6ba23162a0cdc80c84edfe0c783d3bceaed6117506c58f24f59d1034d3f189e3

Analysis

max time kernel
95s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 922KB
Sample260804-r1kmdazvbs
SHA256 6ba23162a0cdc80c84edfe0c783d3bceaed6117506c58f24f59d1034d3f189e3
MD5 a625abb562adc9ef1782fb1a49fb4a85
SHA1 85b4d03f2cdba57fca8e458ca275438c4b563534
SHA512 6de3b794c2533bd207349245f35bbc1845bc2927ce09d77a58b971e5c8c505d0940fa38e5dae7cd4f415110c84fd5ac53e8ef728951c90f85de27a1bd940c8af
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWN:A3k03kHRJARJP
TLSH
T16B159C03F79800E8D15AC1789AA69A22FB757C560730A7DF1364D6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/4340-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c554-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4340-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4532-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-240.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-690.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-734.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1054.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1055.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1099.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c554-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-57.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-240.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-259.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-495.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-690.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-734.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-877.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-980.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1041.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1054.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1055.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1099.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1147.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1172.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1180.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1218.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1327.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1340.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1371.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1378.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4532	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4340	2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4532	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_a625abb562adc9ef1782fb1a49fb4a85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4340

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 922KB
SHA256 6ba23162a0cdc80c84edfe0c783d3bceaed6117506c58f24f59d1034d3f189e3
MD5 a625abb562adc9ef1782fb1a49fb4a85
SHA1 85b4d03f2cdba57fca8e458ca275438c4b563534
SHA512 6de3b794c2533bd207349245f35bbc1845bc2927ce09d77a58b971e5c8c505d0940fa38e5dae7cd4f415110c84fd5ac53e8ef728951c90f85de27a1bd940c8af
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWN:A3k03kHRJARJP
TLSH
T16B159C03F79800E8D15AC1789AA69A22FB757C560730A7DF1364D6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 80ed3c26977ad5ef41a0885f91d1e2997cb3cc5d2707f0ddd4bab99df11a37bd
MD5 7cc80c9bc95b4e16f7b1a5886b4caa37
SHA1 5ca6bdd23885a9f0ae60681df586aac06d123503
SHA512 6d1074983c0dd7b4701c34c1cb5a26779dfc9c7ba3441d66e1cdc4125ae9c4303a7d208c3168d1f2a099a2f1dfe6448476c1f6f8866dbbf2e12ac8fe041fe47d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWZ0Le5ji0hmxNrM:A3k03kHRJARJ7Pji0Aj
TLSH
T150657C17F6A802B5D067C179C5D29A5AFA72384207309BCF1394C7292F67BE19F3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 937KB
SHA256 c92fc2380dc778437af6308b65176c1e98ddf2def01d548eae9ff81aae3af6d9
MD5 913abff6b2db8c94ba72dd2c0542e41d
SHA1 e6079fa69e1b14f3259c6a21dfd5e94ce7550a63
SHA512 cdfbd7247bd14bbc84948535aa365c9e29f5a4f8ff96748df0f466215f703a416f44e8e31789bc35aa5059f787b800bff74b2caabadc543d5827527cf309045e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWLa:A3k03kHRJARJ
TLSH
T157159D03F79800E8D25AC1789AA69A22FB757C520730A7DF1364D6162F72BD0AF3E355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 946KB
SHA256 bb0fd491791d1d28c991bbed971c3aa5657f135949be287c0caecd1081cffd36
MD5 f047cc1f555e3a272d49775fda288f81
SHA1 ab2c862651b0bd814468d384dff40796a52f7788
SHA512 e64130e46843bdfaa0a7678fc6a34f1ffa9a147e1f0203ef86e991369d97bb0807e14c43c6e9f9f4da93ca1491271b1efa0f234b6bf05f18d5c872e957e9ba3a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWK6:A3k03kHRJARJD
TLSH
T100259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 946KB
SHA256 639aa00b2a248c2c63641487aced30a989ee7856b2c2315dd90474065f2f2b6d
MD5 7ad584a7b909d5788b6c88a8149e4702
SHA1 61a8fde38606fb879d2113553a3f4daf6ff13f90
SHA512 fbdb034c81e04b2da4150d3669a32ded25bf00590716153c19d01238eb4f9b659cd62cf35a299704a51a6b55d52eee8fdef228e997b9220e41948f344215f3fa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWyo:A3k03kHRJARJb
TLSH
T1D1259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 946KB
SHA256 676724c37cde350da09f1e53092f9c4e14ce861202b981185db9b77b21672f96
MD5 06860621546904a1d4d5552b97b36bbf
SHA1 03600580165444ece090669c58c21a8ced43a082
SHA512 ddcc227a80730691fba0ca027dc2b2d7b67d544e52f836ea30551823fafe0f56141cd1ab2b8d53831e38d15d272d2fc18e8f9ba40b27cb0aafb6934e60969d04
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWmu:A3k03kHRJARJd
TLSH
T17D259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 946KB
SHA256 def32997bd126bddfd905019f6d1e21eb9574dd3708228a1b11732548950f474
MD5 a52d96f713e8155a616df7b32df9ad5b
SHA1 16cb34298a6ca4c6d93fed7aa906272a2c5f3391
SHA512 8313e45c1f7af7715408949538cfb39342a0b3ed7f1eb65dccb83378e9425ffa4a2b92e5fd8c931ba4f6a8e0c1e2f6f4d7b76abba5b3b5adb1bb79756b35c248
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWa9:A3k03kHRJARJo
TLSH
T144259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 946KB
SHA256 30d6fa4629b879d1f413df546b8acfba912de4ed683cf9506ca3ab9a39a5dc46
MD5 beab1af984f755fd3fe476718a1bdfda
SHA1 f0bef82d97ea5a047347929ccacadec81e4101be
SHA512 086ec71ade69b499a8ba9d052e23ec879f8a3d45f70bd8cc6191ff8ce36db4b45c96bb83ed3c51ffa91deae2405f733a3bca6905a2cdc5170d298b9414d78afa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWac:A3k03kHRJARJp
TLSH
T12F259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 946KB
SHA256 3c144bd8b41ff985278d340073277fc906676f56ec2c71df80f6f95f8516f96d
MD5 b41efc4e88c645b336ce61b6763d4500
SHA1 d281b4483cf35598d592c670da4160b0d53fffbe
SHA512 6bac2003c0bd8fa83709fd81fdb547fa86a90107d491b1628c2c92d97422a3e01ee7321585008a53039a7e43cc71d118e20dcaf628ddf08bbd714a773f25907b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWTp:A3k03kHRJARJH
TLSH
T1EE259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 946KB
SHA256 08fd9a7289abc4b24f59bf3417f03eda0e5172ec14af27b1f14b8fe6d3acffda
MD5 403e00285faddfeb78b58974bf6d4cf1
SHA1 030f27b395b531172b42ffb18241c930efc8e43c
SHA512 54f97b76f7e570e3537eb3e7f69f899936174486a241d17d29bbf1091d2849f1f7cce463cacd178611ec7c1806f980da591654bfd76bf3eb9ee2dae09d7d6593
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaW0N:A3k03kHRJARJM
TLSH
T1BF259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 946KB
SHA256 2e1dc97758f3f6f63ed3c9db501464a828ef76e3ba69a1588ed5389ee5adb08b
MD5 fba20123dfb54d861305fbd410d186ac
SHA1 84fe16b8dfc53865178da3154fbb3d2152f79918
SHA512 2de861f0a7a11dc7aca0c82f6ed46113b2132e9c944347d2e006e6550ff286ab4e65282cb83d6e34c3b9ba828e37995917e04c7e0e3704c22ba18604aaf089b5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWcF:A3k03kHRJARJa
TLSH
T172259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 946KB
SHA256 b555c1fbaccf6137c893863aee013b9212e519981b50b87ba82174df27062fa0
MD5 1aab2a6d3aa2d059c1d37e0e52a32f4b
SHA1 37f042e71b3d36b0470028623785cf4ac6a2f701
SHA512 b564bf6a2cc44185fe2443a722b516c1b80ed87faf27a0b76fa74029f5896966718960c35aff78c0b03751c98afa85ec2d8886f9b4bd436749abe3ad8e9a40e0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWJC:A3k03kHRJARJu
TLSH
T1F0259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 946KB
SHA256 4b9694633ed178ebdc0dbd671194f8e15f33d8a88e4369d42629b09c3bdedd5b
MD5 3682908265c1da46026b60400bbec33b
SHA1 44c52f3ae5dcd1f1e38b085ad894ad2395612727
SHA512 d98d0f4c7ac565bd37ccf1656cf893dac673c1705016d130b6ba4d72d10e272f7123401b75899db668c28094cd846b7c4aa22d0a45d5f7e690493e39e7fdb500
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWqw:A3k03kHRJARJ7
TLSH
T166259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 946KB
SHA256 368db5e877ee772694268cb9dedca9c40aed3dd3eacaee1bff21b363a7dc2668
MD5 066157779b7791f1c5b066eba7755aea
SHA1 a4714eb7cffd145d77f9faabc7aab350b8437d9e
SHA512 1865151ec192d08c207fc656ac83f50a5ac2b20bb4738fb5bcaf29f1cf32de3c479dc78fbf59abc2d66775fac800f79e92fbee437f666c707a3958f121ee865a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWxT:A3k03kHRJARJn
TLSH
T155259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 946KB
SHA256 4c462f07cad3a43c065e84d01ea00f34d8d5f19fd21396a7107d90dfe899b890
MD5 721fe03a7e528539157dfe601442839f
SHA1 a7f838ec84728acca573d160fb9eff5bb671288c
SHA512 3aa9955954a198f73df9af3ce5df80056d23ba22c747307cefaa3bb6dde406b8a50e9ac17e4d7b2fcd19d7835ea2d340f5a7d63205049621e8dfd7ba4a128406
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWfu:A3k03kHRJARJo
TLSH
T1C0259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 946KB
SHA256 e4e40aacab9ec209c1eada49feaea12e8010560ed00daf39031b767e5778af5a
MD5 b030a56cca54494a912a926e2b2736a5
SHA1 2b2ba6d124142c37145a111df00bbe35ce3b6d03
SHA512 868ef992797a1fa15c1ccb7276614e770616e4555bea30588e1b083f697e5487305f2383942c81fa576afbba031ab0c3007bb59b594f9336cbb95ecbfa98b3db
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWDb:A3k03kHRJARJR
TLSH
T1BF259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 946KB
SHA256 c5721a6a26d634e4340232c3f329bd896d8fe2140809127105bccf45e85c83f7
MD5 ad18840d06f6fd19202ef79b47f7cc75
SHA1 8bf1ad8f3de0fce0f4bfc14c98100ef4f1df8fb5
SHA512 69a104e6292a4c4eba9484e86fbe28d51efd37032beae49073af0ccb9c11f477b0bf0063d8ad63863db4580c55ab1fdc3e958d82a9ca1786c599f18f7f13041f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWXf:A3k03kHRJARJR
TLSH
T1DE259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 946KB
SHA256 c820680764766144715d55338f39822b8a8b520646fa19f09fb969a05d47aeec
MD5 7ebf3ef5b736e98e3b47514dfe853148
SHA1 d477505c918dd0e6090f8a8a17118618c8f25b6b
SHA512 bb36c3949e5020e1d7198f577c39a8c5ef2b8b8d0b6b4586d727b8fb273fd1e32cf2f11e1add2ac4487e7cfc576ae1b72f85aed0333a69450b0445cd1fc91644
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWgK:A3k03kHRJARJp
TLSH
T1C9259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 946KB
SHA256 5192543c61c94478ad71096402f68b4d6506517c74159e7b07721152cd3ea15e
MD5 bbbea0aa88ad3b8e02cf4ce64caa8417
SHA1 412897b3e80b55f9409257b68eeaf1cb994b881b
SHA512 3940f507189c8697536f5afc4b57bcb275648ee958f10b676e4880d879cdc5e84dc613f1aa63b61902ec5fd3fb63de5241f4a0013409308a253efbbb59b478ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWdk:A3k03kHRJARJg
TLSH
T1B5259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 946KB
SHA256 7722bcb0a4debe463a94a0c7072b4aa7e06cee3668ce67524e804023977268b3
MD5 2d456cf791d5627eb587b74d60d5ee05
SHA1 967cf838fac6069593ec26ff3052c6c01e13eef8
SHA512 60a8285624c78a5d14f91419cb4dad28a2899e5b0863dfa5820d70f9b596acac88da5e7e11aa66945c9daa887bcb246d5bd44323a2ae59a109e0c699336fad53
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWC0:A3k03kHRJARJp
TLSH
T14D259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 946KB
SHA256 821a67ca89e0584fd3c7985e0a0ec0bb731b9b9a5ef5414c6deadcdf3165bad4
MD5 a4e34ef97d4541e6bc9ea614295f4a0a
SHA1 5cf33d53c342ac26f6709e3114ac15270ab2d9ae
SHA512 fbe7e8139817ad30fdcd75a9561c3b750fd14d1167c448d45298133b0d8256a607d1cbb4121c2c31df91451f8c4bf632ae361c81e5fc6a6440ff2dc9ca9c00ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWRg:A3k03kHRJARJ4
TLSH
T1A7259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 946KB
SHA256 1a608ccc3f160f92dbae14c951d4a45841a6abc904815323e9e689da5410d5ab
MD5 e9f3e8438d51f398745ff528a9ebbca2
SHA1 ece8fed843ccc3833d96844a9192984fc60abff1
SHA512 8db78cd28f60271f954ed940015606d8b572303b54fe7d5454fd0a707e233122310983389e302ea1e057b9cd99a1b084664ad8247de67c8d69aff97cad412230
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaW4r:A3k03kHRJARJi
TLSH
T146259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 946KB
SHA256 bbcd64daa2cc00dae460951b2b906d4e753b49f4e2fda3a932c85c5b35f0374c
MD5 a3d06f5544abdcf3a14de0a212eed9d1
SHA1 f9145583698ff60e0c845a57322c22b73be3d38d
SHA512 8e8611dd0c099775dfa1399c2af294a1be9d57bb9de2f6e3857a7e6207de70f69d4c6a0e84fb477a2a5409b093582e175d6f59d909270fc5dde331eefb0a7296
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWWn:A3k03kHRJARJ0
TLSH
T146259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 946KB
SHA256 8de753584ad6f6f5528ec2a3c513962cf1de6edc3253772e2a4f4e971092e2f2
MD5 6e795fc39c60b77a867b375538450aa8
SHA1 6e12e319eb356e12ea274ad09e836d68624f3790
SHA512 f543accd29df8c15ba1cccd8d69ce39c6163b0ac7762aefccb4a5c74c521bbbb43e8fc446493949b2419f5ae520dd3d8312413fa5317485fe8a2b18893e572e5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaW8x:A3k03kHRJARJy
TLSH
T1E3259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 946KB
SHA256 24e6bbd3e55289f564198f31361cf1fad3d2c2c5ebea242d111b8318d2091fa0
MD5 01710549125d19cf8ba7815a906384e8
SHA1 3b9fc2d8c5900bb74164803ef5a66ddf4bb2a54c
SHA512 5a46791d3ea3e35e53efaafd7dc12e0a20f7f7252ab094ca226db9f3db818d6b945a6aeb1488f42dbfbe19248a3695f6170f98e6deac94c356bf18a54435a98f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaW2A:A3k03kHRJARJR
TLSH
T1C4259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 946KB
SHA256 4dfde8d1c1cc5d36abe89e80937db214742d593f5bb2c73990ceeddb61454ef9
MD5 442f6dbe5945d2cd11d5d621b3768f66
SHA1 02fb95abebdc0656b0605603affbe4bb0561dc47
SHA512 58db0b3d874a1d77a942f764b0ddeb8662d7d404a7a46fbc2270de89ab7956efcfcf5e7e91e06a824b61de9cfdd9d913ea741850a2c9abdc96855f970c56eb02
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWv9Q:A3k03kHRJARJo
TLSH
T161259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 946KB
SHA256 5f72977fb7897b06c0c722a30630396d95f562458a88347b674c9092a1edad73
MD5 006a3a69f619424c5c9db610972cb531
SHA1 055fa03ee3dcfbfe24e1857a8f7bf9d83ce745c1
SHA512 986170e2ed5c6e05126304e7ce30625d314bf9e161841cc0b32283a31dfa71595a28a1621b3978f8a2d2aed67fb22403889ef444327d57fe03e97f36f6877c3c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWG4:A3k03kHRJARJT
TLSH
T1A4259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 946KB
SHA256 1d96ad134f52fd54744fd206b206a1590531aa332aff7cae0e691baf57a317b7
MD5 afda23e660adf724f0b4f77cd8ef49af
SHA1 47ed39f4548a6792a3b4a1fedfd7650d46c3fb70
SHA512 bd57cdb7d94f49d7fed71b89b3b47d1a69db131feca692f44555c9def774d8181b6dd9c8150e940409d7574eb29e38a5cfc453136ffa86bbfc56c39b48578e6e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWVu:A3k03kHRJARJ2
TLSH
T1E6259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 946KB
SHA256 7abdd38c5b16eeff3740ac9235e817418cec5b1c0b4d0d414a694f35e5a5f17f
MD5 e6cd70fa8582bf2b1a3c903a47a775d4
SHA1 7c3d473dec43f93f099a205a53f360d2dc002c72
SHA512 2f24dbc646fd83aead4d3b60b42c8423384f36238eaae3ee9935dfa0f5d007bff94c82f4ccc32c49c53987614e0645dc9cddf9af2a077f260977d2483e7820d9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWIj:A3k03kHRJARJI
TLSH
T144259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 946KB
SHA256 38722d900566c82d87930e8b58ccbe59110942506c6d85c669a7024dda025d65
MD5 10a4a0e30f5bb77615893bc1044b9060
SHA1 74649349f7e539c29298b663ce56235fe6b831e1
SHA512 5e64d1ad8161ff16f2a21d1fba8bd58d71e14678d2529e744b24480251a2f23414557952c2d1ca94181bf481b084bb03ec96ad4bd59331cdc04f05bf2df44dcf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaW5g:A3k03kHRJARJQ
TLSH
T127259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 946KB
SHA256 6643c8f42e958ffd802fd6c8cea0547b172b0187eb752986059c197054b53f9e
MD5 d0cce53c14caa967afdfa68bf03a7cf3
SHA1 65565f3c2d9a1569cd134e8d55a30592c509b10a
SHA512 eac52f7afdaff9c7b48cf2d518f1643e88284b7f1ab4ad9d358290dac0c1de5850803892c270d5b1fcdad3a4c39326fc607254f72ee5e41695f31908bfb5782e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWgI:A3k03kHRJARJx
TLSH
T194259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 946KB
SHA256 5927ebeea90d633a9c1113da7f604221c29d3e9502b9d5d909bab442423292eb
MD5 d7a8f9ebefa844b075b7c513e0afa15a
SHA1 c3def15e3ec900edc86743c8d0f1ca3031aab043
SHA512 d8a7c55d19f2ffd7768e1cf3ec1cd65326a68b60dd390875e95f929d127080cc92f8ed22c587de3fbefcd54dcfea25e5a3606ed5531553ea74ee1258451f53f4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWio:A3k03kHRJARJP
TLSH
T1D6259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 946KB
SHA256 7c45c2d49213e34a118be535236270fcd9d2af04b76a4e4e43b58109aa60d6a3
MD5 e69314902e8609d305f42ee79f622962
SHA1 341073c7def4c1fae45cacd0b1537d8614d99d11
SHA512 b6d5e8d600081ad43bba672996250b497a64e1eb1d4c8918c664930dbcdf03b14e690f1f44cef58946f01da0c3e5f4257d6d5f296fd3d884b828f3986a0fbe25
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWZ+:A3k03kHRJARJ6
TLSH
T197259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 946KB
SHA256 0e9184f85ddaff9201ecc7fe98367d0c23d953e932614bd7a4759ab611f4c87c
MD5 a540670947389c589c582944f45ddc3a
SHA1 0bf53dd9c7b115c495371988cfc8c8bed4846abf
SHA512 64c9bf77a997821d13ab6040c5adebed79ee0d4cbbfc71f1e8f8a1cd419fdb26e87279ccc95737b1b0a3b7c833cc6249aac64194fccd319ea3a28b96f550614b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWHQ:A3k03kHRJARJ+
TLSH
T144259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 946KB
SHA256 f05a4b77558bf51f53bf7725d82fb159fb209122280d8629895c483b654f21da
MD5 88656f19c7dddb4ffa0fd4ec609c630f
SHA1 41bb93f248b55e32625d21a1ac3d748be12fcea9
SHA512 902578aabe375016269e02b796ee1844d1df0300bb8a4e1b18aa020491f822dcbfc04197703988aec0dfe71544247162848e88a5b48962f881bca0c8e14e0515
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWcX:A3k03kHRJARJe
TLSH
T1D1259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 946KB
SHA256 9da36e1e8e8b63c5493147ffadb8971c5a640c979f8f417e1cc420fffa7f33d7
MD5 c5e4835f6b946f9f93e3996c44be5b9b
SHA1 17f4689c01249785934120880ad518be7a7d9a36
SHA512 6ede5095737a115cfd13ba9bf42e9ee1eaa879ea30c350a2f87d324ccbc8be6b9d1496b27fdc5dcef483e2e2bc70a1c8e789a6849519f3db99000bbd0ca24a10
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWaL:A3k03kHRJARJw
TLSH
T15F259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 946KB
SHA256 e87a636869cf3e17fec1622fd3c2110ba9ac7c273aeffacfdc18b3f564812152
MD5 5462fe6a10d1197efe43f8db76afd3c8
SHA1 037109b48352dcce3c759de9cc174c11610da915
SHA512 f55efa3bfaf23e57c80e7215bd9f89ee75ca23d2edb1cedc17b1b5c4587ce9a9a56346f279399b4ea435551f6fb6fb37a582432fa626c6146366fbda9ee86ece
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaW+M:A3k03kHRJARJh
TLSH
T105259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 946KB
SHA256 59e1213bacdb2d279e8956ded92dabcb7c686edfc02f5fb175b965c43060bd4a
MD5 b883cf7a32312723d65c985baa7186dd
SHA1 d8f106f26e0378cf89181a3b2ce7e4b93412ece5
SHA512 153da9878ff995c73ebcb539834c89e2859fe526f457b520024e75827d38c7bd66dbd3875a9ed1e90d8fb2d6a0b308cdd552c5bebf841f0f08deccfe10e7b324
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaDaWnh:A3k03kHRJARJz
TLSH
T18B259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4340-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4340-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4532-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads