0be108ad32b48ade98a658bdd903e73a41fe8031d877ec2990fec2cf4ba65e64

Analysis

max time kernel
107s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 940KB
Sample260729-fm95bseb47
SHA256 0be108ad32b48ade98a658bdd903e73a41fe8031d877ec2990fec2cf4ba65e64
MD5 fca797d75bd4fc0c6aa49fc69b1e3558
SHA1 4eba7399e57d667537d6c8ee66cd3a9ab1f747a7
SHA512 00edc7a164d8a23670dd7f3a05ca417d18b716b9295f3df6d226c12625f269516b9934b6785eaa23f1062808736c7f62976320f5ac385a053142fd08c5b8d2f7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2c:A3k03kHRJARJF
TLSH
T1DD259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 39 IoCs

resource	yara_rule
behavioral2/memory/5816-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c56d-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000008f19-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5816-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6848-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-256.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-311.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-474.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-499.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-596.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-627.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-718.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-824.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-856.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-988.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1124.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1150.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 36 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c56d-5.dat	aspack_v212_v242
behavioral2/files/0x0003000000008f19-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-41.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-256.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-311.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-474.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-499.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-596.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-627.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-718.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-743.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-824.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-856.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-887.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-926.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-988.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1043.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1062.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1124.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1150.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1175.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1219.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1322.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1341.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1366.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
6848	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5816	2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
6848	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_fca797d75bd4fc0c6aa49fc69b1e3558_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5816

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 940KB
SHA256 0be108ad32b48ade98a658bdd903e73a41fe8031d877ec2990fec2cf4ba65e64
MD5 fca797d75bd4fc0c6aa49fc69b1e3558
SHA1 4eba7399e57d667537d6c8ee66cd3a9ab1f747a7
SHA512 00edc7a164d8a23670dd7f3a05ca417d18b716b9295f3df6d226c12625f269516b9934b6785eaa23f1062808736c7f62976320f5ac385a053142fd08c5b8d2f7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2c:A3k03kHRJARJF
TLSH
T1DD259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 b6bcb8ff81cb47a58a2e43d34727204975c23c9fb3bd9709b38ee21ca2088534
MD5 d607f575f6175223b9eed78ca2f0b2ef
SHA1 b2de0ef1b33b4c74eb7284d372b73a293571ce66
SHA512 48488408f730370ab0f88f574c0bea6b44bdd5d467df0275ec31e2d7054f335064b38f09ecbb7ab9da536877510d4aa1c1228eff742da8da2f4e2e00822fe297
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2k0Le5ji0hmxNrM:A3k03kHRJARJBPji0Aj
TLSH
T1FD657B17F6A802B5D067C1B8C5D29A5AFA723842173097CF1394C7292F67BE19F3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 d56dbabe5f3fe3fbb0740e2b000dd07f41c855d9eac1d2cdbadfa496c6342ede
MD5 85fe0a40c4fdbf4c5da8e2161e8feb47
SHA1 da3cd59ebd43dde7c16dadfeed55fd35db29a432
SHA512 8ad16a3a8293c6581983e5d819270ef593e23b57d1c5b6c5fa9209254b7e1e02feea830db721d26d2c392116f5458983806db9142abefeb55d45dcb5ce7f0651
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Oa:A3k03kHRJARJ
TLSH
T1ED259C03E79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 e70ef170d41ff07e5c4e5a4d866d2c7b65b3369d21b43443e03ef03fa2698d52
MD5 52ca6bfc9f67b2ef6611cf746e82e933
SHA1 0980f99e588a9bc1f7133cba2fe30359f1ee52c0
SHA512 883b884110e04bd6e31f5c17f4042e53d257e2034609c5b85139e6e3fe940090a2420912128e5a82047df1d3c9b2df0a5c2971d82b45bed26ec1c5508f252f9e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2v6:A3k03kHRJARJN
TLSH
T166259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 947858822b1353a5dd00c5e96060cac97c4e5839f262ad23f2894d47c510feb5
MD5 01b550ad71d97bd707f96b14527bfb4d
SHA1 2dc22edf556acf2b55be19ec0c4a72b16e3c7899
SHA512 8876dac7f60dce14966a904aa44247e1bd68c636de9d759f50cf048aec71ef9b4dce6e0b765cc525f1a871d8786411ac822cc02e1ce9f0bca707bc72f90393ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2/9:A3k03kHRJARJS
TLSH
T169259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 f8d5ae84067a31603bad55ce0858303dc41323da9a815f6503dfe61fb122bd35
MD5 1a6ae59e885398b37ef9ff944fa34445
SHA1 2e4ea5b05cabb7866ba0e27393073d41b7db1af0
SHA512 5e875e64946a6045a36689273b5c46858ac5080c66893e6e263102ea6e0fba9102a861fa3d3a709481e1ae2328c4379ce2876bc492c6743d7719ee2e1efa5598
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2bc:A3k03kHRJARJ/
TLSH
T1D7259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 e2d123582ea1a7d6f62f1ecf7c15d091bf20702e3d26eddcf9e251d9568bf920
MD5 72d648261704583c0c06e6e40c666cbe
SHA1 b976fb8ef5ba12c36e0c6a2ad26b5a93738ed1d5
SHA512 80075f4ac96f694d879e6c23d5911c6c4c03e0e10b13bbae3d22a149705d1561b9d9442a848578a2bcab05235eda1727c94c58cf8486be20ac1777480f98de7c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Ep:A3k03kHRJARJV
TLSH
T10F259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 3a8d32158501975004238cb6c52e75ecfac77d1ac99585e9a8359bcf34f61ff3
MD5 507b5ebdf38c5d48e8cd1147af2ac8bc
SHA1 c6916271f382f9520e8e5ff6e6868e8cf473f552
SHA512 5372120099f1b2d53ac68693085dc7280a349a3d3f958fd4346fccc50cfcde2d1fffc84f8e4d8a44b60fa3c22908f09d54a5364aff2c2098982ecebc8ef5747d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2LN:A3k03kHRJARJu
TLSH
T15E259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 1c0ffc9938eb131eaf8c60c423d6e91923db85942cb5157505f78a2e607204c9
MD5 347d053884da3b45ee6078dba6375bfc
SHA1 94f2171a0595d380f43becc3bff0f8b1b3c8cda2
SHA512 338fcbd42541ba67ad0e00b591795efdfaa62e92e930703a34da12568c1a84d603df528b10f04a83eac961bf4b83ba751bdd73a347850c50de9d8dd681b0ad27
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2ZF:A3k03kHRJARJs
TLSH
T147259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 4ccba9612b0bbf18b36091c26e415df97b2047c20a9c21a4cce450d7ef039011
MD5 58f0405fd4f9533ccbc131691ca0b591
SHA1 d68d968b78c23944ef50936275852652d94c72ef
SHA512 97a87ddf4e14d1566ab32497d40763cf1ec70e5d36f84e5f51f751b4a7b892f855f230ba09744b2009c5bc081139c585c3cb389e3da5a569218de2d90720ef7c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2yC:A3k03kHRJARJ4
TLSH
T104259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 cccf812e22d0f1bc1bc9af51ef836d060207f9f521169578b79fafdf44a7e402
MD5 5b7430682f82a07b2ff7538de8860d05
SHA1 ca42b632cac0ccd1b326ea50aae744de723d9a45
SHA512 bbaa6af00b1b21dc36fab72a8ad3e70e2863f1088c9cb3e9307900dc0b4f0221e1eb6ad3ef85a36e2d1839351b923393ac962d29aa3d743c4585222b0cf1a210
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2tw:A3k03kHRJARJV
TLSH
T14F259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 88c46ff1cdb3885c571ce1beda28290913f942c07042d3485a766f9ec7a1242e
MD5 4feb05544ad6f98a93961793f379558d
SHA1 cab69ff73b8bd8ddbaac5f10f9ae567072d44d55
SHA512 90d80cacc83f916aaa87a92b6b2c2c40fabdaeaca4ebceae02f23418114d74f99c96c88204877eb9afcf1581fa9c37649e036716440befd7bf5fdea68fe1b8ee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2cT:A3k03kHRJARJJ
TLSH
T1DC259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 0fe32bad459e4089aee4eb176443376c85e4ce708a70d0638cf0395ffc8dea81
MD5 6dcd7f91d299389d792dacd0240bbbdf
SHA1 1fa8c77cf8fa347bb20b81ccdf8fbdbce8f2657f
SHA512 8086e16e6cbf952eb64d09953f49edd492154947b30d16f867eb1e96f65421aef8a121c078934a301a9d754421ccc7170fd05c5f3eb01147c67e6ce51fd36c30
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2wu:A3k03kHRJARJO
TLSH
T161259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 b2639ae1f80a00b7a89541190bf39d618dfcd72a8d2b056348c22aff4c319b78
MD5 e404a2d750889a15e6e95d2f7f043e8f
SHA1 94f539718f8a97e0b21f8ef8695e5dfe58254606
SHA512 04cd2780298bc89e58674acb51490fd6ca186edc9b4de106669197c394e285ca04f6bcc529274827742a7809c24de7d964254180e9a302672d994d23af6b9985
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Ob:A3k03kHRJARJP
TLSH
T18F259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 e6309bbb0b405d589e80db718f2072ba8a339e2594e2bb8a301900f17297bb2c
MD5 0bcb1607dfb322c9eaba83d5bdd2740d
SHA1 364291b56e6ec866f2fb043cd30f6260c7bcb3a3
SHA512 2b67768c59cb473fc53f6dd0c88937794e15b3ea12d7703c46c6ab603c58c66acb7a37626266d25914aee6209512ac405111e6c420762ad76e45438c1351c34f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT24f:A3k03kHRJARJH
TLSH
T153259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 f09174991f8ce7749611c971fbf218cd64595de225c99944521f97660ea7af22
MD5 ade6248cd87083298fd0b7a3c05628e9
SHA1 ca33a934f76c146082bed309465df208c7cfd128
SHA512 75d1b146604e8d7d26ef330bf9fb773bfe9d683bc0dfb911c517eb789e6e5b423c2ba5d3187d69625576da717614d6882e74778bc60e8a277b0ef59070efbbb4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT21K:A3k03kHRJARJH
TLSH
T11B259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 85231408cf53d808043b93b0e9e30daa463051666189eb3b058a04a3e048d404
MD5 143d46bfe9ab5ba6f7cc9fe0807da2b5
SHA1 93edec4c00b37dd39f964984ddef25bd83a70faa
SHA512 af75a22f1b614b3cd24bb8d4b983b5f1a57c7f9d05493e3ea14ff9a341c7ab6735723184579cba71969bd5d30f149e0c739c32389738938f669b5b79cd9c7192
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT22k:A3k03kHRJARJi
TLSH
T1E3259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 fdf4df9f29e2d9c9b2e5d2e4f67180615694f558558b4e40fe2f744627c6600a
MD5 bbb917c1209e3e4878cd213027a2272b
SHA1 7d74dfaa9f1be5210cc4473bba227e176db577ab
SHA512 d0eaaaec42367f0777990d031a186e7d01f22810b853df533eb2a9d5803c0b3c24f500116cbe2ebdc3774a908ca1576792925a8192be9b4300eef660cfc18bac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2T0:A3k03kHRJARJH
TLSH
T11C259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 e5743392952c018f62d7730dedd453bb2d56149c06c7a2c6230ee9b44cfaab51
MD5 906e796978090d197f1a813e7a4fdb34
SHA1 0a20de1e05c9606fb67c27aebbd166d4f9829151
SHA512 48f632e284f0c9de450f6472f296a3555f33e785bde5f848e6a63e1d30bacba0a88531c08fdbe9e371e7a764a8fabfc69c43726ed4bc7f3177bd2b37bdadf93d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2ig:A3k03kHRJARJ6
TLSH
T1C6259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 5f8be4b32bb935023f593bdcbe76940c3a207c759e347a5fc419a49ba898ac08
MD5 f2d5f130469906fe4896012d01c99dd9
SHA1 2186db71dfdaa16950ef2c520aefd617980bf24f
SHA512 c5f6faaae249f44fc112c704ba6bf208c558306f08c2121b23b43b75092d5eeba402e55b1a78d1a0b19112b7453932edbb2943d4260672dfe72d6e540d8a6f69
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Dr:A3k03kHRJARJE
TLSH
T18E259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 cdd53902ba335c37eafb3c776868353df24afcbf4f561b4faee4623cf47524a0
MD5 739baefe7fe944b85fca77f82c8486c5
SHA1 893077d74cd6417f6e269e3010fc9d223201b091
SHA512 20f649d5c1a2b39abe8701d67755b0c09410f098009829477194bf90e7ce0098ec310e4c1e07ab6f8d8e8b96e3e6532d6b9191cd7835302a7d6d01a3d57c192a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2ln:A3k03kHRJARJe
TLSH
T175259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 24a62e1c5b91d65c8182172790e428678ec5e75a4b1624bbf5ad5e8721f46792
MD5 f1a01b0ac0a46a48572d5a2d08d6def8
SHA1 5ce4be05b855a8e7f582d7696f7689ad0354cc4b
SHA512 b7fc6f0722eb6890670b3651401c52fc086a83ca3e29555dfbfcf062ec2140aaa20a1d30e5a5bf9a0bae8c97605bfed3faae6fa3938e290522bd6ca5dcbbede7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Rx:A3k03kHRJARJE
TLSH
T1C3259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 07739ab149b55c3e5af18ed274cdb0a3bc28cd2733dca515d3ea39dd7ece153e
MD5 1a67c8c29615288efad61cfc3a18cfc8
SHA1 301bdd4bfe1b88f8c093ed3d2f5243d16bdb4750
SHA512 72b926f07665dfd5490f38d7bb9f2b451f19f88999a8a14ba0d99ba016cc941b9b1652ef81d352de738ee2c7858796ea978be49746ee668b4ffef08fb70974d6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2/A:A3k03kHRJARJv
TLSH
T144259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 dcf03831086e198c87534a0bb7d74f618dd40becb3d7afbb86b7c44901a0ce79
MD5 506731d54fd321712d2474771e17c9d7
SHA1 c9444f28cbdfd0d361e5edc4d5a2715e5e090ee0
SHA512 ea7c8aeea41a827222d19ee905e65a4f1b2a1d0eeed1244adc23497b5b33faea6ebb695f6adea80468c32085699745c7849c923662585d1aff8337120f9d7d45
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Q9Q:A3k03kHRJARJi
TLSH
T1B0259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 6ae2b1767cc29d2330d1ea9ae2c9d5fa97b7784763eae9650badf074b36bbf69
MD5 438c93fb68d6b5d72d4fb9b56d7dee9c
SHA1 a0524f7568a7683263d473c473c5ed6de2e78e47
SHA512 3f02996af010883b83feb8f78b4cc4a9e14e1755805c1947bb34e2a1948721da7543fa84f758340a9976aabf568bedd3a394dac636e06dd508a70b0f27bf25a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2x4:A3k03kHRJARJR
TLSH
T148259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 8f0c0964b85794e2c03d81895d90acbe3a8121d559e5dda9f70d9d629521ed63
MD5 1248d981a536970c73e545e8f72f300a
SHA1 efa7f2be47bd69c3d1f05e1619c76d5f46c8f1d9
SHA512 7c2e8087ed579f38ed8cc155806467caa9f9367d7890bc127de9c25ff103122b2d12ae1acbd59cdf2bb1b90b2ffad0a312adbed2785f7a5a7530a9276c230278
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT20u:A3k03kHRJARJs
TLSH
T1D7259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 e554226fd3f1cd493b3ad9f02feed866524b36dd27f0e0ae4abd0d3e94d1d847
MD5 51117f2b4e4f0b275c7b29ca862fec28
SHA1 5ee475e6ccfaada8ab1974fdf0f74c5eec34f47c
SHA512 725fa3677d09f2c50f8f65345ee5ebb93c04ed36c1c2d97de47d35a0962232d1447c3099c362c888eb97c3fd3c138e98679bc65db69f0851b6dc1fbb1c0a9af5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Fj:A3k03kHRJARJu
TLSH
T1FD259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 ca3e4a1fdb41029d2949540a1f50602528da127118b01fed0eb6968eba47542c
MD5 c43c6825d31e0404973a0a02a5649a01
SHA1 29cd9df93795030fdd31b4d40f6f5ff16c5e09fe
SHA512 57f529ab0515e9f84e1cf9702ad769be29eda7dbed29076cccbf0db019e628a06936a110b5ba314c805f94c11e982f211dd4cff380327b66021d3272d88d0b3e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Mg:A3k03kHRJARJi
TLSH
T101259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 03b6be083b588d226182557cb4e7899f6cef69d6730ef0c5fea8fbbf1dfed32b
MD5 17f9600c234ee7725d73d20713f28de6
SHA1 1d358b6cbf93d0ecbfc46d0cee43f643e0977f23
SHA512 23e891e2d7df10f74778c2e498d0f8cc1805e7f73d7c3d60309ff2a90749db3898cd93e564dcce5a2974fe0116bf042ec02b8dc05564e96d30f223a9f23a8fed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2TI:A3k03kHRJARJT
TLSH
T19F259D03F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 3230b9be1c7deadeac89d54ed378b08c1627eda80424cb384191e20a6d8bae47
MD5 c626e6fcb9038dd6055a50da41bf1f33
SHA1 895831f19ecee59c2e21e7b06d0f69285c47aebe
SHA512 9df7f7a2559aa335ba029a98a3d6aa9954f6a3a7ba459a3abe6fd435f01cb780accd25ffdd0b77299b4d39f49922e3bc640f004abc35e974db5858e084cb0834
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2po:A3k03kHRJARJt
TLSH
T105259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 807e57cf8fa7e6ed1afa443673bb117551018cb2ba1fe0975e4577dc07f1efa1
MD5 bd62c488a54531c64ce71b42a4092f53
SHA1 abd4bc7b73864c63965aa3aed63f0741fc6ee9d6
SHA512 1a458e999dd04e9141ed0f8fdcd27c8c337971d273a5e86506f4bfb0161df419dba9e89a930c06754007942025c3badfcd83cf5b16f59a6a0ac8ede4fb997050
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2a+:A3k03kHRJARJI
TLSH
T1F9259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 7418baf8e4eec2d57fdf42aa3dcc5cc75ec1bd87c4b22c1b9266856d31c9d3c2
MD5 32f24bcafe5d02498a73b4799ed2c4ea
SHA1 a22e72db4e1aad00229a90d2449d04b8875d624a
SHA512 3df92c562f592c98185024c367d6a16c18c802d4de08c4a008407f284b3287841aefc6cc68ecb2a8cd9b3d13781186377a2b0dd7203df13224e5a35192199f63
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2aQ:A3k03kHRJARJI
TLSH
T140259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 e7d852f0d3e0b715b02c6d05b42bdc374ebfe96643eb6d3322ea6e672bbd4f6e
MD5 923129c888704b43d3d12585d554c5ed
SHA1 adc1fd0751694cabec7c37ebed9d46f81e5a7642
SHA512 970f098ba91d8d9e17556c02feed6ebf8fe7bb44a959aa0e9cead4ddded1a1f12afc903dc6165a92de01eb1b2ac404a82afd9defd26d19d8227ba1c22b9b9ca8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2rX:A3k03kHRJARJ4
TLSH
T134259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 5ed07027fcb4ac5bd106a8003cbbb86d076244cfda5e6bf553c12bb765295fd8
MD5 a03e58cf8082cf4e497e7b24cd932fd2
SHA1 8f3cca55bde4da3126dc1786dd7dd223b81b770f
SHA512 80c117076d6d60f8b50fe1b3c627a190bb69e9d5fa825ef760b2189d5c64c98440987948d228e17b3fa4a4ef92e2ad4aacc72fe111b9204e34da7a1532af9f4b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT25L:A3k03kHRJARJK
TLSH
T18D259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 dc0cc216799e569ffe04d138667e8bafd18d9e715ca3a3c5059a813a69b58ffc
MD5 ce0d4dbc4d9b3bd83c16e5f5e275b14c
SHA1 2873b9e61e3cc7719a860cd1917f4031fda614f2
SHA512 c26e0b89f3fb332417becca41b0e9d2d5098da9db82f9e4d163ab0289102c09892df2ca7353409f974ddcff81023ff0610cac1876485bf82641f3d3c1d343796
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2nM:A3k03kHRJARJH
TLSH
T180259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 d0e0acf8ccef1d2a6a184e3944b34756fe437426335b89575eff8ee3b0bc6629
MD5 c6b7967af1f8df3950be4a65e594da67
SHA1 0b1b09dcda085884d094278b2b7d4ec753cf16dc
SHA512 81e139e2b2c99c685f27af775ce87d461b7365efb6427a2f554051d72376233e413125770c62622ce372cb15d586f8e200b55f7f0f2f4b4f4b627e37a992ac50
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Qh:A3k03kHRJARJ5
TLSH
T10B259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5816-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5816-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6848-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads