667b7dbe33e1e08c299db894385929858f2bb66b8bfd539706e4b8b488d77bac

Analysis

max time kernel
102s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 901KB
Sample260730-q1ycssyglf
SHA256 667b7dbe33e1e08c299db894385929858f2bb66b8bfd539706e4b8b488d77bac
MD5 59c042b795b48ac23f5c031e58cb5026
SHA1 17810b20ac4b5caad5d9dabd47ccb244651c45e8
SHA512 f1061bbef838c6767ecd6173f5a1164aa7e4f16d0bdb1ff9ce6a8909596fbbda11402f240046b5f3dba745ef00302d47b531b56da7484dd50d5d23fa9a841a29
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylF:A3k03kHRJC
TLSH
T18615AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4084-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c525-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4084-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/260-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb6-59.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-436.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-534.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-608.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-628.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-725.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-744.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-793.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-842.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-867.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-989.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1044.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1063.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1124.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1143.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1342.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1367.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c525-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb6-59.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-224.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-261.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-436.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-534.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-608.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-628.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-725.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-744.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-793.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-842.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-867.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-886.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-893.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-906.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-926.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-952.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-989.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1044.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1063.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1124.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1143.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1174.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1181.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1219.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1323.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1342.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1367.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1374.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1381.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
260	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4084	2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
260	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_59c042b795b48ac23f5c031e58cb5026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4084

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 901KB
SHA256 667b7dbe33e1e08c299db894385929858f2bb66b8bfd539706e4b8b488d77bac
MD5 59c042b795b48ac23f5c031e58cb5026
SHA1 17810b20ac4b5caad5d9dabd47ccb244651c45e8
SHA512 f1061bbef838c6767ecd6173f5a1164aa7e4f16d0bdb1ff9ce6a8909596fbbda11402f240046b5f3dba745ef00302d47b531b56da7484dd50d5d23fa9a841a29
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylF:A3k03kHRJC
TLSH
T18615AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 53cead29c8ef4f27b77a6b83aacf588960188ed20c07b6490f30a89b3edd1bea
MD5 01c80d99d6dbfe8b5b2c7a7ebdc69447
SHA1 6a11fb3c5a6752db6f3f32094a34225dc3c87568
SHA512 a710daebcf12d6657ddae6c6aa3ea549629cfd295746e25ea8d4fd4fae366fff98a4e70486771a30378488d4e3372642681c9b104569e41f834f652e97b705be
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylB0Le5ji0hmxNrM:A3k03kHRJCPji0Aj
TLSH
T119658C17F6A402B5D027C1B9C5D6965AFA7138821B3086CF1399C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 948KB
SHA256 27f577098437a1a78a81fb1afb9d8b232af62ae5896681de8ecec79accdb8a55
MD5 fef518ce3fc005788b4b9813e3c0ef84
SHA1 d729506bb7e388c8226d11bc7f9a6ab669c068fd
SHA512 3d270a952db61ff67996d74d5d4c18e562d752fd64b8f40ece91fccbda61a59e6623982f414a0e69ef46d4eaf8b9befc06ecd09c3728e9b0948d4646cc655a3d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylQb:A3k03kHRJnb
TLSH
T1A625AE13EB9400E9E10AC1749AE58623FB75BD56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 924KB
SHA256 7758645074649bcc7f5d04401abc0484bbd4a9172f5a18928a38455d6aa6d593
MD5 894b3cc0dfd9177ff7b0719e85b288aa
SHA1 e141e60d5b3265ca72214bb3e0d72e48f65870f9
SHA512 23911205625a468b5bb4c03c103143d22ad7cd633c6016329ddbaaa280553714e59877068a3228b50af22d8203553125ae3291dc6c44c56f7352f0d031365ed8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyli6:A3k03kHRJs
TLSH
T13515AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 924KB
SHA256 30e0550f907ce615bf6ff41a2aa01fb3ae89c0d759e5bf3ec450e6f198840697
MD5 c482888b0d57d4a09922ec17e1898743
SHA1 20c3f6a8d32dd05d0114cc055f01bd9bd7d3e427
SHA512 67e550cf70336b9686ebc1286ba7f2e3bdabd96253fe78a0884f8962e11d6f973eb4e399623cbace00326c664734e00b6143ec2b06da0a3fc49e4a2096051f55
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyl6N:A3k03kHRJR
TLSH
T1C015AE13EB9504E9E10AC1749AD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 924KB
SHA256 4b250fc362006a3d3c0518788ea0954c3ccc7f0c001ad355825eed02cf07c47b
MD5 78ecf55f19b725df6264cf1755eef1c3
SHA1 b7c07e9e13dd8a9f3390e34260c07fe48f6e0873
SHA512 779ff83e5613b302ad8704d861061407d07b92602711bb7e1e87dcb604b995312bdf775c26890097181bab0a24993e7f5eb448d2d5c646ca9003203d80c87899
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylgf:A3k03kHRJR
TLSH
T1A715AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 924KB
SHA256 d96b0d23e2a76c41c50cac7b308a73a049fa3f81d1f446d79e1172d323ca8340
MD5 6d8ecb1c5bbe4623d3da38d89595a1cd
SHA1 68ac4900d79dc75d1c365237d2304833a16973d3
SHA512 590874efd35ced4d1ba6e9700436bd6b6344445aecb2ccbd805611388cbace76c77ba9826d26450db70d18598084579e63730c9fa664c8d03342310e8106af1f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyl6o:A3k03kHRJk
TLSH
T1D315AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 924KB
SHA256 5ee2a27f2cc4193e8f51dd2f04bf0a861a3df2d974d027b2c51c2ecf877927fa
MD5 170141bcbe96243d0b61774cceeb6abe
SHA1 ef768eebb4c38b0c62d43687f88e8da43874e5be
SHA512 09eff0394a900d663ebd4494a18dfed61c5fbf5c10994a7993c949751c6500e2273164919e6345cb1822ef8f8080485034b5054f73780942d2ea06388d4012c9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylOu:A3k03kHRJW
TLSH
T1BD15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 924KB
SHA256 fd33d3a5984eaf0add008bcb9a9a7af8324e37da0403d8eb8ed7279805d0e1d0
MD5 73a85151c4216d3a10cb881a52d43aa6
SHA1 9b64b739f6304f146e574d1dc991a6dc7a2d212a
SHA512 5ea7244168b514c0142fa91f080fc5bcc59c9e08a33ac7562d3f599530f34c5d32e936fc8a01ca7cf12562427e45e45499f0a912bd3289b6d45a19f86b161937
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylC9:A3k03kHRJ3
TLSH
T1A515AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 924KB
SHA256 e80a5c1852df7c13809914d49293e23a07f1d4afca69e5ae089d27a85be07d1f
MD5 8f5b39d391ae5cacdc443fc103cd2674
SHA1 35fc0b69c62de05414544516efff68fca1a46480
SHA512 03532314bf53b262df24975111a17617193fdfb7f26b79e67373b5cd1a22bdb893112785b0a672651d44c8fef19ecf40951a90a73e65217b47499054092f2982
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylCc:A3k03kHRJG
TLSH
T15F15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 924KB
SHA256 15d22a026e842a0f2b5366853bf4e252a5b4b522a3bfa4ad77be7e9d5b4dad01
MD5 7394fa351c78660557f6ac73c5f5f873
SHA1 af811fd4b36ea6ce0363a16a35be10e8cc0ff556
SHA512 87e3ec2740c6cb362e33cb144b37a114f550dbd354c02338bdba5ec9bc32d25e3197bccc3807f5bbcbf7d060b44ebe0f9a68c9c8b2a2fc8ad4544c7db7ccdb5f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylLp:A3k03kHRJU
TLSH
T19D15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 924KB
SHA256 909c7f87be3c402984508eaaf73e9bc817dae16eb227b5ccf646706e52dca5b5
MD5 6ea1fee9d6e0406fcfe200fa4fee71b7
SHA1 835a2a72f8a57ca147e92640f5c7041d07bb49eb
SHA512 738b466a8d687b92464902ccc22551dfbbb902c86ed81dd13084725d393ddc5fa0f4d7e47c0d70755cab20af6907b52fa2342ef0e850a717e007cc2b555fc29a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylcN:A3k03kHRJj
TLSH
T15715AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 924KB
SHA256 08052099f3e8183b4c676baac5e72a9ee51d09dd2513d060a0cf6e641dcf73d5
MD5 3c6461542f52333d2d58add91cdd10f8
SHA1 fcf0368b8e44a660981b8efa67d98e90f9f265c2
SHA512 07652c80bc0d7f0df4b2a5221c446a0478ab754f2b7e5b46484815c50d80cdcb058d9109e81ca3a894eb1d2b6fe2a50228461eda954a45838b2a23c64f8d7edc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylEF:A3k03kHRJ1
TLSH
T14215AE13EB9504E9D10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 924KB
SHA256 fb667442a4fb46701c7df5e457c99835b75d88142fe50fc6a702258343f8c235
MD5 ba33549c745a14219a8a33bb99875dd4
SHA1 d2ec57b7e2d53445b6e3a026e7e4720f38c32c2e
SHA512 24d48fd9f4d05595e9b3147123297b823fbcdbaa5e0e00f761e3abcedae9c4f01423878efd79a923c849b65318b0eadfe7800a2b6a702c01f03d279bafb730b6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylhC:A3k03kHRJZ
TLSH
T1F215AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 924KB
SHA256 8c843463933a348035eba43257c9bfc9c04ab371ad95a7faa276360e55d76d8e
MD5 75c621207d4104a0b5fcfb093e768167
SHA1 00af78f152f3067dc4379840f716af3d5b785259
SHA512 64394ed75e8ef21209aefad6b13cb9d436cb609bdd9a5bb5eab7b79d6ccedf47fa626d85a671abd052a17472a260d1aadbfb6440a615fabe4df976c0e1e5dc2b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyliw:A3k03kHRJE
TLSH
T1DF15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 924KB
SHA256 08067f09149cb36375303bb06ca0617369b1932010b2bd3a1543e6b3ff4a799c
MD5 128b283855bb91d7a04b9b896e83c171
SHA1 e390ad0a101743125024a4888ed41524b8433bcd
SHA512 0929bffb848e102484cf70bd238631255320b0d72015729f8c56cfca01cdfae9f0c04b904c8810c5d09c8698d137bd8ad89340b45c507677e2a2650e6c4d8867
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylpT:A3k03kHRJs
TLSH
T1D615AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 924KB
SHA256 e84609458246c9ece6157a693c5e09ba169a719a0db1f7cf54a640ec6ebe5a79
MD5 9c4f39a9ea72acb6bc410f715e18c5f0
SHA1 0b54a122684c4dbd6f79b3cbc84b4705542cdca8
SHA512 ba4acc4b21a8b4ac0ce57ae9416f1b13854a124989dfdc514ef568c398691f2f0e07c2457a2bbe99a219f81ac6a86a4c361f0bf4b8429799ed560aca047107fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylHu:A3k03kHRJL
TLSH
T1E515AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 924KB
SHA256 098d0ef66e1ab29c496bb63ea5171b7ca645c0a0f3d3d5e29501d0f315452841
MD5 05503faa2544dbe2de0c1b6157466e33
SHA1 b2a2a466eea79cdb61492bd4d2b22b8118361cec
SHA512 508bad3563fafd49a747be39dc88853ea1d5c5bf25790da4f6ea586280ace4e6c17837a2c6f35663e95c859cd32950b230c68a8c113a4d33da41eb62f3877bec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylbb:A3k03kHRJi
TLSH
T12215AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 924KB
SHA256 8a9cab05bc1d48bd16a4659215732cb5c36ed3b7c60aebb0f6ae5a57145df390
MD5 e9e6b2564596fe806097888eb2905483
SHA1 df6b785b88d6ef166bb3a0d04728ac2b40dd2660
SHA512 625284f735c387d299a1b10e00ed53eea7fb4aba1e8ac0b1ee5105dcdd190b39c11c75dca5cc0b7614d393186c8d745c155df29a2ec0d0da8406c1bafd8fbb15
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylvf:A3k03kHRJC
TLSH
T16F15AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 924KB
SHA256 9945c5869a7a532430faa69c404bf6ee78c210ca66c5b0ba512717be0dcc8f92
MD5 56864d5c8cab9639a55d0d06e948cb3f
SHA1 9d5ed8de636a3b99d01ee506e6b6521cdf7417b9
SHA512 83a79a288db85c3c2e325c4f52ebdee46cbc427bc1ae4cfea7ec0e94c07a591e8c24f2c384bfc17c7d5d5dd7c74949d799c2e9a951802362c2efc796c5992e89
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyl4K:A3k03kHRJi
TLSH
T14115AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 924KB
SHA256 9fd4fb2c08847b3eaef91d8dc7593b47360797df988375bb99b3ad1fc73f12b7
MD5 42e5ce8ff20082d48451ec677d9c8267
SHA1 b457b7d61789c1552c966c06771feebd8675b7a3
SHA512 9bf59ad84cc141386b6e30e7fa73014444db39ad1edffb80d4a6004cc6645fdd9f22db8e4b7b97c8df92d5b443335f8363cbec0d7cbf1ccc43b5b4d92361d795
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyllk:A3k03kHRJ3
TLSH
T16E15AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 924KB
SHA256 e08dde7337700cd2ad10f070df611be1e376d88cef5cd39c256925de556b5b04
MD5 d1ec312481faa41914b8c547702fb9f5
SHA1 9b284cebeb399e98e92268ef95742f0a75bd6afb
SHA512 811bf06994d72f56a97ef21023479d674cad370b54f755a83188af885a11c5d7d196651bb076043a99773dc136c4cbc0ca5b8cb30f3b1da0cd9fad8c477ab970
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyl60:A3k03kHRJW
TLSH
T1B015AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 924KB
SHA256 b493ed50c09db69a27db3bd7ec9d30677d36db2d933c620d2074b590cb469aad
MD5 0b2611a4bdca4fd1c1dbe83b788bc794
SHA1 7aa317e6d20ca5a0b15bf39c5999e401e32e0739
SHA512 00d878f39174823d2f9434d0718a74e30b357dbf2d9fcc8b0fb0773fcc053ee69189691329e68f40bd2fb788facd6490ba783d154069035f5426b480db1d057a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylpg:A3k03kHRJv
TLSH
T11615AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 924KB
SHA256 0c008f0ce1e13986b6242db5d8b843bc5c40b0ac1be0df7b0e900b7294266dfa
MD5 e635dca6f897481fbb5ffb97808ccd58
SHA1 c2741466d89cb0306f00d4d0500a906e0898f4b9
SHA512 33ab42687ab9a0f066602fd125b7b9d784d61d05077234fd090327f96d1317f74db2d4abf22182273a792a6b087c1ba917188892cafdca52bb987fb113dbb2ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylQr:A3k03kHRJJ
TLSH
T10315AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 924KB
SHA256 be0c1c69d09736911abc84edbaab90e9a021d9b107c3f6afcc093378e6c747e7
MD5 e657d7ef1e7a77eaccd943ea4de12c95
SHA1 285cc314cf6a4929e1089beac8b2c39eff62c966
SHA512 590ecad1cdf98de074af10ea7190d31e890707561f94b864d56437530373c06f6b1c56bc5e7988b41d3a490645428ac9bf63d6e58bbe9501050cda3744c0e93f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylOn:A3k03kHRJj
TLSH
T12015AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 924KB
SHA256 9351e53ec75157e251f69f0db06d0dc74c07df5d0897a538e15f2391faa8b817
MD5 340a073b77ecd946ea1f68714f58e301
SHA1 490609d432459811de17d6726eb0653efb5494da
SHA512 0be100e357b0435530befd205bf23968032401e1d61dd93dac3fae5608685387054152cd1d7dd05da72c366e507b53ba1bcb8f344a18a55117a2a946987578a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylEx:A3k03kHRJB
TLSH
T1B115AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 924KB
SHA256 62608f66ef59244549bc02cb2093c3a90839e96c918e0a710d36147c0144cc48
MD5 fb5876e4b29a31ee2160c35db339101d
SHA1 acabedc4613c5872a3c7b0a6a79cd7c005545ccc
SHA512 2094fad7a683ddc095c8c2aff6c334416835b5ad05489333b87a85a75a1950d9c5cb0a8eb419451583c87e5c27e653ee28f2035a64c14e676202291a37968160
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylOA:A3k03kHRJu
TLSH
T1A115AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 924KB
SHA256 2e401adc88db82f6ab04480ed9066c6d21ed3c55d72c70463e1450e0e4f0ba95
MD5 e6490aeeb48dc33467911200e038f6c8
SHA1 976a02992cc5a9e2ff37b1717f1e1c81f55fd3eb
SHA512 eca503a3a5a79fa5f46c137aac1e689997c086fc3f0598b05a8911126d542d0436111e21a08f74c51cab9acbdd3aee1d173b62a95e5c12309268e3c2ed3284c2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylH9Q:A3k03kHRJz
TLSH
T1A815AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 924KB
SHA256 20f0059714a9ca861da9357e022cc704127dbdc5c6e38643cffc56dd965543d2
MD5 ddb1b456bce91f013cf3c238493fe854
SHA1 8a93d11462daffcd552cd84a813f2e9bd6b41de8
SHA512 c08f1db50503215fccc8d10bc47cfee8ab65f825a73dfbf8297050652b65d3fb1f5c34a23c747f247d9e4f4abd51d8877ac8f1ea039de3044a6b57ead8d298d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylO4:A3k03kHRJ0
TLSH
T16415AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 924KB
SHA256 4d8301f29fff40fbdcdde8a15dc2f791f5ff8611ffe77934cb557bf298b48693
MD5 20734f19621682797b693a001655f09d
SHA1 65e6d1d494ca29f4936397aa105c37bdd6b65505
SHA512 62654e2a6e7aa168c8421b052f12fda5e1de94503eac71c1143556bdd900a972d6f7f37c43a92339fff079022539e6c89b6613c012f8c6902b1b07c474e5e96e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyltu:A3k03kHRJl
TLSH
T13F15AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 924KB
SHA256 3d451fab559260909e6e8ccf1dc8d3a89dddc9fb17c4dd4232bf87f6ada91dc5
MD5 9d83974a682988136a6a73daa4895f2e
SHA1 e3351df835b8f6285d30195f572f9cca612d899d
SHA512 25b447c26f21ddae7dd70785e6d67f72b9627c255f35bef86181f595001df534a6b3d0090a15ecadc2ed5e0fb7c2fd63d29440563cfa6cc3123f36e4d6af586d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylgj:A3k03kHRJn
TLSH
T1CC15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 924KB
SHA256 35516923fdd9437f8e4a0189ce3aabffab40c45bafc756b7f40769b4b39dfac5
MD5 7a6e1f75c41ac47248163ce62279d362
SHA1 b80a4d5c56c58b3e63198e7fac7c9c96db8db573
SHA512 afd6edef98968177529a824cd52587cf032a87d9a32ae4dc542ba93e5645d246453df80b466c8c2b23c5e737844d90f6c3d47664c8cc67d28ff9b2c5bfb092c1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylRg:A3k03kHRJP
TLSH
T17F15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 924KB
SHA256 a012cbe90e866a609dce3781f55550b13a13a4cd6a56184eaebbddcd010f7730
MD5 634138050ec1fec57cd45c00c650f006
SHA1 d4f77a161c32ae718c5f2be0db50f9706c19a984
SHA512 401450f1f4ce84de61c223a1e78ae71e69136354878b2754c90a1111ac717524780de531967b0907d9f8277f22dc77ec1193fcf9003b5c4007b1258e8ebf5c06
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylII:A3k03kHRJe
TLSH
T11915AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 924KB
SHA256 ef4428ff530dcb804007c6357eb4fb20db3c7085803ed0ebd23f5dce95360a02
MD5 3851303262f585f6ec6083ea4ebdd9d9
SHA1 2e5684455706f2b5dfe8899039034a384938a92d
SHA512 18a222c5cf81d5e79fbef1fbd3518c7fc31520237f07a5caf34ca452bb46fd207983dba0a175f3c152a9951d77c6fd4cc022f47b68a0fed919db54ba01c44ec8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylqo:A3k03kHRJc
TLSH
T17915AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 924KB
SHA256 2b364f68a3206f52c230025630846ee1c2eb45fd50dee7bb9a9f5343505f9e89
MD5 2e4ecb7f33526f68c0c39d5a56c2f646
SHA1 75170aa2a674d8479ac3d8c9083c7a88f3ec010d
SHA512 8bfe8abaeac895a657859339303e9222184a3c6371e473b2b059132d920b01f4a3b41c7758a2940d8adf36617a2197b278135266e00313b8b74283061fddbdc0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylB+:A3k03kHRJR
TLSH
T1DA15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 924KB
SHA256 23aa113cb22fec6ffc909f51d7bd03498234d5b74866ba83b06abb26cd4fe457
MD5 0b262153ef1c9266e3e493582b566941
SHA1 fa99b3af20b44ecb7823bf1d8244152000fc50a6
SHA512 d727103e0b09430326bbae84e8f6a66ffd29e453e16808d4fa132918e91bcf19268f3b7a14c908aa6e39af6db65262508824fffb32d2ad7a605c8482d7ac1893
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylPQ:A3k03kHRJR
TLSH
T1EF15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 924KB
SHA256 b12dbb3572b284d08885221c74da05edb86ef59b4d6878744a4e4814ecc8d1ed
MD5 f72d8e54dfc4919af5fa360605a61bfa
SHA1 292029fba238a7d95cabaac647bbf06d6d4fe4ec
SHA512 33ed985745e1af8aef464fa212e1265778f9e953ae2cb4d3dc8452d3a43ec3eaf2dab7bab0f76c3498c6d797cc72d4c6b6f4c98245f545cd7c35ef873aca6776
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylUX:A3k03kHRJd
TLSH
T16F15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 924KB
SHA256 bae6556e8c723c71ffebe22573d9986886018d7b064685d755da549828fa4774
MD5 92d30a0165fd92940bf42b18a63bbb53
SHA1 8eeab189dffabfb66495eae8cbb5cbb0e81f4d55
SHA512 df22e205f420cdf1ee570a21fa9aaa2c954236ba03af73b6b8ff497afaf9d1ae1ea13566439ee9c651d5b049afcdec96ab4f5f2ab90affa05dcb5624676a65c1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylyL:A3k03kHRJf
TLSH
T13315AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 924KB
SHA256 54efbb208ece9ae0ed4d91d3635a41bac191ca2d896d638a8e179bc007d995a3
MD5 c7ccd4a12f196177164c635119d2ddc3
SHA1 5b53402f1c65249a02241af67cde9ebd8e28cedb
SHA512 d5fdbfc24ed422d500c4d3e25b4bc324ec66c4ba15b2927d9d0d06153d1c39f02a687149c812f416af1c9fd4745eb109272d2e9dbe3e7d8e579ff35d9b095518
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylWM:A3k03kHRJq
TLSH
T1DF15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 924KB
SHA256 0f56fccebced19d82749e0cbe082885ea72a1601cc4fac708871a35aa43c6675
MD5 f5264193286f57bdf439c2dc44d62510
SHA1 0182c036ea753e19c17aa6c32bb8e84311ed1ae7
SHA512 88631cfbd772fb9373c94cbd0ed7c34d813473f3b9adb6a090e9172c3cf85cba8baf3e48ec3a88ad58fcd8da1178f3f7e667894b70a5a37a1ddd9b5ddb9f84d7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxylfh:A3k03kHRJk
TLSH
T18115AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4084-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4084-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads