92e868acd8834af47a32e961b59645b99a33c528f162c279667f45a5e68c41d6

Analysis

max time kernel
105s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 952KB
Sample260801-aajtqaaf89
SHA256 92e868acd8834af47a32e961b59645b99a33c528f162c279667f45a5e68c41d6
MD5 3f36c40b2de0e6065a6ff9ff94b77564
SHA1 7b2166eddd28b1e7975e925985e8dde0099b7025
SHA512 36d79fde569c89213a9d86c60c63e7a1dea7a62d4875e3540db10eed9b300b561cfcb3ce064fad90d09b9c5c6165236ff4896326dc8d4a2f3f187273dcb7b864
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiP:A3k03kHRJ9
TLSH
T1FF25AE13EB9504E9E10AC1749ADA4A22FB757D56176093DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/1136-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c470-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b301-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1136-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3964-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30f-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-236.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0007000000019851-467.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-499.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-590.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-627.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-718.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1000.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c470-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b301-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30f-41.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-236.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-261.dat	aspack_v212_v242
behavioral2/files/0x0007000000019851-467.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-499.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-590.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-627.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-718.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-743.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-926.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1000.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1043.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1062.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1123.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1219.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1372.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3964	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1136	2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3964	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_3f36c40b2de0e6065a6ff9ff94b77564_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1136

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 952KB
SHA256 92e868acd8834af47a32e961b59645b99a33c528f162c279667f45a5e68c41d6
MD5 3f36c40b2de0e6065a6ff9ff94b77564
SHA1 7b2166eddd28b1e7975e925985e8dde0099b7025
SHA512 36d79fde569c89213a9d86c60c63e7a1dea7a62d4875e3540db10eed9b300b561cfcb3ce064fad90d09b9c5c6165236ff4896326dc8d4a2f3f187273dcb7b864
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiP:A3k03kHRJ9
TLSH
T1FF25AE13EB9504E9E10AC1749ADA4A22FB757D56176093DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 0465c3f98e0c85d7d5f58ce0ad9e87e97db493764659675a04bcf4e57cb636da
MD5 e80514db62bc2f450ac1d6fb41d15b7a
SHA1 b261e102a754d57bd0dbc100b9be2937445068f2
SHA512 f884d5f5917a0ec72122527b1784874359d9a83c7262eee35b2ca6c90c695b212f327d1f01b2bfd0948f4cb1f4d5bd4eef60fb7b7ae12c3aba70f67ef7fad4e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhig0Le5ji0hmxNrM:A3k03kHRJ6Pji0Aj
TLSH
T1B7657C17F6A442B5D027C1B9C5D6966AEE7138821B3086CF1359C7283F63BD1AB3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 966KB
SHA256 bb171986a3078926c1cc9da79ea714f4714c2a926a05a3ad3d1271de69a82c13
MD5 d65e69786ffef3fcf668a371eaf48dfd
SHA1 beb53430f90b18ebf974d92754711dc2075a59fd
SHA512 cf78b5c6792a1722dae180f727f55ac372ac420a20675990ae4f9f34a9ba71b0370844e6ff0e13b162d6aa053c09733859f1373a3aae5b95cd46aebd5d6fa26a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiaa:A3k03kHRJ
TLSH
T1A525AE13EB9504E9E10AC1749ADA4A23EB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 975KB
SHA256 66b9dd743928da5599570bfdd3047421eb1a631d6ff1c730d1952560260097c6
MD5 99f4064cae42f21b0ae5f28afe58dbec
SHA1 6508ee3d2425b13041466e9f92702f8fb7dbf8f0
SHA512 bab8cbe8153a34cb735bae4de014e7fc8359f9fa5ce36ea268fb45d8760580e748c6d42ba59e661186cd27037b3247d31cd3a1bd7e2346a7673d538fb1f11ca2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhir6:A3k03kHRJE
TLSH
T16525AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 975KB
SHA256 7391b91c57fd7ab59690ba3a68f7c94d75f502794d9f71e4ef6831dad0f5aae0
MD5 5f7dacac6a37ff9d869bd4872af941c9
SHA1 f3fd20e0df20e4ba01786fc2f83b38f00d140c52
SHA512 1cfaa1c1b343ec0cacb8585601dca129fa10f7b77e3e632c3b2ac408cd1067fea1cebdfcce4413aa4e1e647d52670ccd3e20768b095e4a0f8350041f44daaad2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiFo:A3k03kHRJs
TLSH
T11F25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 975KB
SHA256 ec9b7bbcce06d52d476eeb9331bc4a91692e24a5e98faf389bee4b4cb63bad75
MD5 2bd4c47764268fb0ae9f2432fc5f29f0
SHA1 6af93fe21881870202942a135c8a51fe77981945
SHA512 ba8d0907b3710a18697d6ee02c90da1d3d924b5579966c5914cb70c99937d05e9b5d43fd11cb4bda5fdeb04a9b2c84a7084abbdcc0da73e0ce107906c33f9b8b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiFu:A3k03kHRJO
TLSH
T11325AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 975KB
SHA256 a1d545b280758bc59ea7821c7116de13ef7cd75bb61f28c40145d39d94e83102
MD5 5c51d70399cb4233833739a0ff92c8e7
SHA1 084c3217e1e76fba9cceacb68bbe88b375a6b591
SHA512 dcdf71f6b5495202ffa7b1327505f8dfb5b12e4b95901f721db3ea642b9b60dc8465bca48be8baa4d277d97be4a80627ce37dae955f5fa9066c4e135c04b1bd5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhi79:A3k03kHRJv
TLSH
T1B825AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 975KB
SHA256 2f07c96ac994335de13bb321a757ce6dc4f78098dff2e19db965d0efd3033fc3
MD5 ccddef3b14f0f1256e4af6aa38d1f52f
SHA1 301bc08b1b5cd59a6c7aec7a1b56f262bb075e78
SHA512 1fbf14ff8adadfbde7b90a123b0dd896c7a38e8239d8ae8d9719f04761a7ccadc20a8b944fcaa412346ef7edcc17c208bb1bb2583fa3a875dd591deb519a5b43
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiHc:A3k03kHRJu
TLSH
T16E25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 975KB
SHA256 a6b235046b73b491ba596476c3be696e26897569f226eb009c03127d49b28ba5
MD5 3613bd5bbb17ea2a450e6ff1eb0a76c9
SHA1 4d7072121dfd35f010f07afd900da23cbb86f547
SHA512 ab6cbdb17f2bbdb65ef2f729a2ae90aaf04ac8177a4826ebcc4524b2e3f8d0846f6f2f25ad0b251e353fdfb4cd89a0220708e907747ea62eec3dc9ebbb0274e5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiQp:A3k03kHRJc
TLSH
T1AF25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 975KB
SHA256 4275b9ac7348937b7d3a0034f5c662311ca198e61ce1dafd84a1102edd258ebd
MD5 92ea67b3faf06b7cac67a6739976be37
SHA1 13daffaace089939490d9abb616b9308395fe8de
SHA512 9e8c17ed864b6c099561ab52f4241019b1ab46eb62c185432790947fc48abbc3b0489d5a9f2e194d3f58014952a19a9dda28a1ed6cc4b4ad63451b988b705987
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiXN:A3k03kHRJ7
TLSH
T1D225AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 975KB
SHA256 fd5899e0f8069b6657184b3a0ce6eab2870573c1609ba371b4e4f203f1c08851
MD5 55e4b25a7d724551030f94a3ff2db98a
SHA1 06223f51c3d05c475645f4a8fbdcb5fdf11ff7a1
SHA512 b93a1da16f73a598b796a66a8e2814eaece3617e32bef3b9cdc6361752d774078eaae7ca40ede98ceec248c4264c4e844264913d5b37c3a44ca7eb0fe1e9b706
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhi1F:A3k03kHRJt
TLSH
T18825AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 975KB
SHA256 236bb4535b0a5ab29f8fed5011d1cdbebf24583133b58af556a23b08cc70e2ca
MD5 c956ce2604079c4057684b6e9a651198
SHA1 901207fe1358d457d5e7a244981a7365ae55a6be
SHA512 e502138a3c3093d414438ce2e991ae53b11e671408c5fc518892f3df5e791f4e45dce96afd8b21a7f8f5d86f293313f252b3205a759c4ddbde89acb3caa8ff29
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiWC:A3k03kHRJR
TLSH
T19F25AE13EB9504E9E10AC1749ADA4A23EB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 975KB
SHA256 2f3850d44ab3e8e2ece27828418ae3a39ebaa2338819de2f91286d8e56ba46a1
MD5 8ca0d5ff6cfb5ba9dfc0ad4d57324de6
SHA1 79dba38dc7b9e3e5c550d0ed9efdb4d3b1846426
SHA512 5a9fb0700de82cbbaecf3b3d52f0d45354644d99471e6ef8be59b9593eb519906af28c49f168cebc6e3f919d5efd98cf18b137283de409398c1527e81c5ca602
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhi5w:A3k03kHRJc
TLSH
T1D225AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 975KB
SHA256 a7a3491454798d0dd798b7334d20391d92197e4f680bdd9dacb492a5fbe43c42
MD5 f345951ec476b815863085e13aec8df9
SHA1 c735d0dd1a254d5b811c4f9ba8e8e07a9245c98b
SHA512 d5db3a289956a14ca3cb73f4ae6c2022d0c2da194b9e60a459b06a903595a80d25ea197ef2fd692d1c9abf30a516e64aeec0f65497e0ce0e98da4b5f23ad1610
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiAT:A3k03kHRJE
TLSH
T12325AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 975KB
SHA256 131047425f075286330ae9e9a17c56eaa51f4ca250b3cebaf789ee67240b0895
MD5 51e87195d0b861ffa8cad737a17802af
SHA1 c88049ae180ca3dcff4db6cfbe3a6d421a81cb67
SHA512 f709ac3bf3b999acc42005719e31bcb8ab27f43fe1584e639a54fa22a1fb9952167294f9161d307356550a32c9b57a890a4405b1d7d9005f7c7269396bea7dd9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhisu:A3k03kHRJz
TLSH
T1E225AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 975KB
SHA256 647c176ff6ec1bd3d924949e85fb5778f7c754f62952c3acc4efad3dcb17412d
MD5 76254935e67df7e9cbf9501d48357409
SHA1 96abee350452664d6c32a542bd0d257928576ec0
SHA512 af9c99ec374b5456fe83392a3a873aab29cf61b91eb9c661169d20848a7673fb89b30c2e06973c201123412307580c14d31aa8f3e4e8c68da8df16f127b4e0cd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiKb:A3k03kHRJ6
TLSH
T17D25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 975KB
SHA256 b9304d4f0a4c05d029451faa8e7e438f3f2cb63bb6d5a31fd2f675d7861d90dc
MD5 e9e070cbc9240c9848ab9de6a7e550e3
SHA1 5c4519136e8c27fdf2a021f6b3657b1032674734
SHA512 a8d53d61d894ff4d3d9b933e78bc46bee6ef6b9e439f91031b65959500c82f9070c638ecae1ff98ec8c082564aacbce48ff4336a012b0e889e4affc8792db989
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiMf:A3k03kHRJK
TLSH
T19F25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 975KB
SHA256 61ac7cf83c7f033fd25c2a7b059938c895eba7252bfc33b1a487910fe34bde69
MD5 652e597e23fecc224d9305ab9cf509ae
SHA1 917614b7f19fc52da542fbafa999ffc1c5f72ce3
SHA512 5e084da0573a656ee2dea8159d45db9fe9abf329bc04bb8615734ab94dc08c6a72b45a887a04ed26add898cf71a9c4d381e33e0e8be3242ba06415e507bfb197
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiJK:A3k03kHRJK
TLSH
T1CE25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 975KB
SHA256 acdf77613c76733ccc885a224e161e3a6f30aa05c3f15937dbef793887675d06
MD5 38560a582756af392d3b8b2491138493
SHA1 e6cf432366535269a31da651d33acd23d04ee327
SHA512 e46882bbbe7562fca7d2ab7759d290424a66554d63da54ca05ba0b19cec0b975bd4a0acab96141a5abe3d83581983ad30a695df63d87455b83c2a0649cd5fe57
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiyk:A3k03kHRJv
TLSH
T11B25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 975KB
SHA256 acf3e1fe98fb7fa0641dd8aa30f5caefce7e594607cc166a90cc61f833dc3331
MD5 3e2105227b5dbd1bd4b68b43e4de706d
SHA1 579c0cc29691a995e03552d9e805de23fd821865
SHA512 843d96fddbfd7136eb5b004400549aa75aca5bb09ad88d474f95ab6aebe4cd1f89674166d66d15e66c37f629eac345bce838db9cab49b2fdd1a3964283778f66
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhin0:A3k03kHRJe
TLSH
T1BA25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 975KB
SHA256 a31b05daa2f06cf9ec15d363979b84e0d4fab26d0fbd3281737c3b6d02a2c7d1
MD5 10d136c8532c311ad489e18479fe2374
SHA1 c9289690d357b7f71eee2e10c514cea0ce379f92
SHA512 44f95a09815ed5075b9ccdae7004df8aab1f5b05bec75b8f0ed3d68caa3605eb65263e8950c6f01e0d828fe9277ead9c6bc90b698fddd216eaf9c7523bbd29b1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiWg:A3k03kHRJH
TLSH
T1E125AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 975KB
SHA256 e3c699d9d3aa5fd5216b9309ffb800afdada1f4838c3c7b34b4b3207c125e6a5
MD5 ac8a10cbc3569863675ea46ecd2d57c1
SHA1 d30bf969b51c61b128204d2550cd6678e584f4cd
SHA512 2a6c89956343578a2d306c43f0243656e90c6d2441bc93d07c2e13feb0866966f679cea35a964c7201281916d3bdb9216189d92f1cb3e116668fb5107f6fe1bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhifr:A3k03kHRJh
TLSH
T17E25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 975KB
SHA256 cb953392a4bb2822a9ff0b988ec5240c094a98f29292716069f5231d3d37265d
MD5 225ae6a50b7bba4f027f0f66f9eaf7d5
SHA1 9c9ee98b718a18f6e20ed4543c930d16967235c0
SHA512 011d086d87fba85d9b614726a8e49ed2d43ea1b2dd81d06fb65ccc4a2af9ddc7cfeee55df1d98a72cfc40f3d4e3211cefdd569db0a8255391e176c685e839f32
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhipn:A3k03kHRJL
TLSH
T1EA25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 975KB
SHA256 0f937f07c418f8618bad9a8e9cc0daa3b3166e2157bc51ab41a6045701ec6c67
MD5 f70a1d609f703798115599b20523328a
SHA1 e9ea76a57220d5dd6256a91e8c00a77356c1d013
SHA512 a16c2fa35e603c94b7179b1f633335fd67595426f41074907458f45397a3f4e3efce8dc5321f2d7c106febb167d278ed21fb2fc518dc3df59d374fe3eb6077e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhilx:A3k03kHRJZ
TLSH
T1EB25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 975KB
SHA256 0a880975dcc7242647e3bddaa26e6b6f7edbe4be97a1eb1c63cfe8ec2d321586
MD5 9daf7c70319c03f427a3703e186634df
SHA1 46bdba2ffdd3aa4a334d9a32af92df9b06bc7b01
SHA512 74b8401fc148738b8f239475b8bc7fe09d2b367461e273f70096bf227c0b61a5d91582f2124c7bc30fb58ee93703cb5d5a402d289d02bef0bfe7e1d28954974d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhibA:A3k03kHRJm
TLSH
T19F25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 975KB
SHA256 3b3d8e41d79bdb5918bc0e0ca69bad418cc9c3860d9b14aee3f910404609ac03
MD5 56a9e0cba4b11b79e9dc26262b864d63
SHA1 b46650809be75681cddcc11cff5bbc32ce0f55ef
SHA512 c091d5a24e7fafcc025fed5ae6d5fc56af904c8d36ede034604ca892acf78e0449e13001e8e7cbb658e691f9c3e18511762fea8a018bcfdf72ede0b9952d5cb3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiM9Q:A3k03kHRJ7
TLSH
T15D25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 975KB
SHA256 f1887a105b7394222ec57aa276196332b66b1eb12e94e55914fc939499569244
MD5 046262a5adfbc78bd7d627d17cc45acb
SHA1 39f691f627bb9a268481e805af3223259a6bd7b8
SHA512 98e3c42b563898043244ccb442ccd873d276efa871bd33f917c13c75969bd31bff94b8baa21af01daa0f4bec468c808e184d05e5dcbf0728f09b9eada97410ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiV4:A3k03kHRJs
TLSH
T11E25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 975KB
SHA256 6eabd15b9ccca0373c36803832c284dac5d01ec0f67392c2c872bdaed8e9fb11
MD5 cbded2953f0d4841e23ff5e5f01bff3b
SHA1 cf45d533ad8b935a130197d4e3c7e91db5f97053
SHA512 adb4afa927e1b4a65f96b78717971ade28d5676cb96d2a00c4279255e16a7a40d64772edb392d7ea8d4f774172e4530270840f52b3c383a34c99cadaa0b967fa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiAu:A3k03kHRJt
TLSH
T1FB25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 975KB
SHA256 0fb240f502e7f15e22882b2c518febb1bdea173a4ef423467b839eae4e91fd24
MD5 a4c806939f64c830633c0e8a915d9d3e
SHA1 cdcdfba176971e83a4f4770e2dc5efb22a68352a
SHA512 5fc79f01b59783b3f2ccdfe83adc30aff4c83f98faf69ebf0ce631cfe630e1ad9bfbbbc1f0bb861e49beafbf90917366b7eef9781eb9fda2bb2d9e5bb0b003fe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhihj:A3k03kHRJP
TLSH
T10A25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 975KB
SHA256 c85151e1d60b3df01fe68a1adfbbee4f6dee15e03fa9798ce637c6887fdcd7e1
MD5 f406cbd7ef4ab2c2eb3a979cefe504cb
SHA1 a8fe1b2ea2017800338adbda1d872186985cb220
SHA512 fe9f3ac81bb57ac8f02f607aa8d86723f9c210b687ac332186b76e71a1aa90e44cd17b3c38ff1ca0c24c967c7c609c78677c8d0e3fe37a369d5221edb7b02919
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiog:A3k03kHRJH
TLSH
T1CD25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 975KB
SHA256 ae34b2cb35ed59a52cc7f256ad873714e47d1d547e15b420488c723642d8be2b
MD5 59bc2e1e36e6940a62182b1df7d39711
SHA1 6cc26086bf18ae41a8fcf17a3cd6934393b1c843
SHA512 02d0b527e6a4daf787f160e116726c8cadbf8300873a7e726cfc1c22778e4c49f0763deb7b317a82785c214fcd48125d50654f4db185683f2b20c1c55275d057
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhinI:A3k03kHRJm
TLSH
T14325AE13EB9504E9E10AC1749ADA4A23FB757D56176093DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 975KB
SHA256 d962ca88584f97a5aa9e0ae9473debeb015be94e8af0970ef9929c47f1ff7050
MD5 bdd8c725520d4708b05af001c0e3d700
SHA1 d3f4c13c7570e6f4831c4ea374e00ce22b3fdae0
SHA512 a0eb27a1e45329b6c8a421d7e094fb82ccb1d79e67403c3a21680e375707dedad96ca463c7f83135fe285042fa65eb05586ebb790ef4b43f498e98b5d5cdc07b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhito:A3k03kHRJ0
TLSH
T13B25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 975KB
SHA256 0f312d027b6d115030f1a83c5a3de7cf1238cf5288da13f81bc473af85da52bc
MD5 b62ac825ca3fcd3827af20e9d4a0b229
SHA1 bdb1c851f62487f7296f2a295bda68732a04075a
SHA512 7ab35c662f078462f971055332f094a73b7bbc1dedd961a28bbd6f41fb133fbd11286476aa185f386175a3b07cf7d49695bb0ee7397a69d02cfa049565fe2f61
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhie+:A3k03kHRJp
TLSH
T16925AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 975KB
SHA256 b5e17c35e870fdb109cbf046cfc875deaed59178cc465933184d954ef2c3592e
MD5 135ab921b7bcc2d23e81441cd894d510
SHA1 15fe638f61e092035a50a67efe2a6b042c68210e
SHA512 4a761e0f661781460d320bc0d763333ec5c5c2df714fdf65a26c584ca73b06edfdf28f07a747bb10dfed71b51ec1ed0ed32630f8859b855576eb0b36f5ec0552
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhieQ:A3k03kHRJ5
TLSH
T19E25AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 975KB
SHA256 3dd7f41459a329fdb68c20ae4edb550179faf6f9d3162aa265031239f9d13d05
MD5 3b6d728f28f89dd51a92ff65b1a7c64f
SHA1 f38c08a664702a8aca58e723e96cc45e99042fca
SHA512 ce5ed72880e1d05dce4b8836388d73dd89d48b42ca89055c90948cb54d0e664608aba6ad14cfc1a73432eab3c2d2013eb12b22759f5038cdcdaea0e2b0a5d0b8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhi/X:A3k03kHRJl
TLSH
T1C525AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 975KB
SHA256 26dd0061d3f8c47f71b0cd0369b0f474266c201ec00f90e86e45403a87d7a520
MD5 6ec7ef513295671f73feefe08619a076
SHA1 5656dee56cdec31749e218b40c3bbb48516316e1
SHA512 5aef173314be4553f89a5f3ab043c58b690f9d0daff90eb20ef7417c1034688bb307dfdd37c036089193e531b53faf306f08da7c8bbd61a54c6ce6b4bd89e774
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiVL:A3k03kHRJX
TLSH
T10525AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 975KB
SHA256 0e311d01681e755fbb2e73dd61ada9e9c1b2b395c60592aee3205649c0552041
MD5 2006477c01e286241b46b826a30c65c7
SHA1 f44a754886378e03836970132ec6ae80eb33af8d
SHA512 e8058d68c14d24c3bddc085e7b0c4fa301f236122716c8cfc568d423dbf42bdddc29626dca0737c7410f61d834724b10cc1568245867bf18c3759ab5e30c1ba6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhizM:A3k03kHRJy
TLSH
T17025AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 975KB
SHA256 1db51ab82779f97f7d50b65d2b0c13447507658657096cb3d4d5112818513b7b
MD5 8bf4f9e7b50c637e25b44db8072cfeb6
SHA1 5c4e381aa135244f1f2af9ca4545534d2b6ac715
SHA512 8b9619a595fb711b0b076fdc1cddee2c7644fbb9b8859017036d9a10333e99e33eb24314a60ca93ff4aa4a63d9a7e18b15b388ab78f3c79bea54a3741c135f4e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBmKhiUh:A3k03kHRJs
TLSH
T13825AE13EB9504E9E10AC1749ADA4A22FB757D561760D3DF2318C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1136-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1136-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3964-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads