c3957482d680cb0ced7fe805f8e77b9b753c84d718de9130677fccec4df40c74

Analysis

max time kernel
102s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 939KB
Sample260807-b67fbsvglb
SHA256 c3957482d680cb0ced7fe805f8e77b9b753c84d718de9130677fccec4df40c74
MD5 a7e232797ee890e7ca849a793731d798
SHA1 8e2e4ff9f236f84422a5c314b25b59989fb24940
SHA512 a1cb2f20c51d88f97b849eb7154924d68aff04db7230284b51e6b3f8adc9ebd7c7f823bb7216aba9ccc63946ae5dbf9801d1dc0f92fe3fd0804e57cceb0241d2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdp:A3k03kB56r7
TLSH
T139157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1444-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c57d-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2cc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1444-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1144-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f6-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019844-218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-424.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a54-528.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-607.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-639.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-731.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-762.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-793.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-842.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-912.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1348.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c57d-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2cc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f6-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019844-218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-424.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a54-528.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-607.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-639.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-731.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-762.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-793.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-842.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-912.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1081.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1130.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1348.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1144	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1444	2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1144	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_a7e232797ee890e7ca849a793731d798_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1444

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 c3957482d680cb0ced7fe805f8e77b9b753c84d718de9130677fccec4df40c74
MD5 a7e232797ee890e7ca849a793731d798
SHA1 8e2e4ff9f236f84422a5c314b25b59989fb24940
SHA512 a1cb2f20c51d88f97b849eb7154924d68aff04db7230284b51e6b3f8adc9ebd7c7f823bb7216aba9ccc63946ae5dbf9801d1dc0f92fe3fd0804e57cceb0241d2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdp:A3k03kB56r7
TLSH
T139157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 c431a977cf6bc2a5a177e14f5d96c273e23422eb339527570a46668297e9f429
MD5 d5de544b565dff51708b83d866c07b4e
SHA1 5f49e2954761d38be5653b3eeeffa429bdc486ec
SHA512 fc7b99a5867dcbf5fd85f348be0856da3ee9dfa04d5cd35b9f98ba5fd09dd570ce67b961b1044e2d2a7f726a07fef4f01c5eeacc2de79080ac5b2e37ef77bf8d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdV0Le5ji0hmxNrM:A3k03kB56rnPji0Aj
TLSH
T184655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 953KB
SHA256 32333590cf08c55a84d6b14381c880ce7f98a863fe424fe90cb94f0b5bf00a02
MD5 5e4bd63873d1b8d16cc1ac6d9356d37a
SHA1 863f7af26d86af2251e32388b6764ee513a5359e
SHA512 eed145b7e94f4ddc909fc3d47d2fbe054b73a87b2e7f5ed3ab255e3747e617ae8bd6fc505dcb67e85be88dc3619132fac5cbe3a52c7443c96d8c205a575bd762
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYd3a:A3k03kB56r
TLSH
T189257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 962KB
SHA256 98f33a4b63036f7e2cfaddcebf194ea3ba932ce2eea18c1abf078e94bb2fe502
MD5 f3be8123e3f108693d761a93fdb55dcd
SHA1 37f8b5d98723a41b876d0de3cf81fb35d284b926
SHA512 1b3f60afb44eac90fcd1e70339e528a1af42acdc05a4f1e6d57a8288781398ac993102965ecb629e4f572cac26fadc7c8ead788d22af3d1864d06b2f97a926e9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYd26:A3k03kB56rv
TLSH
T1D1257B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 962KB
SHA256 159fba7c601e1295140e6625a97e7e9e0539ed40b2594310017da4c3eae2ef99
MD5 29eaa0d3f408fec5898a26e68fd773f7
SHA1 873abb3f9e4d930d3a67ea2fe8eb43e758f85371
SHA512 8d4833ff73975fed2a91308ed237dab21cba9a6f7035ce5858c44acc9e084bd0c615e2a834db878feca1565e98fcc2df38af6e394c3abcdc9f8e8efb6173dd40
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdmN:A3k03kB56rS
TLSH
T117257B03E6940FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 962KB
SHA256 89ea33078ee2d5fba36315f965c77aca5404b90d8bfcf16392023700cfd29942
MD5 0618532b80ed8c7628de0b8e432a72d9
SHA1 f46c83277daedabd73aab1c647429a2adf9dfb52
SHA512 837797b499687f940ec2a8d42e506d9190a52577fc51e3b0b3f1b6ffc3d4be786e59bc7514f005cb4f8fe6dd1bb4c4cd8e0c193927f14bcc48c3c2c8bf6437b3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdkf:A3k03kB56ru
TLSH
T1B5257B03E6940FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 962KB
SHA256 2dd9fde9db62760cf2c0ca5148cb14818735907298867f9634e3a50ba08880d2
MD5 5ab8e05e70818fb17ff5434c6209b282
SHA1 093dc47f422947e16dcf03542096838c99700b47
SHA512 f1afc7e490a09eace957e9940c862fa13a0f11621428090824367281d00ff9a5d34eedaac4fbd4ff4901c59a80f1dcba8c9bafb591c0c4de953649c62aba978d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdOo:A3k03kB56rP
TLSH
T17E257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 962KB
SHA256 2f0f81d658e3450d2517660c539eedd709fa14b1e7a9ddab58755faa920c0665
MD5 d14e8000ec747523035bf5090dcbf361
SHA1 c03ae396ac7bbdbc34873516aefcb85ec2ea7fae
SHA512 1f5968d18bb9401fd6337a49687b16f3b3f4a874c8237a91d524da2ff29558ac18f671e5b6e340d248af54be7db6d9dfea4c8d966805a4991e8c2a887be8d8bb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdiu:A3k03kB56rB
TLSH
T1BA257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 962KB
SHA256 cb5a5236bd6ec8f1f23b0ada9ae1dad909d91f649f004e0a097e867d5c0b1d87
MD5 d4a4a466baf2b905b6d04da5d97a43b6
SHA1 d483a41ccd44e227af1d5d976c13e4247c774252
SHA512 681811059892f6b7c6cf54c871f8e4ce7d09938ac554bce0269e21d1e301288063102187ef653401b21ef5e88e66f71d10b36fc6fbe2b68a631262e5df83b6ac
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYd29:A3k03kB56r8
TLSH
T172257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 962KB
SHA256 a4136f7408d10651760b66950c36d2334bdc4778b6baa3a08aa95e384d9ae789
MD5 31ad89547c73fb1d01927d738ce3d8c7
SHA1 4324184c7c2171c4bc0bd0270431ac3accecb94f
SHA512 ae7c5ffb6f88e2729164dc0d8c9bf631291e033e3c3afcc1072909bbc19cd5c9d6f78386463c76125f758806fa4f4b4a7fb91841b075f3d87d4cca18717759bd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYd2c:A3k03kB56r1
TLSH
T1D3257B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 962KB
SHA256 e10f3857a8bee3443abfb594017e1513d7760e52ae5c16428fe4f917d9ec50b2
MD5 678a84f79535db1aea9f271127410cb5
SHA1 24827cd7fe0d1d1813a4e1b37008a13d0af7c3f4
SHA512 2c458bbc37467db2f70d7b3981068b8627d85db00c4d6df345148ff8278155f537639193bd55e20080a1328b4bb5385e418e0348af3eb3489c85f0e5f239a4ba
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdvp:A3k03kB56r7
TLSH
T158257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 962KB
SHA256 aae49ad67e647c0db0903f05c07ca41b924a0cab50759de1a4b350ed3391f5d9
MD5 7cf6bd0dcd6c51add8cf3d617e0d1f7d
SHA1 86534e49c11c4a4bb802507ada6a65ce5f246df4
SHA512 cf8ea876e78ac8376bac75824ce00b10d9c19463576ade58bc71611a3cb202e9685429abed1c872686ebc728ea1e7ddbb9b0a21031dc5139bb64644f8f358586
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdQN:A3k03kB56rA
TLSH
T105257B03E6940FA5D10F81749A964A62EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 962KB
SHA256 5e84a9d874da4bec67baa6dd496d9e0efcfb263920db7108f2f593c1569879e4
MD5 b9cd1ae548b1159e0c1abbb309fa6d66
SHA1 5c4f02b057675eb9dc51babfa0db70b456bdbfc5
SHA512 7f63f984b35c2dd2bfbe333b33858ce0a025af22c54cef4e455eb7d7e7197d1555df5ef6df8de190009c89b4770c54f442d5985dd67b38ca5ed3611aa4248791
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdYF:A3k03kB56r2
TLSH
T1EB257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 962KB
SHA256 429caf64e340e0a0c2c23d2058cfdaf635763e47c345c51cdea1bf5e829fd3e0
MD5 38385ce6e38caf4bec657820fc530899
SHA1 7c906fcd07895366d2f5a390384351b229ac72bc
SHA512 b7f1d63b9a5456bae8e76663ff839d2b26ab9fd4bf54bf7f5fef377ee3e96ab3f00cba41b90df651b76c02bde035ea6d535f066ed3f7f51c55914467182913a8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdNC:A3k03kB56ry
TLSH
T1E3257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 962KB
SHA256 00895dd88b9e12422df143ac46c3df26f5db643653affe00190875a15f578151
MD5 dc636cc41bccc4e1a70e36bc5e92b87d
SHA1 754e26ccbdb87bed4132fa7940bfa17fee36f33f
SHA512 8d2c5ea34eaafe79ea4ef2275b426486178e989f52d2cd0766f9ed08e4832b4eb666c4bed57c435e78ca41cc92052773fc8f10b160f5824e958acc325cbfce04
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYd2w:A3k03kB56rH
TLSH
T1EA257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 962KB
SHA256 0d5911afb846bf316103e1f7963dc6b9f9d0739122bca540634bbb3af1d4a216
MD5 845845d03c525b421bcbafff5e3ed63a
SHA1 aeec5ae814805c41e121965f45f8ae463c353a08
SHA512 0dea543b1efafcabdfd3a1ed3e56133d301df78bacb84afbd68d2a5abbd416ba34fba37b32f4364ee4d9cf9ceecd9f73bb04f31c1e01137d78afb2fe997a5f22
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdlT:A3k03kB56rD
TLSH
T1D7257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 962KB
SHA256 983e57e9b9d006c8ea2e211ffd24ece47dfdea11497d2dad7f0b2ac80046e5c4
MD5 dbb975c2a316fcf5a6721075d5b3a085
SHA1 7d6af4dd3542d710b4c730b9c502aa5db580b389
SHA512 ce7939a88d70b0789680519e4d90cbecef1aa2f6c8c81d9af40410f28a3f5ee41f7c3f20cf7b56c62faf5215b6f24433d9a59970469870b4f45765e8b4616ff6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYd7u:A3k03kB56r0
TLSH
T1DF257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 962KB
SHA256 5d5ea342be1f5a93662b77bdffc4c98f4fa470157291f7dae0b825e6f1772837
MD5 10ae4034389712cf4b0a1475886939ec
SHA1 43e5274b1f82c140e64fe273dc831396488b7302
SHA512 bf27c6407558a6704ce7e80a22b420b9c389192cf0a30929e26461e73b0b3f593d4bb3e0a843e4dc74c790eed850de437bcaf46f69259142ef0fb98cf8eb35b9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdfb:A3k03kB56rd
TLSH
T144257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 962KB
SHA256 86a66ff6f4912c973f31b7c464b976c4abf806a3e4cdbbb9c91c71910f8b20d0
MD5 ac0c90935c5a11fe26707c618fafe711
SHA1 227d3bdeeeb9452b17975713735a5e5385d3fef1
SHA512 d1ad5839c04d49d15f6c5c68cc9e407f6bc35b6d01761209ebef27c39611d1c97b2d94af02a6d1decdb0f1807c7924b285481d560ecd95fc67986f2b7c3acc48
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdbf:A3k03kB56rN
TLSH
T162257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 962KB
SHA256 3a996ce4db9012300114d2d93435d39fa1d50862365753b104c75ce798154350
MD5 6c8e3cc7449344d2bae69693c8f730a6
SHA1 274e49665f3693473394576e9bb9c7e2a437e41c
SHA512 ef23dc6a0dfeca2f622dc1fbc5eccea2f860b835bb967b3b7b3b5f9828fef8499b1bf0bc5c53f79ec086e4c84bad9183bae909de60c969f9c0959b333417c306
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYd0K:A3k03kB56rF
TLSH
T1AA257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 962KB
SHA256 f6556d85868b3e54602bca1468e43a33916d90f57e9a4c808f5bbdc0cf1ce756
MD5 efe976bd571d1bf4e17f6129eb0b0b30
SHA1 2272805036e9a4ab827ce225f93a575e24679b1f
SHA512 a7d9cd919b37f2904d554d5477399a256decd9834ca148e7cc42dcf175794867237ae31db59b4b2f0ee1d8ff450436641a7d0636cfe12c221608227b09d39927
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdpk:A3k03kB56rs
TLSH
T125257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 962KB
SHA256 0f712cf16e328b55a2a0ce2459d8460d4bcd7446392ad069f1684c278c0921d7
MD5 75e2bbeb9d6362f2b4d571f09cc219f7
SHA1 975e4d089f6d3133866883c783b73c33cbc6d0ff
SHA512 bf89ac6bc0128a5497a7f7505a5d4500034f5509dc8705123b8a393b3b536588e6205caf47bd8e64b9f8da8afa28344c625fd9b3d54f698ec2d67c4586a229a2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdG0:A3k03kB56rF
TLSH
T1D8257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 962KB
SHA256 3d48048e65b8827a8d7086892cdb2edf4f18c8584bea43b731b9fd5923ff4d65
MD5 a128f5f67b2118ae5f6928783de1b1a5
SHA1 bb439babd9577c4083b9a6b9523f2d29927c0aba
SHA512 39858cf467e3c8f7aabca487eba8e185d75284453179dcd81b56fc56f3b2049cd411cef8d9968293bd09a5a3c781a58b6556efd936fc134a261c9efecf25b212
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdVg:A3k03kB56rk
TLSH
T15E257B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 962KB
SHA256 f54ff45b74583a934ed8404c5a92fe38a2c06dbf476e5c4efd29174449fb3eda
MD5 b570764cd3d9fa4500b248a29899bb2e
SHA1 9f62530f068b974545d9ca01ac161d0b79415fdd
SHA512 0795d96cf1bf762d541b1655d15caaa930dc7b716bd871f4adcea3c60dee7eb1a3e59db0c53ca045511a9155d4ba6d02419e54d984ee8ee04306bfffb9395bdd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdkr:A3k03kB56r2
TLSH
T166257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 962KB
SHA256 7458aaee330b874bb6bca6f1c3dc04d55464182eca4b332b3f13e9143bbdfff9
MD5 f2b97f56731ea63191856cf579396337
SHA1 9ed9c64001682b63edb21a861995853afc54bafc
SHA512 6555ea755cfc396c006e0a5a36a6d7b1e6534221e88baf3acca8b4c7ac9af6fd08e6afd97c43592512a970d2961e233347a5880e1c5c10f29b91a3a642ece5f7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYd6n:A3k03kB56rw
TLSH
T1CF257B03E6940FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 962KB
SHA256 8401e694820d26cb3cb242f7d3e5a62842b0e684425b6eec955f9cf73f7e45ac
MD5 e1eb282a9675bef49ad78ffe1c9b8cb9
SHA1 2b4c63fa7bec2c3d2b5eaaef514d0418f4f8ada0
SHA512 34e357c24689ea01f1345e89e3fca635c0aaa9640e6c0296651c9ce8f9b4d06640d930d1a384689b346118e23674bf57bfcd260bee9087526a31922647a795c8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdQx:A3k03kB56rW
TLSH
T187257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 962KB
SHA256 beea5e50bf856e8608a9843a320d179b1f369f7709b4bf950f448e57c294fc80
MD5 2abe23bf791fb0ad515edbbdc74d99d3
SHA1 7aa30c3775a0ac8e8438e95a308762c5850470f2
SHA512 ca487800d04ec807549ec0a2a1f31e6071849d60871ba5f16b8385926c143710da6aaf679bf20035bb53d19ba017d924dd05ab2229d6caf49a0e36cc919d4c1b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdSA:A3k03kB56rN
TLSH
T1AC257B03E6940FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 962KB
SHA256 5677248b7ce8df5508899c863c5418a39515d99714c961d82f345bb34086355e
MD5 564e2e84ff6b0a0c8c7141fd460910bb
SHA1 2b8501f9f7c1ef5c00a7da34f16e2c55ea79fcf0
SHA512 b65a59ebf05c70dbb206b7fc4c9c9d0d4c4b49df02b3d76e08bffdb61f9050a34041160303fe691dd01116458e16cde946e0dd6f7ca78b8eb0441bdfb1b7a171
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdr9Q:A3k03kB56rc
TLSH
T16E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 962KB
SHA256 7982520739105a86f62b4b2c4048b041d142204bf70e4ad8fc0b3902a61684e1
MD5 18f91c3c98618bc8f6d888d7cc8950c1
SHA1 3a785d2b12f053e9dfcd446e7d2ab3670b9f0d17
SHA512 8843e04eafdc9aec5c30b636d608bfee0f95c86bddb9854c35b10b521014a69a0e9c49e187cb7d6f11e5c8fa92b938f04173f9d267a74abc7aca45727c7e77c4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYda4:A3k03kB56r3
TLSH
T10F257B03E6940FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 962KB
SHA256 2d5018dbbd2307d46e471222b3676a930d80806aa664c2f69ad7061226166087
MD5 a6ee098e1e1c63e695118d89eb1a7fad
SHA1 1b6dbf1e0397eb03a522a13fff87e9414bc5dcb2
SHA512 98450b2c89805cfe01ca4f9b41ec9d951784b55c3742ba401844a43b78a169a710664401007f5af752f53295e0b57b7848775792e345689361cd1bf4a3eed949
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdBu:A3k03kB56r6
TLSH
T197257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 962KB
SHA256 7b0ac0de00d3218580a06d3982fbc031e593f884c2d7e3010a46012506bf36f4
MD5 04b42f8dcf9ab3c8cfca5cf9817a544f
SHA1 9e27c71e4d24abf75d2426bffa1d05871e2ef9af
SHA512 2acc058ea098c2688e3fdb6a04426313ac8b4f8f3b9a45d9489195395e582f36f53f77cfa701dce89f51f297045645fd0bdf8c9946033412e898ba3e75ebbcbb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYd0j:A3k03kB56rU
TLSH
T192257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 962KB
SHA256 acbb5738e093fa08c5a700ae1fa87791cc7fc6d0022c65ca152f4e04063e7e2c
MD5 f22c4e2ba58db470f9f9d31141f9f339
SHA1 379d62607b19240a8d571ee9665d06b6748a35a8
SHA512 0d0c44afdeb8931ae4c4a659b26d2b7ff65cbe6e0d005b1eb3dee97e4324c5adcd73eeeb17d25b08610d8fbb1858e64a1d4883668d9df2fef1eebcbddf28ad97
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYd1g:A3k03kB56rc
TLSH
T122257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 962KB
SHA256 e90ae16bcad4a96d5a335be952b0cee8ab1d420483fc80510bafb6bdf1d61000
MD5 2589d292a660b8f38675f8379a7c3a60
SHA1 d46a2646b80ce8476d9a35d8958fca37ffe12c24
SHA512 582fd355e995021c0931c8183ab8e11a50813e5bbdd99a284f30efc73c6b251e6a0d775ee821fecd5cec4d7c7371307518579e686ffb2d6c6673fc5ffc3b8698
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYd0I:A3k03kB56r1
TLSH
T1E9257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 962KB
SHA256 b347f75aae1e963c278896be97954691ce1959581862a56ede955b2707901fe3
MD5 2742e372eb144e479ca47407d4062d09
SHA1 e28a8420fb54b82d9943e8bfaf6921ca11ef528a
SHA512 ff91604f710f1790bb147e953ffa0e59fc0c5655c498f7213b911014e7dacf2782effe70b593bef38ac3a2f0849de26212e763038845ac66a3727915214c7305
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdmo:A3k03kB56rj
TLSH
T156257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 962KB
SHA256 cae0aaddc278fdde81a92ae0811a26d16bbcda2b5048c8c9b6d15204e10236c3
MD5 e3db74f5c34d1a54bf939f5a27bc02ad
SHA1 5d1e5e78a7375dd0b3a020d40444aebaeb72910c
SHA512 b66093e554c4dc9ee375ae8da5a9c069d3bb0a11df5476d938cabdef5085b1fc5fe510e06835b0038268b06aa16eb8e87b2bd1e04b72e0895853bf259cca774a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdN+:A3k03kB56rm
TLSH
T16B257B03E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 962KB
SHA256 3b285952f4883f72b68fbccb7ffb6d2e3ef3ee58495fb70794693fdb2be5cd78
MD5 e07656c5e7678b8dfb6259e88d531fc0
SHA1 d2e40d7777de6a8dda850b182a1ff933159d8328
SHA512 f2932dd69c47c85d7d5845a60eb03a32a006cde56a6bab3561f662c85dcfb7c2d381d6d45fef6c2502c16043c9ca65a29a5d7941b002da432631940ec0ebe58f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYd7Q:A3k03kB56ri
TLSH
T170257B03E6940FA5D10F81749A964A62EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 962KB
SHA256 02517ebc9ea4b924bec25f6f1e5b07909f1b657faf00b5187106d96732ebd429
MD5 cbe8dbcc0e92e0f8292d41a98f551f47
SHA1 298fbce1935378bdc850b7a8ba935d0d87ff2c96
SHA512 5a8324362beadd2a164beaac8423d52493052d2492601fa41193499c93944329c97d3e1eb5b5f594fad34ead1b2a830d6585e8bf4d3dd4625228fd452b8e7673
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdwX:A3k03kB56ry
TLSH
T11A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 962KB
SHA256 aaf778917ae0b5ec7a931a1d041f8ed24e71ae207c64b2fff918d63ac1ee0d0a
MD5 f959436f095b4ba2812f40855e73bd76
SHA1 9116a7111efc353f31da32134058db4d866191f9
SHA512 54325e8c0e5976b581300d0247aa6e936721e3cb6821900f562925fbe8169bd8b1b33da3b2c9c9b505d38eb8b83326a99a39e64cc0a744b70133caf5543ed3f1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdGL:A3k03kB56rc
TLSH
T17A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 962KB
SHA256 012f659ce10e44c8dabd23b7ee5037f8f0dbb96733bee0969b0f9f8116721840
MD5 bbd5e0046813d0a9fac1ff7ffa63086f
SHA1 8ff6124153a29240f44b9f4435b39c8cca0a6a5b
SHA512 996803776a1f771f96517d4784e333380d899a350da6346a4c96851c950b8f564774bcdb80ebe2f3e9cf66f54fba783f8a5e6b64736b5916d1fcc0e6510c4901
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdaM:A3k03kB56rt
TLSH
T1E6257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 962KB
SHA256 9afb2946b9f150a7d4c6bc9583419ff876ff91700a6593fbc93d0e3b45afa751
MD5 016302574106db518788926dccdea16b
SHA1 a43bcf95a94475196ff7a9ef6625b88474a18879
SHA512 5b50edf59e6df81819065ed52463670cd86117a0ef392f4000cd51669a630ec5646db5beff7ad682096886d1a72ef955a9d10dbd704ce6567991e6702b64861b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQYdLh:A3k03kB56rH
TLSH
T16D257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1444-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1444-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads