85fc91a9a311a87f800346613cddd61f793033e25e813dee5034f45d657b3a14

Analysis

max time kernel
100s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 922KB
Sample260731-3sr72aae69
SHA256 85fc91a9a311a87f800346613cddd61f793033e25e813dee5034f45d657b3a14
MD5 6b15f55f5441955ca3bb9b6d127a6d3a
SHA1 0530e0f0bd99b2e57ca288eda35bf183159a3505
SHA512 5528b14d0ced59f31d538cde61c70dc9a71a8e683a3d71e32defb80004ae3ce5d5428679a02cffb69cd45a7bbe63a8e8ace8cfc9bf32f8760e62f6a54d191714
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSL3:A3k03kB56rfc
TLSH
T177157B13E6840FA5D10F81749AA68672EA737C421F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4868-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c508-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4868-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2256-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c86-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-443.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-565.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-614.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-640.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-726.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-745.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-794.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-843.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1002.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1064.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1125.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1144.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c508-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c86-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-225.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-443.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-492.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a55-565.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-614.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-640.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-726.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-745.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-794.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-843.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-868.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-887.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-926.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1002.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1045.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1064.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1125.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1144.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1175.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1219.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1323.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1343.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1368.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2256	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File created	C:\Program Files\dotnet\dotnet.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4868	2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2256	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_6b15f55f5441955ca3bb9b6d127a6d3a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4868

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 922KB
SHA256 85fc91a9a311a87f800346613cddd61f793033e25e813dee5034f45d657b3a14
MD5 6b15f55f5441955ca3bb9b6d127a6d3a
SHA1 0530e0f0bd99b2e57ca288eda35bf183159a3505
SHA512 5528b14d0ced59f31d538cde61c70dc9a71a8e683a3d71e32defb80004ae3ce5d5428679a02cffb69cd45a7bbe63a8e8ace8cfc9bf32f8760e62f6a54d191714
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSL3:A3k03kB56rfc
TLSH
T177157B13E6840FA5D10F81749AA68672EA737C421F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 cfd91f52ee19d3c85f812dd953d8ad8b6c50144f433469b6716531b13eb933ee
MD5 04b7e9177138176e4f558d9a927f6770
SHA1 e881b6533a706c175a646502ec4b30b6e3afd43a
SHA512 e9ef814d90540daef969ef1d0eeea7beb1193a6307139a68bb9656305687a4e17ab1a5454232ba1c3e19214948583ad1cc77d41386f6ef16f6ea296fc2a9eacb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLo0Le5ji0hmxNrM:A3k03kB56rfnPji0Aj
TLSH
T162655A16F6A44BA5D02FC074C5D69666EA733C421F3087CB1354EE283F67BD19A3A362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 937KB
SHA256 45e9cf9a2611062d2037279104cad0c4c475aa11e9b281d41874d82693b2dd56
MD5 113f9a110c6f0e26a75d5b3651a999ae
SHA1 f759f4da1c12d2c16d37618ceadb9a4a21cf3409
SHA512 098ad53027a40128108ff39913e08a8a56b5234b138d2436392fe83b0e049e8f3e97e6b6d9c0241a90883e483c3a8c60d832177986e70603573b44022b5ed54b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLSa:A3k03kB56rf
TLSH
T16A157B13E6840FA5D10F81749AA68672EA737C425F2097DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 970KB
SHA256 3fb52ebb09b37c087a6ac75e04d27ecb416f9171c28cfdb32597c02a7948dc39
MD5 5f931d66d89dedb43b5608ccd9aee14e
SHA1 0e34e62ccb10c37f1fcd152e6e691384b8767f2f
SHA512 af2013b4fe9ca7f8ef71c133cb632a2e2bc86708f79484ae0e35e8a6e63ba6c28ed4831d30d650e87d77d0b8885580c95056ca8829a707f7bbaca42d22bb1a0c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLxb:A3k03kB56rfqb
TLSH
T1AE257B03E7940FA5D11F81749AA68622EA777C421F2097DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 946KB
SHA256 e22bacf913fdf624a8d68b8792d56e565be2f16813a8cd9bb833d3cb2539e340
MD5 a72dcc718a002cd752198efac8511ee5
SHA1 7c0d4c89ac20b6327f419faf8b447a521c1f7d25
SHA512 46964453d344a0bb701eb7a9e51fed2728cd310d0bcba20b9013c4fc9b9848854197bc0fabaabbe8a5bc5ca2d44a83527d9ad25ffa4398548f2c1413a82fedba
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLj6:A3k03kB56rfv
TLSH
T1A1257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 946KB
SHA256 b5aea67e061dc67f833951234a7add0388d0242f0865b1fa78dacf6778f33464
MD5 81c637c8bc2e297d847c0ffe0a0be297
SHA1 f77987091ec59a8f249cfcf38d0a91aba25cde0c
SHA512 52f8d1563bbfaff26beaf5639b7c1e22ab93b295b554e7e95ac2f24ace9c7d2fa46d42143c4095908db6e82e9f3154ec0c27521c30d30c9cfc252d028743af2d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLNN:A3k03kB56rfS
TLSH
T178257B13E6840FA5D10F81749A968672EA777C425F2093DF1358AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 946KB
SHA256 ed130af0388fbf9f1fcacef32e90d6a5e5a5306a155356e5e065b6f12ea507b7
MD5 75dd3b9d736cc506288cd7fab5d4a8a4
SHA1 ad50ce560cf863df4e485b3227b300e942e22ffc
SHA512 923ba18b5374538a5ebb006467abcf39bde297ffa1c8fe10facb49d13ae8bf699c5a87383af491f6d89ca39cd71f72f342a880f24a16d05e3e4ce45db9c495af
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSL7f:A3k03kB56rfu
TLSH
T1BD257B13E6840FA5D10F81749A968672EA777C425F2093DF1358AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 946KB
SHA256 558b5cda6ab6d3aba42ccbea4fcccd37e30dab250b27494e8f3f3b5d446d9fbb
MD5 23778cc2e6aad3abd83a74d5358aaf06
SHA1 61c7c4cce91142a2773a95a8959d1220ba67413d
SHA512 93e35cadf5500567b49d2e36a002fdcce4b97c908d5f4036e1a41bfb5726795a2ce4f1433e66d962328749969941c340504610faf70572d3d953fb0f1b3bd883
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLto:A3k03kB56rfP
TLSH
T105257B13E6840FA5D10F81749A968672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 946KB
SHA256 a2d89e5db737d475cd4c03cc46b9c83c372f4e83e287309bf47aa3554b8ffec1
MD5 91725f9f5d559163b470a27774ee1859
SHA1 ec6c49e380e0da692d2c70ad1ee58ed682a28c44
SHA512 bb5317887dafb3570743e592564411a6ac3982fdd51bd2bef1a824342adce5b1e807490958e3e35d221cdd1977611bb5708c6859db665382ee9f1b08fb8ef245
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLtu:A3k03kB56rfB
TLSH
T1D5257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 946KB
SHA256 cbc34d73ff297c54fb60a7c776cb24153109ee10da94256547cbfdbeaf4c8e52
MD5 33490a29cd181d234c809fda7d9e52ed
SHA1 02f07082d28390dbc48f532aeed378d12d98d240
SHA512 fa6cae1389bf454a34e340bd91fac3648e21d9ba0e5ea2cc4631ce921b9c69de77e3800a50d8e4e620b0dac1c02878402e9aabd69de6e8f1e745fd59bea791ee
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLD9:A3k03kB56rf8
TLSH
T1B4257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 946KB
SHA256 0a46eee338b66a9cce5a66e23f46cbae020740447a5da1a902ac08ba2654dfef
MD5 b9e4e3a4dc695a94949156e8c3fe9d40
SHA1 22dbb850ee8df6805b43a351ced76178b9037eba
SHA512 2e15ef86bcd57b75427398b2e64864886711d672927f375db4956773bc2e5e96ee8c842224f065ad3a7c93c97abb1410d06521b324fc48ef54e6e2766e9fac6e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLvc:A3k03kB56rf1
TLSH
T1A6257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 946KB
SHA256 a8cd88bb5f78faa66e2925bc9fdb44c473e9c77bf04210b1da5c951c815fdab3
MD5 456f6ea99816c1609d3de1b64030e909
SHA1 f4d5f6941abe20acdb000954006c8196b129cb29
SHA512 0ad17682c17a5037747c6d2c915f883eb148bcf40f588d0131ebf063bbe99816ceaafebef2f34c97345822ac8ac9815a57590a1daaa7d1d21b4c6a6e46366f51
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLop:A3k03kB56rf7
TLSH
T1E8257B13E6840FA5D10F81749AA68672EA737C425F6093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 946KB
SHA256 323481c93d5f79a3ffda1f0cbbb313f7ad4061be64af56ef7c03ac453ea67e3b
MD5 6cdccaf18205fe015ce6436421dc5b37
SHA1 0d20b3b60e98118173e96bd9d3d12427b0bafb13
SHA512 aa9f40db3d011654e7e2d41a85039ade16862b9c69483df041ef702326621d98dba8522dfce1afd907305d0800bb44400d36b7f4228eae802986d43bd8f094bc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSL/N:A3k03kB56rfA
TLSH
T1B8257B13E6840FA5D10F81749A968672EA777C425F2093DF1358AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 946KB
SHA256 b44e4927f2ea88d70fe18d0777ebfb9fbc2431205e344e8095128bb91125ec38
MD5 c3cff430c65c0f54bf054510dfcd35e5
SHA1 1433b1bcd1db595c7d93a9ecbaa87d47931657a1
SHA512 5a8da4740fce9b10ec8c3e56e7e59b14b5619077de7b6c771cd812a265c2bc9201ce25dd9afd5c62877ad00b736931a8d7fc5e43d8a396dca05f69aff575db2c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSL9F:A3k03kB56rf2
TLSH
T1A1257B13E6840FA5D10F81749A968672EA777C425F2093DF1358AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 946KB
SHA256 9c3ae7f37c8b8ce3b338e475685151d629834e389fb1c5053cd88a026d3834b4
MD5 3cf8cd3655002b8db80e582bfc512978
SHA1 4a70db31df1586e5c5627add794ff3c83f3ba653
SHA512 0a81c05b6b0ba55046d9a148fe94a4c39067c132420feb05998ac6e1f94274d038be54df7ad43226b334da6c04d51376c8e9fc5a8fb560bc0cedfaf4913693eb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLOC:A3k03kB56rfy
TLSH
T16D257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 946KB
SHA256 f7186b421ba6893dfa01da3fa6e81daf1399c9021d248205342503045bba1e28
MD5 80057a982dbee8b27ead87165c9c8300
SHA1 f4c41b365255d75e287d3ea577a25555750a1f17
SHA512 dc4b5391dd66858340b9f13c1d6229be701f5f2d799661d9195902789903f1ccf7dfe58ddf91ba260999a82f1e97e2d9199fd3b6471535667f24438d7673b591
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLRw:A3k03kB56rfH
TLSH
T16F257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 946KB
SHA256 c6bde5e26a97c04581aa14e4fb148a0c948abde176636ce1dc85df5a63ecb6b5
MD5 93715a2944cbb225b7994e63467ba012
SHA1 05baa64944178a5ac7049850e3ed3fafa7e68c8a
SHA512 a5e956b64d65336b9a255a7454ceb4f5fd930d0b487574286bd5735f1479b59a20edc2ef584e9b540069b679c42f7de221bf846237dec19f14d329f61a0d8b67
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSL4T:A3k03kB56rfD
TLSH
T1E8257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 946KB
SHA256 04ef2907f171344c12f7616409a01df82462f8207f5089fe034240c0867c7888
MD5 a87ad810115293edba9c599e3f807a64
SHA1 63e4e4c662a1de860db89d329169f294fcd4e5f6
SHA512 59882c91df636b1545491e4f45f1c69ea263b1774304d5152748f85891aa120389cddd64159d451b7b8cd0e3d9232d164097ee0e480f17f935732a6649b5a944
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLUu:A3k03kB56rf0
TLSH
T1ED257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 946KB
SHA256 1b99136db97389fa53a2c48298cbfb9f775fc36e7fa36ce28b03fbdaa6f460df
MD5 256475ed619816d5463ecac96f2b4532
SHA1 66f09a8bf098ed037a43eba47e637762628d3f9e
SHA512 476e483a5fd8e3eaf3e85270107b37f3f0f2296e7efd42135cbc794b9c1fe488f66c7566187a25efc683d1595b6e087394b992863601dceec91793e6df5120af
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLCb:A3k03kB56rfd
TLSH
T163257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 946KB
SHA256 a71763d4d2a4af7c59e46ac75fcf3b4bd47d2c2a79778a7da58e9efe91e85324
MD5 123353a5ee8710bc944d43dee5f1bed1
SHA1 9b8f62674da58969c709c1a456023441117e60bf
SHA512 2c94f881283e619601c00215350af97a2384be2d69a291391dd66d4eb50248a5c341c3aaca6381a47f4441f8d59025a1fb6b9e8c96d56c88498daca649043715
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLEf:A3k03kB56rfN
TLSH
T11F257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 946KB
SHA256 9bb6e0491b3be6f420ba00ea9d56db8fa3c7de8b56c2bd696bcefa0e43cf9fae
MD5 8d337904c05e5279dbb55b25199c1c2d
SHA1 5812713f33e15f853a16a0d20819e7195efc2285
SHA512 b71b699259eba7bc4e2449c86fe1eb32218aabab3fc057c8fd6eb05f94d1432835aeb93b58a86380d40f8a984736469e8c626001436ccc0bfe4a848726940071
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLhK:A3k03kB56rfF
TLSH
T133257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 946KB
SHA256 bf58f284ce7881e22b1dd0601f3e8255ce95f8d583ed4d54c71ff4d4a7813f5f
MD5 b38b023ed97475be790ccc82966fa10f
SHA1 fadcfec33995d3349c0b64eb1bf81323a5b6a289
SHA512 787197c2291be6ac23ac4463627983f5efb78fac37889044dba9f529c151e799bf90a21842fbfa482b9357a30bfb5f6b95125662ff76a3d8d852d0423773a171
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLak:A3k03kB56rfs
TLSH
T1CE257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 946KB
SHA256 664d0cfcea4654191f247a5807dc67f009719da0e91cf2be640b1677861ab060
MD5 009347ae9d15cfc52bf2523e6ab3a1de
SHA1 ac9205bf7a764ab79f236a01b598fda0dece5bc7
SHA512 99511d169f20829b74fedc8478e2176fd5ce26e50609158a89103a86135832f472948cee9db0705b2942c1175ba702d84ff0a1cdd0a6a006be362f59439fcdae
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSL/0:A3k03kB56rfF
TLSH
T16C257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 946KB
SHA256 e16ce6e75acd18140cba387338fb54a5debfa2590d46e7d159212058ef1c52b0
MD5 3ed38967bc611a83a1d0f9b5d3ccff54
SHA1 f0db3ed34482c0f9e403b9460aa017ba9cfca634
SHA512 8f5e598fce4a5be0158465169431d7faa2eeb5f8b2f59dcb16816950041c29aa3983dcc64f9d30c1b10708debabfaaa2cf4b518273d86a2d68fbda98fff9eafc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLOg:A3k03kB56rfk
TLSH
T164257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 946KB
SHA256 8cfec9d8262fe4fc81a1eb805318d9c527863f9e38f152b4c63fea0e870fdeb7
MD5 478c68d8ee79ab9f799931db86603cc7
SHA1 6843dc8df166c806529c7e0bb8f8ab6dba6639a5
SHA512 71f593a7f9773d4d9f139d52c05567154e758836045280fa95542b5ef559c2ba1cffb9363f1f282a3fa7a7134b593d4f2e1f6e4b610d27f5785d90663d15ad3e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLXr:A3k03kB56rf2
TLSH
T139257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 946KB
SHA256 54548b168418ac16796a3fc8926400aff3a60d67134fbb85e3514197e5bc1cb4
MD5 acb57d24753f6cee0740d48651fd4750
SHA1 11eab22ff979f8a211243aebf4398ae954ff2ea7
SHA512 7c8435385fa5c2d1515656e35583fc345b0d49994e9fd219c6ad832fc4d22ee139949f21d964c7d6acbe3e55224721621cc88b1637ccfec6242d08f53de985be
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLhn:A3k03kB56rfw
TLSH
T157257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 946KB
SHA256 010ce15015302c73db46bc9622d1704e2449bb2c3dbb6c492c44b43c36a69d68
MD5 22db3d7d70e70019c4c85dbff9ce7efe
SHA1 a467cc3ccae3b45044c399fe2ed98d54682bd94d
SHA512 8a4b9dac873626a86e828e5bef9ca86cfdedc4327f55dc5d301008f4e79cf0a66b33ba1de7c704d349e69dcbf577b676d8ed40eee0319da528337249089ebe78
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLNx:A3k03kB56rfW
TLSH
T1CA257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 946KB
SHA256 a5681e0f4c15d2cefba1688efd500bb7e594b1cdf76bcd4db05884a06ae8d01d
MD5 90e04b543ffe3b111269af1bc7458150
SHA1 4c2d854cbf8a17b669cfeebbcc02e4e926e2951e
SHA512 7c32b5f61c4555ecbc21eac947c8155241e3e11e835f2ed3f744387a5ac7379af37ed98aef074b5d704f06b92884ec17011bc73ee8c71fa1fa613b118ce60dfa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLTA:A3k03kB56rfN
TLSH
T1E5257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 946KB
SHA256 900d5eaff3909cab13c4a0aabadfec487b5ba2d4cc70747831ad37cc82de35df
MD5 6bf9fdd5b239a2544b508fc83b875696
SHA1 6c009092fc92bcc28cada35b5e90de9c015eea03
SHA512 1e03c9b3931ad36fc4292694204d43659ef2750ec69a0deac52c48836f5977e947e3a33c5111b6d918a759723bfa13fd42147b81d8dcff667af6bec0201e1402
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLk9Q:A3k03kB56rfc
TLSH
T1CF257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 946KB
SHA256 ff861a5a72a70d12e84158d852bd81c702d94143247af96dfefa3d130afc1a13
MD5 1e8d1b6b5fd3d8872c487fa3e7ed7158
SHA1 f8c5601b453b252ab2ce04e678a452e34d9d14dc
SHA512 62646067f560563271867b5022ba5d87ea1d2acaffe91b28539cda2d884fdf283b2ef8474d3f3b984157116e5029ca5036c1bef609e41b792d5295e454a71048
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSL94:A3k03kB56rf3
TLSH
T112257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 946KB
SHA256 dd1f12bac0b631788bea6d640cdd9644f7f0f1943a405c541de8891578fc993b
MD5 5229fff574f563c427feed2136390437
SHA1 f58335e38b3b9096914fd5898b738946e12c6895
SHA512 b02487ffcefa9137a05524e845ca1e8a5a7ad10a23718006b4ecfd66ec0d6f2f03268775424f4ebd4123bd227fe596aaae6c9c82c1f02e2e1b99a7d3399f877c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLYu:A3k03kB56rf6
TLSH
T116257B13E6840FA5D10F81749A968672EA777C425F2093DF1358AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 946KB
SHA256 aaa0fab42fdac7e76acbcfa6f763b7124b2156d6ed8b27b0eb67c7b0f92754b3
MD5 af36da61a6d4703fd563742e7e2f9fbb
SHA1 885d141d361e13ab638b6f8b5c3eae671de11d5d
SHA512 3bc189cd6c7c5075b3fc4f4029259d55c62aa5e71dd34d287cb3ef9b8f8e0547b6952c28dc4b00993a2523be2e5d98107086d2eeb5a9f1266e877226d0c8c6f3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSL5j:A3k03kB56rfU
TLSH
T1C5257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 946KB
SHA256 2df679b5c35146bdb0fecbc62d3b1d090d9731c72a0a4815d9b8ff920c734230
MD5 8076f371178c4634141731d0bf780794
SHA1 7873a2e96a582da83206fc63e3cb093a8e96685b
SHA512 e56c55d787ba08436b34f9c72afc1b77c11a46971a549d07f02cc2d35b1cc3ef8d15b64b0e885ef8a7f8e4fd2ff14f63a8efe9cd754f1589585aabb8e397b1f9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLgg:A3k03kB56rfc
TLSH
T1B1257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 946KB
SHA256 f3b9bb7876950e02ccb403459e6a614195e0e6682dfa13f0d3d267cfa51102d0
MD5 931b2d2bf3a94ca3a90574c1f82afb85
SHA1 9d6f4eb4a799508cb3bb732d5c4804fc0688ac8c
SHA512 d0c23eda14f08fc463dc7158c6d90e7e3f63d6c62629825accf0bddbf80bbf12de3d1459c7bc4bff087f7a037ea38dc486544b8be0215d750c0334bc85477ce7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLPI:A3k03kB56rf1
TLSH
T188257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 946KB
SHA256 c014b24c4948b92d758043107b24c957644cc10d38f3191456d1711162578ee0
MD5 cbb2d370f91d47a5537a8e929b7b7f28
SHA1 31926c500768deb56b5ed38c716f86eede6c629b
SHA512 af99c42390da771a9f09c4f35e7edcf3a137ccd59312593f089d32f656c2f54ce602804d55cdb60e8ea228d8addc490774f9ce874bfe1f295d14184b315a0b90
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSL1o:A3k03kB56rfj
TLSH
T124257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 946KB
SHA256 a66f49b82839b7fe85fcee6d2a556875f7e522142a61b72a84cbe4e72c788805
MD5 5d49318955ec3f4ce657e94ce5577b8e
SHA1 85fbaaaa162621c80365500e767c6589597b947a
SHA512 39d49ab81604152694b1310900c77a7cbd81f65f75995091569cd18050bd668583f6b22c39b60215698f94110a770ba3070550b3854f1512cf9e7400e03642ba
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLm+:A3k03kB56rfm
TLSH
T143257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 946KB
SHA256 9b6be473466597c798140d29acd33ff22e12deb2828e0d68bebb3caa161cda95
MD5 a115b4c3effbc98f18180a4340e2f6ec
SHA1 94a7c170992212fbe6ae669a33e6a01a95bcd2e8
SHA512 97807ada7ac1182c52237deeb73c87a28ab890513357fa7222cb097ef89211fa2491f67a0f98f77b4a298eeea30231f052602b1a200fa1a1e261f80860a3b2ac
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLmQ:A3k03kB56rfi
TLSH
T1FD257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 946KB
SHA256 1b28d98416d028fe3e6feea9410be9b74060e172596d314680244bc196fc39ee
MD5 2ef13b8f456a9d6fd66c6383f2448398
SHA1 4ed17b41a7db12064c0b1d31b741957081b1c907
SHA512 b5de19252fab63bf6e7d9358ff804f0b23675d033e447c45171418148c97d9b5896dfe6d38ba2fe29dfdf0ad9d32032dcb378e39822c8f95c11ee74d9e7567d3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSL3X:A3k03kB56rfy
TLSH
T191257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 946KB
SHA256 868e4b192e19ebc6d39b3ce7ff7ff961c713d265d41e7c062c817e2275833b39
MD5 f3af55decd02ed8fffaa202ac4fb628f
SHA1 906074eccfd6dee5bba3c693c3eff3f59d1e354a
SHA512 01452653ee61d4eb9e8323ebcd7375512fa790230db9759339ed5589dda00ca1dc58c45511d0b6dc94059be699b02506748346490a2efd56e777ce9efd6215c7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLtL:A3k03kB56rfc
TLSH
T151257B13E6840FA5D10F81749AA68672EA737C425F6093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 946KB
SHA256 f4ae47202576f58450db0d190240fbf92e512b62a14227d49c07b5222f3cec41
MD5 1901531ea7180e783afc812adc0abada
SHA1 55f14971f9857de59b7d04a01e21e77e79451440
SHA512 0e4297262e4837e73822f04399349c6ad38961be2b181672ea23c31368e23087dae265e55cba37837df56b3cb1df1b6994707270a57622b0dca918b01b577b89
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLrM:A3k03kB56rft
TLSH
T12C257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 946KB
SHA256 b43b0d9a5329f671d943605bc4c403641dd36e0e917748492603eb8679bbe157
MD5 2f90ac5737a7398f0cdf625c362e12af
SHA1 347a18cf32758bcc6393e6db92a9a043422fced1
SHA512 55116a8b2f6bad4bc184153c097b09ec705901c7e4ac5c36bcc7c30aebf976e4418b92af5ab907e9b34676c9f4500e008af313a19fc4c9df5c3edd3e38462629
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDaiqSLsh:A3k03kB56rfH
TLSH
T10C257B13E6840FA5D10F81749AA68672EA777C425F2093DF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2256-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4868-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4868-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads