dd9ced519f39fdf0eac570203d75c7ff43bef461fac15bcb609a66b66b0d1fba

Analysis

max time kernel
97s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 939KB
Sample260730-dcc1qsxhjd
SHA256 dd9ced519f39fdf0eac570203d75c7ff43bef461fac15bcb609a66b66b0d1fba
MD5 d5a9b43fdf4d027154cc926edfa4d1f2
SHA1 5e3bfc2d916756054d4c7212d05ca711fac024cb
SHA512 bda475782e944dc521705131ac2885cd34efe115dbc7c0d9e79e6f2b575f2684b68209040469cdf2da42797e594861305b2493e8033573dc9346e889d2179fbd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaE:A3k03kHRJ
TLSH
T11115AE03E79400E9D10AC1749AE69A23FB75BC52176097DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/1188-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b807-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b305-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1188-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1348-203-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-265.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-446.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-702.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-783.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-972.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1015.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1059.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1121.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1396.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000300000001b807-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000500000001b305-57.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-265.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-446.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-495.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-702.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-783.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-947.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-972.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1015.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1059.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1121.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1146.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1215.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1318.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1362.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1376.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1396.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1348	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1188	2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1348	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_d5a9b43fdf4d027154cc926edfa4d1f2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1188

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 dd9ced519f39fdf0eac570203d75c7ff43bef461fac15bcb609a66b66b0d1fba
MD5 d5a9b43fdf4d027154cc926edfa4d1f2
SHA1 5e3bfc2d916756054d4c7212d05ca711fac024cb
SHA512 bda475782e944dc521705131ac2885cd34efe115dbc7c0d9e79e6f2b575f2684b68209040469cdf2da42797e594861305b2493e8033573dc9346e889d2179fbd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaE:A3k03kHRJ
TLSH
T11115AE03E79400E9D10AC1749AE69A23FB75BC52176097DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 79ef5ffe4e9ab83c642ccaa7ffa3eaf135007755c3301632c12a364680990983
MD5 c8946a28a20c1f41783cdb6640e2967d
SHA1 32a329f16789135192d1b091a32809fe9c0c1c5d
SHA512 f65a4e35f2b35306f82cbced6889a88458fc6f165cf229fe13c6a4354e91acc1b4183fe38893d8258e5ab10dec57a2f4f2eeed22220b21d3a20c53bc6bdfad13
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEP0Le5ji0hmxNrM:A3k03kHRJPPji0Aj
TLSH
T1D2658C17F6A402B5D067C1B9C5E69A5AFA713842173086CF1398C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 953KB
SHA256 597520487305f74d621c03aa6c7d3a0f1e88eafd5d953997ea3f75eae7d0bf1c
MD5 9145a275d0af440f2aba35b1cf3e17d2
SHA1 dc600c743a7605bbb6778ae2416686759ac427ce
SHA512 20db7c76dcbe903b4a880d4c1b8a79fae1dd8c9917ad72525086f3177eebb1eb911d6833497d4c9fb3df374227a0b7cd9dd439ef4220c3743de8a69e1eb8b069
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaERa:A3k03kHRJ
TLSH
T19525AE03E79400E9E10AC1749AE69A23FB75BC52176097DF1368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 962KB
SHA256 8326a946a61d0be8055bd55fee3ed60de98b8b81bfa20bb5ae2ed3d63138a723
MD5 57252d211cf0e82103eac75554934d9b
SHA1 10b2c7c5b6f48e5b1ead4f6452ebb194360cb2a6
SHA512 f0c669cfb354f14d72893cc747f035f2484e17140e5c74aa8979ed98634a96331938f5be9fcd49bf4795eb36405c9cc4675f903e26a18f210d74672f5dbe20af
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEo6:A3k03kHRJX
TLSH
T17C25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 962KB
SHA256 796379fc79d9d942e1bf98520014f8edbbb640c8f28b419c8ae0814473978094
MD5 092258183205f1cfd9849ed71962ed8c
SHA1 145da69d3696a569e2fd908557fa570f33acbfbd
SHA512 f409cca7c530fae0d6b77565a3c705c7238d4eeaec0b14e5edbb95d334e3b330bbd48d57c7a467c508266e5f5e28392cb1f13a5ac334f61dd428d9ab08d6b109
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaE8o:A3k03kHRJn
TLSH
T18925AF03E79400E9E10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 962KB
SHA256 383324c5725d809c73ea0c5dbfb5bc7dd2a1f274d73691a6633f902ef961f039
MD5 43cf4ba5122b4b5b788c96ae294ae7aa
SHA1 436f8018676f5f79de9853921073835a5a7676f4
SHA512 f4bbd8221814dd2ed04445aaebe3a90fac04b98eac44b238abc4ab27096cb0af282a2cc010c769aba48283faf58995e86cef4632b9fc599995ed14458d9b6f69
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEcu:A3k03kHRJJ
TLSH
T1E625AF03E79400E9E10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 962KB
SHA256 f48e2640d8dc2b8e5f7be48810c54a2a00357d8308c12d6da5b66e78fe492d5a
MD5 54170ccface227446850e81050299457
SHA1 77ee035fbe4c36c46c60c1e2eff4a461153d98b5
SHA512 606b55a1b289bf99b6a21f79fa7e2a4cb34426c2af1d44156f854331cd7825e50c87f66fa2ce27e52788f5e5a14e8e6d62138ecfdb1410930effdf930c0da5e0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEg9:A3k03kHRJk
TLSH
T1C725AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 962KB
SHA256 cf93245f3286ca9574d461c5160c38f4695e51a1017a65487c11b2695f814dcd
MD5 33d90e2d2a24c75562a0b12a980d300c
SHA1 3678dd92f1da131cd4bfe8100771d086ff71681c
SHA512 e7ac4ae1da08635c0527552624149b0fd3c538fe7f681143978b9438e46ad6801e5e3626383c21addaa84cf4b581212acf25bdf5a80f4e38697e85d07a16d6c4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEoc:A3k03kHRJN
TLSH
T10625AE03E79400E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 962KB
SHA256 3e6be5a4f0de4d5ac2e5774cb2c82c5df81f23cec7bb76a7190c0aa365d2c012
MD5 b3b58e781760f363254bfd7dcfb7c24b
SHA1 0d2678edb35ba4b6b717a10e2775c1ccc17ab1cf
SHA512 6e5c624bf83d1a4ded81598814541b11af4aab19aef41c5fea218d44578653dcef86f114f0f5077fb38e955a3128a0d8fdda5420a7e63c491a0ae2f462da9ac6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEBp:A3k03kHRJT
TLSH
T11525AF03E79400E9E10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 962KB
SHA256 da22b7e6f0a0756632e94061774dba887966ad5ea75bc9dbed82772a60694480
MD5 7f375b9198df12c0476c83400b6206d1
SHA1 9a02c739ac3cf3e9e94871a49cbf9546ba63faec
SHA512 fb3422f984b8361766edab3b5034bb2ce6e18204715af26bed6cb4df67c0b28471add691966d1065a742d1fd5afe7a04f350e59abe74718231eb06a9eff674f4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEWN:A3k03kHRJo
TLSH
T1C825AF03E79400E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 962KB
SHA256 4a92ffa2d82720df25995c3d8dddde636347f412bc8378afcfce5d8da59cc681
MD5 5225d681b9d95907a8a4933e26ec67f9
SHA1 fc84162c5e736016ffbaa027ea1ee5692bcaa917
SHA512 51bb5bb9ea392f4b4a97a3d333efb9a25d37434d1f4ed1201707574d97c97a568dd65e71af15e8b2410170976bf21bad09e5ee9c4a60257ac02137f341755781
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEaF:A3k03kHRJ+
TLSH
T13125AF03E79400E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 962KB
SHA256 80b9900819735fc2ad11609ee8956728acb77b7c48a195aac6d72f3e99188f69
MD5 a2665c0f4d4fbcce3c23babd4bd1c43f
SHA1 71636b8ba4bc5b1b6439323e75eed07a734b1d91
SHA512 e712df3c7185ed68540662798db510760715dff355321adb1db3bdb3e579d3c2a36479a1ff06e736966aa01afa1e2e29c49b395ebf1940405a5a4457fc2501ef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEvC:A3k03kHRJa
TLSH
T10A25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 962KB
SHA256 c38a54035938836e2c72d2977807cac2bc1c4f79d3e87cc52d843bcef770f2d7
MD5 0854a4368013b651417898b7b970b0ae
SHA1 d732a65717f70451606b3017085158442f999a70
SHA512 b254b05546df9c284171920ddd246855d1d89310db81e728099b21d084f63b46da3fcd5591860fe9af24f05e410f4d2c479d0332b057ea3842d10950533ed857
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEQw:A3k03kHRJv
TLSH
T13725AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 962KB
SHA256 1ab277196ad903b11d488da98401fd8e8b969a08e6f8c688a3c98cdec5c2dd46
MD5 51009a06074d7df525d4baa1932d4e04
SHA1 49cb1fb8ed8a0bffeb9c5c39f9f3dab5f5ee5e41
SHA512 d100a183f370a2342fb9354bf5f0a2ba80238492b597892a222cd3dd2fc2071f7d6018a176bf155e98cd4884f36ffe2b5754be1d2d3cd0fff5eef78d202d2a5d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEvT:A3k03kHRJL
TLSH
T18E25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 962KB
SHA256 d6ad84c28f5f16c07f1dec3256fac5702c20fa80ee372e1da1845b661e74e496
MD5 d4e87494610b84865d717ed185284086
SHA1 137b9a3741bbc5c7a7f2ba5075dd6312bc7cb218
SHA512 37bb89490205ecc9b849f8cfbbfba9be3c151ec5f78ce9ad0cc96d9589c0823c3b77a9f97e2c0c10174151bf3506793c6cc4d028ca5f76aafd8bdc23278f7524
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEpu:A3k03kHRJM
TLSH
T15025AF03E79400E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 962KB
SHA256 94cb3191362ed3867b0583c898f7ec1cc60e76c61b10e06ea006ad4bdd588730
MD5 da73cb1805d26cee6c19525fb5b997d8
SHA1 8a40d8c3de25876a101f35dd8e9687dfdc888dec
SHA512 267745d2bdae470c6e1abddfd93f9608ce39843fe22c8d8aca5fc184f7b425684cbed4d12b5253495eabb5232b55b4a0995e5a5f08a82b4caed8f7e503603142
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEhb:A3k03kHRJl
TLSH
T11725AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 962KB
SHA256 769ae8e55c9a27ecd49e817a50864362cc11a0e61cc3611c861b91b7caccc8ef
MD5 cadcfc6ef8c887395d78c6fe9e26544e
SHA1 93263230f3039bfdd107392df4bffe4fe7dee690
SHA512 a6308cb5e89f4c8fecea6d8213ac081de5f6c5f6aaa2fc08330109eb4768538fcfd0291c66de01908d4a0c754c0c52c2904e55129d5c9a3ab4c43e3325fdde7f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEpf:A3k03kHRJl
TLSH
T13D25AF03E79400E9E10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 962KB
SHA256 42d57d142160b4f8e0bad5684d1260bb9849345417c6b9a0f62a833146d03776
MD5 1b50a64b06d14ddaa1c45903b787f6c6
SHA1 3686fe7b57338a2d30e53676ed2fa3815fa994c2
SHA512 54f947538cd24a43c73c9649a3173a32bf7bf3c296d327da679a7b2f90bd1f885a133bc3a8ed54e08792eb2ce8d86e516acc29d060a1af84139eb09230cb370c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaESK:A3k03kHRJd
TLSH
T11C25AF03E79400E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 962KB
SHA256 43e65b59ee776d361c67788f8eae2e4f01b45110e92cd66ba816fcc8512dd9c6
MD5 822193f5d3ed7587b69b98b237503911
SHA1 74b8c7fc22ce6713d46fa14744810a343b00c07e
SHA512 a52e97a55aad87cc983a721cff17e2a09a9e0cf942c154381b7ffa445d6e9ff222a5c711575d1e95813d0bee20f4ada56cebd22849c46f3699cea328bf171b66
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaE3k:A3k03kHRJ0
TLSH
T15F25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 962KB
SHA256 6874c6a86edbc17a035199dc5742dd3931bcb9177c3e7ad6c96b465d7d827dac
MD5 1c8700c9947179dc861c6bb2f89598ff
SHA1 6d192c88140520305237bbab8164e7efb4160078
SHA512 b0e580297f55b1c070e1c8bf615119b85c912a7c8af5237000b4239e18b04ecaccc82b8e6d1f7e6613f06f1f134ed46f4f725d729b9a85f97239d19a78bb1687
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEA0:A3k03kHRJ9
TLSH
T17A25AF03E79400E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 962KB
SHA256 83c6db3c9716e502c3521a215bb18de6d933d0f947dcf79ae4a8bb778122e604
MD5 67344517f5138cb4174e5687b325c11a
SHA1 d5b5f42eadf30661b3c16640b7ddbb88cad190c2
SHA512 b6b996b6c50341a39e3317d87300586ccaa038cc5f19f7e79799a520ae5709583fab4a336b0f80b7e058d23d3ababbb34ea5a425729e692135e2ab98c27a31b1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEbg:A3k03kHRJM
TLSH
T14F25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 962KB
SHA256 e770abece8f00c865e6bdb30e1850fc5fd5e1078617f63b7ba3655e004366476
MD5 9faaaa54b7cf7ceba0049b23659db299
SHA1 2f0421310f2fa17ea50e76df446b1eb2325427e5
SHA512 7b9263dfad3eee5b4103e418a4e494938f31c5afb0e062fea9e40a843989a1cd4df43c7941aadbbd880f75bb9433a5584e773ec225ee6af3772ecfb5a8965899
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEWr:A3k03kHRJe
TLSH
T17825AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 962KB
SHA256 02cf5f4002219fc612758aa7813ecf1178e9c2657fc738db1ed2c74410f3ce2f
MD5 1c296dc76510d6d322b5e78439d6d296
SHA1 353a75b8e4fadc177a2ae07999871fd6a3172f19
SHA512 a5805c6fee99516c0ee8a031d6b38b9ea48ffa8d5f120f3b2a017773f90f25a5d09c065ef512b7b705ca16a130f43c678d1eb8df90623558516c58531bd93db4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaE8n:A3k03kHRJo
TLSH
T1C825AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 962KB
SHA256 70643b4ce48443dc6f0360e70ebefa610be8f36770255821a7698df55717498c
MD5 43a8bbe3129d88827aad907ce6d59954
SHA1 eb6b7d2bc077f88905ba45d93dfc7de127c3a604
SHA512 932f68696ed9e6e1cd81ba96477ef28e3ff3ff40b8e5d9a1784b3568828ea4d07a0a9bfa03b3e0e386d98c36d4a9037e9d31799f12e5609c0f55318bd40ed6a3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaE6x:A3k03kHRJ+
TLSH
T11225AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 962KB
SHA256 886eaaf164a3cde24436e710d2d728a1ce8a8b4fb09d5d96c02f99ed34199541
MD5 c369f5e85471f24b742e97d3575dac2e
SHA1 48a9a3ac57108797c5401e54b400dd83f0461e61
SHA512 50b1596ecc1b58d3a3e8c63c7fd1ff2c481cdf0db9fe75e90a03163d344c259fa29a431ddfefe1c79358d82cfda22555204fe9b8c1d76ac8a3c0eefd3cad2f8b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaE8A:A3k03kHRJ1
TLSH
T11A25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 962KB
SHA256 abcbf6c3b40c70c6ad1f174217c4ec6d8f3f6b8bc9065faa2b8f4ecda20bcf96
MD5 6043918a204f4c5d84217e1b7ac67a7e
SHA1 6c05510797e65bcdd14aca0bf0e3015747e6531b
SHA512 1190a5caf6ef7436df48580ba0b2cef813ba5e207c6a19e4580e478c30bb5f898e3180c50b47eb3792658757c60c36a41780fabc332a9b4117dbd47ad419f9bc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEl9Q:A3k03kHRJ0
TLSH
T11F25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 962KB
SHA256 33e9a1d80c6a2de924f70b109660adec3b26f1fca82743ef1acf6871e7c1cecc
MD5 68526892681db8de4073cab43295b6f9
SHA1 cbe6fa92c348cce4a49baaf3659d653627dd1d97
SHA512 d89fa9a5d197376b2c351829825ff38d8f01668de605db517b6165643a30fadbed6ec437791790c095a979310c7aa5df5cc4c80dbea3a4d868e2ee101020bc7d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEQ4:A3k03kHRJ/
TLSH
T10425AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 962KB
SHA256 be60374bf6df6509f62e07b1766bddb171f3fcfe3f717d1bafe6f21cc9a7d4a1
MD5 add489db66e83f43c31605224deb9166
SHA1 58f5afbf1fa046d0f45ca9e5781cc3b0bca82699
SHA512 12d435973057f2fa18f55d065e2cd27bdb6d12b0e801503f3c78b889d6df4d83b9e76d53422bda1e9f662ec2e8825e2b806d9da1a78b17f9b73f4f6fedabcbe0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaETu:A3k03kHRJy
TLSH
T12225AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 962KB
SHA256 4410717af5e7fde51b885e328dfad282e0e3530b07f79e45caf1b15f70adbfab
MD5 66758e3c434147b7035ff7dd5ad104d9
SHA1 49c442cd28bbe8b1c1b4ac12f86592a097ba9c38
SHA512 c6d015725c8f6243ed205c017d553d7aa2a1ea647c51a997999bdccce64c49885df973853e116f38c35ecac19dbb920cb3dfef013f1f1b583059fb67e0f7db7a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEOj:A3k03kHRJs
TLSH
T17625AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 962KB
SHA256 0f8ae2b419ca53bf3e0b57e2ec94eb37c413346cef89ff74a3d85a250d277ab0
MD5 6fd955e9723a36119ba1afccf1920f33
SHA1 607698dd9499de19a3b2eaa63b7425e0c70b10bf
SHA512 723bc67dd313447ef982bbabce6fe0bd305631927074cf7dd80c4203b83e944de85e9439937e2bf8195561a55ccda9d7f692a48c031c462a2526185c59f39b6a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaE7g:A3k03kHRJk
TLSH
T1BE25AF03E79400E9E10AC1749AE65A23FB75BC52176097DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 962KB
SHA256 c7115c294fed855117920e67fe37745b4e1536012e0d1cee53f7278865014868
MD5 f4b477950f29fb53e25c4b7450e23b1c
SHA1 9b5625eb0027169897ae3ef4acf1e8583e5845df
SHA512 0857152885b6a702ab7b8922131316b33379d412dde5de0beb3cd0101e510737cac1ce8c210c4456bfd89232f2aaf704ddf1c3e54f31fb4aed9aacfef013b912
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEmI:A3k03kHRJN
TLSH
T1E125AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 962KB
SHA256 7868d3ffcbc1c83e62d5cce554167fb7b1a28726fe5d441251c81dc8a387f2bb
MD5 d95957af66cba493432ddadf94e31345
SHA1 7380b352fca6a107c571b925efae157bfbb85e72
SHA512 32993e21c86e8941177be7edf566c9419651dfb3e9aa8bc9a919a7f87f25ee0c4098dfbab4be7dedeae4e66126734e76ea97dc1e8976a76e34674f2b12f8de98
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEUo:A3k03kHRJr
TLSH
T13D25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 962KB
SHA256 ec141ba568288570aaddf14d712d854e201242d89938581240bc15f9680ea26c
MD5 5bdb332a861062894b5dc33d72094080
SHA1 6b42350030b97ae57c1931134af344a64409bd16
SHA512 ba45dffb6fe7bd2c0ad2cb7a4c58d1134cbbf5416e5c6701f555d99742cdb8a429e82aa65934deee2c90be38508a0bcc09c64c8b42f200f07f73618b1860c7eb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaE3+:A3k03kHRJu
TLSH
T19225AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 962KB
SHA256 7b1fbacd99d55a17f6013c605d08e240d6077b140bb0ba526d3d44e75ccffca3
MD5 d93a4db625bcf5b7f84d8c25f34f2d37
SHA1 6ee99a71479b66246c5ceb352397c9d172a1af32
SHA512 27a683fffc895dd21afd162809358bd1b45ad00378c339f7d2cb1ffde22f74a18921282c2e58b74d9bd11fe46ee9cff40aa2a4b77c7fa64a870f480c3ace06b8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaENQ:A3k03kHRJa
TLSH
T17D25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 962KB
SHA256 2ba15d862081d77e79f824cb5e74a32159dadc3fa876e33cd25b35de9445414d
MD5 42b1659b1859b403b1e024fbbef1be93
SHA1 b6b73c0e1176942e5529a6b3f34951affc047fe3
SHA512 b319907b45d5ac309f8e4b86772dc94f8e928b0da0773ce45f8a2794a74fa409a6fc6407fb57e96b7db5f2da14fbe41a87329d38ac384452951f683a1a6d0fd0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaECX:A3k03kHRJK
TLSH
T17325AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 962KB
SHA256 0fb89114dbaf1dda860323b8c657ff114c146fc1dc3392e34533a6a91cf3bec7
MD5 49fce29a7ba8ba9f738d485b8527f1f7
SHA1 04d3fa83238a4d553d1e04b20b98a1eb0540f46b
SHA512 eb467c2701fe985f47d68da73768c550274d79b12d32f5bb9836e05af58ca44de4cb9e20806791785148e3234ff280ab69068e2d34bb2098080840556b23bd2c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEkL:A3k03kHRJk
TLSH
T1CE25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 962KB
SHA256 d3d50f839fd2c859bd437125767a8ff2070e6791163eb5094209de2f20bb5054
MD5 7ddf7669bc5612baa4c0d78a4e04e061
SHA1 0aa64f8120f98c4ab7d594f9345195e47d9cb5e1
SHA512 9440a6306639857edebf439fb888fd03f2547c2359bc9d7de48385e9152bf7a6f3346eb2a23e82b4caa5eecaff7f7e8915aa0c7810c84028af77773a48f85752
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEAM:A3k03kHRJl
TLSH
T18D25AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 962KB
SHA256 7940b640018cdb3a9154750983ce32458a8714ad7a9fdcd6c6600ac75c34dee5
MD5 c2a3b4e5e65429a2d2d65bebfe5d3675
SHA1 1d4783b092a34054edd0f96fdaa959f68192644c
SHA512 f1ad1979617895bebfb13883946e9fdc3ffd2ef9155610eb1210c2f181dbc1fb15d615373db2f1264444082db331ad54724a37ab025db9c4f40d9b1f7939e9d4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2pKaEhh:A3k03kHRJ/
TLSH
T12925AF03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1188-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1188-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1348-203-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads