d9fabadf73967067cb95e97f232a0e0c21f5e119d01ed903e87523f0d689d027

Analysis

max time kernel
102s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 947KB
Sample260805-mtpkjaaa22
SHA256 d9fabadf73967067cb95e97f232a0e0c21f5e119d01ed903e87523f0d689d027
MD5 df7c78744619de00c2c8c505b366983b
SHA1 f1a7d16f83c730a5b661fd71437b9cf02780e388
SHA512 2602a5cd6cd73666186fd45d9da1fd4c2f00992135a4c542bb352c8d4c9b847dc1ec518d24c4f43f05831ef37e92fddd6bada9d950743d9f8128a5051a57a6f8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Zu:A3k03kHRJ5
TLSH
T1DF25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4120-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4be-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4120-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6124-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-686.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-899.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1099.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4be-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fe-41.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-224.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-491.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-576.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-686.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-736.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-899.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1099.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1136.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1167.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1366.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
6124	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4120	2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
6124	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_df7c78744619de00c2c8c505b366983b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4120

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 947KB
SHA256 d9fabadf73967067cb95e97f232a0e0c21f5e119d01ed903e87523f0d689d027
MD5 df7c78744619de00c2c8c505b366983b
SHA1 f1a7d16f83c730a5b661fd71437b9cf02780e388
SHA512 2602a5cd6cd73666186fd45d9da1fd4c2f00992135a4c542bb352c8d4c9b847dc1ec518d24c4f43f05831ef37e92fddd6bada9d950743d9f8128a5051a57a6f8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Zu:A3k03kHRJ5
TLSH
T1DF25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 deefaf04fabdf28dee12798089c8f391e59a7724724d7856c33e0274d3521efb
MD5 5cde13a2d4f602a8c2055bc0661d21cf
SHA1 9529f1e1ecf1587d63e9d47ee03551807fe212c4
SHA512 9f39f68ec6e0d7d1591bf0b4e5ce6a2a6a3b9546c2846fffbf02d1c46b3856028e430e70dd5ad18cd961bf98e3cefb23eab03f32c5e641ad3cb3a4e3ac1c6a5f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Ze0Le5ji0hmxNrM:A3k03kHRJlPji0Aj
TLSH
T140657C17F6A402B5D067C0B9C5D69A5AFA7138421B3086CF1399C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 962KB
SHA256 70720e39d8caea11cb2b11895e834f7dd1135b5f2c58d4548850462e461dff39
MD5 f83199e8a493b42334b179a976acbe44
SHA1 df857af433ccd07737ce3a0e14a37e1f0af06827
SHA512 e49731872bb84181605eb8c550877c66b723cd0c4817ed27836e318e01ce9a4f31b516eef1877c96b9664f3ca7a7e52e17ce82523aa8c1c5f2fc385194562f4f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZYa:A3k03kHRJ
TLSH
T19025AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 971KB
SHA256 86c1a8de4b88fba55bfc8cf8d6827d821f8eff8f66b0446988cacfb39336d6cc
MD5 4b237403c452be0f44122bd7d46573e8
SHA1 bfb54c9684086c84dcb155c482d11547fa36ad2b
SHA512 d93dcf199dce9375c600a6dd58276c1241f1d9be84a7606b9a573ff48e412585c85daca93eb8af11b34cea91e17f7faa46ea12064ca8d88045868c1717c983e4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Zx6:A3k03kHRJh
TLSH
T1F525AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 971KB
SHA256 4d6ebe9d350f9ab4f01bb90a60f8dd72b720561e5c4359cf4e509ccb540f850d
MD5 79e71b5db738b036a260ed1e0cc4ac50
SHA1 1a03eded55097590d1c6b7256e5ede075e8f7b34
SHA512 6c1c71f8c6eb69281609119700d1baa271593338593adcc67e2dd532d957e7caf283f9f7d8f605d7732d5a1806131d50de8c87986a600303bdc1c24c175eae11
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZvN:A3k03kHRJ4
TLSH
T1B725AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 971KB
SHA256 ea11b133f9b4aa21cca6e9a524f0f8da8559947500198063a47b02274221c0d2
MD5 15e61738d9dada72aac0961cf1d3eb49
SHA1 e254da2a1a5b0656704ea2fb53867d8756d647b0
SHA512 6ce3fcad876f6936dcd507146ff1a5b750b6fad546c2ab226aae99f33d0e564d78e8a846a4a74b95942cf3781a9ff4d55bc8ac02e2b881362400ab3fe1543d84
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZVf:A3k03kHRJw
TLSH
T14925AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 971KB
SHA256 5a801f62a6515e2c438724f27534986888f400b89976f348ab3f6598ba9cdf48
MD5 a91a04df8f5e1670f51df96c1eea4bb0
SHA1 7bc1f9712b19491158dd0f5bc58222b00f30432d
SHA512 28653d68ce942d1304b8649f5854dae8fec9ea04c55d10308ca38378699b5fd2ed2321bfcebe901a580ccc3310176cc56ff76365bee67f7cafd7ab0e97327e27
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZXo:A3k03kHRJ9
TLSH
T1F525AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 971KB
SHA256 1f93b2084e309aa56424dc22d2b741566c813ad12f8c28c6d478a84f215e63bf
MD5 b0bcc14ca369e779b295530ec8e11f12
SHA1 aade823f5b3b5ee84a4f374d77cac23b5d39c8ff
SHA512 8b9bfed048488938c0ef0328dad5901010041a3c7339ff3020ab867966138ee623a46d7672e950cfa02967f0c16ba7f02f77142e4bd8ebcc788e6dfb98fa8f6d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Zbu:A3k03kHRJP
TLSH
T17025AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 971KB
SHA256 31c569e526dceeef9d3556788675a361b4c5e080aaa2331872e9be95ed678b06
MD5 dcb1d345cb2756a6cdf53586cb26a438
SHA1 6c3494daf9376d080410daae8bdd5832dcc7a4f7
SHA512 d8d98d448246a1136b736f8c39a701db04658fbc79feaded0cf16eac41331b188f686146d236f758dc63289acec3075f49c2a7cc095246204e0f668380cd235b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZJ9:A3k03kHRJu
TLSH
T10D25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 971KB
SHA256 e3d9d4e7b1bdd9b35625d17f5228fe61dd8b127b0118ac2566200ddb582090bf
MD5 6e3efa824e000873071ec9699db1d97e
SHA1 d68d1fca12e51209acccbfd04fc4ed55805fb100
SHA512 3db21f293516925ad3aeb7ce84acfc3eabda73b8c5cee06e82b2c5e722e7b8d0b04ee0e8237523df0921126c9092c56d4981352727bec45787c5d9ccaf764d11
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Zlc:A3k03kHRJD
TLSH
T14225AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 971KB
SHA256 575cfec414eb5bb9b9f048d4a299b32e96dc2e0487b46d6c0070f1d215fd918f
MD5 3b57d4d4cdc7fb44ba6644a981411dc9
SHA1 85be2f548d0ed1edb28150a4bfb72cc3fa9bb0fd
SHA512 4d1eb9dbeea55f0a0f5273742c5f08d805a195fe826ba37c9aaab3a42f2ce20938f68849df0fb30683706b22ccb6f4cdb72d7cac0ec76f6158f588e1e61827a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Zep:A3k03kHRJB
TLSH
T1BE25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 971KB
SHA256 589d7c56b605a7b44e4f6e910a28968184f5d09e1987b32d1db290d3f286a102
MD5 cc43ae41994630bc6e37da2d622b75b6
SHA1 7ca2f83e5d2a91014238de9147abe153a771bbc5
SHA512 5f769eb81c637ebb3d4090d0faf30a42689484af2336171704a5569b095e73d60a3a5851f77b2a14c81ff7a597366ac815b6253920a2c94a9677ccf352fae91e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZRN:A3k03kHRJa
TLSH
T10125AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 971KB
SHA256 e1054f1baadc334fd9f9ab147f14e91aca256091bef1124fae8c94284d20d7cc
MD5 4ec00932ce57d585f7679ece7ed3ad23
SHA1 eb5329c7a3b8e5d1d52ea90b41ce764848fe7c4a
SHA512 b3c1524857e52e56da96c9e7f7cd6ae3bb050128299fa5d3ff727aa5ea3153a9cf515dd12ad608a242a6026940cea40817d1b9ea0ce5030757b0d10cff77a44c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZzF:A3k03kHRJg
TLSH
T19925AE13E79500E9D10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 971KB
SHA256 213f10684ec75c561faef6bef0b4a7611db6dc32a1aec8e29869cfe8c927754e
MD5 4766d1cb5b214528b0991fcdd8727737
SHA1 7c3619751b1907f3f09647c0be2651188090bc3e
SHA512 23ab7d2a71ff1733495f5f7ced55cfe0498fba21410b553e8f4e8f8e1dcbab57cd116269f779a5c8ee8772ea9787abd18d6b1bcc5a6dda62ede9ae6a838e4ec4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZcC:A3k03kHRJ0
TLSH
T16925AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 971KB
SHA256 689a8622cde6e02626f7c9c5663f9103543703f88144461a1f9b264107cc514f
MD5 9de4927b74d3067d4ac43f43b9c0a141
SHA1 dd15b2d484c49a67c603ff19607d86ec9a2c8da6
SHA512 c36e9f7a3ec06c7fad9f4d24dad562d8f09d8a9b315f8201f326e77ebe46dfa9a7edb8d35a891fed995204e6d8f7e5366d3aa2a953f1abc67681052034bf1140
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Z3w:A3k03kHRJJ
TLSH
T19425AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 971KB
SHA256 3a1cb94b7d81d1f352c4421b0e1e30b92cfff81fea48dd13e9ffc26090a3a13e
MD5 e6d1e6c050548d37148447eab83e2d74
SHA1 adfe539748430a2b484c5814ab7101a7ac706d9e
SHA512 351ba6ef0aa838389cc4a9dd6ea6de340cb27aa2ef19185be902e66799d2d819af1a6e4c0e4bf99694861923237bc8f7fb03afc838988ce1fac099ef6be33604
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZmT:A3k03kHRJ9
TLSH
T13B25AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 971KB
SHA256 45f41e74c79cf78c72d1e6a473aa94f8a76c6f5bdd234cee4048610fa7b61a62
MD5 e1984d6b239a9b0c8e44e415412c06a3
SHA1 585391a670cddd00192607311c2a6681afe5c189
SHA512 4f0b33533c366592e21ba1914104778f9bdfcc685e53bee0dffc53a98f25edb47ebc25cd33aad68c0f13ddc52c9fb65fdb4882df3baaa08dcff02c7cbef53fa3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Zeu:A3k03kHRJC
TLSH
T16F25AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 971KB
SHA256 accd4c9d3c4d427160143d9b9a4150f6a192dbd250af4bab2404bdd3ebb9aca8
MD5 bc1801d13cce7617020520c8f50ecf1a
SHA1 731d0612932918bdc0e3afea940e1c331afdeee5
SHA512 a0294d403fb4065b4e308d8466c7a2756acf8789f1ba9fbd2102cc1036b714efdf419c3b5f516e1e6652e4361dc2566d507efde5505081bbefeb2bf03e727a7c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZYb:A3k03kHRJz
TLSH
T13925AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 971KB
SHA256 7f61a4c03f8fa564b81ef33f7e33c3ab60bd6a8145dcfa44c7b8317d9c92fd8b
MD5 c9eacb685673b7ef9ed715d123a855a1
SHA1 66afd72d572987f6ad6b3e733268c248af6b26a8
SHA512 5d6bacfb5c70eca5f01b6d19a2976f3d8c57f6e12c1336299998f24738ecb5b6aef6df491c2d755b3e4d5d6b9246ab82fdf2c3d4c6ffc956f7675a79839e6c2c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZGf:A3k03kHRJr
TLSH
T12D25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 971KB
SHA256 8c62ce515155f10630186b405d348d7c5bd0fed45b0ec3f9ca08c341d15a53cd
MD5 944937db8f8bf4b0c4c25410a2030a3c
SHA1 bbc7c08548b25059f1b771c56d9e9f36be8335a9
SHA512 ad95dd9978cb917bf391c4bafc5a4f1fc93ae793969a95a544223e97013b200da937f4687f10dcf8e8dd1a35291e382922db72a237d5e01c67a6689994ec4492
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZDK:A3k03kHRJb
TLSH
T1C325AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 971KB
SHA256 fe6361e91aa714a61e276079f7a3826551e1705b58eeb662ab710c8c735f8e6d
MD5 2825324bbe650ee806867d1dcb4ccfaf
SHA1 95a2620d42fd07ced34ca057d8853cf8fc882fb1
SHA512 44501734ef007a6fde9b060e1313dde3625907c4da89c58a6b4ec647a5595c12b976783d313e7b7cc8366bde5e629399555feaec76811dd182ed2a680df9bbac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Zkk:A3k03kHRJW
TLSH
T1F325AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 971KB
SHA256 e22e4140cb2f96861f86ba57f6cd8bf4e65fe8d792d8e8936f6b342e107ea65b
MD5 6550306a6d7dadfd8485c8c649fd6ed9
SHA1 e2fe4e29336acc9a09ee2c55f088ce5fb7d34e69
SHA512 c6c993baaddd1ed461939e2d4c85af7a82a11a0ae9a421f62b46968f97b34cc12f2906718055b32269a1928fc5b6aa80bb99791f5d383a6e84f6dfc7248254ce
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Zt0:A3k03kHRJr
TLSH
T15625AE03EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 971KB
SHA256 720d917c15f6d51f983c3d504db616447734cbf48a5f91b3be663c52a92178e5
MD5 9d85b7dd3734b6b2ae914604771aac3c
SHA1 49b445a6de6a6b1046ab319c0c3b390b797b08ab
SHA512 6d9832e9336b35bdd6c49ceb354ab7edef44bbb934c8408c0eda71cd5118de83937e7a6fc2e85099aebb3966e49e1de7d9f68402a1909e2ff614baabd2f15bbe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Zwg:A3k03kHRJe
TLSH
T13F25AE03E79500E9D10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 971KB
SHA256 a8630aa146967841ba02c5fd487cc6f77b685b546d59bd2a34651a5b4f2d573e
MD5 6968b0e08229d40438922cb042275e3a
SHA1 05724ceed7127440e802cd4b1ff5d2722f630c7c
SHA512 9eda49e85cd79593ec749befa40a2d4b1e9a34bacff0c04d1a4e1dced7b28462f757c0d6d76bb8b6670cf227df9ee73a8f00e7ebb2dc64ef9f9f25a1619b387b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZFr:A3k03kHRJg
TLSH
T1F925AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 971KB
SHA256 2c95cf70c5175fbb62e37d5013a53eff7c5daeba236a20c1f2168659f9bb74f3
MD5 aca0273bd845ade60f85481b86a5d617
SHA1 01c3d254bd847a936ff748380e34559a4cab632f
SHA512 b5c1dc1430f0f826be50581d53cdd5cfdde676efa2d076efe3b47e3da29f7bc84f580d841be893b2c968f7c68aa483858bef3ee736078784a1cc4df9556ca036
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZPn:A3k03kHRJy
TLSH
T1D425AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 971KB
SHA256 10076556d2ec9a437cf1b424fe5468581efedb48e9532b47c8702cc3caabafc8
MD5 eabec4aa17731cf42f72c179cbe5b41a
SHA1 31b519573cb0448f30d3bac8ff880aa38c69dd27
SHA512 ce0c74ccdb386b3d007734d24cb0adc609a4a7d7c1324ecfd4d2975d6f5193b2167f5618d5a7aa2b5ddb36c94a2dff42409c947ecd55c1cc3ec99a9d113a27df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Z7x:A3k03kHRJA
TLSH
T1D025AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 971KB
SHA256 2013477637762e5a90720e578621e00c4ebfeca4011fca5f40b528d3443eeab9
MD5 8ea2dcd7b4fa12036e6d35f25f36b130
SHA1 675209392973a5603ffb3ebc6633614744200466
SHA512 1fec894d45c74e8c7a1ab9ae1d2205224034c31c0e586fe26b6f5122c0626c6483c7ef04c5eb1f83235b488ff26406399edc49db2083a0fb94a5e91b504ed486
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZpA:A3k03kHRJj
TLSH
T17F25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 971KB
SHA256 6ef669896cca0d0f9bc29f4fbc53f9af3be4414641d5c4c4fe5264dcaf64a8ce
MD5 d2947f89d1da5d76c0862f1463cbbccb
SHA1 67701262d006ad6c3f1a424c5d4efc0768a793ed
SHA512 f169e31273941778917514979b62d114cb296c692160214ef75260cc30edb2978e4e4d91ec2fb889021be3c67485c1a8c12c495f4fd11575185c2ba4162a6cc7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Zi9Q:A3k03kHRJu
TLSH
T12225AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 971KB
SHA256 f30b8dcefb6b87febe77a4b7cae75d6984e30ab44671e66ffa222499927bc66b
MD5 d1332b67146d635ee57ce5fe161127d8
SHA1 1a9f76296254fea97b3d4c005007e4435b86d1d6
SHA512 addbd9d7a31363761622b33b914f5d6df50c5d29c89bb7d4ae8228027ba416f7719a332168d948f94661676fcacca726a977803a8f9b9c5e161d270f941a71c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZH4:A3k03kHRJN
TLSH
T18E25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 971KB
SHA256 f2894dd3f407dbafa5d95e6f9fa6dab6e5ab01875d6a801e7ae24d8b32db0f87
MD5 e598d52ef891a82b7991bc184cdca83b
SHA1 51f78630d4beef06b7d879adad312151b0b81afa
SHA512 0a3d9ac9b61fafb94b2c6888b1d3887865d1a7daf5494268f8c9a0b07f41ca3261fa43f815c9b7d0d890feaebb529deb6035427d7c4a32e139a8493156e85137
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Zmu:A3k03kHRJo
TLSH
T17225AE13E79500E9E10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 971KB
SHA256 3de2706be07dac04c9f0c34abf8620bf72b5801f5620ec4b5b3e6c9c26ee66d5
MD5 f7bb36f323a36ddafac80fc63d6f8ef9
SHA1 89ff8df31db069ca6002d283e74256eb0d4ac179
SHA512 5bd0ca09adcab4b7e08c2ad015312a2f589d218edc16aa5620e32087e7b823fd400ad4b8b5e7772155755a620c4cd007be33aa7465c68500f8c29909bbe2245c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZXj:A3k03kHRJi
TLSH
T1BA25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 971KB
SHA256 3070b4b2092a71e9da5cae5a01b1d34e5834a87a0f15b528b7639e2cbb0febc5
MD5 bcc9a4e59144842940a1fc25f77f03c7
SHA1 e6f89d949d5bfd790e6bc593da414906439ce87f
SHA512 2d083cdc46c87648620511bc788faa89fdde31bc54a41d2f6a3bd311fa0efcb9eb8a4e5ad865da65f052b2ee80b38bc30342442c7088474f085de64b901d2962
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZCg:A3k03kHRJm
TLSH
T11A25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 971KB
SHA256 7d4ff2fff25060db10eaf6d1bb611fcfa0e26f5046b5e96a54661e3e74664fc9
MD5 3b72ac0758bb7dfa3d5bc40647cfc946
SHA1 ad6d6cc680db2f2d5fb4c3abb8a266eaab4e98f2
SHA512 fbb2b379abcdac9dbc411c69072ca42c79f05b2bb07fd328b6673f8906440fb3a9edb958f52708fa9ac2c4b8257ab92cff73eb7b53543606b29ea258a21fdff2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Z9I:A3k03kHRJv
TLSH
T17A25AE03E79500E9E10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 971KB
SHA256 ef17b5176b6ad3f652bdc1eb3b0bb70e243360ac2608a493089bf85af7bf5d46
MD5 b3c9a070f976621f876a71082fd38525
SHA1 c5d62d123c51328ce121284625d7a61e5efd52ee
SHA512 8f47282db39e83dc8a70d4279b339901a39661f8a6bf2209e2c084fe2f7f1a6a440e22ef75ed8173e513394a326878e3cd9ab85c1d2e5bb1c63df315e6c07d48
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Zvo:A3k03kHRJZ
TLSH
T14825AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 971KB
SHA256 38c64d9263ea11919cb012a5db81fb1c9a53d3062da7a72eee19a3a17a252b1f
MD5 e5f35bbcd3fb4eef03ed9c80366e5322
SHA1 b47fd6eac32d22ff806b3954d2d8cb91aa354c98
SHA512 9d7053599d94c12e6903a17007fab66bccc62a1837b45a70582b725dd8b0509899845e8995c5f2a74675b3dc9dfd55108f6712dafa124f4788e38a01529f868a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Z0+:A3k03kHRJc
TLSH
T1C225AE13E79500E9D10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 971KB
SHA256 1d98bc17abceeba8f01b68b83776020b686ffb95dfb64b31e5b9a748bd87b4e5
MD5 601195e02cdafda140d3a99d4458a69e
SHA1 c65d295a5572158e5c91aaa23460b05fc077659d
SHA512 6317294d4e10c031f0f2eb74142fefd051b4cda2a61614230ad7d8e5d5c06935a76ed0804ff442780183c80ccfd5df8ae28b7c9f17ed75b0bbd238184428feb5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Z8Q:A3k03kHRJ0
TLSH
T10B25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 971KB
SHA256 1475c40f982269fd2c5da45f8acc30d163d84a904008af405987fae6364bdbb2
MD5 2891c53b8f095f69ad9ffbb8ee112616
SHA1 dc713fde80fd8f8e9e847e61fe05affdf53773be
SHA512 c26672691c476f2d19b08115e3d8b0ad3590f7a1cbf255d76ec7c31def8a39ab00187225014adaf22395677b404bd457579ca21de41569dcdf58690da7bed2d1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZlX:A3k03kHRJ0
TLSH
T1D525AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 971KB
SHA256 207553715407e47c947e6e2a326b83e5d1fb1a221e575ffedc724cb522bc6922
MD5 37ead20a4fb935be10d3aeeeaf648723
SHA1 120ed1c9b22374bb2745074dff874c0edd9e2ce2
SHA512 c5759ce6ad92d1c4a0a6861822ad25e78088b6218d4e3237437f6dd74084a463451d7dc8d8756ff33a0178277aaaedaf92672573e74eb5e73019d0c6dc0369af
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2ZHL:A3k03kHRJO
TLSH
T13225AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 971KB
SHA256 c0a8d0889729136ddf07c234b77298126daf4e1881abe4876fe84641fa13284e
MD5 3ffeba11f4697685b6083ace5b3fa950
SHA1 f5e0d573346bd2b35b40c60a896c549366948737
SHA512 0b0301b06a033738e82a3b69f3a3de310d31196d7ae21607563c752ba0b6c71e7875c5f51cddcd9b9a96e66069b4b3f0654026168dcf21dbd4289617706adab5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Z9M:A3k03kHRJ7
TLSH
T16025AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 971KB
SHA256 da86504c3b257fcc42202ee8154d252a35cbc2e13ef088a90052ef2606221035
MD5 0a8b4ae8c11dbb8efc0339f0496797b2
SHA1 02e09c99d3ad7c6e62b2ad8adf178e5da041ccd4
SHA512 46349c6f3339d3eee223f5b83854fdd05fb63b4130e17726ceb353c5da427e76aba574d90f16eab726a1bb09d4719d92b2531d21cbe986ecdf5db1fab6319ca6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRavFT2Zuh:A3k03kHRJ1
TLSH
T1BF25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4120-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4120-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6124-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads