2/files/0x0003000000019993-586.dat	aspack_v212_v242
behavioral2/files/0x0003000000019b7e-697.dat	aspack_v212_v242
behavioral2/files/0x003a0000000187ef-1283.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4176	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4520	2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
4176	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_79a76a29d48c77528a68262d894cf5ad_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4520

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.5MB
SHA256 dcfe6b3fbd649db5c1256c27f7d8409c53fc51ae1cf68cb8d9bdddd757427175
MD5 79a76a29d48c77528a68262d894cf5ad
SHA1 4ea8c082302d86286a8e8d0ad760a58a013a6127
SHA512 8bebeb3b40b94b23bbf9d698afb8a64dc6a7bbf4c8db0e1fbc9f0ebcf1be1a4843aabd8adcb74bb8363ac698b9a0b05fddbab63059d96ddbe4789b1bf88d61b8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZK/5SYTqMi8CtBd2QHCHmTBW5:A3k03kHRJ6qJtb2I
TLSH
T156655A16E6A442A5D06EC079C7D29A56FA33384257F086CB13C5D63D2F337D19ABA323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 2.0MB
SHA256 cf19ed4eaafdf6735dd52ad73b74f40019af20e893dfc1e62751b222361bd374
MD5 f2148266e4227dde7c51ada7174d83ef
SHA1 07aef9b9a578eab1a183a5a5fb1284c0fe7b3c6e
SHA512 f8920af512750f92de94ff9f69d8e2d29b528d230f429c9b0b6d5ec77468e797ebb4c103bbd4165fb3eb4210af90ecbbedc1689058f0398d5dc17c5b2a4f916d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZK/5SYTqMi8CtBd2QHCHmTBW5X0Le5ji0hJ:A3k03kHRJ6qJtb2IQPji0Aj
TLSH
T1BEA53916F6A44365D07AC0B9C7D2965AFA33384217B086CB13C5D63C2F277D19ABA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 50d15b464fe2421431b565c09768c7d007a39106400cd94ba3e285bb478a8d97
MD5 199c4c4565fb509c19634ed752c4a17c
SHA1 7f53f97cb8acf6f3efb72161a2f1c50bdb49f7a9
SHA512 d19cb53d96adc0cc4db0cf3d61627f16023e6914c8ffb1c83b7c105fb39675d5904a7a23532d00c5f19a8b30c2f92a25380611998bcd528f121821b6fa512a83
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZK/5SYTqMi8CtBd2QHCHmTBW5ko:A3k03kHRJ6qJtb2IK
TLSH
T1D6755A16E6A442A5D06EC079C7D29A56FA33384257F086CB13C5D63D2F337D19ABA323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe$

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe$
Size 1.7MB
SHA256 64bff45bb4b2618dba244a925e704cf6c20507bcb539ee2d4fa22ae080cb5781
MD5 f03abb1b7768da8b40d1b0c887e2a8fe
SHA1 f11b57d01621e588390443a8ee6d68a04ee916a1
SHA512 28e9f4512da8108b0d822df6a72b8a11602e53dd990c37bfb354aaa3016e5f0e848f229e584c6ab81ed8b3040798248b9e3ac0d9020769489b82d5b7d2e1f0c0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZK/5SYTqMi8CtBd2QHCHmTBW5FZM9zFVSOS:A3k03kHRJ6qJtb2I6ZM9zfu
TLSH
T1B5855A16F2A442A5D06EC079C7D29A56FA33384247B086CB13C5D63D2F337D19ABA763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
Size 1.5MB
SHA256 c2dbc1fa63b09e92685d0f7c6788a60cfbde8be299f52fc6c4154693c13fb328
MD5 089ad2d9a962e92ab8eb594e85b5d927
SHA1 3360ec13880a151a5c5aa12aa8c5409d1ab502ba
SHA512 35af50005e788f014fb44a3d0fc63a59216c4a1d5ec7de5bc5fd85bd2c6dcb6356472bea167a8084ff32501b9883f6dc738d836dec4c8775e7b5d3794534b4a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZK/5SYTqMi8CtBd2QHCHmTBW5T9:A3k03kHRJ6qJtb2Ig
TLSH
T1A7755A16E6A442A5D06EC079C7D29A56FA33384257F086CB13C5D63D2F337D19ABA323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$
Size 1.6MB
SHA256 8cf33ffdb1ca4d3b9ab4cbef27e63bed4c6855694f6664251c71842a9905ced0
MD5 c98f4f6797ba79ade9f72290b98eb52c
SHA1 458d8a414ae4745a3d69ae74801c48fd1c5c9274
SHA512 34696ade24472c649f87f1c34d5e6cd8a73c6420691b1887603a395ea3051fbeb0b93035452261b77ebcdc848c6786da7cb5f4707908c5ffd3c05974f4464fdb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZK/5SYTqMi8CtBd2QHCHmTBW5zf2a9:A3k03kHRJ6qJtb2I47
TLSH
T1A0754A16E2A442A5D06EC179C7D29656FA33384257B08ACF13C5D23D2F337D19ABA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe$

Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$
Size 1.5MB
SHA256 a90e643b1528c60ff8a203fb7a4918340e310dee7c92160bcb29a6414c3bc97b
MD5 6b386afa36bda0e56794baa6d05226ad
SHA1 fb58d621197e1d44f093e55e6ec3e9754b71219b
SHA512 4cd5bb15737a841be67d00de95ac803449cbad7d505d7d53b2514a9a8f2151272e50f7858175168ead833f482f9635110ccc90f430b8e005c0d0ef1969a99053
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZK/5SYTqMi8CtBd2QHCHmTBW5NC:A3k03kHRJ6qJtb2Ix
TLSH
T1B8755A16E6A442A5D06EC079C7D29A56FA33384257F086CB13C5D63D2F337D19ABA323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe$

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
Size 1.5MB
SHA256 da9c23c62130837dce1e7100fec0c311c39a68f9bb890005e214468c0683a1d9
MD5 7beb599f524143afc8a72224b54d2ec7
SHA1 2094774705c894065bba52320809c637c02e1aaf
SHA512 a2a5329a8bcfd181fd3e28d8dd0449c087576a6cbdd2d8e340f0a3edcfa4dddee26f5c4de034b7ac504a3a097e828fe856a45ff0e4f062df779ca71adeac82b6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZK/5SYTqMi8CtBd2QHCHmTBW5DF:A3k03kHRJ6qJtb2Ig
TLSH
T13D753916E6A442A5D06EC074CB969656FA333C8107B086DB13C5F73D2F336D19ABA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4176-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4520-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4520-165-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads