379c307623aae17273b00be4047d49a350350269a9925f304357402d26f33bd9

Analysis

max time kernel
94s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 930KB
Sample260805-3vs74stxdv
SHA256 379c307623aae17273b00be4047d49a350350269a9925f304357402d26f33bd9
MD5 cd5b987ff57dd1dbeb68ff7cca16bdd4
SHA1 79b43402f2aae38c3298c59c97fa4f7caed38238
SHA512 24f7c21436e7c467c34d033f39768b04126976735fd8b02440e18a65b7725652df87f2a092f85dba8d667a5bd7c2f59c1d6d23d98c897ee5e5f70af023ae8ef3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMa:A3k03kHRJ
TLSH
T18C15AE13EB9500E9D10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3724-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b815-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3724-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5716-59-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-588.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-704.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-790.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-834.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-864.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-986.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1078.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1289.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1332.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1351.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001b815-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-40.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-496.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-588.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-704.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-790.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-834.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-864.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-883.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-924.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-986.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1041.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1078.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1127.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1146.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1172.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1180.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1289.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1332.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1351.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1370.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1377.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1390.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5716	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3724	2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5716	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_cd5b987ff57dd1dbeb68ff7cca16bdd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3724

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 930KB
SHA256 379c307623aae17273b00be4047d49a350350269a9925f304357402d26f33bd9
MD5 cd5b987ff57dd1dbeb68ff7cca16bdd4
SHA1 79b43402f2aae38c3298c59c97fa4f7caed38238
SHA512 24f7c21436e7c467c34d033f39768b04126976735fd8b02440e18a65b7725652df87f2a092f85dba8d667a5bd7c2f59c1d6d23d98c897ee5e5f70af023ae8ef3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMa:A3k03kHRJ
TLSH
T18C15AE13EB9500E9D10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 7195469defb527bac77dc84591198a002c3eb6bafa9b06a6a271a640f81dea9c
MD5 c0752d6f89a02e54b8bb234251f894fd
SHA1 fd24b9960472c80321da5d5b2dfa431b0435ca43
SHA512 4264c325044a2f808ca32f99c3442b5c21750fbdcba9fd4f8d8729f663fd28dfbca7e5672b072dc8d09500f75e7a288940b9d3287c2bd9bd8c46e8013a8eb397
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaP0Le5ji0hmxNrM:A3k03kHRJIPji0Aj
TLSH
T179658C17F6A402B5D067C1B9C9E69A5AEE7138421B3086CF1358C7283F67BD19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 945KB
SHA256 5cd33fb82e259b2330a8c097ec2969e3f87eed8924021a8ddf872d3a5338cf7e
MD5 6fc28ce6a2e8230eaac73f74322bedcf
SHA1 6c4e2f8af56b373ed559a0659a2d37a90695fe14
SHA512 5595a63fc2207175b93a7938e96fd8d3a8f3d3daf3f8be0ddc94725fd35a7e1e87f7d23dac908f9ad627e712c18a184b9ab31ba2bc43d3611296bd23586823c3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaRa:A3k03kHRJ
TLSH
T12A25AE13EB9400E5E10AC1749AE64A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 954KB
SHA256 620bf9ffc240be5f8ba5280cda200fe6dfa3e6fdc6c90bc81eddc89e77b39c51
MD5 89bbd5c77f86042e62e2fb6d936be943
SHA1 5d9be1da408fe1e24999f853847d09e4fc2b981b
SHA512 280cf846b4099047e7d42fed79a3355e09ae7ae7fef3aea7b5c3e0aad28c9038d1f8375bd4f9384d8ccb9fc794f6b7ad377048859dbc3940f0da4d183f282573
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMao6:A3k03kHRJ2
TLSH
T1D225AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 954KB
SHA256 99fe70de5525001d420918eaa377cff8b847afd0f5192c528f88605e8e173ab5
MD5 5bac5b47ad344ab8a9d16c254705a746
SHA1 b151530338468e2302c7de8d338c9043e97c5253
SHA512 7eb7ff33dd570f88ce81615cbc7fc26173e57320ff99658822437766ba646dcabbe5f5fcea5cb7dfc64b6dca14c7f8819e0384943ca43fee82b2025c2da0a06c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMasN:A3k03kHRJH
TLSH
T10D25AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 954KB
SHA256 4b3c68a65fb19d7234126219f3e0094dd52af397e2d44be76296e29deb6a8e8d
MD5 75173105d046509b43e72d5e2de0ccd9
SHA1 4a82ffbb32c9db067fa10edf3f90e9a79ecbe6d1
SHA512 07dfa109724e0534e5e14b3254e371dd5dcc86e1008d9b8c28f7562e01f9e4d2cfac1d03caa3618319deeae1d30690e9189ed900bc7e138bb8177a4bc509373c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaif:A3k03kHRJj
TLSH
T1E325AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 954KB
SHA256 ccde49305c2d293f3817174ab23a0055352b654b62f20aef4e2c88811fa97a8d
MD5 7fd6be3103829d2e3fb58648ce582bbc
SHA1 8684c7a14117709a025be12c0bbd063d450afb7c
SHA512 c1f8b194e95b6534387c331621a08fb1a87eeb02176645c93c2bdbb25bdf03feddad775d193b12104f7a01b5af3ef5d08da09694e26ba321a36c9e6be07f142e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMa8o:A3k03kHRJS
TLSH
T19E25AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 954KB
SHA256 e21dcbf084deac7e878dc910f3cc4f5b0e8857f8b72674f4a1363045afe3a565
MD5 2bc1349796de9742f157e04752dbdabf
SHA1 5347362c70ac502554d29010b7821f90ab319ce6
SHA512 c30ed6f7d2db2bdb89c31bb9894c35f46d4dfbc206a2241ce5ee40a81e0ab09a20ae7e64c84e909d9b9479c6db20cf084dbabbd5636f50827e9d1b3f737db38b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMacu:A3k03kHRJ8
TLSH
T16725AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 954KB
SHA256 4fa27222a9cef9f67161712159c93eb051558ab1e984f33ce391c37fd2cb14a7
MD5 666183e980ec7521c17450d2af790c4f
SHA1 e1389bcdc16db2deea98884a9307ad54ceee4167
SHA512 c3b53c29e1e0f35adb994679ef8d81e012749a3f1be9677a826261373374913da548ea29ed01521223d861744a2d590b8d063353e34de5bb94b84bd53a7bb45a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMag9:A3k03kHRJh
TLSH
T10325AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 954KB
SHA256 a6556a97426645802024a4c7d010ac3f2bbd264d82a5416a464351f40024766a
MD5 7d3cfa8dcf64b6429112dff042b498c0
SHA1 421cc472942bccabbe8b22cf08a179805959e550
SHA512 4dfe096ed5ed2399755301fabfc664f1fac92437a0bba8571399f2b1d44a31c2826026ad8b8f5b7c72b2ae0225915b8bee1c93560edb81863374c47d8e6139a3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaoc:A3k03kHRJ0
TLSH
T10C25AF13EB9500E5E10AC1749AE64A23EB757C56176097DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 954KB
SHA256 f528687c7b057286c78510d832c12c4f9a35244c3964fb25bd6cec4228c0ff69
MD5 f5d4a72853282a3bcb47d5de1f354d51
SHA1 fb95771ce5ff6912c746b162b08edbaa23f94492
SHA512 098dc734151680701a73e5ce23c3e7bb2a8469367971c1155f5b155c78c2a6fabce8fc9155dc54c20a4644b7ac4e07a4857f6364ae7df6ffb3f5e9c339770ecf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaBp:A3k03kHRJi
TLSH
T16925AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 954KB
SHA256 43dd8da4f59c8c6a51fa9492aad2366231423d0694d7a70b1ac56d50e244495b
MD5 9fa59dcc8095040a1ff7323df8e5b15b
SHA1 89355553ee1405fdd1b9d8fd01071277886d3f38
SHA512 7b5baa513878696b7bb6b371b35996fd0692620e9ec63eb54306ef778530e8b618b520d8bd93d4aa4598752de25bc1ae9dc2931c6a22eca291f3704acdd22cba
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaWN:A3k03kHRJF
TLSH
T11325AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 954KB
SHA256 9508df445a8518338f0d07a70d489417691b6e4db5fb666e844f736dfbc5ad6f
MD5 e26eb50a6a59c4d6cc89b7fb1448d8d0
SHA1 28e2d2efcf553739958dc2d7056838d7ab6787e8
SHA512 c2b4e77f8215fe551d26034f558521932f8a6c921f075a236ff0ce7849ffb2090cb2d5f32a87c6d8034f9b03b2764fd59ec07d68e2ee6d03ec4dd13361ebe37c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaaF:A3k03kHRJP
TLSH
T11425AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 954KB
SHA256 18062adb3d1edb0b1487169a5e3c406817bf23d626b715b68cd9a2b169149254
MD5 9506c51e712d2aaafdd6325060c3d641
SHA1 557cad518150dfaa4354d5ec8f895ed0b49ec94c
SHA512 bef99644ccda66c9220885b12e59498938538416d6e72bf9e3f26e4404103a974bbabb09a63b3615891b9de495029d2081465ca319755020a90598d709f57675
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMavC:A3k03kHRJD
TLSH
T1F725AF13EB9500E5D10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 954KB
SHA256 c23ca8f1f62419300447704117ab6a277feaba24f703b6619b553e09ac99bd7a
MD5 7500f1d9c248c905d85929c3db039a7f
SHA1 5e494d23e113adeac7e64952be625ae88c4b98fc
SHA512 8c794aabf7f0d3bd1233d5e90f4dd75d7f5cc2349f317e2fab62b25cee2f694dbbdc26fba5826a5bff6358f57c21799bf2c477f0bce97d9e2a438d1d8ab9cada
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaQw:A3k03kHRJG
TLSH
T1AA25AE13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 954KB
SHA256 6edd5582a883d6a175fb765b7f6cf3518af367b3cc45c0e5f0d56b9d28c97370
MD5 59b9d93aaeacbe357960a342719ee99d
SHA1 0d5d1fa35ac40412942c8ddf738fc066669bacfe
SHA512 f69f8688c288f7e0480e8847458dc240367183f0c15c587d6c38358db8bcb2f29f0f1a65a493b61dd210c4f4ff78c8de970b4c249b1bcc9010939bb71000ae64
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMavT:A3k03kHRJG
TLSH
T1EA25AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 954KB
SHA256 71e4986c58cc97626cbb3b711ea929a9266d6789d36e0efb1d12d9678cf0f6bb
MD5 cbb46bba4550d0f883f078087ee4aa91
SHA1 c0d61b9510b5d8af1367077784311111edafe96f
SHA512 f86ff67a1ed54f001963a7806cd31d6caabfbdc5723f221a156713d70635b600c972271d0a39eb37fa2dcc03c53a8ab15870be038ef80afeba05ab9eff550267
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMapu:A3k03kHRJh
TLSH
T1DA25AE13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 954KB
SHA256 4282d080da4804af19f2c2d575dff5e5ca1ad35e40db7cca3834ae430ffb5a7a
MD5 2bb018d13148d9fb23f1d8ec45c64b63
SHA1 550df7f2742bf129f490938e949c86afd7403b24
SHA512 802693ddd304f51c8448169109bbab9c23eedef561318265344eff35d74d5ed77e979cc4f32104ab9afc1e20f57b47dfbcc248b1b6e122fc0ef0aed33a83f83b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMahb:A3k03kHRJA
TLSH
T1C925AF13EB9500E9E10AC1749AE64A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 954KB
SHA256 064ae49ad2f74f4d7f1721b67cc824ccaedb082e2dde2c7d9d2574264976abd5
MD5 2041031c1fa7828899ab91fad4844faf
SHA1 6d4fede98d440a9f68020d7275c405b476f4cedf
SHA512 facc41471d4256fc5fb5e700525e1cf5789556411a3be0628bd539fc5fc3b319e9f948c95b06f5cdfdd1405137e66eb13a82dc8158c4b37105c2a763e09547b6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMapf:A3k03kHRJw
TLSH
T12825AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 954KB
SHA256 1aa810c4cf55caa1c4ae7a91d0b184aeb8dddc8653280ad7fd56fb8e9f6964d8
MD5 44a08b1351c07c2dc5b0cda706d54589
SHA1 52ac38856edfc0f702d38862d5dfb16e650100db
SHA512 cc79d620b1874cb135413619abe3797a196845459c54fce7bf2dfe4bdcc9af8037af86932e068c02a5b08ddf23a64c25a2acd00dee56c0391d123161a61ecfb2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaSK:A3k03kHRJQ
TLSH
T15D25AF13EB9504E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 954KB
SHA256 b999e885e97ba04a13497acd81a09c45ee562881efa1ee8f724a808c15263b54
MD5 d9b5dae341891961c7df1fbcb841b10c
SHA1 ee835ec43af348c4d8eb6c2fc79d71c691181cc3
SHA512 79d5cf406d5dc40b8e9364ad3bbcd9acad5c896df6ce56a598b4ea497e1cb2bc5e37bf8c5639a8aefc343d9fefef27f2636aabc7c103ee03aed9e620f26e17b3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMa3k:A3k03kHRJ5
TLSH
T12825AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 954KB
SHA256 f8c668aacc83ac2c3ff86b9cd8a62aac0b99e4e8701e58520f223b8c05abb162
MD5 f059f1356acaebe41699fef0c5aa35cf
SHA1 b0fd65acc69f5547af6bf1c6b3a63405821898ce
SHA512 0671078b6d7ea13ae263b4d968872017e54a7df923618e4d9b02349604e7257a268af822a0c1f79a58056f4d22c6de09c940d0f16f7061bee2a275572450861b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaA0:A3k03kHRJM
TLSH
T16025AE13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 954KB
SHA256 9dfdb22f5f77b677f9e3c4d8df99e52bf4902537baf60f3e0fad106988c0004f
MD5 84fb85d637beaf695a0f6b8e2f862de3
SHA1 15ed13638ae09630a39b097ef7c01d2915f0ba00
SHA512 0744ece87c295b25006fe8e597794d99a152278c2ca4a9a29aa20a47a16207be574512ed428caa0a23ebf2fe37af2aeca1f1a23218afe137c0aa56604d2cd792
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMabg:A3k03kHRJx
TLSH
T1B925AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 954KB
SHA256 ea317fe2006535112251a75eb16edcbc845d6b0867d539aaf79063c5bb94d732
MD5 ede90dda0b551ce0db67f181f760991d
SHA1 a346ce6fec3fb63460d515001102e114fbd809a5
SHA512 2a8d00c0429ebf2de87eb9e3fd050aedfc128dd8a5720c1baee50b5d9d7862d4842f6dac6e153ce52735816d69fc7bcec629acd2cd1c7f8aaca55a23daaf5bb7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaWr:A3k03kHRJb
TLSH
T19A25AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 954KB
SHA256 88ac80d7cfc451595913f2cde33bbf53d9380f7c40b68acb0b68accda9cdc11e
MD5 addc1addfaf8c293366600191ce72f2a
SHA1 ed1c255737558c44ffe135f0492b6195e877638a
SHA512 b1d0cd2762a01e8d4ac470b97d2cd8a9eb386588d8fbc5bc3108249183b93d1488d0db9f9c2b4340e10a1ef3d5d41dc478d47cc6af6f96d266c7b5cd7062c45b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMa8n:A3k03kHRJt
TLSH
T1F325AE13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 954KB
SHA256 09686b2c11dfa18cb6f6e70e6d58e3f370f066834b8791a503dc513232404f76
MD5 544f210749f0772bda157ab965708f6e
SHA1 1b9661a85f561f4867ad46d0b97e3068b80c4637
SHA512 72dbdf66582ce0a1992da89ee0e654dc64705df23afbfb8a90d81450559fdb8639600279824f5649d3b280e09a821156a17847801be9cbd65c0fb1b641cb08d6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMa6x:A3k03kHRJT
TLSH
T13D25AE13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 954KB
SHA256 408b947411b47d4246df95d552995418757f4b0fa8e12ff8add2df8c6237eedb
MD5 cf737f299c7444996db6f59dbcbc905b
SHA1 b9004dc0b9c6af0f74f0a216c4fec47637a0ca3e
SHA512 db0ba70bfec94a5a5a9fb750202cf173e44b94d9167a554b971e34d8d463208af40ec82bc59e86cb4a863f56a0814ca1c66565704d63dd12514691faffb27b50
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMa8A:A3k03kHRJs
TLSH
T11E25AE13EB9504E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 954KB
SHA256 a7b53d829e3bcde8b2060c5672f83cd4be8dcfcf02742d3ed3d45771d626c80c
MD5 cd65b887174797971761a08fe6ed0e28
SHA1 ac0c629a914e7b7e934cd2dae8550896eca090d5
SHA512 9aa4e1e91ac3b1e428ac9d5240b8d6f71b00879ff625ded7cc00a5557e587ad2057ba808a985d8d3669e6eef02aafeec2f79bf8f572d860f9bde0b1076d21667
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMal9Q:A3k03kHRJN
TLSH
T1C625AF13EB9504E9E10AC1749AE64A23EB757C56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 954KB
SHA256 c132ea999bbbabef18a75a1a5a311670f24623f2ceb4ef645a1bd3a5b1059cd8
MD5 612c2a7e309c756426a774c566e4c76d
SHA1 5fbd04b01de3879dacfa5c38fd56797dc6154cd6
SHA512 9b7fd19167d7b8d790211cd9a18694b7a05ea92b6bb96c2da03b9e3e8ae45cad0b7fcd5e9d4c75a6bfa70b2c6707b97ebe649bfc83df517f2cf90923b4eede92
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaQ4:A3k03kHRJS
TLSH
T15625AE13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 954KB
SHA256 fb7a24699e18ff85b704d13cb3562e7c706beddda47d2a7c5f44f52f5c7a4ba2
MD5 9938c54f9e1e08f056375677a30ee48d
SHA1 668db196dc7d26cda5819443ca483e437c1e2432
SHA512 945c29f1d122bd8aa9e771bc2305846e6845434204b07615d3fd2594ff9676cb3edb8a5e8112e9b428dc03de2cbeb0635bf0b6ff23b1eb8e85776425b801c8b7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaTu:A3k03kHRJD
TLSH
T12525AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 954KB
SHA256 0736d0a2959010b2bc9af5548305647966f4719018a3a32369442ea85e7d1af2
MD5 632a6e2a10dba6836d4c32511d051644
SHA1 1c212db4810ff4de6b06733890602070bdb897e1
SHA512 ee53e66268c3f8028a872760abbe1db95d8f89ab0c1c6a32105dcd5bc5087197227e2da55734a1a89ae59741ee026160ed4996cbfa3c94093fd723ac4c1d5d4d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaOj:A3k03kHRJt
TLSH
T13025AE13EB9500E9E10AC1749AE64A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 954KB
SHA256 ca8d6b3d0bcec78633295ed49676a918b30690b2ea19152b5bc0a2a710a719df
MD5 e46db96be58b28d7ea5bc18d5695bf56
SHA1 df7c87645479ade2d0e0e7e3d2e7a889a262ef02
SHA512 91726b3268441284915a9aa7a03cbd518cf93715dd965e2253428e5663b72b67e6b0e1bba226fa95b3da7e0bc9d96a90d37a0f9682ad420ba962f784cb6b4a9b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMa7g:A3k03kHRJx
TLSH
T1F825AF13EB9500E9E10AC1749AE64A23EB757C56176097DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 954KB
SHA256 29f42588928e972acaa10ca08381e6aeece7bac500b195ee1e69ec1773e173e8
MD5 b14caa954ed9e7663b27dc531b749a30
SHA1 08f64dbfb3e44e038c2cc21c1f2c8f6d20a4173e
SHA512 3f1729627debd98c4589b966fe27ac6797f3394704254cf7d149b9f7a1767d2285dce8c090d0a0d3f3b33a34fd173116964f37b5b085659ec41d7635c4a19c76
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMamI:A3k03kHRJg
TLSH
T12225AF13EB9504E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 954KB
SHA256 7b291142326fa7d3ebbf55e4d1a04aeb3021c18027c66ffbcb244c25e00de1f2
MD5 03966d97f53da61bd98a290f66f23547
SHA1 459e779c663f4f029bfb2132dbae87e3c2a576f3
SHA512 cf554910ae39bea08edb903f44f136c657a910c9bd7d48ac2bb62d6d87cfdad860785a060b4edce1af2865779f9c7206ff1721c2be9441535ebe13fed38d87b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaUo:A3k03kHRJC
TLSH
T15325AF13EB9500E9E10AC1749AE64A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 954KB
SHA256 087a9971970b463eab0f208fac0e60c72fbec48547d3dec65c1e0cd306e3ab71
MD5 d32ac778a63cba3c3a4136f65bf6cf21
SHA1 7f1cecaf6d1f3cbabedb8d25aaedfc88734d4ddd
SHA512 3fef79f8aec106793ccecef2d30fe8279e7977d1ebb98279e9e51f8b1fe18a64ea5f8707552db0c37a7d39a82f3174ac167cb0f5fc6048d3f6c7a9a0bdac4c2b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMa3+:A3k03kHRJn
TLSH
T1D925AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 954KB
SHA256 584addc80e977f5677b6f8d640722c7ae44d52c1ae6f38705641ce775193fead
MD5 5d1030983c76d361b44a17f3af148c78
SHA1 8da03c51117e9200f4b9f90e896978c3d226912d
SHA512 63a78539aec39e6d67f83bb0b427ddb7db601f0f18315019d2c43fd0e07e3de6ad79bc04a66399309514633f24a4866b8d7cb3d3d2ed981bee65ddac3b4e5c9e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaNQ:A3k03kHRJT
TLSH
T15625AE13EB9504E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 954KB
SHA256 5a839459b8fc3c1d0faca3b1d365742fb63b5f453655086ce96d83cbe97daf0e
MD5 5d22db6fd9dc7c240961e802a450f4f6
SHA1 3704fb3fd4fcbdcaaa04936b1e551b9d997bfb4b
SHA512 5c58e5cd77a574995719b7cc7e73bc830ee85ac4ee5c9a7bf10ec4f8aedcc45c7c46b870c1346958b6e01bb4c9d05a8fd536e37d7bc6d1229d3f3b769366182f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaCX:A3k03kHRJH
TLSH
T1CB25AF13EB9504E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 954KB
SHA256 20159e904243faa6800e677f8493824249ef6d6ca83087a0f994f2668b333695
MD5 ae0a9de8ddf660b6c9e919ea53a87bb2
SHA1 70ddb61d2ef7d4e0182b780a2dbf354e86a335e9
SHA512 340da8c0a8f1c0e5d69f0f1a713c3fb0d1fd228e056bcb5db3f2ab527cab3dc39e2492ba1e25d0845f239ad47ea559cb638a6fb5598fd32c4b76d13c3ad0d649
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMakL:A3k03kHRJp
TLSH
T1BB25AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 954KB
SHA256 bb8af8ec1f4bd43f0dece73cafb7875cfa3844f2638bdb441ef71a06dafe5841
MD5 35948ca6b9cdd562217f4cca338d4a72
SHA1 0b88de1b19ec906d1e2cd4ea37adff3604dad4ac
SHA512 c310526d2ea3b5b49953f2c966340c5ab45d022b77f6e397eb8680422a337024ff1d742fe69ccbe068b81bfb876714614d8f94bf42a1f61f36f258d675d039c4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMaAM:A3k03kHRJQ
TLSH
T14F25AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 954KB
SHA256 d3a34b8643ce497ff929f2cf25d3086ea969508c620a8924658c12c6aed0dfc1
MD5 eb4b014f40aa46d9e1f24f76b3f9ee4a
SHA1 75dfbb2e21a8927d41ec2958234165525f9ee4aa
SHA512 091ce1d04fd8722555b96d7744e28bfb726d95846293529fbeadb4ad22b2d2e594d88ccc5a0c2aa762a26e18af569750cdd1fd464e88b57663ec0b9d7f842aff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZMahh:A3k03kHRJC
TLSH
T1A325AE13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3724-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3724-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5716-59-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads