003c784d860c64b87bf6ea06eb3cb491aac3f63d505b07f8bf7e7552dae9d213

Analysis

max time kernel
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 932KB
Sample260806-axb3dszdkf
SHA256 003c784d860c64b87bf6ea06eb3cb491aac3f63d505b07f8bf7e7552dae9d213
MD5 167e65f2c7e5afec75c6a6c5f3631c30
SHA1 6bf4799c34535d84d229afcf229545eb73d13efa
SHA512 61488c2560baa6bf1ffa018090dceab87d77394bcd9c79c272ef5357c3425157d88d9e640b74af7eb19ebc53536e8309cfe02c9a5c53d2ffc59c93bc072626f1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprh:A3k03kHRJd
TLSH
T1FA15AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 48 IoCs

resource	yara_rule
behavioral2/memory/6012-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c44b-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6012-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3324-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000188cd-202.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a59-209.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-247.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-248.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-295.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-333.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-352.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-422.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-441.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-460.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-462.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-470.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-498.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-499.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-506.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-525.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-616.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-647.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-727.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-765.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-814.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-851.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-882.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-979.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1010.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001aca9-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001acb5-1345.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b791-1787.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 45 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c44b-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-41.dat	aspack_v212_v242
behavioral2/files/0x00040000000188cd-202.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a59-209.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-247.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-248.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-261.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-295.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-333.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-352.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-403.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-422.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-441.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-460.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-462.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-470.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-489.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-496.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-497.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-498.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-499.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-506.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-525.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-616.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-647.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-727.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-765.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-814.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-851.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-882.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-901.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-920.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-934.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-948.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-979.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1010.dat	aspack_v212_v242
behavioral2/files/0x000300000001aca9-1331.dat	aspack_v212_v242
behavioral2/files/0x000300000001acb5-1345.dat	aspack_v212_v242
behavioral2/files/0x000200000001b791-1787.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3324	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6012	2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3324	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_167e65f2c7e5afec75c6a6c5f3631c30_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6012

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 932KB
SHA256 003c784d860c64b87bf6ea06eb3cb491aac3f63d505b07f8bf7e7552dae9d213
MD5 167e65f2c7e5afec75c6a6c5f3631c30
SHA1 6bf4799c34535d84d229afcf229545eb73d13efa
SHA512 61488c2560baa6bf1ffa018090dceab87d77394bcd9c79c272ef5357c3425157d88d9e640b74af7eb19ebc53536e8309cfe02c9a5c53d2ffc59c93bc072626f1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprh:A3k03kHRJd
TLSH
T1FA15AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
Size 1.0MB
SHA256 486c8460f019a7916202afc55a00ec0b6d0a6d9e1b8ee76e3d3b69adc9563321
MD5 4c74184827887fa37d3a14a36dae929d
SHA1 ce88879adc3c6f865b978e5c9562f61b7ffe47da
SHA512 b587cd6b5694d7a6336ffeb2eb576252355e22146064c04af21b00f51dcb055b0232a517e9edefdd72206c86a62346451d693f3c8ef39e20d751ce9d4bd04ea9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprTTjE:A3k03kHRJzw
TLSH
T1FA35AE03E79400F9E11AC1749AE68A22FB75BC52176097DF1368C6152F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 b78c0c77f68a9d57b94951222bc6110bfb2eb2247cc5843dc8cc62e129191486
MD5 f0eff9680cae8d16089438e7f893d585
SHA1 0bfc253af5b9e63f1a873d407d1a4bbcc180d0bc
SHA512 930c412da8ebe668ba3f93aacd7546564f95f2526ae8995e75f2de6ae001ab0f2792f73356aee2edbb3bfafa7a9b87689864f82c183d68cdf43831ac11a5ebc9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprV0Le5ji0hmxNrM:A3k03kHRJRPji0Aj
TLSH
T157658C17F6A402B5D067C0B9C6D69A5AFA713842173086CF1398C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 946KB
SHA256 b307c6a58da8bc5958a04778f4c784cea19357eba055aae007fb32b7e3fd0dc8
MD5 00c09cc15b8cdbd4044f0bd8b5a01fca
SHA1 7bf5052dcfc952315e6e5a60fcb21357e83c90ec
SHA512 ce95ce0a8fce33990c40b0c4b29ac514b870a100a3f06bcdf7cf464bed509dcc4363a5b5935101574d846bf029ec10eae9f8c00f232a9da529d82c56282dbbc6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr3a:A3k03kHRJ
TLSH
T15025AE03E79500E9E10AC17496E69A23FB75BC52176093DF2368C6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 955KB
SHA256 b756fcc7cbfa62e0509f0a0f2c3cc99d7704ca407f9f1b599000a8ef1f4b0a1c
MD5 f411121872cbe2ff3b81c4efd6827484
SHA1 452a1433436582e9e171d8e2f9a0ff17cb1fcb4c
SHA512 97464914b66f4d367790c6fd46810b4d6ac30098a25d7581f6ae336017db6c2813f89571cc9dc15a0c0413e43e99b1daa7afb483f069f018e8026fa3d4b06403
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprHZ:A3k03kHRJV
TLSH
T18325AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 955KB
SHA256 a714464267ebde4d18a731ee0b042e4a0b7b6c6c9cbcf5843923d6e99ef3325c
MD5 6e8752759889de926f369e8fcc807c93
SHA1 7961c001abac6ab4f01acc2e817a87246437ac20
SHA512 74f461d6eb7e4a07101e2a231bdc692579b8da90d9726f7645d241c39e1bb85a601293c19fa4eb646ee095613c9c4b8ade92f23af382ce5617317d1cecd4b300
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprc1:A3k03kHRJy
TLSH
T10A25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 955KB
SHA256 6f8548c87b9f54a03b10b1b99b7683614c69b19dc75f2588fafa9cfad56c99cf
MD5 4512c4587478ba382b8dc21d592d4e51
SHA1 1643c65d9217f776cbd5d36f4efe514708be1bf7
SHA512 6aaa7077a141fa5c7b249d53a33dd867c43c9238f0016745d836087f84882fb5e86d6fd49141bb930ee17e9f8e4a3935f38350a6950468163f9da0e8a674547a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr26:A3k03kHRJd
TLSH
T11525AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 955KB
SHA256 fa55f3bd9a9bde513435ba7cc78fc9278f33af085834d916ea07ba17521edb57
MD5 4d3c651d955e2b0afe613de72c91fcb6
SHA1 beb23c4372ff4dced1e605a8ff8d0d772afa89d6
SHA512 0654599d6e3ef8845058d11309c51f8202629cabffedd5d11746da427001d274c71164cb25471e2a23cd8af90d0f0499387da5b7ce057c10a11ab179beeab1b1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprmN:A3k03kHRJ8
TLSH
T12F25AE03E79500E9E10AC17496E69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 955KB
SHA256 b8b13464dac06886ebbcc8779c33ce50f0ed092f28fcf67d62d58fdd065ca968
MD5 02ced218f70307dee17e3b83346f11a7
SHA1 959ea6c30ac26a62da0763ddd8c77e280780b055
SHA512 6f58e34eebc3169a45cb696b5e3bddaef3c0cef9642f8053eeb72b62cca90a8dac3c17d807b853961c50a28dc6284374a94be140ab863b9a48a09299573b1f64
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprkf:A3k03kHRJ8
TLSH
T10B25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 955KB
SHA256 ebe9b29b5b4ebdf598299a275c276e9656358a6682f7e052e4c34f0cbd060a12
MD5 8b253039fdb970bb8aa6974a52cd4fbf
SHA1 0aa1833394438b2221212326d34d55684bf50ae4
SHA512 a7cce672afeeceab46314641c202e986c24bdc9077050b76ebf0f51e76ec2cc453a7c1bda4ee0cfb5723087d42759bd5876c6d67c70412144340aeafba3dfe0d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprOo:A3k03kHRJx
TLSH
T18225AE03E79500E9E10AC17496E69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 955KB
SHA256 7e3e9d2916e374440e4a75c9782f722f80481b8ca1579e4d425f1b1f1da50c99
MD5 5765c2bbcdb9edabed80885eb133f429
SHA1 98b45f09c637934c9c8bd93d1802f60ec7d969de
SHA512 89c90001dcdd91a18ad35eb45419f197d040231a505d46fc335d3aa432bbe082ec44a3d51fedfceb06abd0170215321d957159ad0c3d67ae99652eb5f01051e1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapriu:A3k03kHRJj
TLSH
T12025AE03E79500E9D10AC17496E69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 955KB
SHA256 3b8861a8b3511924395dd89de6ce6b83d7a44047f1f7491ff8b28f6758dd8e5c
MD5 00b088e8c77f222c8330dfa3e31950d3
SHA1 806b2f5291c88bd73ecf91cd15a460e532ad97dc
SHA512 bfa48f860e21b65e58e5eea6986fcdc958b21c012f31deb297937b0a5c4bff4d1192d98bb87ba10d1abd911df125068bc46a7b374d2e98e7ade110e93d34445b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr29:A3k03kHRJC
TLSH
T10125AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 955KB
SHA256 6df3918371df9fdd64b85581965e605b246f59de0fc5dac2775fe265ea878865
MD5 dc18f92b293e010e802db3c25ccdff86
SHA1 d4f10ade4ee39393a2dd6ed334b71c04b61b8999
SHA512 0728d61581c70839c75353f76939b81db5afe9ac477b5f12cc0e8ea6af06175f0cb983024cb1ac60757909733cc759cd32ee2717bc7797c219f0b1de125c8a3b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr2c:A3k03kHRJv
TLSH
T1CE25AE03E79500E9E10AC17496E69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 955KB
SHA256 ff9553961daf9d247b1a55862b512d01757ac0e642ab8190f154d17278d518e2
MD5 ac8275de6e75592e5fe5fc1f6f02759e
SHA1 d5e3a7a72b98b29fcf9f62a7af2cad4127ac17cf
SHA512 26359f6586cb499f7bc5f0c7da5dd1bf15c992c0b3142e33fc89e0558956e486120c350f0b2862d990ae4face830f6869031745396de0bd4b1a9f0d699a337a5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprvp:A3k03kHRJl
TLSH
T1EA25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 955KB
SHA256 116446e8d9d3da0e8304f2d2663b301de0db20ba620f27e2c9e12b4f3ccf3bbb
MD5 dd9e8f393c72240a12f2eb0e29d526e9
SHA1 26e32097a906318cac143fff65ef9e24d2536637
SHA512 296ee755dcd47c4f73fe4ba66385553ef6e5bf40c146ae436a1603094d094649dc78bdc4d7a1b1e9af71adaa44e6df5dc68b5bc19c2610db10167b929e97c8e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprQN:A3k03kHRJe
TLSH
T1AE25AE03E79500E9E10AC17496E69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 955KB
SHA256 e2606b656929a77b6bd0afd756db4b7fc54fe475847be8a4ffa8e5608b7d7adb
MD5 3fc0df475499b36c17428bbfc4833d0e
SHA1 4dc274920debdc1ff81106428f31ff651b12f140
SHA512 5651d70f0a4311782cbeba786965da67a6151fe0506eec2ff55f8a213d08437d288f8ea18128ca4f64158a41ec29580436d26ff440c7f5c47f25cf66d53bed3b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprYF:A3k03kHRJc
TLSH
T1CB25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 955KB
SHA256 6df051f33cdde4ca088f9429c66de825ad46e08fec2997c08463be4274285002
MD5 be3727a649006b54e7a5874e86fa2fd6
SHA1 01695469be3d1d2ced1969ea7d38b8995465ba3a
SHA512 292ac524e6af11492b46f0c2ce0bd662ef2d9bd3b34c56960cefa7b18dbd60a57f6f5b525863307647667facda040dc8ce3e5654e984c11b8cf49ea39351f85e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprNC:A3k03kHRJo
TLSH
T13925AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 955KB
SHA256 d175659e65f9bf1f2de5ddc8c9e7db3c5170a419594a31c766fec82bd16b0415
MD5 5dda95b87107aa29bc7a76df32e3315e
SHA1 67d10ddcb441894106373a4ec82a463f75c4e4f1
SHA512 35b451aed2a8cbff73748024894aa145cccd2ca1be09cef00c2f5c690034d78d4e93ce5a2eac62e4c5819320545f483824897f150ba1508249334c01ac9e76c0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr2w:A3k03kHRJF
TLSH
T12725AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 955KB
SHA256 07c59d3885149932c256096937e7d52917985fe4aa4fa8f1ee6402bc9af36f18
MD5 38b9cc0dd67c870d6853028f41107a44
SHA1 9e2102df6d51210d4d95bb9ab3af56d3a795d40c
SHA512 96fa55154b8c939b182ba051bb492a2171b2b6bf42510dc36289089b1ce15eeaf81b7baf819c555cb5766b108298c237d306472eb952ffe525dc04a04506f087
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprlT:A3k03kHRJ5
TLSH
T1AF25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 955KB
SHA256 09cd96e8df97794c82639aa24a21e112c33d05a46e36a389f565d5b7ee2f9e5b
MD5 4f58b45a95d52ba5e0d5610d163b5a7a
SHA1 1eb14716be24d14b22e92bec51b24b1202bc33e1
SHA512 60845b549d1cfa9e0524121b2443297be8db7323bbea8a60999211c7d441d72bcc416c48f84822be31b40cd2972cbe8194f70a8833b5cf790c6596266e56c844
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr7u:A3k03kHRJ+
TLSH
T10D25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 955KB
SHA256 6408ff0d185051394b8019ff5f8ed52e2e76d438773a49069eedd2581fc56626
MD5 c2f5a80731fe7947f3b146df9892e75d
SHA1 5429b11bbb164ba44d0fa46d3944e72ebf4566e6
SHA512 31c17d2337c5650c417ef2f4d165cebd437c6d5292a904336d506ee0e17b4b505316ea74d98af47cdcc3661290d485f02303e9c34aaedc0c441b2fd5dc37f58a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprfb:A3k03kHRJ/
TLSH
T19225AE03E79500E9E10AC17496E69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 955KB
SHA256 9f0acf63f8c07b2ff29f9c3c9d6dc28e3cbd8e8f2482dc48936a2b81e43caab1
MD5 223505a1dcb0cbf3c094b254d753de58
SHA1 286a0d7a687fce2726a4a9e3c9da264501a463bc
SHA512 37947e9ca8b8fea10061fd67f9e17f33e34a234264d4d618e93c3a3eade9a1c1ea52e9a6467527d370d382d58bd645de726569e6be1e3bfbae6ee7861173a3c0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprbf:A3k03kHRJ3
TLSH
T1BA25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 955KB
SHA256 68e5d54a2d60d72ef2414418a565ae0dcfd34380c22a3414441faaa197d0606a
MD5 737cf83d0c2da1bd14042629367760f2
SHA1 9d0f8348aa1ba7dd93378950e770473892dcb378
SHA512 b13d478a6ce28c7256c21d2c4ac8082752938644c00a6257e1140a0cde93251dd27e107a4b3a01f8ddedf1015a1a56561cdac312c184e0a772ec7e8655fede9b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr0K:A3k03kHRJ3
TLSH
T10425AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 955KB
SHA256 62cb0a454b60a8040d27b5848bce60f4ea775bce5798dac59d169d7db586f333
MD5 86b1362043dc6f47b7fffe6eccf19544
SHA1 1e7bdb0b79d07bb1d267ae5742b80544fe65dceb
SHA512 0ed74b92a13ad94a3ebe0f457aad8d1c7d98983d38cb11e92bb66f1d3988ad0b8c40fe9bcb10f469fc3e1626322b25ddbae19ae2ac28467c331f0b21fe4f5e6c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprpk:A3k03kHRJS
TLSH
T15025AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 955KB
SHA256 a9006698fad2be6e8c1b1b25d232877562f7285d4f6e408597581ff360a1d77e
MD5 75062d310f4a6c75b1352d0f2c9ad2d5
SHA1 0a215f00c34a22e1cde7b22a9930392dc494ff27
SHA512 11ff5feabc6f79b70a43da50daea2eddc20cdf76e2880a34550908ebc009a9cad1d37b524954c8ad6c59d390d333cda8a5905dca36e607b04e5ac7ccc957c715
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprG0:A3k03kHRJX
TLSH
T11525AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 955KB
SHA256 5500300209f0fbf654a6a20e024180584ddfe1660757e8f2d16c6ddbf9f2f16e
MD5 87de5685ef789ddd50686231c37caa6f
SHA1 a668bb81d5e774f234c8a41a408dbd70d5c3ca97
SHA512 e1f04d3c017a299c8b95f832feca468d372470943132db056437c390c221b188dec2f35aba0f0ff2e2039e3c5f6876655faf2615b61468a362409e3708e6b5e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprVg:A3k03kHRJq
TLSH
T10525AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 955KB
SHA256 0d57029ca6f0691dafcb507da2320b6cfde4b28d61edd4bafaca27354c373f37
MD5 66a3daa8218b0d5bc6636d6e46cb92f8
SHA1 70159199d8b0d0804873f18eab26fd34d6e756c5
SHA512 c219d8df0d5adf616d987326c5a1e702d59ca88f7f544ddbd428193f14242ba625c4a5c4c59e5a4205bdcd5746a144a48d9783e414aef0c172d65c94e7702178
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprkr:A3k03kHRJ0
TLSH
T15B25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 955KB
SHA256 834907899ccb8499efe5addbc1e5760a2adcb4b02981f13a9b54b69e7dec8f05
MD5 2977d0ab87e755670677adc28f70c58b
SHA1 c2d0ff6b27d27b9f04db22ec75783f66210d9cd3
SHA512 a831e05bdc5ecdf823180186c7a638ae72b4328b218c8c210e3bbbdad2ae23e86e146c7eee51561a496df3defd644bac8adcc699cf84e4481f17a83944b15072
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr6n:A3k03kHRJu
TLSH
T11825AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 955KB
SHA256 e2ad683ec9fcdd31d406bf8b7eb701728b6d52836833529bba0fbc64d436f6f8
MD5 a2e731507ca5194e7fa894b5821e1797
SHA1 de2b9349b4f1660212b932371d5c2b43144a6e70
SHA512 48e08b3a4af451515c763be626c25ed391c5cd7b9c88be13937ef4ef7b5631f45326cd01eb24f388310b62c0205224e9ac301b2164c06e784c25537157389a20
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprQx:A3k03kHRJ0
TLSH
T19225AE03E79500E9E10AC17496E69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 955KB
SHA256 45ce417ffdf218459771d20e349cbd365af7ec0b97d85a81df930ab3d47733df
MD5 1dd015fd59b254b7a9104ad0edd7fa23
SHA1 08910c8a1d71465a50c3fd88081c168b0090663f
SHA512 67fcf3d4448647aa1f8926725672a8e038ad8c801a24e6d451302226153a1def80f1d4352a05b58f3b462d7af44b78234aea03656316bce50017fa14e70aae38
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprSA:A3k03kHRJf
TLSH
T12725AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 955KB
SHA256 e26574ce74f0a9c7110bc45058a2d91c9acfa852086569edfdf50cd154801e4d
MD5 1c2077609ea45c4a7a4fc1f3077c0f19
SHA1 23b3ddf1c6ee4c72cde030398eefdcdc2136a987
SHA512 ce5fac97edf6f36d1fac6bde02f88d8f52d0e7be4be4bf5c34462f6e56440dda728104bd57f2901eb178c96e28fdccfd47443c89f2d222004ff7d8c5a76c6765
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprr9Q:A3k03kHRJy
TLSH
T17C25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 955KB
SHA256 12926394605fa3c939bcc7c2791296942f5f7af8484276ee1a29385912bbe096
MD5 4b5426e8f127d229e09f9cc680188c59
SHA1 1e8394fa5a7d4e685044fead7a6087d4e20610af
SHA512 6986da12f1402dcade6c4e92c2e21bf6a41084f0ad47d0e5d31e4689f4d7a679584fa1dbbefd4cc9a5af594fa8fda1754f137a5b5e233589a6f27c7b0cd680e6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapra4:A3k03kHRJB
TLSH
T19C25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 955KB
SHA256 efca9223175e69feecde2cd9bf51dc0aa54f5603b6ba59ffa272688304bb2973
MD5 4bd8a1fab501b26e13d5bb779c0bb17b
SHA1 9c6ec75df04506d42534e1ac66964fe6785811f6
SHA512 1f4f6a2741e8d9a64e2b35711d39e8b95cb785bfecdcf3ec87a9ce43d17e92f058dcc0bc655538b76268b206a77ece6aca1bf5dbf7ed7c69f702418c2865ca79
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprBu:A3k03kHRJc
TLSH
T1E725AE03E79500E9E10AC1749AD69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 955KB
SHA256 9a2f7e39aabb5e72e9385cc2231c39e75796d883c03e0fe1c929be7316e7e210
MD5 d4444e8902de0784284da649242506ff
SHA1 876888dc416c1368635ecb4ad827a87442ac7910
SHA512 f93f04824cb56b6bd1c127c1f725110c65c12c3b2a7c4cca5e1328fd326a9fc21fe6243f8b35c51ad2c59eb4ae2ad5f83225951e3d314a9995946a0de9f5ecee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr0j:A3k03kHRJ+
TLSH
T17225AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 955KB
SHA256 32679b57080052d7093273f45393d0d26ee432961b96d5637d73e9c4634ba351
MD5 050b5f667a4109cdd7cf5de3bd14294b
SHA1 27011fe2ba8cd473b267085e9df0db308189183d
SHA512 45ef8e6d6d36f3b2dd32f76ffe27fab167e358fb017ea856c09f0958fb0f06204d9c5adb474238b20ce04ced8448b30b71be055862b3704cbf3a3508204204b5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr1g:A3k03kHRJy
TLSH
T15225AE03E79500E9E10AC17496E69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 955KB
SHA256 6637da9d220b4c57bccfea9360340eada326ceb693e9e76079089d959dcd54fd
MD5 f37887196cfa1b2ec097c66ccc065b52
SHA1 4df2ebe259a6be0361ce1fe9df6f49fb7adbd10f
SHA512 f99255f8664359c7b832c10dd0296b7a3d3ece29ba52e175e5cf5573906cae557419526e1d39574280bd1eb2cc291d26b2af03c43720aa3706b67fd08c18b05b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr0I:A3k03kHRJD
TLSH
T1E725AE03E79500E9E10AC1749AD69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 955KB
SHA256 a7dffdc4e745cdc42d1a2d585c53f9c599767f98be1b23d10b2e4dc88352a40e
MD5 f42dd3511f647e5fcc43f33e9ac08e1a
SHA1 65fcce0507aa53996a1241833b4bc1475b6038c0
SHA512 c2fbf38d5df56a71041d4668ebd76954f247f0f63d079cbc4edd80a5df5b6110a13a1e7f10de5f00ffa0eb771683d489eaa96270a2a7ab461f6d1ed6fb5cdd60
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprmo:A3k03kHRJd
TLSH
T1EC25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 955KB
SHA256 561bbbf63714cd71e2aa4802c8ba8579654e7e8fb04b0cf467e7d59a28dd341f
MD5 6f9124635b28422b23cbeb0bbf733aef
SHA1 80211474137ce15d2699671ae2db3de8ba039286
SHA512 8460cef56e132a8d8f11c6f51748b47f44b6413346df9a6c840c5313e7310aa21b5e7d51fede864f3026a5ef5ea7165fb77057c9b8a532d0cd0905912b912f9f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprN+:A3k03kHRJY
TLSH
T18D25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 955KB
SHA256 cdee24b770596ce4d8aa129b01ce843caa883ba90f181df67b477e32ed65f016
MD5 1c394e422df9d8823916d0e350286a79
SHA1 3fc1c6e3c44f0a1b102b7394355fdc1ee0e78545
SHA512 e9e973d11ecac4520b57b2b3c2dbbc12782608abd377428e93185f6dd12074ed8940d21e5f4053b7a352cdfa7d6094040b960db19346fcb4c63eda65e6a30f80
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr7Q:A3k03kHRJY
TLSH
T1C625AE03E79500E9E10AC17496E69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 955KB
SHA256 fa726869cb686327bc76f1f74cfab0d9d06bc6f643ba663b81f4d3a6b383995d
MD5 502163d68dca147848674cabf30b47b7
SHA1 e97eb51f4cab351b7944a530a00edde08876c0ce
SHA512 2393939c5a294519746272c442c549305c2f230f24e58983c757b9f6c591c1700d714f596d7f624546f9fba38a219f58152dc5425dfcb963f9c5d0a51a87e288
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprwX:A3k03kHRJo
TLSH
T10B25AE03E79500E9E10AC1749AD69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 955KB
SHA256 d78f5ac7c9bb40620d0e6f19d7251453fabdb7d1dd1e9c26c6932ce3360a8870
MD5 f13cb7adcb2ca526214217cf3725dc55
SHA1 7e1fc0cbe6d9adc6f1d0611ad9454262924f362f
SHA512 d261c7d458ee5f9462debf2d2e6e45bffc9f494fff33e4e6f72bf6c3e67cdb7998ddeabaef6306fa8194ead09f65fe0a2668e4fd29c57c803acc1e1966556a66
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprGL:A3k03kHRJ6
TLSH
T1B825AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 955KB
SHA256 98b8ee62cd70ff89479a912eb4969cf84f67129f6ba9765a64ca17255ae2dac3
MD5 4de608842d3aa5dc92ab3af90a33eb9c
SHA1 dfa4fd262aa07bb94fb3089b86e271e255c92782
SHA512 b3a0ecf76ab6030db822eeb94a0e243944389dc20d202098a3d13051d521bce7b87fdb66bcd3481e1edab4e69ef99bffad7b101081c44bd1cbfc2ab1845bcd89
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapraM:A3k03kHRJX
TLSH
T10025AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 955KB
SHA256 c47868adfd02d5043cb39f03fc54724b8b9cf06322630f5744b40164ba655970
MD5 50805cbe48b37fa366e7f4d18e336f39
SHA1 98aa74b45baab495ccf4bb5036af798d74b5fc90
SHA512 acaca5cdc5e4baf6ce99fd70961788262f160f185fc0794000f7c706827c9eaa07948634067a4dabe85b3e8f1f3d7a4fd9c5ab5caa6af61da2e3e543c94cce81
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprLh:A3k03kHRJJ
TLSH
T1CF25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.exe$

Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
Size 1011KB
SHA256 1bf31bc5acc51604d8f8ae1a90bc36e0901fe86e1cad43160261463aee450d1b
MD5 fb27edc82ecb003afb4a679e936fc57c
SHA1 67bacf10c03b10a5dd17c2521acbaeb079f6596e
SHA512 4a5d8af96473c476c60265660b3fa7b81f5a8e04a8d03bc85c4db3670872a0e8d504acffee1574607aebea6d49d73c8c2c57958e2e9ccc17b248f0acaee499fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr1F:A3k03kHRJT
TLSH
T102259D03E7D500E5D64A8130DE9A8A22FA35BD92172096EF2368F7152F727D0BF3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default-browser-agent.exe

Path C:\Program Files\Mozilla Firefox\default-browser-agent.exe
Size 966KB
SHA256 d4287098e4731fca5ad9f8c576bda14e733311100ebf89e8ff3945302b1356a6
MD5 f2bc715763c2eeb5fc8fa03f75aa23d7
SHA1 6274b447e199ac2a779b8e49a2e68acbb77d092f
SHA512 6e6f315caa734b5ea3e0ef4bfd4b40a17cf671eaf7f15b93badb308ada63859133e4832ec350e2c8359fc561ff88b0ab388da9c0612cd2bb4172e906c18e5cac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprnT:A3k03kHRJ/
TLSH
T18725AE03E79500E9E10AC17496E69A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3324-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6012-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6012-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads