bb86b6d4ca51bc3fad36d0c49d03f9b309a1f66654641b1ac9b6e37ce434c096

Analysis

max time kernel
104s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 940KB
Sample260805-dvbwdsvtbt
SHA256 bb86b6d4ca51bc3fad36d0c49d03f9b309a1f66654641b1ac9b6e37ce434c096
MD5 1851e8f79b1d0b3529439babfa20d587
SHA1 efd02099f2ecbb6b3dc76329c8213c9573a630e0
SHA512 1765f9fdd7434c5f2118812af935fda584f8cad51027ab4217d1cb2e2f4c2cc9ee9a100ccfdb1f897c3500d11188378fdbde3302ec564d7d357234a333b2535b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11ep:A3k03kHRJARJs
TLSH
T112259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 39 IoCs

resource	yara_rule
behavioral2/memory/4876-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c587-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4876-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1636-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-254.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-308.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-472.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-588.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-717.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-981.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1397.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 36 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c587-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-41.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-254.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-308.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-472.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-497.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-588.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-625.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-717.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-743.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-924.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-981.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1043.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1062.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1123.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1341.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1366.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1397.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1636	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4876	2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1636	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_1851e8f79b1d0b3529439babfa20d587_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4876

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 940KB
SHA256 bb86b6d4ca51bc3fad36d0c49d03f9b309a1f66654641b1ac9b6e37ce434c096
MD5 1851e8f79b1d0b3529439babfa20d587
SHA1 efd02099f2ecbb6b3dc76329c8213c9573a630e0
SHA512 1765f9fdd7434c5f2118812af935fda584f8cad51027ab4217d1cb2e2f4c2cc9ee9a100ccfdb1f897c3500d11188378fdbde3302ec564d7d357234a333b2535b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11ep:A3k03kHRJARJs
TLSH
T112259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 8c6db37fbe61296140fd46ea499a301dc239fe0c42cec1acc712c75c87921f32
MD5 344f219c094fa43ca3cf90b1219dbba8
SHA1 2e0c2c145d2c7031337d9c896345d37672467a96
SHA512 6015dd8b5bd3f93d380a5e79c7bc2ac3cbd859f7ee6b23d48f449bef5e3950e7cbf99956d0183fed8ad01095dca44fa94f04891b144c620eedaa86bf5af591e5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11eV0Le5ji0hmxNrM:A3k03kHRJARJ0Pji0Aj
TLSH
T102657B17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 0b75495eb9ce0b367928e4bf0816773f45bb9ee32dfc5dcc266775860894f9b5
MD5 48077c3377698018a073e8c70b0dc0ed
SHA1 f8860fef80130e0270d92f85c552131fbbc70ed5
SHA512 bb8749a898ba57968709b7e2ffd9645ec68bd0b8842be8c54b79d20b8405eeab74e3dab6b83a5ac042fbe1e394006fa3980805fb3b1b964242a9dedd81cba0f9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11e3a:A3k03kHRJARJ
TLSH
T1C0259C03E79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 084d64efd6ca78098b9ee0fb42f73182c51b04bb77226ae86a1f7ac3df14eb99
MD5 cef4330eb21c6f9b2e9e1b5567fa2ab0
SHA1 7ae523ae82ed64ab92152b4e9e35f131e6bba092
SHA512 92e07edef5e30f31988418feea14ca4088ccd02a9cda2ac9d20838dff2151a4da01a91d71e5cbd323cbd68f74864a41508667c6e2ee3388135a7edacc0723779
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11e26:A3k03kHRJARJi
TLSH
T148259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 54904c4b2e249d42814f7ab6f9edac2821be4a16da4e72069bca3f6adfb09e9a
MD5 cb6300aad400119c9ad12c9cbebc21ac
SHA1 f0953436da75b0bbdd5d66754f9f4c039a632513
SHA512 e116524bf4c2a3a24e8c1cd97fe45b5379392ea6d2c9ccaac9de2675ae3c61b7ffa12d6cfe2791e54f47cb9cbe43f74b5f6b6aab4c3cdccff3b40fe8182616e4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11e29:A3k03kHRJARJl
TLSH
T16F259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 752cd6fb1411ec0a61cdbe685f0a13ac4a8e8b914d2d62c1120c9dd6e9f81849
MD5 b92d52ffd790590fe898125fa0518dc2
SHA1 97e5baaec49e93516e17a7070c879dceb0d20660
SHA512 df608533073bab1906d07ff3d20dbb86cce9e578b9edacaa1b82d78b72ae8caf7de9b81d6c8af9869eb2a1a6b2e4b6e2dd9dbd412fde70496388f2d065702be0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11e2c:A3k03kHRJARJg
TLSH
T166259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 d02143946cfdbbc6ddcc9bfbfcdd9855361328047e256af007659f572ca70e8c
MD5 a7ec73efe66d7c44c275eec9312961eb
SHA1 08e4bdad5b835d4e0d6aed91c9e63169ba0eb5ca
SHA512 af3f0e68e2ea8a0403bed3589e81d42f573cf891a0a848e57ccaa33bada06bc4065d6834c2478f4d9e8937e2025fc05d2bed1a3e896cdfdacf4259d9540eda2c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11evp:A3k03kHRJARJ2
TLSH
T192259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 01734200182aa90b22b06770ac205de44cca4ac904959b210ac444b06cbef1e0
MD5 f6c2c3270e1eea426219579336a20339
SHA1 14993497c0db76576c6fd0cd7f2adca841274967
SHA512 d714b3152dbf7ef24eedcf821ead5420384ced382c42dcd28c5609ce49798c4f61f9806aac082fec88aab3910951e5f539a5bac32c7138565a9240581eee000c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11eQN:A3k03kHRJARJ5
TLSH
T1C4259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 6eaec88cbfa7c195aeae8b7828a8cf157af802fa02cbb1d01d87a77a69d72c47
MD5 2fc748e64e3a035e4503d98a1d0537e3
SHA1 3f86af336e7eb196ade633a5ed5420c5ce204f0b
SHA512 57eabbf316fa9835ee2d4c6b3ebaf7515a0e291bd3093e6bfa926b1a43d6acca720c5cb94cc5fb33061b90ac37ad9a0096d216817ce2972d519997e54ef9e11e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11eYF:A3k03kHRJARJr
TLSH
T182259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 dfaabe1f00430f3cab3acb765bea376632fb793f1f0872bffa5da2627fa44da5
MD5 546be7d2ccfac844dfb1fdba4e3ff767
SHA1 d3e4fe58d634b69bba55c6c74b1912e7f31030b7
SHA512 8f4498b2f328c61546909f08a8d8c6a07d9d886a21eede81b8dddf8e4a6b3e186d02954aea6b2cab990823633e0237b4b074d16347da79037537b19349742119
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11eNC:A3k03kHRJARJH
TLSH
T1AA259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 20ba55ebb41bef701f0c024f57db7ce85b9d346833a47f1013efee2621905b29
MD5 080b71d76ef3ae9e925ab62a754759e6
SHA1 b0bb01491ccc3476c6dd6a3f005ba629f6895de7
SHA512 bee085ac4a5d16577f26d532706c4c196c823f4d0cd9645f055e14f487ec12a68c0b6d83751f5b7a3fbc35470f4750aff9c055942ebe3ee5b2a9a97d06c0d925
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11e2w:A3k03kHRJARJi
TLSH
T19B259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 88fc1c4a65994b4656ef0e66ad0814943d1082c5d11c477411c128610fb3cc85
MD5 dd30e091ea98dbadd148f3feff69d454
SHA1 5f81cbbd6fbe3d59a87be45bcc36c09c6d0a55d4
SHA512 14e17c59aa65b099856fe4172302dc1cfbe0e2c3f95fda4e724324ed3531f95cf16cd13a13bf7537d09a21628d3801f619fe064052615c7fb6b57766aef62a3b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11elT:A3k03kHRJARJS
TLSH
T10E259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 b928e7f2327a15ca8c4c59147a84def73481e1516d80e0081adc0e704b5e294b
MD5 32ca24badc43a99d3b623c9131bc4883
SHA1 3996de15890e256597a7bcae66d6276eaaac9ae5
SHA512 666247a03a6b492f2705eebb7056fa2ca7c8b5a9938388edc05e03be3d23b8a44193ac123b22b723c4891fea7b3f7929be8e9929a736c206b834f4ddedcaffcf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11e7u:A3k03kHRJARJd
TLSH
T145259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 7f21406ad4cb30207c58a790f35f119fb7ab52fddd84ccd748805a089b4b84e1
MD5 1005aecce64887ee23f50c8b5bffcb27
SHA1 d9d0f10a297fa5f9a374526cec8508a2fd8fe8e2
SHA512 e8159b5d88794e4799f28876ad107c6dcd4c2d1290f5cc31010d63cb19b9d915f8a4ba098cceee6b4e74cd859d4c6b4cd3c1fc07c1b1b37f1ef0eb87091fc8f6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11efb:A3k03kHRJARJs
TLSH
T145259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 e1a496ba9c285d87243451283d59fecee174145d5ba91c164c85c4878a6d5654
MD5 5f2070e417781cdda95a4519748da15e
SHA1 2e01e60aa8ce6c87a07910ec7e673e0c740964c9
SHA512 0945f92ed562776f8bdbed3b91ddb1e81c43628ec2b3df7df24b2339e410498e315df89b3c95bebbc77c74f0d48f2d457cf09586c75a4ecce0f101c2df95dcdf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11ebf:A3k03kHRJARJs
TLSH
T1BE259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 11c136390d7e1ee67e99dac0e1abf06c5e8ce86481a5abbf637a6084f986440d
MD5 b885fe15a7388c7ce9155ad2bcea18b4
SHA1 ecd131e40b7541a88a657cb5d757c0000bc3974b
SHA512 a2887a6d559397f4d68b0bfd282325c2199710c67f83299f16bdfdead3b84672b1757c67a703461c9df88d4cff493076b55e7ec9945106f92f84ff6211f0bc4f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11e0K:A3k03kHRJARJc
TLSH
T105259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 61ae38e8a9f1044f3ca71d9a7157517647071e6a9128a1d2d1277bd21210ae5c
MD5 cf587278373e1d46038091b1ac77d950
SHA1 4908a6674c6180267ad11f104fb629bed20b4905
SHA512 bba5cc82ad79be9e9489869838e0d80c05673db564d49a2476c3fcdee56ee72e4e755d09e47572ea3c385fc5e8e6cb64310f01c495988f714406841d4fe41f47
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11epk:A3k03kHRJARJl
TLSH
T10F259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 81789ca8dc20a58aca07507007b93887b7612681bf1d9859ca680ea0dc6b58de
MD5 a76198e76f3404990061b306443722ec
SHA1 4ed525770b9ce4c2e0ec6d61c4a1f1fc1a6c7b96
SHA512 cf82b57bb464b174ad53887c9f5761b2d2dcbbd55b861d98b33ff21a17b28e0ef8abc1b60f7ac568a0ed3a75b28da82b5c4bf4341f9aaf9fbfd942be9051d214
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11eG0:A3k03kHRJARJY
TLSH
T1A9259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 86a34a91c47543dfb6076b8f5b5ee9f62637b04604e6333db5c12aa0defef543
MD5 05f5a9f75eab2e095a2e25103afbac4d
SHA1 69a78de40a142f771814fa0711f67461ec494e68
SHA512 bc0bb242a4ccdf084a67460a9eaabdd71af3d51bca2d07d2be8fab5d6b0645731e308b86892ebd54c7a2ea1de4839538a3611bd62c93dc867ada0d8a7322fee4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11eVg:A3k03kHRJARJ9
TLSH
T1B4259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 e23a4e54ee899afa28ce1246a9f2284952c6bcc7164d7aaff9b6083346ca5f69
MD5 426a8801a4584d3cb14caa4d7eb4f0d3
SHA1 4563da8fe428505260d4667258671a85401ba13e
SHA512 251253adae91a8c9e437bd4de0f0af9f88bc750c3adcf36a5ea6a9ebfa3de7326aeb37fa63546c34606cf9c0d9272bbf3263fa87c3cecb203b4c48b9faae5223
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11ekr:A3k03kHRJARJ/
TLSH
T1B4259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 4e28a163e58a320bd76e99e27c6c7954a392a72c04ea3de2c4b682daf4733b75
MD5 573c10b6c349a97eb95f355274056dc1
SHA1 c4f5201a6671ef7065b3f4dab7b6a5a8cc0de985
SHA512 f5593732818ee71a14dfd4cada1b4fd244653478fd2508c4ab6097110469a546ef026c098cb1fb8cad8293ee5bf4cb7437ec13a6a0feb93c437fbeb37c3776a1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11e6n:A3k03kHRJARJ5
TLSH
T171259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 4cc204b58a1edd95fb87e423ce4a231045cf00a06bdcf53b2b2712f67266e718
MD5 6e6f921a18e53b9e6d5990d28842a2c9
SHA1 5e28d29db4e9a7dd16f8e7a8a05911cd7d13f4ad
SHA512 4475a982a594792c394f41c4def78ccc842cdeb91137195066dadcc1f42218a09ad94083302928ef96bc989e72cedae1ba6b1c632f01f1c2c331911ed43f3d80
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11eQx:A3k03kHRJARJX
TLSH
T172259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 99ff614cd47422bf76bd5fffc5cdb29e6c334e0cfbc9dd22ffd1248e09147e2f
MD5 6bbf047ac04a8051354c5dda19eb0db8
SHA1 ce9b8eb873b4b7c03cbe8f50fdd9dc78e8880229
SHA512 32815afa4d5c36e7d8d27713e042937f293b6b18e1812b1bffbd35322871b82ac43b119db0abfd860c6123a73f0d30fab8382177c577ff1da2674dd54bace638
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11eSA:A3k03kHRJARJY
TLSH
T105259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 59c238727c09123e87a92ce19ef14b7d4881a254d5a428c57f34eae19c5583fb
MD5 a18e3c6a01c990edfe5072ef92b45d44
SHA1 ce87ebf7ee5240d51d5f6cb3a09cf41df5453bbc
SHA512 f4027a3aa57aa6cae73191da563bf620ff7c7dbe8244dda45b330cd00813d2bc636220bf2a52f5c026ce3ba7e216045e3c14504a6a83924294ecb495c9762c80
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11er9Q:A3k03kHRJARJB
TLSH
T187259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 2f3aa5fd7946be88180f8a9e2df347dc758e69d18356f4564cdc9c2ff3113841
MD5 7c571b443726861dd33aa26cf7330ece
SHA1 4026d0cdbe145bcdfefbbf458e18fa8c6bc2be28
SHA512 e34a3c85c10d9feeb2add774c1e97d2ebc95294f80fce1337633bdd636fed6089b855d13a32a6da8a72b4e82144cd619fb08713f36a10b3d69f9a29a4503c6cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11ea4:A3k03kHRJARJm
TLSH
T117259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 e76dd4b9423b9bf83d4aac3b732b85cfb9a428f495b1b94e2606ae3a855a922c
MD5 4c415cdbf1e925fbd8acae3f4c8ccde8
SHA1 cc120ff8956d1932a72870c02b7abde73fef5063
SHA512 9eae785a0338ce06916fbd8e4700d824bdf7437fb697fb333aad33e636d40b146cdf6aef960ced3401501f957b960488b5dbe38aec9b4ec4d74f40c4a7c156d1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11eBu:A3k03kHRJARJ3
TLSH
T139259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 f5a4fd1c5e0b3fe0b9da465d8256dcaf0fe0b2b024c268d8beaee05738045927
MD5 0413390121c8095b98217b2619a95912
SHA1 44d4d7369777c63521a1e6ae8288063ff24c35c5
SHA512 d31030737233a83632c1b76d2d7480220d7113d8cf5b5eedbba6ab0735be3adf8b682202b69e1ac55ed248765786a0003e7487a0d59196dc3e88854e999d74ee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11e0j:A3k03kHRJARJ5
TLSH
T165259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 acb0899535474cc949ef28ced05c9d47dc7beef38f68e43fd01767fb8ea81a1d
MD5 6ce4670969b048ac9daec8beafc71b82
SHA1 3b10ed4693079d41d7c47a59468ca209ccf69e56
SHA512 8f64b25870cf031a184b8f240efb5241f84e388d06d78b33062a5390d02916ee8450534f7d56296bb485a62b458181382d7421d3f9b5bb40b42117fff32d25cd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11e1g:A3k03kHRJARJN
TLSH
T1AB259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 7ab086a8b2798b048304c571dac069dddfb15ec2ff953a39e56d31626c24f952
MD5 1f63396cd0b4f8fe6a3def4b5611660f
SHA1 48d3cf6c36051e047208dc5f07de052dfeb5867d
SHA512 9646fd35d39756513c537818393836d0cf3e15b13dc309adfacb2da50695b39b47415b6ce74fd7a14c67f16539bebfedcc7dd893108de89204bdcf50d21890b8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11e0I:A3k03kHRJARJE
TLSH
T1D1259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 3a6b321a7d442247d40642a09c663a187c2c4e69a9ec9342ea3da27de7bb4c8c
MD5 ef4165b9c89dc7e3b97039817d026343
SHA1 cc30390c5d284b2ffbe4757cd94965d751ac7e52
SHA512 2cfd4e71db78ce7e61ac02d53a37bbd01e8b3215204c7ea3ee02938e02f7aa02b02f7d030370e2916bdb833f9bc00ab1991110b9062925837e2713506500a3e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11emo:A3k03kHRJARJ2
TLSH
T137259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 0c84a4b470916a6a24e9052d3b27cafecf38d20506f325653b4b74eb86eed1e9
MD5 5a2e6cb1e018377287dbf79ac514cc2f
SHA1 12e0d41660a75911ebd1b1938a3188d7616725f5
SHA512 cead9a68d66a39c1321ad7ba6024ffcc61afc36d8060cc0fdf5809fc859ccb5cd586b102bb3457d5bf962291af823ef8c36a3f8000d5fd60312f01b99b51d62d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11eN+:A3k03kHRJARJj
TLSH
T107259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 52a6efb14d8837e679fbfc145b3b0f22d2a29f0d963f31385ac3981588de2f21
MD5 fc969423b43b4eb5422f0f0349c8fff2
SHA1 65b83d31a6da352c13869a6b884a9a1a2c783688
SHA512 3a1c4a4444dc8781968bbda19610d0932e667e43e111d8d586046df255fcd238076382ac4fc9aba93a5a41a9424eac24bfc634a82afca82da239db2c5f405d26
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11e7Q:A3k03kHRJARJ3
TLSH
T1F9259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 fe75b2c62cf014520847ec09389db92c08dbd61e0dd735fb8b8c2a6c8f98541a
MD5 ba177d885d9b2dd3e763ce869a230816
SHA1 2a101df5108ad7495a07f25ed57c38199b43395b
SHA512 0f1dee6bb3c9ba9bd739dc27307665eecd879e561215c25f96e4ecdec0086b6789a33b7d80d5ac8d3e31fc4ae4bea905483d00077458b6ce1d0b79d64bfbb50b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11ewX:A3k03kHRJARJr
TLSH
T15C259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 a9c4bc0612eb47c580a9dd7358b45d8cc8c5c874300a969138e29efc19ba7cf5
MD5 ab29f981ce4174a07e606c913f7013b0
SHA1 f0ba5e8682b8abbc15a6ddc087f479e3e5f05516
SHA512 c0a3494cc19bd3e31277608404022db851aaa7015ff4fc800bb3fd13a68526e97d4345e8d59ffd180df19e8e53a058995e0c289cba208d637aed3e8ef28da179
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11eGL:A3k03kHRJARJl
TLSH
T18A259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 c7f23c7817dfac0cd0abd12db6610ae974a36c5622f484aa387b728c6f43f241
MD5 4f5b9c45c67d44e591f7e44c2ef6fe82
SHA1 ab564cd4ad369091dbdb506ce1817fbabde8b1e6
SHA512 ffd5178d1ec632f9bdbdc41cfbe7abb44504814c8643f21d3b0e5ad34ebb1bce923c3d270422c46c3035afdbefbf0c247b37edc5281f5d267785251649d8afc8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11eaM:A3k03kHRJARJc
TLSH
T1AD259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 5464d51030e9e63a1d6302a6c37f4fcf9e835751b28655034897b57adafd6fec
MD5 78d868e587123ace39e887064c5ff7dc
SHA1 b15c723767314a8bdc1a5eed07b0cc176c6a3337
SHA512 c97b968efed517d4be0883bccca13ba4fc8a2f3cbbe7d74f97fce8770a2d56b3829f6acd6bae2ecca509cbeda8833cea67e050eecbbb9847824850c3b1885845
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11eLh:A3k03kHRJARJW
TLSH
T1F5259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1636-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4876-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4876-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads