d35eff4362f148339e21655eae385d7c57d34e010a0794a48ecae54094ae9cbe

Analysis

max time kernel
105s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 913KB
Sample260730-sjvxfsbr71
SHA256 d35eff4362f148339e21655eae385d7c57d34e010a0794a48ecae54094ae9cbe
MD5 a2d20eb2e1f6bf704a027158ba59acad
SHA1 0cf869995002e6ebb5bb6b7ca72638c4a7df3ab0
SHA512 aabb47f84462165f834f2df2c25b0ca147f717a08d0405766b8cc42c93b08d355eba5412e61c37aafc71e498839015d2c7a15616f4a4f87a481a317284cef234
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmC:A3k03kR56ru56rX
TLSH
T1B6155A17A6890FA8C11FC1788A968672F7737C115F2097DF1350BE253F76AD0AA3A643
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4212-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c505-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3152-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4212-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c6b-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982b-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bc-499.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-578.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-653.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-764.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-801.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-844.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-914.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1083.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1151.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c505-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e6-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c6b-60.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a3e-226.dat	aspack_v212_v242
behavioral2/files/0x000400000001982b-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bb-444.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bc-499.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-578.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-653.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-764.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-801.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-844.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-875.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-914.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-934.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-1009.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-1046.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1083.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1132.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1151.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1176.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1220.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1325.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1344.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1403.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3152	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4212	2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3152	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_a2d20eb2e1f6bf704a027158ba59acad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4212

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 913KB
SHA256 d35eff4362f148339e21655eae385d7c57d34e010a0794a48ecae54094ae9cbe
MD5 a2d20eb2e1f6bf704a027158ba59acad
SHA1 0cf869995002e6ebb5bb6b7ca72638c4a7df3ab0
SHA512 aabb47f84462165f834f2df2c25b0ca147f717a08d0405766b8cc42c93b08d355eba5412e61c37aafc71e498839015d2c7a15616f4a4f87a481a317284cef234
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmC:A3k03kR56ru56rX
TLSH
T1B6155A17A6890FA8C11FC1788A968672F7737C115F2097DF1350BE253F76AD0AA3A643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 b993d3364266545ad7511545ec139000b2c4f552558e60ffef62449c1715b5dd
MD5 d00fb2e2ea10634bc228c2ddbc60b51d
SHA1 57d82457dccf08090782ba67f5e8561934fff692
SHA512 9bb3fb43625e8588bd5701abc71c157137ddb1dbefa7bcfb58ec5b1910a5c8de7274d2b29aebdc0d5ef0014e2c8563eba1e3fd3bf3ad3cce4e174f069594e2a3
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmC0Le5ji0hmxNrM:A3k03kR56ru56rTPji0Aj
TLSH
T11B653A16F6A44F65D02FC078C59296A6EA733C415F3097CB0354AE293F37AD19A3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 927KB
SHA256 72a35c6db67eb8867b999e71afdea0d62c70d80df7be98a4a28aff7286205df1
MD5 a4dbb786eeccb954f8f3722985e77438
SHA1 847ca6d6dffa20d8940080e2f2f74881db41b02f
SHA512 5404bced32336db1862a65fc3da561064d4c09032a96265ce0ace91ea512517006ec9cf236e0b366f5a5ccd370474af287f8f7a329e366464b0e42e71309f92b
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmMa:A3k03kR56ru56r
TLSH
T17F155A17A6880FA8C11FC1788A968672E7737C115F2097DF1350BE253F76AD0AA3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 961KB
SHA256 71643898b7b211900d64031dafa8146bd86351e1fd41350ef618020724c2d0d1
MD5 12b6c1bf7662175e6574c60dd40db8dc
SHA1 9cb28af4f055106c289a51239a36874c5caa3fdf
SHA512 b376ec2771398d1091dc6e9a6823116d5b4f7a5fae22d5844c761b8bf0be5f0e395ee640a338c418ca92535ee3b2a03c24a201ca0fcbec6a353686a048c9e563
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrmnb:A3k03kR56ru56rWb
TLSH
T1D7255A17A6880FA8C11FC1788A968572E6737C125F2097DF1350BE253F72BD0AA3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 936KB
SHA256 acc7c13ea77240bef2df7fbc3596ebb04357d64109704a374aea8222c5f7c638
MD5 f249210d13074520c09ae6d0f106c005
SHA1 c658f53ede8433584e196cb32d851b3cb0414b8a
SHA512 a5437ca5e14771bfb61c8d1062f96d1cd88e749ddb01f2a6f3da4eb811524a66817ded075df2c9632e5718d6012382fda756f2e680a010fdbcc1fe2115fa728a
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrml6:A3k03kR56ru56r7
TLSH
T15C155A17A6890FA8C11FC1788A968672E7737C115F2097DF1350BE253F72AD0AA3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 936KB
SHA256 1b24814e6bd935169d615524235172d21b69a60ebb269a7b8aec703d284f4768
MD5 e2cda46c051e36ed4cfc56f248d705db
SHA1 7ba01ee96a1af8cd813c53da29be1741e595c593
SHA512 fa2acd85b3fbc92dbff1c95d41508907e15c59ec4d0c3f4389b0d356ff2f1678e5bbc172389a0f70475f7909b7f0781029fa3acd469c9b27bfeea3b3eea7a258
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrm7N:A3k03kR56ru56rm
TLSH
T19D155A17A6880FA8C11FC1788A968672F6737C115F2097DF1354BE253F72AD0AA3A653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 936KB
SHA256 6f626d898b7c22e66331d7b65f5bb686ecfefab989a798976540a8cefd38cba6
MD5 fd2e901f004541f2c95a873b64621b8d
SHA1 93d3bbb4a74ea2c46274a206468c977f407fee1e
SHA512 1e6ebc253d071b4fb09d42b8da749bdc1c7710edbe7726f56088b875c501700bc8d550ef54182515720362f35fad8c4b53b70478ba4bd54e6113ec896dd658b1
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmZf:A3k03kR56ru56ra
TLSH
T13D155A17A6880FA8C11FC1788A968672F6737C115F2097DF1354BE253F72AD0AA3A653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 936KB
SHA256 63701d16a7d249dd349dccb7e764a5c2202bce19dea0c1b3713114070d91db90
MD5 3a1470cc944101f1794bbd198b1ac29a
SHA1 994b68d00503413718a1ec78bb857e6a84201026
SHA512 0372396a761a8b0a456989dd73b27310c9212c71350cff320f84c936170b6a02cad9578af943d7354595d7611e7465e12ba291a9f0229db5d46386b1c41f79b5
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrmbo:A3k03kR56ru56rj
TLSH
T1D2155A17A6880FA8C11FC1788A968672E7737C115F2097DF1354BE253F72AD0AA3E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 936KB
SHA256 321887f558a5ef5633465fbc8e0c4445a6b82c5daf3104fdeb26ce255caf4aa2
MD5 aebde39f8965861acbb43b5e4c91a857
SHA1 f533fff432a0da914eafb9a1222801236be53aac
SHA512 77ab8f567b71e5cc6b7bd21776e77fd405974c6fc3540efd96516a67937b85b2d8d9626f2a025a073a764d49c097d85da008736544e9ae703b3847a77ebade37
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmPu:A3k03kR56ru56r1
TLSH
T1D0155A17A6880FA8C11FC1788A968672F6737C115F2097DF1354BE253F72AD0AA3E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 936KB
SHA256 b385fa015ddb83dc0d2574be33504c9f1db202135352e8c305e4867e9a66ad80
MD5 1e2d7963ee6a1ebddfa063661f8b361d
SHA1 18354a28e80a834a0c9a67e20e28b873ac30ef6d
SHA512 05d2c2bfc3ca7292c035925133b9cfae2f872327d9d934d1ba02b1d3b001fb745f93eef393667e4f8e2578d2ff314391fa5a9ad9c5869ece36f038c582978a61
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrmd9:A3k03kR56ru56rA
TLSH
T1FD155A17A6890FA8C11FC1788A968672F6737C115F2097DF1350BE253F72AD0AA3E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 936KB
SHA256 6388157fdaaf7a3bf3e577b286427b74f9a712529a410ed596067749ffc3f6cc
MD5 d775d9c2326d56b7d9362dc7bbebaf60
SHA1 2a5334209c8a055d06c35c5d0a98234533d8c8e0
SHA512 2d1b56f3d33f1cef6f5016f4f34627a9c1788a327aa62472f6e1f8f36277d934270fbd166cd193386e73f21811cdccdecc5bdcd50b723a92df474fb50e77c179
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrm5c:A3k03kR56ru56rx
TLSH
T1AD155A17A6880FA8C11FC1788A968672F7737C115F2097DF1350BE253F76AD0AA3A653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 936KB
SHA256 0abfe910d0aa1cf9a549bd748db4282ca335d05fd7f3f199c1b3641599905fac
MD5 a445ddfb85760c043472dad70dcc8ef8
SHA1 61401d757e5db04ce430763045c3b04361ffb04c
SHA512 0b927fe2935b898f16c64b46982b6351fa2c6610a17973a0b946f456441278499f21344d1eb62d9fe071e68ccd59011733dc87bea640e811415ab53312e0e291
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrmyp:A3k03kR56ru56rP
TLSH
T1BA155A17A6880FA8C11FC1788A968672F6737C115F2097DF1354BE253F72AD0AA3E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 936KB
SHA256 66ee8407a4ca4697d67ed1900dea51835309bcb49ec09254ada3615ac45f469a
MD5 bcc781a230a59f34f13d7c9d2440c0f9
SHA1 0dbd37ebdc5eded8a7fe0f4d59cd02cd2ac01d00
SHA512 9b9740990378d9522f1c049ee9785a766254ca2766b7b0edfa12386005aa1326be34bb43b1cf023dc210d68977d8a7436629e7596c985c13f3e7391897db33a3
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmFN:A3k03kR56ru56rE
TLSH
T16A155A17A6880FA8C11FC1788A968672F6737C115F2097DF1354BE253F72AD0AA3E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 936KB
SHA256 435253ce2b683516a386ed671c2ab93dbc43a2ffc912f4dbc22f14c8e48a3917
MD5 5e4bfa975ebd32c961ad622bc6d482b4
SHA1 2e7e7b21e3c2cf7e6c6ba21e2d3010a1aeb18d86
SHA512 14e09c1b5ca4f61f4c5dec73aef4d2ec5e8059602fefc0c99cc34e762ca9b8e2a93a53d6843e41466ece1ae537b58bb5a08e65cc6b2e617b1b8654074102f90a
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmXF:A3k03kR56ru56ry
TLSH
T179155A17A6880FA8C11FC1788A968672F6737C115F2097DF1354BE253F72AD0AA3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 936KB
SHA256 b4de850d4e071d2b3f9f94a9bfc3735b3db1c3d89bdd6a2ec8cc982549a8ece1
MD5 b6b9c52d60cdfbee2cc5683529868cfb
SHA1 3f4892c342b7b2fbc0d654d6a8ccc27ba1681663
SHA512 652c9f7634b89a04858bd15380f366f20db3add0714c2209a1cee169d6a2bd5d63fe785a9a43178bfc7cded78ad2dd40c6eeb6f70448707f271fec4bfd24881e
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmoC:A3k03kR56ru56rG
TLSH
T194155A17A6890FA8C11FC1788A968672F6737C115F2097DF1350BE253F72AD0AA3E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 936KB
SHA256 e7c58e74529d73090eb1abbd60400103fb3158de90c6175315b8cfe9394cff20
MD5 20087d9ee5d346d232de0226d9e6f72b
SHA1 6a920fcf4bad8795308f15e608514a3ef2c8a20a
SHA512 7574d9a1d0c6cd76dfc4d7effadba2b59668debb021a24d5bb0e8d0d5e1142986f7c878d4285654df44ec231e8099250066e0f8c18bb1d80352fe3088f745688
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrm7w:A3k03kR56ru56rz
TLSH
T16C155A17A6880FA8C11FC1788A968672F6737C115F2097DF1354BE253F72AD0AA3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 936KB
SHA256 091334525224b77ee8b8496a660254096d5edb6472ee58234c7e91836e55af62
MD5 33ed232c87523fb0d5af20a6a9c8ec7e
SHA1 618758f76d1b169452de143b47eaf7d8122eafad
SHA512 d4452eac9c6cdd888b69761203429e216416f4f99024beba081ee5457ff32a5c7f0fd6dbc542cb22aa557736cd043225a3ad83d623af8bc11d6b56636e9d3622
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmCT:A3k03kR56ru56r/
TLSH
T14C155A17A6890FA8C11FC1788A968672F6737C115F2097DF1350BE253F72AD0AA3E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 936KB
SHA256 f31458cb70496c49d83e82b9bd55c4ae7b6a01526114c4562085c1c4660bc62a
MD5 bf7e5baa5fe5097ce8e211d70534224a
SHA1 7a12dadb71b2f8cff07f819111fb0716b8b670e7
SHA512 a342d6fbb60130a8ca6add0f510c3a1dc02f47f5ef4ead2b652f4098c2d4dc06319cc6bd38c0382916f1399c336305d28251a2fc19f2c0f00f057f73eb0abe9d
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmSu:A3k03kR56ru56rQ
TLSH
T142155A17A6880FA8C11FC1788A968672F6737C115F2097DF1354BE253F72AD0AA3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 936KB
SHA256 aabcf23815e40a1a58f110fe4a17b6c759ea55d03d7f8f08797b66eec361d3ec
MD5 6b1760d0df393b450451044055762af5
SHA1 67bbcc14ddb3f1f0eb6675890549adf7a4f5b066
SHA512 a15feb6b13da8abe464f0ce430cd2d8e7adf47354d5fb792591ccca75c0c75707750032e1a6809c972e1704c9784fbfe917c3efc7d65c43a093f5bb20152d42e
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmMb:A3k03kR56ru56rJ
TLSH
T1FE155A17A6890FA8C11FC1788A968672F7737C115F2097DF1350BE253F72AD0AA3A653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 936KB
SHA256 2692caba85eba5aafcbdd3bba4326355d7b221e3dc4b85740369929cbc252356
MD5 8b9c963522ba1dd384b3d8f62f3af182
SHA1 4b611d72e44002d064cd1f808915a2c19826ae0a
SHA512 5c1f29d06cb4c0594da470631e0bc7d9d48fe334679243b998a859102ddaefb0098f72bf0a4878de8bc7058330ec7eb2391568b4c67051cbd995603f741bbed6
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrmyf:A3k03kR56ru56rZ
TLSH
T12A155A17A6890FA8C11FC1788A968672E7737C115F2097DF1350BE253F72AD0AA3E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 936KB
SHA256 871a050e8d66e367c3bc657f142956c00a3039e165ce6e67ec40e686ec8ba8e6
MD5 8599945e8297cb9d7d7cfdf78d578614
SHA1 a9075d458264263ab16eb18325cf7773ccac8970
SHA512 2a3a39069263393d89b2e623c3992a7e8dedca6efbf8d2061f90314127a76d423ca34429af287546973c07745199f95e7fbdc211ed4f6d9480e5aa130a5dacc2
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmfK:A3k03kR56ru56rx
TLSH
T1A2155A17A6880FA8C11FC1788A968672F7737C115F2097DF1354BE253F72AD0AA3A653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 936KB
SHA256 ec2929f176c028a6a49c14ef53147b065ca2bd804dd8501483df7a8c590c6453
MD5 9b16beaa6e94e85a2d2587ce5bf597ab
SHA1 35d19994d33dcbc50d63025d0497562bd5e62919
SHA512 6904ee587d2612ee65b78579dd6c67af3009a409907aa626cfda4f464ed0616110b6f6418a19f74d8f3def74136d146dc6306c0ea1c5951b6bcf974a7b2f1f81
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrm4k:A3k03kR56ru56rY
TLSH
T177155A17A6890FA8C11FC1788A968672F6737C115F2097DF1350BE253F72AD0AA3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 936KB
SHA256 3dfefb7425e1bcd46e6e8fd6b1115a016ba706c89682b73c153a9d59ecdd1d28
MD5 5931f3d1b96f1f51c008720f65f20d38
SHA1 fdeafd75487b1c4fa5e4df787797655d23ac2542
SHA512 ac32870e2cd93efa3313167db41ef8eb27dcad2627cda2a3dd9bdeadd1a072af9bc6187b6dcd153dd6077cff7348d453924323d109c17d73ec8866dd5bb505ca
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrm50:A3k03kR56ru56rR
TLSH
T12D155A17A6880FA8C11FC1788A968672F6737C115F2097DF1354BE253F72AD0AA3E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 936KB
SHA256 53f0674197b176e6a77bf3a93f7d8abc1551abebda87b7e1beacc3bba42a4704
MD5 908f6b56b44a52fedd0706e62c477323
SHA1 641f3bf79bdc3c590ab749b47fb945252a4f71e3
SHA512 8f983f18440ec85f7a6c5a791395411a8d7df254740fe3d62787cac404dd179ec7b3ba8710ac696482799fe36bd10802ece0645bb51e4ff116dec4f45759df09
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrmsg:A3k03kR56ru56rw
TLSH
T183155A17A6890FA8C11FC1788A968672F6737C115F2097DF1350BE253F72AD0AA3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 936KB
SHA256 6fc516fe22d54d449338976c567fdcb5ec58a9b229522570ba034dfbbdd4b079
MD5 eab4239dcd010cfaa1abf697dbc0e4ee
SHA1 1f7d70984b0d42629cb00004a8811d75df01fcc1
SHA512 af6d5b7b27543b614e8fb09a313ce451be0fb94db90fd757161049eb9ba5cb1f73ec06e7d42d828e906afd8379453092bd509d8c71c65d66f4e5627032686c79
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmJr:A3k03kR56ru56r6
TLSH
T1AB155A17A6880FA8C11FC1788A968672F6737C115F2097DF1354BE253F72AD0AA3E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 936KB
SHA256 6bcde4dded4712f3a46a90500deeacb18b119f7041d64b7eb63845c84d133d2a
MD5 e09ac1bf7712e27e0d0b73dbf71abb3d
SHA1 5eec95ad5880a7e74fc69b313651141054cd069b
SHA512 cf1da7676ae950c5ca13b664e7dccc6026814f7ac622dd8dd75eb8a968904a9ee283e91b7580a207cf89a70f9505ef415a9ab52d8cfbaac16cfa3eac04e5c575
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrmrn:A3k03kR56ru56rc
TLSH
T167155A17A6890FA8C11FC1788A968672F6737C115F2097DF1350BE253F72AD0AA3E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 936KB
SHA256 9e7900636ce9f7a31433cc350861a03875b9abd5ee130bc00ac860a0588693cb
MD5 efa996e0e74bc22ddeb3f806e75c2288
SHA1 6dc1258f262c70bb4750cd3dbd5c34c73e4b59c7
SHA512 d25ccb45eb9a9ed9ba95b77446a77847f4952c98dfd6f1d7b3f72efc91edc8a7c30d88d6abab769b884644bea6d3ba2130f0a2504f25c6459898c246a9036990
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrm3x:A3k03kR56ru56rK
TLSH
T143155A17A6890FA8C11FC1788A968672F6737C115F2097DF1350BE253F72AD0AA3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 936KB
SHA256 4b28b57578dda2d2e9db019eab45d08c7af360e17262fdbe67661d1823aea552
MD5 a62261ccf501bcfab1bcb4fb4ef89b08
SHA1 bec5898401d3900e99798123311d094259091438
SHA512 0152575fcd34b5c6f4db211965fc43ffb15892afcf6f19adda848fded78c9b798330c1b43d96e9e495bf7e5e2d9fd86dcc67542e4b67bf901635169bbf2db124
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmtA:A3k03kR56ru56rJ
TLSH
T146155A17A6890FA8C11FC1788A968672F7737C115F2097DF1350BE253F72AD0AA3A653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 936KB
SHA256 11216ab6199618ad212857412848b333d9a7bb60a708d2f9cbeb1d54d618aa12
MD5 9d59a787359c6c23572dadef61a273e5
SHA1 175b177b65ae01886539633f43f3927e7f91c729
SHA512 971f3579234d996671ed414ff49ffa1e9a126a1981334a57c77fd0ac2e48d22db6079e3053919c8960403e0358e88a4fb2909b041de544bcbabc8af5326767d2
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrmm9Q:A3k03kR56ru56rQ
TLSH
T156155A17A6890FA8C11FC1788A968672F6737C115F2097DF1350BE253F72AD0AA3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 936KB
SHA256 11872e1ff457a1143e1472b73cb3cec8870a40a1ff8d46094366776779f01b40
MD5 cba960c0fb1e68f0e91d9edcba957db7
SHA1 13e995399d6c65e1aa442a2b721cefa32280dea9
SHA512 0ff55df41ac6dd19db6cdd285aed2e8f006a640f7dedb34b4a4fae92423ce22b50a0d19ca5138b3a6af21810aea7c1c9ea9b2425dc7254eab7dbe854e878ec5b
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmD4:A3k03kR56ru56rL
TLSH
T1FE155A17A6890FA8C11FC1788A968672F6737C115F2097DF1350BE253F72AD0AA3E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 936KB
SHA256 ad7c66c0e23d490c8c8234563e767d788f222065c596f82e3397ca6fc5273b49
MD5 2e52750082724f0b92199963c4980566
SHA1 163a3d4d37d3124af09c8927b9a3447c9540c8ce
SHA512 9556480bb4c2d6b4e629d265ca33cfbaf05c5a258d347a84be284be785bc3264f909fb669f3bf8d85e174996018ab162f9ad3d17a784d232052a857fa96c0b1a
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrmqu:A3k03kR56ru56r+
TLSH
T111155A17A6880FA8C11FC1788A968672F6737C115F2097DF1354BE253F72AD0AA3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 936KB
SHA256 885e39fd7d232581e62f3d6ca86c2cab7a8943cbea995046b39e370b61a8d751
MD5 6ffe7d697c7e432075d6e8b0e948e5be
SHA1 25f936af00a543fc2e7bf1269ac912569f791d39
SHA512 32c1bfd6019ebacde01443c265863625aeb5276cc7bf9b7f2fcb71a557314786f23d0f6f3208b2598cd2ac06a786de18e8111493ab57cef773ca70b2b57c5852
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrm7j:A3k03kR56ru56rw
TLSH
T1C7155A17A6890FA8C11FC1788A968672F6737C115F2097DF1350BE253F72AD0AA3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 936KB
SHA256 f6629bf5d5a184a23e4f012f43b067eed208c19a045c2934cb669f0c5084c7c1
MD5 701b5d823bd971b94e83602c1d28e464
SHA1 adb59a9e6c918a76611a5ec89c8e7bf0e67ab210
SHA512 b1210aa12485058b4281a14577b1b54d356711831c09b226ef7778cd63f45dfba0a4b13c70a8e23fd9974dfaf53e1dd668d08e9d4ac333dca6a4f2b1f3aaef6b
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmGg:A3k03kR56ru56rI
TLSH
T1FC155A17A6880FA8C11FC1788A968672F6737C115F2097DF1354BE253F72AD0AA3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 936KB
SHA256 4d8651cf089ff28376af6cb565e40e9d5820695450949ce100b2008a0cb5a248
MD5 3881459d17f6506a9d4d3076154230cd
SHA1 ae730788b2b60f3e2c3e2a4d8ba8863f18795251
SHA512 f40f9475827681eb8c59ff8c87a4dc407746a5631f2873f6f89fcf721bac4c115ed8f7c961a9049cbcb8f4017bb58fed0a1316f06a1a111c6906e58b8be9475a
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmpI:A3k03kR56ru56r5
TLSH
T189155A17A6890FA8C11FC1788A968672F6737C115F2097DF1350BE253F72AD0AA3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 936KB
SHA256 090777b243a673c4ca4749e859db7c1e66ce8fc337dfccbe62b8abd647c4c618
MD5 6adde79daf07cd70c2cc52529422a4be
SHA1 bd16e1b4f77ab49fcdd75ef90c81bffacfa74069
SHA512 aacce73e9699e0020b6839c4693ef7b3701c48783e5abb242429847e1c15a2582b204473b3786cfff4e065d63d699ab437c00b2967fdeaf5a6c3ab50c3a10125
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmLo:A3k03kR56ru56rn
TLSH
T1C3155A17A6890FA8C11FC1788A968672F6737C115F2097DF1350BE253F72AD0AA3E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 936KB
SHA256 9ca0c28140c036a763e59f99398efc46ed1e64e35425d239c4e418a3d2831919
MD5 5384d536cab184538d70bbed5971c22a
SHA1 dfd2022e9e652c3000772256d23ca197c4f2971b
SHA512 1a1192da5b016ea01491a71c24c74a9e2a7cddb48568463a066e4191bf45b8ddf111329a4f04336a4f82d439be089872075a5fa18991085bcc848b7294b9480e
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrmw+:A3k03kR56ru56rS
TLSH
T184155A17A6880FA8C11FC1788A968672F6737C115F2097DF1354BE253F72AD0AA3A653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 936KB
SHA256 a633bde53faf0b9c914118ba638fb40ed51342f9c15bbaff43b6f8beffff0d6c
MD5 28c788be14d116cf83407ea807e9d639
SHA1 38f947b3e599d9d335210b7c9d7687d212e44205
SHA512 0313f9d0630056615e764369c055bb7aac00ffc8f3056b6176801b3450d2092080d4f72a10ca8c871398b59c01fb122a58e6c344f28b7b03c46b81a20dca9e46
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmIQ:A3k03kR56ru56rG
TLSH
T18E155A17A6890FA8C11FC1788A968672F6737C115F2097DF1350BE253F72AD0AA3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 936KB
SHA256 f2e9f4dbe645ccc3ef93e2edaad7e68d920479a510c204a594937d6220e013f9
MD5 8bf924ce60441e5cf6cd4eb4bb3ea157
SHA1 08bf85abea00d93960b8598773dfe01cc9016db3
SHA512 9e4c334e9793b42ecc7a5485ed56ca4f3a434de4ad78e3f6f59b4949ffac87570a6517a105155850f81cc2773a4c5011491a3dab672caebba65dee0c9cccadf5
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmBX:A3k03kR56ru56rm
TLSH
T172155A17A6880FA8C11FC1788A968672F6737C115F2097DF1350BE253F72AD0AA3A653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 936KB
SHA256 19e126b337ed17c2ae9cb3cd81f89dc22f3151326369d1436b6102a4ea74c94b
MD5 881de69b87233ac3a97d0eb6516db0e8
SHA1 4552aa7fb9d30915970a02bd60eb9251937b2c3b
SHA512 df00b7f9599dcdd1071c4b17a1cf8e712c92396a828adec3507161e1670ff0cfac01f99cebeee0e8c94ae059a6b90ed303dc7c7da732e273e8165945fa209189
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrm7L:A3k03kR56ru56ro
TLSH
T1D4155A17A6890FA8C11FC1788A968672F7737C115F2097DF1350BE253F72AD0AA3A653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 936KB
SHA256 8014c95e7e678f295bb452be05202ce13a9988031c8731ab2b4da0f5153693c0
MD5 2f0f6fafe959747cfed752574ab5d400
SHA1 b3533a65cc64e1440fbc5ebcdfd3d3f4c9c78f94
SHA512 0b3ea0881979833d31d4e8f3aaf4e58797597fca2826a14a03bf59cb55f8bbd7a9440696af81775e8b41ce7be151285d49491925a34be42e255ba790babe9595
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5TvinrmBM:A3k03kR56ru56rp
TLSH
T111155A17A6880FA8C11FC1788A968672F6737C115F2097DF1354BE253F72AD0AA3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 936KB
SHA256 a79260cd7189703b104a89de84174958acb11c1bf36aff7c16446c93f5fe389c
MD5 7c0164ecb35ce5936557de13379ef43e
SHA1 43529d87b1daa858c0072ccdd78012dc22b51476
SHA512 4e782be1d1d7a88bb630ccfce13c077d5b1fb537483c3e31862edc1a3f84accaec555adc2088565adee7923ee62e92b03b42bcf2f73a82203a64c0bdcc3d8c2e
SSDEEP 24576:A3mnXoZ643mnXoZ6KEagogD5TvinrmVD5Tvinrmqh:A3k03kR56ru56rb
TLSH
T13D155A17A6890FA8C11FC1788A968672F7737C115F2097DF1350BE253F72AD0AA3A653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3152-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4212-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4212-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads