62f358e6c196b6c809d620ca7ca1ff17bf5b59314c04c2329d5d2751ccabe2a2

Analysis

max time kernel
97s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 924KB
Sample260729-y3ebpsec92
SHA256 62f358e6c196b6c809d620ca7ca1ff17bf5b59314c04c2329d5d2751ccabe2a2
MD5 7f5bb98479c7ea06e419d7e7630afc80
SHA1 a24440dc00ef99e7015aab125d2bbb9a82c213b9
SHA512 f674fda7f8e96beb3c0b2dd7b5d98853d0d29004331be102d9e511f93b66746c6e33e6270732353d35dc8352977d1497a57f4e8899a4822970c5e09d3d4a9b55
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaC9:A3k03kB56rB
TLSH
T143157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5976-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b807-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-45.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5976-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/628-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-685.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1097.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000300000001b807-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-45.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-495.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-685.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-980.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1097.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
628	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5976	2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
628	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_7f5bb98479c7ea06e419d7e7630afc80_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5976

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 924KB
SHA256 62f358e6c196b6c809d620ca7ca1ff17bf5b59314c04c2329d5d2751ccabe2a2
MD5 7f5bb98479c7ea06e419d7e7630afc80
SHA1 a24440dc00ef99e7015aab125d2bbb9a82c213b9
SHA512 f674fda7f8e96beb3c0b2dd7b5d98853d0d29004331be102d9e511f93b66746c6e33e6270732353d35dc8352977d1497a57f4e8899a4822970c5e09d3d4a9b55
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaC9:A3k03kB56rB
TLSH
T143157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 67074d270e7c14c06c3a25f5a86f1f6b8d92c729168f1ace914fc30e46d5d33b
MD5 1b6c58ea0f8215d7e3326db4cbbfa0bb
SHA1 aaca92e7e3cecd44479efe21f764b60b4c39f445
SHA512 38066c50e79426d7cf4c0654af31eee9f6b7153193a2aff7edde446a880150bd68e5b94909aaf33081d17caa75c15147e257cc28279af0078221f1d254f234e1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCJ0Le5ji0hmxNrM:A3k03kB56rdPji0Aj
TLSH
T145655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 938KB
SHA256 1725cbb8d424e26e92b0f652ce18e3827d4dfb4b2fc8d2c385ddb5945917c5f6
MD5 ea13d7515e88bb60d8e8d26f28739ced
SHA1 04891960feac7282be31947692981b8d007834c1
SHA512 1c2670c6e3a3198348a990854375db553b5a77b8a78d7be56ec1d76a689d54c8c67626215e16cd0b787b30826190e65e87f59bde0a7657ba45bf4a70094ddd4f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCba:A3k03kB56r
TLSH
T117157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 947KB
SHA256 c8070975aa0273288b5d0eb80f8cc08b6279e3b6ed61bb8e359939fa1f0ea543
MD5 7f6e5105ba9a699f8f1558899641d15f
SHA1 2bce0262649fc6546216a1afa2cc9f6a500692b4
SHA512 9f07820a73057c0cce8792ca9093d1f45817938bf8d5ff6ea6659d01c3631956b5619feaecd498a9ac821aa2cda4b7e1e860a582170c34da1eb2896cb062e05a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaC66:A3k03kB56r5
TLSH
T130257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 947KB
SHA256 fd06a8ffe63fc38767f8cabcc91cd23db978064da88d7601bafe2b57b51287c8
MD5 b7c1b0f74fb263e6bfe2d122491ed1bd
SHA1 955ac4724a1080e48afa5b2be20e340996a54010
SHA512 d580ceb810c7dff068e289f288fc88fbb1c2503df34413a3f8716c19b048a85e67211bfdfe0f79e4d9db989d0ef27a09cbe64916c59af91fee6ea63f3021dd46
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCyN:A3k03kB56rg
TLSH
T10F257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 947KB
SHA256 cc496ec655ce057aba3f1c014d1434952267b3012ede660feaaa8f1f8f49bffd
MD5 55adfd8af16a15870492e7b99b928437
SHA1 af5b2547f4e3fbac1887e2108f743431f8e972a7
SHA512 f6e52ef52169e4e607e05ea31cd1f7452bba923406e1d1f2cae88261245e199bccbc3b1b7f59e6332e9ad24e676a865509e6815c5d0928c1db8c927b61aeb2e4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCof:A3k03kB56r4
TLSH
T18F257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 947KB
SHA256 2badd64796db60d5133eb72e6b5811f428e291babb935e336ef00f99e139408f
MD5 9c6d18958d2a3361463d8742a7d2c602
SHA1 80db7cf748bd7d71baa4ff635008516f01db3da8
SHA512 d8f9d724f3761ccea0479b0cae22d2fb15ac4afb39ed655b17dc9a5bb81a9af34b304182855859f61264cf1d7e6976595114b741482f8b9e3d2dfb3021780178
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCCo:A3k03kB56rl
TLSH
T1D9257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 947KB
SHA256 489e30c85d8647a80a98431d1dbe5f3f4cfff4c2e3d3ff95170329f407c4c813
MD5 5c2b21cb73b3c25988cf297fb714f807
SHA1 c657ef2564480421290835dab95ae4e9c9769b54
SHA512 6934ec1fb97a016a7d6de2f648e09eebe2c10c2485984a30a97ed3de5814f36864d2f079fab4ea439fa4028ec980dce0652bd5c85d9dc3b4966ecd7e115c10d9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaC2u:A3k03kB56rH
TLSH
T161257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 947KB
SHA256 fb8dfecf6038b1c0dfed1afaae173b3b57fcbc49f97dcf0ab844d3cc9ff81a0d
MD5 a4f0dd3ec901b66c683c6c461b761370
SHA1 975470d92e8dc2428160d004e4d7cf72c1e64445
SHA512 c4e08b50590e8fb7f672f256a67fa8dcd9b34454ad466b00aa7ba5dde615aa0330ede83a53dcccc93d6bdaeaa4c16e9d3448aae4340143bc95874138860a6a57
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCq9:A3k03kB56rG
TLSH
T1DD257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 947KB
SHA256 657e25b25924c3411dd0bca4ded1e97a97a976b20491419cf6fac44e2f8d29c9
MD5 e26d416c18441813ba53fef5d70fbe6f
SHA1 d2d668668f23714f374e4f84a7b519310bd07199
SHA512 d97c8ddd04f8b31f5788ddf126396a6376a96e5bfd59de47dc1c0ec9c4a86fa1dc3181b01ee546a3bf4e40a9896e4004b5eab3653dd4a9145ba9a13cee39812f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCqc:A3k03kB56rr
TLSH
T1F8257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 947KB
SHA256 789531d1cb8248e79dcc8fabc8bbc5a9586c39a8167fa0705c7c993799c59c0e
MD5 a7ed2cc8eb3d9aa2f1859db0283fac05
SHA1 8c22025dfd1a560a9d8b5fd0e284babb6be46d58
SHA512 1848ff18e60de29434965af4290c2bf2455f4a100e84cc736e4faab21cb09b52a69573f82e6202bca6bdbfb86f364c82449a83cf190d750e5efef04cddae544a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCjp:A3k03kB56rJ
TLSH
T1B5257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 947KB
SHA256 c30c31b72d11efcf0155868963102fa330e2ab940d9b2209045d5072efb1ce77
MD5 783c5cbf57029944a1ffe84c30615cc7
SHA1 117e06f10d683ee66444fda145ea374045d42603
SHA512 1460af21693cf9063e75f8c5482d7bcbe2fad84685ae0279c241da911393b017a634e07638deb3167d8a107d596c25ba5f5dc04ad5e3dcd135861ca22160678c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCEN:A3k03kB56rS
TLSH
T189257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 947KB
SHA256 1585d6128c37877cc73f62da390bf5c487e3b29712d429ea3fcfd25b5ad279be
MD5 b784db4b036b7d5fcac32d753256184f
SHA1 237817d8e6eb1a69ac39476ff78a031fa25394ef
SHA512 74d8bc2495b5bb33f5c30e3ddb6f35679b661e1dda7d1636c0282c2d2a18304528cc85a38dee5c69c37fb76c87c6baa918db0383cae9346df72baa7854a104ea
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCsF:A3k03kB56r4
TLSH
T1AB257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 947KB
SHA256 595362d327e6fa0087fedb9dba7e8ff9411864eca3003c5b0fca14bb938edb35
MD5 c029d084f03213f4b00d14b8f0265364
SHA1 83302cc7caed01b55c40950c309696835fb8bac8
SHA512 7f84bbc3c14c88581e1393492505d14a4ccb04a6931b7759eea44456ef23b1a131c109d705c6b5ec44660a22b72ff799798a77303c18c50ea5baa8be76a83c49
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCZC:A3k03kB56rM
TLSH
T183257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 947KB
SHA256 5b41a97d66814abec16a5c896d48b9979f92e8648103ef61c87aa918dee1653d
MD5 1939abbaaa7bc7dfc9ab1343c208d9a6
SHA1 c9bac24f673f3afb2d70ac1f6802f5d786a335a5
SHA512 7ebf802ed3c0daa5e4de87ebd0a117ba18572c1609d9fab96a7bc6e8adadca58246d576c1d18afc7d1daf9602412e6dc2b2e58c6254a00eb3f6b73f105736bb7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCaw:A3k03kB56rB
TLSH
T11D257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 947KB
SHA256 4354704ea2b5ee82f3668384251fdf9fad9bcd33bd62fb2e2184af0e7c28d84f
MD5 ded53b54e4115f2b01a0837704e387fd
SHA1 81f0074b7e70a9164edb490789a899727da628c4
SHA512 95e281990d485bd0fc163e3e5627f6f64cf3ab9853a9f1efe9d3d03682a40d791b475d85f0fe702173c839a5f46f52300760b5731c41c09b218653c788c99920
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaChT:A3k03kB56r1
TLSH
T191257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 947KB
SHA256 6a8b29dcbcb152f13befac54523712aa1356f4ec5b1b58fe88d860dd6ce4a602
MD5 85a292789e33c14094f289aefd72dad9
SHA1 808c02f3264f1c8e4c2587e07c019f76e9f4555e
SHA512 3e0c0ddbd7ae9f15e5c3316a6fe9d15472999fe03626e7fd1ada5740f6146bb4f9a53bee1c30a3d11bc8338a8adeab135e55ed66e9e0a3321a1a3a0508d34c5d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCPu:A3k03kB56rq
TLSH
T16A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 947KB
SHA256 cda3232b7ad964eb938e7cdfcb091efe1ad9140e60b903b210936e09d21cd2a6
MD5 489c177893a8ba5b25077f558a19e699
SHA1 3c44ead4c03c23df83faa2a905c5176585567748
SHA512 f18ef91239659585702881feb1986d51894db60f26c3d59b1be83b6348b4fd3ce24646a814a60d6b537737ea457db4efce0c8dea1b2b35e386dff448a2458cee
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCzb:A3k03kB56rL
TLSH
T100257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 947KB
SHA256 33a16f6e65e5a34c5b812e31f37b4c6607319f5c213ef983c1ccac6b7d7b97ae
MD5 88fa96da6c8b8ba52997cc428fc16256
SHA1 68329d60b3f3ddd102a693f8e4fd48d81530575e
SHA512 8f94279759769e0d443c22d256684647cd76cb9a0d722ced04fafd3d77f58432b7b7286775dc2a361526624a7defeaa031d4465cbf480241e342617a8429863a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCHf:A3k03kB56rT
TLSH
T1B6257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 947KB
SHA256 44ee1f97af3e1d50d98d8c82f0d9a7d74141e181b685f0ff155732119d36a3f1
MD5 8228a52efcf935381413e84e326ac68c
SHA1 cb439b8c7048deac13a6f852e96864af3fc1d4bd
SHA512 1831c08f319d1dc144e122d00056e8222c269346f753b13acfa4fcf2e1b4c4f993ea7cee8d40802866d54f600f4449b03bbd69d8942ebc366c58124b9d5c49a6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCwK:A3k03kB56rD
TLSH
T1AF257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 947KB
SHA256 aa922ed968333035a986ef31ef2f608873aa7df422476912619782c6df3ea75f
MD5 8651cca2676e90c65a24b1512d8ef70b
SHA1 676faf2e8c37cdbc4bc4041981bafddf2a5c20e5
SHA512 d358ddbeebe6b1f0fc5e72edfe822c79808d3f93702c0e049ef5c9406bd800db0098f8a6bf48435c8143b58cc079dc550cee64b87a72ef6204c4e0d2b72739f6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCtk:A3k03kB56ru
TLSH
T1C9257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 947KB
SHA256 a7f69cb5c8d719e46d34e5d7af4316c81eff57c9cd318bcefe1056fb9906fa92
MD5 db02cb86a85e78a3fdc7cec6514e7828
SHA1 b9491717af5218ae923b8bccac63446bd5c9bc09
SHA512 e00b122178f0f5a392f6272b4b833c9e33fb06f71f01555f885e8a2701a20e2cb9f7dc5a23f573f6c46abf5632e28eb798f4735bb0ebbb58d3f96f771297dec4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCy0:A3k03kB56rz
TLSH
T1C6257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 947KB
SHA256 67084d1f96913a49077842b08067e8851a1027a646341971948b0dccbe5f2b80
MD5 c94eeed0cef8d303407847064ac3828f
SHA1 e5165281de88a43dacd454c28c4477f610717347
SHA512 e57463e971ea01b3c211008c76ec695be8c01a55d93d11077df20bf8ed618d3dcb43e8070bf9e73e15ef1a9147fe9fd09e3e3ae0b1e4a0e1caf1848f176b029d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCBg:A3k03kB56r2
TLSH
T1AF257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 947KB
SHA256 bbf66335141595ba4c417b16e6b273e6cad56c6bddf6ad8e089ccb309581f694
MD5 367f84b525e6cc7b96e9a1931ee1bf1f
SHA1 606d34a733d736c16b6768291e5df4a6847bb26d
SHA512 8505edda5b975e11fada7946620c71b7d27a1d1f180e8c3a5ac00eef753eb4a9b0e9aa24b1041e0fcf5d75f37806beedce4e8d19e02049cb1a3b361b58d1e934
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCor:A3k03kB56r4
TLSH
T1D7257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 947KB
SHA256 897f7a4564f889b2a456b0c67673a910104382779eff257beff3c7d3e059bde4
MD5 798732fc2e948e742a0a27e7d8078dac
SHA1 d0f3a68f8eb2c5416364947c356f81fd1289aa76
SHA512 e6c56281bca6ce84b9f632d36d422051f18f42a001a612efa7e17f9026864f69d78bb664b62874669a85c480b7311ed59f726930930daddd6dd257c82c593af7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCGn:A3k03kB56r6
TLSH
T194257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 947KB
SHA256 72457a212dd3efe413b7e02e5cf169ca7b90bca33baddf0d5901d95b31c8869b
MD5 a30a0372112c06b8800d074578e08d8c
SHA1 e6174a3144992c835cc89e236ac05a5643c2993d
SHA512 e30e6cc7861e3dcb007a35d9f25c53ccc14a2f6236d17887ce5dad9fa7592815ac538413611b69e35257129a7482b42764f636623c10ca353324959b559726c8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCMx:A3k03kB56r4
TLSH
T1D2257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 947KB
SHA256 969ac724ab49cb65689097fc4cf6465dafbf059ad09824061785b35a3aceae9a
MD5 39c26863323061855088971cdbc88125
SHA1 0e3f83affb0c663a675480cb57c055abb3c27b3a
SHA512 c7f7a09c624405ec34f79782bbd35004dae05cd739cff9fa30afab37d46046429ff13b0dbfdeccbb21648874dd1d8feffc70880208d9260a65befb6e07a266d7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCGA:A3k03kB56r7
TLSH
T1F0257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 947KB
SHA256 66e83347fd2f237c619d9b57e508cbb5cef26f4f85282580c80243f2613ad022
MD5 6a297efa2b83701c77d094a67003b9a7
SHA1 974406795b9363d1d28fe1db7c56849b4563c3bf
SHA512 8e5c1510bf7743611085fbd3f2642f911ba69ab98e38a6eb47bd3b9a8eeec2bca1bf439e13919e36a79a31f6cf1962856fcaad1a5dc483bc46a238df1a4f790a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCf9Q:A3k03kB56rW
TLSH
T1D6257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 947KB
SHA256 a948e95a5c1935fcc6d2435eff2aa0d3fdb4ac2193aac6b7bb982a43fb740544
MD5 16709833dd0e192de90ee59710a5b888
SHA1 ed78aa82efa2ddc6f47d95e06da86eb91d15c682
SHA512 d02f88a6a88026240ec23f8d210e7ccc93a2fee36ba35481e99d6e5358d86a2eb908d34adeea4c7ae1c13e8ef2af6587a67b6d258d50ab4586e1289bdc707810
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCW4:A3k03kB56rF
TLSH
T14F257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 947KB
SHA256 ed0f6245d51e0da4806038f630cfbf8e3af4607f7b6e98021fd7a07b391ee100
MD5 a4c359e6775415d15b6e3dc49df8492b
SHA1 89e4ed583adc9bf19225c28bc949614debcc5be2
SHA512 2f5be8704fd5ba9c2157c6d6c25c838371d77c7ff25c790f616e46087ea3a881483fb27c8cd88aea60c3768b44548cd5b4de9f0cdb9012a1b2708d2416594abf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCFu:A3k03kB56rw
TLSH
T189257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 947KB
SHA256 c966d3bb138ed2131804b8086889dccea571752e801ce9a8a3f912a15a1d32cb
MD5 19b060477ee77c43c832c2c7e1f0d6d7
SHA1 e9e3c5aa60580ff4af54ec4d9a6b907c98ad9282
SHA512 19ca237712f05771815f2069fdf610f116abe615fa680762b429a290574df6d7056124b44f7804eae981a965b33b7877791e1a3920757b28cfb8a8eafc3cd47d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCYj:A3k03kB56rq
TLSH
T1F0257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 947KB
SHA256 1286441d052bab18872e69470805edfb043ae958f918187cbc36721cf978cca7
MD5 b6f63031c1d916e0dc2c6b870705cbe6
SHA1 8af2dfb88954fa3abef121dcf9bddca783ab5d5f
SHA512 a6cbd06d28ffa4ae7b7f44e19c42024b1e575fe2f31a0e0187dd871fb757f257119ada16ae9fcd49c20d98188e1538b8c699a0de264c4a8b6486d30716a9da77
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCpg:A3k03kB56r+
TLSH
T15B257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 947KB
SHA256 10b72b9d194bad8d1b36fa3150174e658f251908245c1c0db43f9d4d9e02ec3d
MD5 4d3e368167878e4a02691d3687938bbc
SHA1 d438589edf3df4c1bfd25fa90b77a2fd138c2cba
SHA512 d32ce19d43195812b8c67e4a486cc5617af2f625b6ad0b118d95ff9968ee2625c6589f3ad57cea4b5f13f9f75acf52b476c8d42038760f0657c6e7336f7f9018
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCwI:A3k03kB56rX
TLSH
T198257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 947KB
SHA256 53b54e7bdae4ec8f92d6304bf98cebfe702787806a48b422cf915a8e7cf72340
MD5 557844f30970e6ee77c709beadc74e10
SHA1 899b87ff039f1e3f539254cbbb8972c5e2ef47b5
SHA512 f7a462436d0684b676e4f5a6694193082d7ffb114667401723e348517b971a6e7b2573c932b49c0041f440f8a4ff1649847a59edccbcbf91666bcfce5b3bd36c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCyo:A3k03kB56rR
TLSH
T10E257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 947KB
SHA256 6421cd1d2e5914e2fb82a24a2219a3b33212ac06dd1f1993cf699864946a57f3
MD5 ed45fb071bd2bb56712e6d6311224078
SHA1 dd44fb310c14d9bf834d3d8838af8891b6f553dd
SHA512 0c88146761e0154988a2f6708eff7903da050cfbc13d215b71941a5008e18af3968edb92abcc453b5c46c6fca6653eb66e87d5c3d806c0e7411dae8757dd2e53
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCp+:A3k03kB56r0
TLSH
T121257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 947KB
SHA256 b687e5377816f2298932735431409311562159472206aaf84863d47fdb411d9a
MD5 2271d9847067cbab62199b537b0c1291
SHA1 4e83cde3e2edaa8b41712a0cf285818bf9dd733b
SHA512 0d7adfc8ecfe7ed531ac1fb387566ebcd7ff2befd2981b64ef18944fc1beae05d9c315ea1b6b6760e13f067db61856111beb9042bfbd0e1a1e13d3f5339dbb5e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCXQ:A3k03kB56r8
TLSH
T1D8257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 947KB
SHA256 73a7cc1cd9348eff1cb82ae681829d5efc8d988132ccc98c211ec1b295c88591
MD5 7a5dd9b6a819c70676d557ecd448fc4e
SHA1 af18cd6292c75287aa2d47f6c9be9feed77b2c69
SHA512 55458420bac129c18f24d586a0f500475ef0cd808a60a09d053ae9e316e3c45de658fa1330b2628dd5b9f8ed2325a38bc574d5ff8a9bfb5012914b018d9eea28
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCsX:A3k03kB56rc
TLSH
T10E257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 947KB
SHA256 4d1e489a964e265116a9b3e6a9b0a74f3282b49cec215b17df34c3f835915728
MD5 fb11a3d988bac9859f538cec563c705d
SHA1 d2cb188694222b13c8f68ad5fa0652c7e65e4b9e
SHA512 e9d7624d725da28ee6c77e7bb0f6d92d61d88c8f1e7c0e2347e308bddd02ec16c714bc8169f2829baed9037d50dca5a59fe92120aa7545f9600cb3f599981036
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCKL:A3k03kB56rG
TLSH
T1BA257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 947KB
SHA256 271486af2e3b3c986e37a69de3a6a85cdacb2baa3da210773f80ff46bd2330ba
MD5 bba643aa43cedfdd1cd8fe1a4d035106
SHA1 ca8d9c5406821a99190f7e5940e18e73bf54de9b
SHA512 361ae02139796dd326546c3bd4e566a44d4bba9772be9acb30a01b728127433ea84d3ab987632f34bdc56ce43780402aca2ee11cec80836670564e592a7c6505
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaCuM:A3k03kB56rj
TLSH
T1CA257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 947KB
SHA256 7a0b81f44b9a0dd203af378898f11f781df3e6b6308e1800e57379cdc829194d
MD5 8ee8634634c2518ef5bb45ae0d7710c8
SHA1 629d3561d3d4d4aea3a1a4cca4bb756368a735d6
SHA512 85309fa4a81ce58d3f91b525a7b7a68b11f65229b64134ea150b00f3b8baf2f49fcf9be603851000a93b4638bf09bf362da02cea55616bd4dfcdc60e9ea3b855
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaaC3h:A3k03kB56rd
TLSH
T1BB257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5976-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5976-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads