295592e0a5c40e5d98733956d1e38a72c3d67803fb9dc165d3903e9268bcf114

Analysis

max time kernel
107s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 1.4MB
Sample260724-25a9lsvglc
SHA256 295592e0a5c40e5d98733956d1e38a72c3d67803fb9dc165d3903e9268bcf114
MD5 08a29653012b48e10c12177c85308fe1
SHA1 1203541a3374647290dfb3731bc4a71d2a597122
SHA512 1c04055b68cedceef06efaaab432a7ba9a2e62cda2aa2d3e1a00edecf5c9edc03f2a5c762f5139bb86da0c5afce80846694919cbd778abe670d73a377f5c4741
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QoYYTqMi8CtBd2QHCHmTBW5M:A3k03kHRJrqJtb2I
TLSH
T19B657C26F6A442B5D077C079C5D29A66FE3238425B308ACF1349D7292F27BD1DA3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 7 IoCs

resource	yara_rule
behavioral2/memory/2636-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4f9-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2636-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5908-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019b7f-686.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019caa-1273.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4f9-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019b7f-686.dat	aspack_v212_v242
behavioral2/files/0x0003000000019caa-1273.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5908	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9A8DEEB6-1F0A-4CF4-BD83-A8EC662094A8}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2636	2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
5908	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_08a29653012b48e10c12177c85308fe1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2636

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.4MB
SHA256 295592e0a5c40e5d98733956d1e38a72c3d67803fb9dc165d3903e9268bcf114
MD5 08a29653012b48e10c12177c85308fe1
SHA1 1203541a3374647290dfb3731bc4a71d2a597122
SHA512 1c04055b68cedceef06efaaab432a7ba9a2e62cda2aa2d3e1a00edecf5c9edc03f2a5c762f5139bb86da0c5afce80846694919cbd778abe670d73a377f5c4741
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QoYYTqMi8CtBd2QHCHmTBW5M:A3k03kHRJrqJtb2I
TLSH
T19B657C26F6A442B5D077C079C5D29A66FE3238425B308ACF1349D7292F27BD1DA3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.9MB
SHA256 b9f88a3fe08e4cf6b3e4f8176e8d083ecdf12dc3348da5da921ba8b60e41a628
MD5 df0951a43d876ef7de91d6892662e036
SHA1 54bdb6beafb5405f5f2ae5b5d526fbea6148bb18
SHA512 305d3c1a914ae2cef517d223a49ea21e2fdb8e1cef4f4d1baa5c46989bbc13438a9c799085f75532448b51f28fe8db162114375cc728ed5c2c51af602da16ed5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QoYYTqMi8CtBd2QHCHmTBW5MP0Le5jiS:A3k03kHRJrqJtb2IRPji0Aj
TLSH
T1E6954B26F6A44375D073C0B9C5D2A69AFE3234425B308ACB1385D7282F67BD5DA3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
Size 1.4MB
SHA256 9b1a40376c0563747eb5d09e31f22de049b90325a521e0b21d85ee97be382a1c
MD5 d4da2f3579fbdb17279855e0c38875aa
SHA1 df23d255a9e5dbf3a5e6ea7532b3fda7eb74916b
SHA512 4ec707d20b58a1463ad1c04dfec865c9ee6bb4e1b6fd57718d900f0d7a857979087856481ae6382610e070004beb67f5a82ad352a1b64c4ed652d15d53415f20
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QoYYTqMi8CtBd2QHCHmTBW5MHs:A3k03kHRJrqJtb2IG
TLSH
T119657C26F6A442B5D077C079C5D29A66FE3238425B308ACF1349D7282F63BD1DA3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe$

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
Size 1.4MB
SHA256 f4461f78451e102dda2da67f9dc5fcc29089335b45f0021413bf28246f2641e5
MD5 602665a0c67556a7eed7328061541307
SHA1 11c422289cb85c17d0ebff5c238f174a37569089
SHA512 39659e402b69c6316a1687ff044dff4c16f10f7fa7868ea80a0c620f760f3a3bf713594c4b05968a720d289bd11e2c131e251f097966c1f68cdc1a6bf3676e82
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QoYYTqMi8CtBd2QHCHmTBW5MLF:A3k03kHRJrqJtb2IT
TLSH
T13B656B16F6A442B5D067C079C9D69A56FA313C821B308ADF1349F7292F337D1EA3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2636-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2636-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5908-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads