ebca220ad9e7dce1e3b358b50c20245435eed748014e5f2d7d2c265bae397d9c

Analysis

max time kernel
98s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 14:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 931KB
Sample260803-rsvsdadl7x
SHA256 ebca220ad9e7dce1e3b358b50c20245435eed748014e5f2d7d2c265bae397d9c
MD5 7ae0b988b7183b896d94051c016e251d
SHA1 e7d62edd87085fc7e04a3362bf1933569430c6a6
SHA512 2bf9042186e3737d61cfbbed1fe2400ac6df94e50610789b473212880d3d34481c684e7bcc14efa345afd930c02346d25408db25e5c5d8f4c201eb9e60d8c109
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoc:A3k03kHRJARJH
TLSH
T1FF159C03F79900E8D15AC1789AA69A22EB757C561730A7CF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4548-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001c65e-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-32.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5668-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4548-165-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982f-258.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-439.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-488.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-549.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-612.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-637.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-722.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-790.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-839.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-864.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1078.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000b00000001c65e-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-32.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a42-221.dat	aspack_v212_v242
behavioral2/files/0x000400000001982f-258.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-439.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-488.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3f-549.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-612.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-637.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-722.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-790.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-839.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-864.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1004.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1041.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-1078.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1128.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1326.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1370.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5668	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4548	2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5668	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_7ae0b988b7183b896d94051c016e251d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4548

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 931KB
SHA256 ebca220ad9e7dce1e3b358b50c20245435eed748014e5f2d7d2c265bae397d9c
MD5 7ae0b988b7183b896d94051c016e251d
SHA1 e7d62edd87085fc7e04a3362bf1933569430c6a6
SHA512 2bf9042186e3737d61cfbbed1fe2400ac6df94e50610789b473212880d3d34481c684e7bcc14efa345afd930c02346d25408db25e5c5d8f4c201eb9e60d8c109
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoc:A3k03kHRJARJH
TLSH
T1FF159C03F79900E8D15AC1789AA69A22EB757C561730A7CF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 e5c15089586ee683100474ec2baa7a1f0b095377008b45bd8586a676a36351cc
MD5 649dba99c63dd1da53e136ce67328ec8
SHA1 01de88baa9520ed9dd16e423dec6692b29d9e039
SHA512 23ffeb8af0832a6f208d757937bf635c5f742f48419480e64df759411509c6fcf23f04a06136bea3460657bf48024dc0f93564912cad48f32cdec2209a0d0dea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapok0Le5ji0hmxNrM:A3k03kHRJARJDPji0Aj
TLSH
T10E657C17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 946KB
SHA256 d1603c1f69e4031e41a2192a4d944284f0587f3fda15a3b61576269c957d8c9d
MD5 2c565e7bbbd0cae0c663add93072e013
SHA1 7d03b29010d6ca6476fb6226c82af720d078dd0a
SHA512 847527962ef6310baa48ee4208bd25d743498fcc3c35caa1a101371a52747a6083d93b4fdec21ad5c529ba4369bb75086f38d4d8c4b87212e66e61277b0e5861
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoOa:A3k03kHRJARJ
TLSH
T1EE259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 955KB
SHA256 93d5481753ec5cd7921947d11843e955c912252e4a52899e77818ba2cd5d1349
MD5 e5677f3040e0928e495019c846f0ef7b
SHA1 c1b6e86fcd68fa0ec6f906ef622cbbe7c88f5b9e
SHA512 b7d18b40e74d17612ba060c93585880d574b49e3a279a091d3ce0637de56b66a517a1507fb76588dffb0a56d6357f735fd9ac8f7a79bd2da588f4863b9a7afd9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapov6:A3k03kHRJARJr
TLSH
T1D4259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 955KB
SHA256 bd1b76eb06cdd36b9dc7114dd901383ad1657c1aa5e182ffb436ad9d37eda9ca
MD5 a5b17fae63c29d27063ea3a762172a85
SHA1 f9f8f06d22df4b646a7b23d835c7ae56fbcdfc0a
SHA512 3c732780fce962923eea39fc0a5f60a8c96824dc82006e4945b2214acea8e8d77967e6bf7ef5179198399b88ff36f40c13c158ed6150cec4b254fc760adbb952
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoxN:A3k03kHRJARJW
TLSH
T182259D03F79800E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 955KB
SHA256 03d2f5ec833a289f6dd11e37b1b5cf716287382468abb81da929d9e4f2586bbd
MD5 a53ac2c0721c6a61158f384a968940d2
SHA1 c4f57e18c8ab3faaf431ca3f5a657fa539d0c3a7
SHA512 4ec3f250bd3be25502631994c48f3b960c000740191ad9b1241fa4f788699520a35fcb4172e520c9c5c83d3f1374f7a79d8d6dd9f4225c737eeb1e70b64b0c5f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaponf:A3k03kHRJARJq
TLSH
T178259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 955KB
SHA256 3b1fcd1bfe58c2041af94515d3542f1c0c2217d838f63e3d01280386e4cba7d0
MD5 baa86fa276b091e473fa8f1c0df1765b
SHA1 4b5da0553489d812a5f4c3e9e651556bf9f7f2b1
SHA512 afe32a57badd0e176b920829d6b7925905314ad129409522fab7146045229ebc21840423b131821368c7f216e60e5ccedf5162e6acfb96c56e55c5a37277248a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapopo:A3k03kHRJARJz
TLSH
T100259D03F79900E8D15AC1789AA69A22EB757C56173097CF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 955KB
SHA256 11d3a149d5295b0cbac3cca03224de0d1dc08b1b75c32c0126b82e9d4d4995a6
MD5 c283927b96ba700d2f2b835c861c8700
SHA1 9d027cc7e71b40dbb4fd5c847acbf3bc2c43a596
SHA512 f1a75467730e5068a13dc44d400dd61c3dd1eb1fa5dcebf37b6afc33e0f3c03704e54e9ff0bf2bab0d0a8fca2b03534e103598bf76058b2655d80ddbca7485b1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoZu:A3k03kHRJARJl
TLSH
T1FB259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 955KB
SHA256 5d53725333f966750ef319124c01f6b6eab48ca25b6dafa3f36650543a05ffc9
MD5 631a1bf89d9187ec14bab9aa6138e9ce
SHA1 668aa902a1d0fbbad1df12391686520a04137d4b
SHA512 b0cba44c4d2afb182c517572dc7a8c405e154f4eea07566135163938ef787379dff805ef2fe30b0629e4501f3a7d2f862c36ae21cabb6630a9a6044fc7a3c001
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapo/9:A3k03kHRJARJQ
TLSH
T132259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 955KB
SHA256 7b005c1531e898ef8ef77da060971fc7cea78cdda42174ca507e7db78d686dc0
MD5 908a0d3b22dd8ee6511fc72012d03973
SHA1 798db30394c7ea1a4697140a4ca7dc9a30b92d59
SHA512 bfba7b822df69912420d31ec59044c232694895b7b924386b029c320c7369b879a7cd3722b90b9dcc314dc3c675203c9c66fc575643be54ee2dfbb009d8cac94
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapobc:A3k03kHRJARJB
TLSH
T160259D03E79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 955KB
SHA256 bb0d81ebae4f5369ed475120d19042c088063773de29366b0f287d6718bd7c8d
MD5 720a9773acb2766da9f68b4ba6a8f2d6
SHA1 5ade6aa51eb891755b1ea3fddd6a948d60b32da1
SHA512 08f46ab84234664896c968043c98cae5a16fa763ac107aa0b22176813e553aaec4aaea72cad26ceb7b6da72e5f2a2708e02e4a63bdf16863b91c1b9b167c32bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoEp:A3k03kHRJARJ/
TLSH
T1CB259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 955KB
SHA256 d35cb2eac304129616fa7ea6e6c75135bae00d3e41c1958b5dee8f3146c75d22
MD5 075835f885098ab552a85ec11c1878a6
SHA1 24d3cca1984f5b6a653b7f91ce05dd952bf14711
SHA512 88a51a78f82ec4df4973f2f9b0af11edbdd152b79e6ff50d3ccc768cf4d0219e4b3294f4ad853f6bca24c4474de712533b90bb411935700cc0e5054df9b82653
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoLN:A3k03kHRJARJU
TLSH
T12C259D03F79900E8D15AC1789AA69A22EB757C56173097CF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 955KB
SHA256 54ab07e93b84b4cae2d596b7cf28b9fb7d31a82edcb22e0ed588e748afaa4ca4
MD5 c2c3aa01fc5c1d3f70cab4c2cbc2f084
SHA1 b7202e8d152cedd3023cd3846b341eba380f07fa
SHA512 a776aa27d2ce47416a2413760f95752d8a11ab8367895eaa8d835e67ead17f0740ed4d51576f94de0760e3bf19b1d1336fe3040ddfbcb7aa4b41923288b80259
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoZF:A3k03kHRJARJC
TLSH
T160259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 955KB
SHA256 57adab2ab9689d7d052ebfae50d16384ed5aa05d700b6ca1528d00e67c6c18d3
MD5 0f04c55750b58dad586d627c0a1d9cfe
SHA1 0b52a1b95b8a63d1c10c0000bfc4c62cbac58371
SHA512 396d47a956b27f7d41e1a5a2d121fb0a0e0c763efc864b3c1f1df94ce22b843025619e7eddcc1fcc2f232b84bb90227b10ee7ab92d6e09f5f9662e261a998300
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoyC:A3k03kHRJARJW
TLSH
T1E1259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 955KB
SHA256 19aced13f6657442e4d39909a72ec6869a7deb0a87fbad9b6ad07a5c9a3ed16e
MD5 abe893b63744e538af5b799849710e0e
SHA1 c4d1d8b7cbad187a9bd801f888b119e9dfc62f5e
SHA512 05b7206d35342082e59ea97e08eadb60e5cdce8e8f12abaa6a88680dfb14d338760e18623928544807eff1e62d905de5bf5ba38a26135e479c13fdfcc006f5fe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapotw:A3k03kHRJARJD
TLSH
T120259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 955KB
SHA256 bd30816c251095a886bc2bb175309baa3bff4ce0b0a999e4b177beed6369be4f
MD5 841cbfa149b6cee87ae76243a2b71f65
SHA1 ec8dbd5eb092324004f030360476a7b74727c5a5
SHA512 b7275b6256373312bf51bbabff452d7036cbe1acffeafc7990d56006d33a118f2aa543295f87bddbf6f190c0a05a7ae1e340127f8e6de53315d393e947675e27
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapocT:A3k03kHRJARJP
TLSH
T1C4259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 955KB
SHA256 97cf646b9a02895a8243ff58b8d04fe8f0cfff7546ee424b3c9d6c0b09c0718a
MD5 3367ba066c05c94b14f55e73acbf07e7
SHA1 64b9019d5bde991e1a4248720c3b37ba9852ee35
SHA512 1e364661c9e19d440092c4a2f527964f6765adc86cf52e6a4a00388b259921ea8fffc0dfe244a9fdb503db527babcad8fd82ffbb1f1bd67d0084e379f4efc67e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapowu:A3k03kHRJARJg
TLSH
T180259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 955KB
SHA256 7a5375d0961a2597a1659a407ea61b28e338fb12176074e9b7f9f24a73a152c4
MD5 6309f2d34b4f9f1e8172dee30e69e5d4
SHA1 9509b3517a4a6103c3e39a82757528ff29bd9859
SHA512 cd2880076d0602d12790ab0d9ffb333a2c55e5fea521094dce3d497f94d11227ed8eaeaf6abdfc95ba01ffbbdde549c17cb8750e06b0e9099305a0dc7d5915aa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoOb:A3k03kHRJARJZ
TLSH
T14A259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 955KB
SHA256 457cd453f3a80821d264555b20a65e0ed5ae1a6572763707be564879f149054b
MD5 4fd7263ef12e7e81a4f4e646fe34f690
SHA1 eaa81a60ffafead752ca9995caa77d120ee2ebf4
SHA512 15ef815d11f12089d55f6ffb951de547a346eaa834050115ec33413c84c63272582e138d9090aefc62345cd12f7f1b87c4a5be73b9f8a40edaae115c5c0b180e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapo4f:A3k03kHRJARJp
TLSH
T10F259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 955KB
SHA256 a7e59a14e1c231fd3909795dcc9ee3728a64f1ad0da060cecfac3c36947d5a68
MD5 1e814b5f8596414020ba49593bffa90e
SHA1 7b5abb0651d8c53df99f7c97d88711b0789f0881
SHA512 24522b5f6306807a2138f21f94032889fc1b2c9604a2b42a9fb0b2f08c8463c78f31d659c405e79721b0cc7b8859718dec8df5ab6dceeb170abebf2912b5b955
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapo1K:A3k03kHRJARJB
TLSH
T1A0259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 955KB
SHA256 a73ab50f69031b9325728538d3abc5df3f7c2528d6db1d00bdf608f3afc30ad3
MD5 1200365d9ed82a4618dd698afc8f97dc
SHA1 670dc9d856663b815bdc60dd6cd901295d303ec6
SHA512 5393416cd3501a77716626574fc8161eb9cd84841b653253a1816f6a40eef0671c3d680d99874127b0abebb78bb990c4dfa3416342ab0a2ce2da3d21fffe3954
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapo2k:A3k03kHRJARJo
TLSH
T111259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 955KB
SHA256 ea93245cd6c6ffd49508d56af5e9a9142022faeb1b58ddc4304cb6aef6583af6
MD5 73b1f1393c39b5d7e0507355e6d57760
SHA1 4894b71755a798ac52ad57e34fb1342cf6a307c8
SHA512 b60835fba6309747ee1b8fb04d8a49a5afbd0ee756f958def61f75efacc49a6071446a98c46ea49b30a93bfcced89c86609834c401f45fec02c559dc59d41b72
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoT0:A3k03kHRJARJB
TLSH
T193259D03F79800E8D15AC1789AA69A22FB757C56173097DF2358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 955KB
SHA256 4a707e9c2a5ae180fb748271fdb46e5315c13911d266fcc8703c24675d4849cf
MD5 c08c19e6ec18a8ae6a28e82c9da2c0c5
SHA1 50d4ce78838a80bb8675716e33df885a21e69477
SHA512 c740fb15573d680f5fb88d2c511ca142ece5ea1e727dab94289eea1909377ed96d166369f308832cf1442fd509b71fb5e6344bf8736ff707046e18975bdc2337
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoig:A3k03kHRJARJA
TLSH
T1B1259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 955KB
SHA256 219d01f1a003056579a52713167b8e0579ed77143148f15ba0fbdcb502879e08
MD5 7bf98f0d1ef00ef643a896fb9b05356f
SHA1 b95845feba0c339fb9f43d2d03bd9a33dac3f526
SHA512 d4ab0d2a74f15007ea454c5b753e12ac2b13deec9b942ea4b43d6717ea8afbe4e53c45dbe8882891bb235aced64a4bf98a2efd3dbb80920de921dac84090e539
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoDr:A3k03kHRJARJK
TLSH
T1A9259D03F79900E8D15AC1789AA69A22FB757C56173097CF2358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 955KB
SHA256 276e6f41e6c8e37d7d7b2261a9bfada0b20dcab6748400c4c8b79bc769601a28
MD5 7cdbaed3ca25d0e30bbbf0ee27f68cc1
SHA1 dcd8eef7bf1f39fc5fac8ddd95ec01bdaaf3f780
SHA512 9800a17cbdba4354c58945199f728a1fb35220efeea2eaf106279ca7ecdd2ec9f69cf7d8465846ba700eb0d8631d1e265398c37d389d47dd865fb6080bb1292d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoln:A3k03kHRJARJM
TLSH
T1C6259D03E79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 955KB
SHA256 5159bda8035ad4b627cc7f0436e1a2e109b763a2902226f013156b2cb87c6502
MD5 ff0c50c42d9493ed4e636f7d89b93b48
SHA1 dd84af3367cd11a66b6fda9d55c848159a881086
SHA512 9008a8435d8f727ff730d1e244a588e8f697f5e5b619c29f831e3a01b90c642797db98ab4b0b5d08aac9e4abc95a324fe6f8c9b3f7242580e75767c0f48095f4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoRx:A3k03kHRJARJa
TLSH
T19D259D03E79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 955KB
SHA256 da6ed035895742ee893db9a056a86762a115fa85ca893873ac0cb9f784cf6f51
MD5 951d168fc0459b1cb9a5eebaa8f37762
SHA1 b3aa0e2e5f25365b04ef1eb5c3b7daa939ac595b
SHA512 630bd136060f57b51f05f4649f221220d53115b029ce12431d19f73c9299630ef62eaada2d0dd1bc44a8c86fb88fbadca31a78a2fe685d1f226b7a9694512b88
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapo/A:A3k03kHRJARJZ
TLSH
T17D259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 955KB
SHA256 ba51afda05ced8cf8821e66478cd6f7d90980e38a85141a53959a39ab5ef3f1b
MD5 675809dfaae1612bf21d0b0b0da681d4
SHA1 0c2f254f87add3d2332b85295e51062a86e63e73
SHA512 49be7baf0aba544d73763b6f45e50744cc486007391c8432815b1f33fd8cc478173435247b06c66eb229ac397b355d9076f4c31ec312cfb1f3be4c318c991b99
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoQ9Q:A3k03kHRJARJA
TLSH
T106259D03F79900E8D15AC1789AA68A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 955KB
SHA256 616d52b427c8e168ec7b1612906308c79f84938a5fb6e5d5ee40529bd56ec401
MD5 79c2eb8ce99ea4a28dfaee5786590e6d
SHA1 46ddff43d68a22696fe2ad6eeee285e491427368
SHA512 65d834a16dbf9bb0ed938021d9b1460d0f7a602d7292c3f76c7c123a47a181f629d8891e06a0d8d8d1ada024129159e912f4535704f3a78f4e90ec593a19cfa6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapox4:A3k03kHRJARJb
TLSH
T1F5259D03F79900E8D15AC1789AA69A22FB757C56173097CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 955KB
SHA256 3f05d98a54802af8922830096672b1b1657496e9e716d27af28034127a309b2e
MD5 1efc316270da1876fea0d9e859c084d2
SHA1 d13365f4b7287f4def2ce3b7e13dd4f2d5e88fef
SHA512 5ce19561c796a9e7e8822517cc24afbd815baa15ba2391c402f061a14057f15b66315e284ef2fda5459edc063063df40e93c6fb6de894b15628a2a8b7888d669
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapo0u:A3k03kHRJARJO
TLSH
T133259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 955KB
SHA256 c551362852d301579210ac8e13891bc0525a10fd40d0abe52fa79da4b3f40872
MD5 c45a2a243e832e45a9112f5a9cba1613
SHA1 caf981efa6ae45a7679ebede42ea579bb31512e7
SHA512 962f9283d9bdeaa82433ef85ff49172f24e5f271e5dbb8c1fb6c43cb8b0b3fca8c452789655c664599ef98efdaac5f39d399c17b1b5d05b1ed5ebc072def8efa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoFj:A3k03kHRJARJg
TLSH
T151259D03F79900E8D15AC1789AA69A22FB757C56173097CF2358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 955KB
SHA256 33db3eca83e0d8154f88daa81e389203d8581ca92c63d2c7b1ecc85f7390cda0
MD5 81698a73998951a49cddccdce52ccc9f
SHA1 319b1941eaffd29719df6c658bb598e1dc2100b3
SHA512 e5e824a4d44be9958e52b996c1eab2fb71b91d4cd044b10049574caa4bb6ad2709298fe77059e9dce1adee3d510002f8f9680b71fff2977ff920844d06f6434f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoMg:A3k03kHRJARJ4
TLSH
T138259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 955KB
SHA256 61e8767a9688cf3505c95492f0351c7c55d34c68c229d7bbb0a9d89ca118b1cf
MD5 47a7546050810b9614dee87e1098d2a5
SHA1 085b8eb56a18bba78b515d27ebdbc8dd3dcdb183
SHA512 2f7d021c09aab6fe64fed19fc23f1322903059d532eecb71e5f2166027606861b48d49bb9a861a51905d768af00e1f1a7eb6d31a34a774a9232a9e1ef6ecee0e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoTI:A3k03kHRJARJJ
TLSH
T19A259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 955KB
SHA256 9e044d963bf0939facc1251a5ca1fb6d112518adf8d888a78f9401363491d90f
MD5 ce06453c97b3d20749606bf5a81128d3
SHA1 509e813a97318a45056e624c73e600cd80f8bbf7
SHA512 38cdb775ae270500057d67490c4319538bd4e0499016db69def0bae547f98ee10a7bed7870be54e5c86154407f2d40ec6784c462eab42f9f1c276bf9b6daf672
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapopo:A3k03kHRJARJ3
TLSH
T146259D03F79900E8D15AC1789AA69A22FB757C56173097CF2358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 955KB
SHA256 cd4bdabc2d6f8ce4d146023dcc7ee112a9813eafd3043a42ebca992fd7372e86
MD5 2f73e5bc8ca6e90af32cedf3833c45e7
SHA1 3cee59cce5cdaceb881d8c22be36250ebe6ce29d
SHA512 7566af0c648f1f41c1c1d6b99f3ae14a9919dee16a1c736d3455a18f8cb1f7ee02c15c35160f6f3f2000acf492e19cb467b4ab68c5137676a3c9c660d0d36ca9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoa+:A3k03kHRJARJC
TLSH
T1F8259D03E79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 955KB
SHA256 e2426f7580bc28d8edd34a0e8cc023c1964f0bb0e179e4d5803b9939ea79f7b7
MD5 20a55ee192969a5107f05be1e2305d3c
SHA1 2d359e5dc13975764ca910bb7c5571a74b182bd4
SHA512 4df945b9596745b08736485d37626d2a26f1899d9bfbfcedc9485857c142beb21a1306585f52d08c14e43d38ab29b67ea802442bfb73b3aade539849217a99a2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoaQ:A3k03kHRJARJ2
TLSH
T159259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 955KB
SHA256 f4ca0d1fe7c92f30c4b4bce0b2ef510ad80f27224377eeb6a4dad807db6243e5
MD5 90a6ed8662c704747efc86fab5bddde8
SHA1 56507b059de71133a12ce7bb197b91ca48730cd0
SHA512 2c24f866a2183f43106fa360f4fd6831f8f87594ed14b380a3468cb49060b327c79bae2665925256a62c918f5be39d372a77c803f8f66f0f1eeee29348ce854b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaporX:A3k03kHRJARJ2
TLSH
T11C259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 955KB
SHA256 071932e8d08d2b32c2e9387c7b66c7f06e82ad21582bb9253fa8bdfc5ee892a5
MD5 9a44bc1cb305fc1f5d4fdcafcc03a546
SHA1 68fdf7a5afbf259d87b4f919f1107dad7f3fd653
SHA512 5c2b48981eef75316c535f0b16c0bf7202ce2af21c6150e0f187d29b268dbae69425616d73462cd21687b17dc21d8a0679f172a29734d9df07c83a60e0738208
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapo5L:A3k03kHRJARJ4
TLSH
T169259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 955KB
SHA256 ad82b3070d98a9d906ef9382acc8feda38f97881be83fbe3f12d29056b145cfc
MD5 4b46dfb429bd7667f2445e47b5ef0b6d
SHA1 87f98edd243b1c2db8c0953e3ce3da38c8d8ef10
SHA512 b60e0fc8d70934e0cf878ba0ae1869b4ae136d54d8bb9cc077a006f76960ef99bc27ee8ee25bed6258a4756b1323b4e2c81a04dd94657a6f2776e735292c8444
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaponM:A3k03kHRJARJZ
TLSH
T12B259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 955KB
SHA256 7d3e746984e9d71ad4a86d45d219c2a8b891f3880c6b14cf3b8edcd643202f3d
MD5 dcde102ad2ab35ddfec86ba763be6d1d
SHA1 44d12d6f9d9083868a3aaee66c44f501a4d88609
SHA512 bd7e7be5424fe3273f5a54360fa1f0c9565524c8bc1d151ed0d57b27508ad542d307c03d829993c1bdfe612703054a1775eacf34f1d17ffed89b722039d812af
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaapoQh:A3k03kHRJARJL
TLSH
T148259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4548-165-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4548-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5668-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads