92d818bd4bb3f8d32fbf951521e89c884bba7dbce9ff2b967a461c3e7a732456

Analysis

max time kernel
104s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 931KB
Sample260804-vdjcksdh26
SHA256 92d818bd4bb3f8d32fbf951521e89c884bba7dbce9ff2b967a461c3e7a732456
MD5 00e64a0122dc653be5c4a3edb739d350
SHA1 d311a4644e83b944a8b2ba5022c9c3f6391ecace
SHA512 ef6022ac60c368169a46c07f0cf2a1839c03aecf45a4d1f53331215945f82a1081841f7d4d3f238ced6f9cbdf01496501385dc0f023b4c7186579f939213f1ee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mu:A3k03kHRJARJA
TLSH
T17C159C03F79900E8D15AC1789AA69A22EB757C561730A7CF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4900-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c562-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4900-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4600-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-588.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-620.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-706.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1000.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1347.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c562-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-224.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-261.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-442.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-588.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-620.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-706.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-737.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-786.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-823.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-854.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-885.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-892.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-905.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-925.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-951.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1000.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1043.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1080.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1129.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1148.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1173.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1180.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1218.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1328.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1347.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1372.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4600	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4900	2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4600	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_00e64a0122dc653be5c4a3edb739d350_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4900

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 931KB
SHA256 92d818bd4bb3f8d32fbf951521e89c884bba7dbce9ff2b967a461c3e7a732456
MD5 00e64a0122dc653be5c4a3edb739d350
SHA1 d311a4644e83b944a8b2ba5022c9c3f6391ecace
SHA512 ef6022ac60c368169a46c07f0cf2a1839c03aecf45a4d1f53331215945f82a1081841f7d4d3f238ced6f9cbdf01496501385dc0f023b4c7186579f939213f1ee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mu:A3k03kHRJARJA
TLSH
T17C159C03F79900E8D15AC1789AA69A22EB757C561730A7CF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 9f7bb4ca5528961ccbab0935e0a6a0cb4451841a3902b820cef866576b4c2361
MD5 2f8121f5ad5f0297f81fb1d601c0b0e1
SHA1 337edc0d18d040335cf24b87091e00204825a9bf
SHA512 8f0143b4ac2791bca1337f4e0d63d9a7c4868551e482f24a8858e882c5b28df8f5ba42357247f0b8292b0825c8f29e79d54863308bcf78d81193f683300f3751
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7me0Le5ji0hmxNrM:A3k03kHRJARJYPji0Aj
TLSH
T1C8657C17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 946KB
SHA256 6a51e6b78aeb049611c04072c31ebb0a05013bd9ae291390fc825edddd7906da
MD5 f5eb9e3afe1d8717c918e83752f5a11f
SHA1 f3338d8111bb6cb0ec72605c0ae9149d85eb23b8
SHA512 b012117eaa8a52ca99e18197538c14369cf09fef123d99e41188f334d2bfddd130b0f3bf6c9d8f19427c522d7974fa6a88f983956c1ef109c7ac6fa581a897f1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mYa:A3k03kHRJARJ
TLSH
T12C259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 955KB
SHA256 bdb71c2e0fee17e3327f44138f010a921b9a89b7e59c826e30a09bf0fc20e4b4
MD5 aa33d546b50c618a5c15b124b57c19ff
SHA1 315901bfa824999733616ae1bb4151cdfbc970dc
SHA512 530736449203b9e409f8d297ed6d3fd56470015a101feefd4b71f4deb60203a3831f8a3788c6c9c5e3be7f49ce395e6db06b6051ed5ee5452e52e107910f1d87
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mx6:A3k03kHRJARJG
TLSH
T1FC259D03F79900E8D15AC1789AA69A22EB757C56173097CF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 955KB
SHA256 9f248d3243c806084810afdd5239d8c3ee9adc58048014a73c8dea628a3b14d5
MD5 e5778e62b323a9b1238af306d2292ca8
SHA1 85198e9aad9f0234a89c4848e7a87a97df2552e5
SHA512 5efb06354e0c8b2eeb37a52e5ce1bea7e9449ad27594d995382cbfff866b478813d5460b45d922eb65cc238ab4c6c94d8cce822cd259c8283690bca8fa73a978
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mvN:A3k03kHRJARJX
TLSH
T1E3259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 955KB
SHA256 e7835f768565ad425ff204657b8267eb73254e2b974c6faf6e86bceccc3b3f88
MD5 19342e346c652b2adc773e07ff39ec4d
SHA1 5618ac9d76dc9e08ed5e44766fab95959745e7d9
SHA512 fe3f2a31b6d9f06d51ee27eac012fbd8b92226597cd18b2e2be3186d5c214042ed20f27f666816b8d0d6122a3f7b8e4ea3a6d041bb607e6c6d2776d32b611961
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mVf:A3k03kHRJARJT
TLSH
T166259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 955KB
SHA256 552f85f09b18354136aaee02a3a052c43e4082cd505a814c5350036d35d0e538
MD5 a42c912408ab09940a2ed29bf6c0cc92
SHA1 adfdd082292f6f966783284c5ba594ee9fefbf8c
SHA512 6c75e14b780c382c1180eb514ca464316ff4131e0fc9d89f4adfacee327eac39aa227377f4815ae7c884c2ab938ab9f326597de5af13517dd08754599b0f69b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mXo:A3k03kHRJARJC
TLSH
T104259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 955KB
SHA256 005da3670aa54a05d85d8576ebb660cc85d9c8beb62bd1041924972e5f200279
MD5 e5f8cb0b1d7754806453372855302219
SHA1 6d9d74ff68fe418102b1b2c125976cc1ce35693d
SHA512 928a9de497554cdc4dd096413b9cae93c02f726326e622fc74c4d390dfd8dd2cf8c635f085d21bdf3b3473c8e28e06879e5d1af0975c47e4c87bfd175c174c14
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mbu:A3k03kHRJARJM
TLSH
T110259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 955KB
SHA256 d22b9ce25e6646c6249761ec5ae6eb402821eea5b5ca9bcdd413e6dbf21d9469
MD5 23c8145f6dde9d7e8c559913dbfc6473
SHA1 e921a3e3371d1d416f2c72650f4cb22e9bb0a805
SHA512 87f8c40affcc676052feee5034f0aeac7232636f5f404a53bc317b60df03ea6fcacdb5db8b24a15c3bdde453d0dbe8a8faba31126256018afa133b5b9de82dfb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mJ9:A3k03kHRJARJR
TLSH
T16E259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 955KB
SHA256 0514c02f4dce1c46916324ca1f5fd43db5c66f2caf95b7a7a461cb6a9b210c98
MD5 6482ffc867331ed69ddd06c7871124df
SHA1 c3ba04cb728b5c5de4fc4ab86b0676b96c2c0355
SHA512 a8382cc4ba108c3df52fe32f0badec9a1c93783406408307b2f8c78a754ab857d1e0ee60de55d3726a70551341fb32ea1e51d8c9e6dba4d0058dac43e0a5ad35
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mlc:A3k03kHRJARJk
TLSH
T114259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 955KB
SHA256 d4970697143de69f60d3066427db020406777c79ae9bd8d23f17aa6c77a0f8d1
MD5 92170f0e9a64661a6c149810d8c65676
SHA1 2d9f610e589edfc851333e3a2d445b05de05ee47
SHA512 cd26565769a69fa207ee6690910d6acf10c64a73001db4ee33c857cd3ac8f12a1970a0698dc6cb7ea4d287d9ea51958b2ff705f400c7b4068fe43446bbdaa375
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mep:A3k03kHRJARJy
TLSH
T131259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 955KB
SHA256 af5cec56fa330ae853fbd8dc2db301e6ca161503a010457805b5e9fbd64451bb
MD5 92ed9cfc9e224d319d4fd93e6ab9d944
SHA1 5e1baefceac93f7f13aa813136e53498ff491caf
SHA512 372a09ff7537bb0c9c4090396ebc3a6b6ff9924660c273a1171f49da821cae466f737970113c0a31290084c5401e902924f5744efc26063aeb868187e10aa448
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mRN:A3k03kHRJARJ1
TLSH
T1BB259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 955KB
SHA256 b28696ff8371bff9169d7e6e650b8cdeb7b0fe7f793685eb8e0bc7098032eeed
MD5 f5471ccfbac750a6bf34e9a908c12efd
SHA1 f2f27845c3dbafe293287d83edd586ba9f8c87e4
SHA512 52fd7b34f6d7c6225af200964626d44ffd694a359774cac451f4cb26df07bbff0148b7c270b90467eeede0097ea60e863611668793447f04654fc7cb1ae93110
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mzF:A3k03kHRJARJ/
TLSH
T151259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 955KB
SHA256 8caa0459b5a138a5ba87449783752a8564a908af798a71872412639f770c6298
MD5 571f98f77546bcd2a1c4585aa59bf7e7
SHA1 d26c05339261b7251de3366995e896c7d9bb6027
SHA512 1ecfdc6be4b5bb56fabc8468952f21b217f4750fbbb48e355b58f7338e9fc8e9fef44a9de5053561f1ab6e34476517c3f478c50678f0d4c771368c81accbcbce
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mcC:A3k03kHRJARJz
TLSH
T158259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 955KB
SHA256 c86c84b614a225e82b8c9c933f9b2949b2ab868ae24b6c4e08ab8d32ff6e5549
MD5 a548a58d0adb13da0c1b00bb5c82b3ed
SHA1 91e14d58e94aa0fe600fc7826e44cbd4db29691f
SHA512 f839c8371daf8286843edfada406d04bed6e547ec2e8c208f8c276a10a38626c584ae7956f93804d6e736f8759c34dc6b9ea3ed8f69b4909a5430a848fbb0aa4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7m3w:A3k03kHRJARJ2
TLSH
T18F259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 955KB
SHA256 d187b783401531c76c4942e2d8a2676c3b3a84ed26c0c6dd16bad2db6e4c5c3f
MD5 2cb779bff623c880eb5905b31f4d9577
SHA1 a3c419efff1bb4d0dff4751b0e74fa87cc24412e
SHA512 c75b127e6ae9ffeeab58ad3864f226d9b496e780a43a13e3226882220585c5e1e29499323090511cd004ca630a1041db859e1b8a5a7ca51a3e2409d88f63bfae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mmT:A3k03kHRJARJ2
TLSH
T1EB259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 955KB
SHA256 2847b2335963321549043c508969991d0aa56e86cd93c2da88b01150e44a7b03
MD5 e8524d7584e62761920ccd2678f8c83c
SHA1 2ddb863fcf189009078d432391b209e3eccc0f41
SHA512 be1f5b580de313c23d2be798ae35d877f3dd7107279fcabd4149480fd3260b3e31cb7b27ded602f4c7b356658be7f164442f685e211e1800ed924529e5091fbd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7meu:A3k03kHRJARJR
TLSH
T1FB259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 955KB
SHA256 d664b0e05ffefc0c17e61bdf502cb268838e8d5a875916b1a01ff44b0cf3bf6a
MD5 aba815c939094a833cf31b62ea3882f0
SHA1 e448d8e3941cf65ba12bad8fc6aba5482f56176a
SHA512 4202be9d89843d0e29612af42de788c6ddb798bd5440d5f5ea66bbe6b6f9ca780fd2212965baf614c5f86067b8f31adcac2e5985f2a762e87364fa602ed5a415
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mYb:A3k03kHRJARJw
TLSH
T133259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 955KB
SHA256 8652b1cf0394b868e32a274b503ba245066c9ca2fef36c3a420db7c04bcc63d0
MD5 cf9a31dc90bccae166b3ad5ea8996e28
SHA1 b3e79aa96a92697274607ae51756ce16522660fd
SHA512 ef318c3b07a9230a295b222acbc11bba6438c082cdeabef1edc83d41d0269e470742887ade96bbaf3e62f037e474b3b7c0de0482b934a028547d225349362ee3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mGf:A3k03kHRJARJg
TLSH
T146259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 955KB
SHA256 52825409bb1e01aee34d446266fcc52cbcc5edb2723a25bbe96533a3218d5ba1
MD5 753be41d3b1ea6fcccd7054f1542463f
SHA1 24a76a51dd150ba6dc23a29b13ffe35e5105b17b
SHA512 924c08cef9823f6ad52aed824ad7712b79033c6196c8b09d5640d7e92c6bc451bc5162261556d3756da1e012948f52d72045014ec689c7405d4d30944c6c93f8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mDK:A3k03kHRJARJA
TLSH
T1BE259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 955KB
SHA256 01a379be4d4c22c7b5fa72264fc2528f36869bb0e7ba4e0b7e41a9283941b319
MD5 5333e9afbd39370406bbe78a8374a094
SHA1 523868a1f1ec51b349902eebb02cb8cd09a2806c
SHA512 775ad236392901ba1299dfab3a6d830a4574f8900583c6cf9866093a0d1cf086159787c6aff33be21874902f8720f0dd13548f00e5976e838bd1060f3203778a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mkk:A3k03kHRJARJp
TLSH
T19D259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 955KB
SHA256 710171e2087ccd7f15fc9fe5c3f98fba59412acb6cbda6c1c580fa6024e3be59
MD5 f2ad395876dbb3e2530b7ec3b5ce2378
SHA1 79ad00494d362671fb5badc8e0b45700f0a67871
SHA512 35504848c188ff546e2c64b4f197d55519ce445b1d53ae95d46595c5ca285f12599e624c513e309e4caf0eb26dde3f16ee269ec8dcc70386c09ab3c9880ceee3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mt0:A3k03kHRJARJc
TLSH
T1B9259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 955KB
SHA256 71fc254ec49ab0e661e08551917b777eeade9afff94fd340a8ceb6699ea616c3
MD5 8cee9652c6143fd1915a2cbc333bfd09
SHA1 acfc4d0354a5702bc32030319c76e8c749b1e286
SHA512 ef3bf70004ed300ac6930c1ef6fd4d2ca449c91a3001805a24fa6fa23dbb330b2971a0eb09d4fa9792ab0a932712e7bbe814c5e8ae14071937e10202ca69b235
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mwg:A3k03kHRJARJh
TLSH
T1FF259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 955KB
SHA256 3827c739b2aaa6968b6c256d9433799d864b715d9fa9cdba8d3d4de503a16393
MD5 1c09ae9bda74cabbab3be9ce58a467c4
SHA1 ca363bc3e6ae1cd2caad75a81540e1f618e31ce0
SHA512 5f9b3159fe7a5bf1478115669fd5821ce78bcf95ff664980170d0424b3055fd5a9351500c0010d7d7c8018d4a1b5837ebc7205df7bede4cfd3196347e74d9995
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mFr:A3k03kHRJARJL
TLSH
T1F1259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 955KB
SHA256 81916b4790dc5943933b6411ef5595876186d160fdf4d4c426990c0f944cb109
MD5 59ef401d37dc5198692b232c055eb238
SHA1 b11c4708a6bca92cf6f899f8a047c182a5b6e0d6
SHA512 e8329566c0a57c222b690720ec14eb3f6c7286f5c59a5e817df6e4c4445ba82bfcca1cfc4483fd6c7301ac2c6bddc387f15f4a69fe1348454621cbd1ceb2f695
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mPn:A3k03kHRJARJ9
TLSH
T18B259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 955KB
SHA256 fdddb43e3435e194690bed1734a3e5ca860741bf2f5f164242e2e6a44945f916
MD5 9fff4aebafc1d8ccd7f0ec9f14685a87
SHA1 f1a8fcabfdc6e22b5e290de73bb44d5b240c7cbd
SHA512 933b5397ad9f6d0c17ab224e3b57c9c8d757a4ae1fa9ba14968bf721c095934aed0d0984dd3ee8dc7b617032ceb4f382974056d05bf05fb9e705277407dff424
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7m7x:A3k03kHRJARJD
TLSH
T1DF259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 955KB
SHA256 43a283f63adbb7845d1d6776726138d1e21e4a74fc3b15326850a5c1e95cfa23
MD5 b4822bcde4764fda3581b2b205bb864c
SHA1 c83d0cd53fc267b21ede84f0a1ab02b631148419
SHA512 c755fbbe83704894b13ab79769c6c49bc225f28d60865113ae99c4ace4d6206dcb4bc9156e1d96b39f865fd5a77fe0407f9ff3e765b25c8424a0c43a69622567
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mpA:A3k03kHRJARJc
TLSH
T16E259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 955KB
SHA256 434875f78698d371b64d40fe4a6fec9d16b7b94dbb99278797615db87f42f87a
MD5 575590176f10219dbc438544c7bdc7f6
SHA1 79e907c815df04d712469c9bb4a9102c819ca5cf
SHA512 c3319168620d4832c17bdde4c5aef9df6e9bb5914004bc1cb777046464592d927614f491d447ef622df9f78d0b96031dfb087ed72ed1581ff384da3c4a87ca71
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mi9Q:A3k03kHRJARJd
TLSH
T149259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 955KB
SHA256 4064f68cd53e8bbb16acbc363c6a0696f319accd74b19721a0f44bb0be15e5f8
MD5 e81f262728ede994dcc185c6a5aa4ed6
SHA1 022a7e4bb3cbc07fde384a6461d172275492c45c
SHA512 06321f033d0370e81728e756abc3d8615a6129ebfa18a12512a3ba2622773e940009a58359379a37f199aa1364e1b3c9599cd0b15cee8edbb2d98b7e7b0e2d8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mH4:A3k03kHRJARJC
TLSH
T146259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 955KB
SHA256 08fa26ab0c0b76fb41a493def504813e7e9711596616c67e5b60bbe37cdcb207
MD5 9504816b3dc12e7e1d0b5bc1534e2af5
SHA1 096456bad1e35684d56d7c6ddb17a35d7714f599
SHA512 1a3f4a52576a263bb816d4f3cfdb31b7c3a88a738edfd7145b45f94b534e20bd29a4de94b6a4516034c4327dbda124498f81332565a31bfdf3b33aae2c32effc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mmu:A3k03kHRJARJz
TLSH
T1A1259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 955KB
SHA256 a78d2c07cd4d7542e962e924c73fa2e89bb8a110ab0ea44777848be1f7be77c5
MD5 f706f661aaaabc321bd656187532cd90
SHA1 5f764fe68a556e175786553df8bcb0a311040854
SHA512 2788dfcd3eda2a63db7f4bcb1954746e146d63bdc6a5144a6e74b6d10d9988ca025501b367223bf6eebad7e1bf19b4c8470d9a98f0ec4f11e94b0e3916be11e4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mXj:A3k03kHRJARJ9
TLSH
T12E259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 955KB
SHA256 8389d5536f07e5c4a6ddf18a7ad624539c434ee7dab73ef53864a63329c338eb
MD5 b4aa7ce3fb496854ee0e7bb80badd5f0
SHA1 a8f77731204c07f32e9fd22c42554dbf6cb7dc92
SHA512 fd0b8830f7f15f5caaa415ba7dcf9e05ce9c0c284967caf9bc44b82f1517b7265feadefa1bed41f9994ffad4f91cf8e21ea45bb38ab4704c5c9ddaacf873c0ee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mCg:A3k03kHRJARJB
TLSH
T195259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 955KB
SHA256 f1be7ffbea67e1dcc701f07c55f4e72464dd70df7b4f8ed7620a379f968cc219
MD5 d8fa1bd646ccc638832fdb83ae2d98da
SHA1 667639346886073e4ea2c2d19b650365386d603e
SHA512 e9d285c33ae3f8d59584cae3f721c75ecfeb36ca5f2182096d69f23f5780e547c3ac68e0465d2085452dbdf31fd04901d73b3ad6085ab67a2b2069f3b520cee4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7m9I:A3k03kHRJARJQ
TLSH
T171259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 955KB
SHA256 6f855363c48a358521bcad22ff71e569e14203b4cb250803b58a39eaf3078ec5
MD5 87a1483be0ba14a01aeea42fe2de5003
SHA1 edc97edcd9ed3dada624cf5d4807d8c42b7ae2ad
SHA512 ced08ea0b44960c1e96dab433ccc969ec8bc06b909b6edcb1c891f71cff5b7c9eaecef14d413362b3eb8f45b1159556ffb044d508388bb7fc68c2a66504369f8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mvo:A3k03kHRJARJy
TLSH
T132259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 955KB
SHA256 2d95a9025c36eef16fdeb17c78d2f775a83f79261aef0456ba3ecee638035025
MD5 82d1387103f4362e059f45af88d050a5
SHA1 33da95a53173cb04d08be3513cf845d5727e7679
SHA512 d2ef8765a4d35ee6583132949bf50452d741d137ff80acc5d862314b00a8b30274b90a0770765ab5cc00fc9fdf91c42ebfc53bbd78cfb128fec155fbc4f4d3c3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7m0+:A3k03kHRJARJ3
TLSH
T17E259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 955KB
SHA256 8404f1c2ac6dd8e552a083e44495cec9fa493060955773b21b7a525608cf580b
MD5 daf18e1d6762b7293fe217c6370035d0
SHA1 862adc74f665b33b0e8f1d813965a6e1f0772cd6
SHA512 31e9cb278c13e9c7eceee6c94bfb6589281745763d865003e9ddc9e2f9b8a55412b9b09276dff801da9b12e6358acd195eabf3f1cdbc1ecd26b4feb4fa5a06c9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7m8Q:A3k03kHRJARJj
TLSH
T114259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 955KB
SHA256 1cb68cbe81f50e3adaa513541fc42708eba61883a33b005c27d0fa897b5e565c
MD5 a57b98f41caa44933b02560c08524384
SHA1 b067071d1b6fdacb3c578219a911536ca78606c0
SHA512 2c3af7dd801dd0453788c728b087ac8fbe91bb73a9eb32b401316aaeb6898df9ebd25f54277cc340a1ad339ae8b1b86dc9e02c4890f43292c2eed5d625594896
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mlX:A3k03kHRJARJ3
TLSH
T1FA259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 955KB
SHA256 8c03b14a2d0d430bd0539281f2ac0ddc0e60b97768c3ed7d6827d4a3e8d63f11
MD5 3fcf04e1e32f2c8e26c62ede0fefdfba
SHA1 a14b955f2e50e33408cc440f31bba51929982ebb
SHA512 960aa0788f97714aee2e05944fdc801794870e0f6a14507e58efeefb6a983813393b885e318df1e5e96c23defad8942b4b4b20e30e5f7e2261a5672394a5ec38
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7mHL:A3k03kHRJARJZ
TLSH
T1E0259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 955KB
SHA256 a69f92c8fba4658e7bea4708711ef2e13528ed93ee7ea12004de5b6d19e9dd10
MD5 1a4618aea03bdbcc3b3daf7943e23320
SHA1 c93945b3ef2e1492c75b5e485304a13ef03d5377
SHA512 d2478ed5cc57145d4a7ec02b174bfef5fae3a1da9a5b1a5b40d97b3663f6b4de8922fb44d5091ae40df3ff598b6487db3665d63aa2e16219520191a5987cf117
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7m9M:A3k03kHRJARJg
TLSH
T150259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 955KB
SHA256 52680386072b5e7d96a2261d679fb9d5db211fde3eeb529d7697192456e13c45
MD5 2ea082398adf5036105c3b42eed69946
SHA1 c83862aefd414192e8d00379432ade43fe3b4559
SHA512 fa0afee44651d43fed4bc17716925f6288035c8c8b8b6c796d0a2dbefafa452dfca6ce1190dcea7fd157156147ff0dac3f447f817d794d0117e6eac430fad0cf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7muh:A3k03kHRJARJS
TLSH
T1AD259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4600-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4900-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4900-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads