9c9564d8279c709815d680971c666efc2d954c863b134c9fec7599b714f1560d

Analysis

max time kernel
103s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 940KB
Sample260807-n63tcsvcpf
SHA256 9c9564d8279c709815d680971c666efc2d954c863b134c9fec7599b714f1560d
MD5 184a1db30a8085e3b4350b2a1d5950f6
SHA1 ebcb403f2ac6562772373bd68688492106bdc64e
SHA512 e243312eee539eb1039941381bbb6d1788f1c44cb75f2fa36f69c78a312640115c13b6321bf40b87a44b8c51a9d127305f59fedd2fd1a5de1a2f5d46c893861a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPu:A3k03kHRJN
TLSH
T1A125AF13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3376-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c469-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3376-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2264-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-582.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-620.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-670.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-731.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-768.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-799.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-899.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1099.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c469-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-582.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-620.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-670.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-731.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-768.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-799.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-899.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1007.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1050.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1099.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1136.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1181.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1219.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1322.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1366.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1379.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2264	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\dotnet\dotnet.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3376	2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2264	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_184a1db30a8085e3b4350b2a1d5950f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3376

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 940KB
SHA256 9c9564d8279c709815d680971c666efc2d954c863b134c9fec7599b714f1560d
MD5 184a1db30a8085e3b4350b2a1d5950f6
SHA1 ebcb403f2ac6562772373bd68688492106bdc64e
SHA512 e243312eee539eb1039941381bbb6d1788f1c44cb75f2fa36f69c78a312640115c13b6321bf40b87a44b8c51a9d127305f59fedd2fd1a5de1a2f5d46c893861a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPu:A3k03kHRJN
TLSH
T1A125AF13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 950a690d8187f6cb5268f4690b83f108c86db663ff4b46de531f7850654a49b3
MD5 1f5e7d3807d885992df9cfe3cca41ee4
SHA1 00e4ab446f07424992f8d79cfcbca453393fcddc
SHA512 41bcf7b46b2ebf7f955aa1e2da343bd6003f56da29a4641a1c37f156d84bc55d9675999362f36c53e830e3b1d1c6a8ab4f3ceef4a502714cfa14ca1641d6e71a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPe0Le5ji0hmxNrM:A3k03kHRJZPji0Aj
TLSH
T128658D17F6A402B5D067C1B8C5D69A6AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 9db56cbb56cc32a4216d0f8dae6cdb51b4e8def6e780ffc2d89598afe869b452
MD5 3c2ff10f24ad258d79ac43d10799d7f4
SHA1 37f2fb76f3b33b9fba666aca97cb2625a6451e23
SHA512 c6cb28f0df7e365c77d817d7ecbc37cd5dd613d2215c411faa15ccb72f0b098613b387f631bf9eccd522911393d1ad845203ce3d5046e3e033b0d706c386d1fe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPYa:A3k03kHRJ
TLSH
T12225AF13EB9500E5D10AC174AAE64A23EB757C56176097DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 a7c62f545ccc0b4d9cb112a91ff4a2e30b75fdbf7832c45c54f8cc180cf3b6e3
MD5 189d77f414386accba3f0dfbf3d53afe
SHA1 bd9aa1b62722ad0827960f391bd5895089653c52
SHA512 33d2001d0dbce2f09e1d388a18bf70aae3bae6eea975b5e8a3d7fd257d588e61e0a9ac5410686058af57397166555c4a40612cdac7c99de0e0190e1377e9ab61
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPx6:A3k03kHRJl
TLSH
T18A25AF13EB9504E9D10AC174AAD54A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 963KB
SHA256 de9493971e5d48165a773a6e69c15e54bac5ac5dad14338ceefdad497f84a34b
MD5 53c453b23872d8fb98c3cf7c9440b64d
SHA1 9f61509f044f44c1fd6d540e0865c8aaa53e05ba
SHA512 01b06ada9b4b65c8205859ddcdb07d45d54afc11546bd7a7cdde7f29032325a9d15a7ea12e80b085bb59209fbad8f667d2463e8f1f8d03985c7e5fbe7f86679d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPvN:A3k03kHRJ0
TLSH
T15625AF13EB9504E9D10AC174AAD65A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 963KB
SHA256 808345860d1ebee43e22cc61ab682fe9a2f20c4d430f3a126297c7f27ca5ab06
MD5 a3e9383ce73a7f4abe953a388b68c1a7
SHA1 6dfc0e62765026e581fed5f5003a722682b297dc
SHA512 27c1ee36d7430992f34be7d1f60529748bb32a17276fc37ec099eb9a7892467b104097d1e48698e68e6c3ce2a8a32215f571d39b5492e295c2869056ed974e3c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPVf:A3k03kHRJU
TLSH
T14025AF13EB9504E9D10AC174AAD54A23EB75BC56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 963KB
SHA256 8f0dbcbdf6c42c85018bc1840c80cc7802dda83ee3b6e05ec5447b311c224078
MD5 51be84732786806dcc012e6a5605d457
SHA1 2f2492f215e56402252d272b7680d3527e6da237
SHA512 c82ed9e40a0550386ab25e162d44dad499b5c5715a14c58567d8064d1fb4c99d97085f8a9daa55427d5ee5f1fde7ec3ea051c93457c2b71ee4dcbfe7064fd813
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPXo:A3k03kHRJp
TLSH
T13A25AF13EB9504E9D10AC174AAD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 963KB
SHA256 6a2f14f3f6dcc29450d4aa4d2516f3360cba9198dba7e5629d57a5c158cbbccd
MD5 f961621c4ae149fc0bbdb25ea8cb1536
SHA1 ce7efa2914ad566fe2bb0a8178c377e9e6d9d47e
SHA512 9ada17a5a2cfb76cef61e70a214f113459ed0e7a643fcc7a11b6c99737943649bb17f87ba0cd9d34bde36dfd5c5fab1e1cdd412df2ba69de2cd0d805afa115ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPbu:A3k03kHRJL
TLSH
T1C825AF13EB9504E9D10AC174AAD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 a17844d83ecf9fea3c325295c8d00f76b3c41e481fe28dff4d02a7c05c2721b9
MD5 9724e10200050e860d7c695b15f2a7e6
SHA1 ee8bc4437d78ae074aa133f882d808e1c3aa7eef
SHA512 295ba67c90f284e2ddd3d979f94b8a1c389cfe96a05d212f54ccd544ef030f6976a9cbe3b0a9aecfec4572db8a05fde99034a716c032cec8d9053746dd16d15a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPJ9:A3k03kHRJq
TLSH
T1AA25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 50ce2bb90bede1a326e1b215d41478a7196adf4103a001eb66f1e398c46cd564
MD5 6c4c5d3b5cc4c2db9573e32862ece613
SHA1 9065579013570dc45376a2d4141aaf8f9b2c5ae3
SHA512 f0c83fefca96de9d4544e2a550efa1b495d9858314081a400a3c43736b11d649d033e8cac521a0d49d93195f7e453dd2f9dca7efb09a469a3dc40dcfc4d0dd32
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPlc:A3k03kHRJH
TLSH
T17825AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 dc13698ceb94cc02a8191100da91eb8c3b34d5bb94522203136cf0f592c3ef6a
MD5 f358dcd1a05d0474d1e47ca969dbe46e
SHA1 03c989a2990574a65e8ea3a2a9d3f6c43b37e850
SHA512 c27f7f1875f9310b5dd2ebd60a15aa05ea635848cff89c9353d4ff470630fe3ed6df1978be0751880d6160fbb09e2cbcf78125eecbbd1667649bcc5ec9110011
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPep:A3k03kHRJd
TLSH
T18B25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 3433f980a6b20e809263d49ae5832ec216f40487676ae6c0554c23e9048cbdf8
MD5 1cf4d2b017f228408fb7a97e04ca25d7
SHA1 59a1b66de08e079d3efb07a1dc4c21cd487766e1
SHA512 328a28b73a6bb8985daec3db43e9889620e4683de91d85b2c2afe79f96c7374a993bf1eac88df80cdc0e0ce5e458a38aef424c562581bac84b5cb2342f7def59
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPRN:A3k03kHRJm
TLSH
T1FD25AF13EB9504E9D10AC174AAD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 2c70a521bb4576aa886561567648d4f293231bbc4d8d8e011d0fe9b09f5b28ee
MD5 ec8fd5ce6629665d4b10ba90e48d1719
SHA1 266821933d47c20b1baaea7749239241e63b9a13
SHA512 4f2ccf75195ffd4ee59bdd69a1d32109e9ce8076a8ceaa18aa9604da9c8920ce90268679909cf36751a8060b3a4a320a26380dc103b3b646072813e4409e99d1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPzF:A3k03kHRJE
TLSH
T10125AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 bd6193a6f652821fb852f1e9c014548d2cf41d6a55d78b8dadd68fa98aeee056
MD5 5a617562f1ecc093c685c0308104e608
SHA1 1dca3f444a47ff2281e589b673291ca7d3f7d486
SHA512 4be10517e250ed410d4abe7848aaddc3d06bc420273224fa19eafb227c8dcb661c57e5969a85b759ad877d2808376739413f0461c6568fd2256aa44142a29493
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPcC:A3k03kHRJw
TLSH
T15E25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 69596a2683fe9927ae406ef0225296f572bd9303a43fb58cdd169723d4953e99
MD5 b0ea206e665a4532d69ff21460fa2932
SHA1 dd9461fcc3d3c1b8fb12d5b9918007886e270ab0
SHA512 e478b9ed225fe7a1a3b431837ac5cf272a0300c501294685506cc81bca36f9637323edd79b88f1f660bd0589486dbcc37a4bb6916b69d93c85f19d7c26bc76ba
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoP3w:A3k03kHRJN
TLSH
T19D25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 5a1ceaa63c58ee4d10ffca9ec09dd6811e0943584bd927e142b4167b082d231c
MD5 9b60cc3537da9a9c8775b3d5b45b53b3
SHA1 3dcc536c7b13335e5b5cd6142310247808231e9d
SHA512 40fcada3b08184b1df65af95d32af841f63fa891b3f6a69a5abbcddd555e1c4ca258fef2f19e1f13df54fdeccbd6504cef0482ef2551d032541ccb31586659b3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPmT:A3k03kHRJB
TLSH
T10425AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 3ac430497a9c4323e311ab709e3df39a0a9559db43761eb8b7125cee85bcbe4e
MD5 668b3939d9dcb614b96cd3e2795d8cf5
SHA1 e1ce25253b69f76ddf29e783149913f974557e66
SHA512 a7a233727391e3ff3229c713766e63d167de7d21d9e0f0d80717b97646254d154ee7880cf647da53c6112eb5c6428be2eae2f288cc081ae2d7e6f3dd628a936a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPeu:A3k03kHRJ2
TLSH
T14C25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 bd73795fb6525fbb4c50ece56b409c7a13af6cb57bbe2392d07ef5fd6b6ef7f7
MD5 caeb7b7ca98529c7cdc2f3237233a287
SHA1 234a5953c72e8c6ca155bfc4124c0c07f9fbee3f
SHA512 62843619c63126ab17cb285f3a028a99d41cfaf81de2968581b97e595380d0a6b8261337d9273327d1c8d5f24549bb546d139c5591d3db7b79464dde0a29543d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPYb:A3k03kHRJH
TLSH
T1FC25AF13EB9504E9D10AC174AAD54A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 c81b727b5a0c355bd94754f0ec06668da08c6ac1a270bc42844806688d11db90
MD5 b2835fb94c8f5fb5e9eeba53a4e0b4bf
SHA1 2c395997c14f5a28a129af220993889c363907ad
SHA512 50e7a8d4a7058f75860fe1e8238e83cf464d33d04cdf3c39855963a96cc227aa021aa3b134654f40fed1bae09c920e3b683340d6c82011e3026fd8feebc2196d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPGf:A3k03kHRJv
TLSH
T1E025AF13EB9504E9D10AC174AAD54A23EB75BC56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 331b6aa2da344fa20945f7bed432d6092b03a8694bd13ccbb506ab22452fbc64
MD5 956099d46689335146bf9bba50df68dd
SHA1 3eb2c58503df5126ce1dcc0884afa84134bcd4fa
SHA512 47b544aa25dc9f3d3f93f0d9ef5fbad326c8ddc5a2c86a13104f0467806727370a36890bee7f7c085fa2ddc1a2c9571c8c521f76614b31bcd8040d40df8aeeb0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPDK:A3k03kHRJP
TLSH
T16525AF13EB9504E9D10AC174AAD54A23EB75BC56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 6af446ba7e86910ecef3a03f0060fcf1a60fd868d9b2551777224b92781276aa
MD5 6df74cd446048a41c7c74e2b3c875317
SHA1 500ef8453e4d10b4820b27428bf9c691cdd244e9
SHA512 e006358305f1243703e50de0c0e976dd9d1e5cf79edb959ee2069d7af6b13b804f0c6e3bad13346028c97198b36f652ec99fc8639ae29628c6a3488a7addec89
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPkk:A3k03kHRJa
TLSH
T11D25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 f5487c6ec6a838b97b2d0a10655d6d3be9861664dbd37fa64afc6cfdc964a6a9
MD5 5f954985261a25241cc8e99b0eaefff1
SHA1 174b1c4b55d73c6efd4835574d0c99ddb0770334
SHA512 e5a2a3869753cf378f9d4b2aeb789c4cdc2d682778b27f8806a70a02783398ec9bac53b86df6e8f9d4f2c354dbf9e4e01856817326a757ce098ac12627b0df66
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPt0:A3k03kHRJv
TLSH
T1F325AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 484cd7ed53790d80f6d1c2a5fa590f202ffe980630fedc3250006919e40ece6e
MD5 0121bc262ba39d24a1191478ac66614b
SHA1 5d638fe6457f84ef1c742296f1986c78ce7e765e
SHA512 3198df384b6badebf3203793a02ed2af018afdb9da45da4e43ff58c61038eee986703e680a3060423ced2b65dbaaf35d68e0994461bbee3f70b7b517776dc54c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPwg:A3k03kHRJy
TLSH
T16125AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 1b28e07b29434406e53f9e1432ba5b933fcd3af8cf5fd35e33f697db9846b115
MD5 3225fbc2473088eaf25db1d49174201b
SHA1 7e09bb3a08bf1beedf1723e9f704fadf237de1bd
SHA512 2b60da4bd6cf396a635ffa0293e738a1f5db64fa84e2af2bf86dfc6e083a19e224f98c1d3d77b01714870068c18aeeb721a992666cdf5823bc0ceb219d5f67ac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPFr:A3k03kHRJ8
TLSH
T12B25AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 03e7925e737c657aa17309ac6ee532f9ebd8cc56602a6a65af37b7a908da39ee
MD5 c29e903e41af911ba563456558485fce
SHA1 4094c355965b4071fa3d16c3fb703a028996a794
SHA512 65108d7071a1b0133dbad0dfd2059fce65495ad75d44e6b3aa75088c4b54aac1113a4665d18832ad3cd76c85af3a12772db79e75e9b119ea63b8ac16a620b0d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPPn:A3k03kHRJG
TLSH
T15B25AF13EB9504E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 e937ed8ddb829653c36e6dede0754be7885d72f0ba9814e3363c783fdf7e1e25
MD5 0d7b7e236f605dbbd0d41d83bda78359
SHA1 7a47d8fd0256146093592dfd94f7e8c2004e40b6
SHA512 32f3345bf99a05cf8ff838978f42faa04a7628aa036be876001371b4a4273226d046598bb725ff491af174801fa937689e4b292e9c66967ebcb148b9fb351eba
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoP7x:A3k03kHRJc
TLSH
T12525AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 069be7490d56fcf21c6b05bcd6718ebb9f360628517b69e9de0c8b71acda3297
MD5 396bb383a7035d78dbba1c351bd3e6b8
SHA1 0e8a118f9f222052ef7e4e6c197c2cfe9084c3e6
SHA512 384e7d29f89d535798f7b40afd3ab7ed58d515aaa4d91ecc5e26d3ed3c2a5e0a415c89fc82700bc05302281e38a18dfb0e6e8006faf990b552a37e0d181bd9f9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPpA:A3k03kHRJn
TLSH
T1D125AF13EB9504E9D10AC174AAD65A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 0e76f897b97f87d314feab4e9de53150456763eee112d8cbce11e90273471e8b
MD5 984682835f4d9e5f893181e42fe3a0d4
SHA1 be963a6bb946da55dbd235d2d342a9bb545ad801
SHA512 dca36faf837813f9127eacb21fa5ece8810ae7e52dbb03d3fe54e49b27df981187423db7e450ecf6a19437b2796cb459d171aecf3f81840a9bb9f84060fb6f8c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPi9Q:A3k03kHRJK
TLSH
T1FC25AF13EB9504E9D10AC174AAD64A23EB757D56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 ae508b1016586e7c0d0beba31f8a9d978da19b73114bfe1795338c3805a4b209
MD5 6cba56322dbeb6ae39eae7cf1822b5f5
SHA1 d923bb23cc360a041dc841eba7a7453c1397d82b
SHA512 e2c516f3694b0290fe454243944b2da86ce16ab4959fd0ee28ab7491fc231f51e8d78467b591ea269658b83c85e918c40d280c57ba5f9ad803f5fc336d6cbc33
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPH4:A3k03kHRJJ
TLSH
T1CC25AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 7650ce15364c03b79dcb4f5da8c3f2ddacb2d3db4916ac9b4f9c08d882937d6c
MD5 9b8ebaa066eaa1464a35479c960b646d
SHA1 0fd822e6c6c7b277d138e3ce4eb61f2e13c7d074
SHA512 81339b7b93c297e155530c1e4f9bfd437d4ac405851fbaa89548847a96a022a3363d0311a5d9e4868abbe12cb88e3b50ee13f70da5eb95436cf37e2b979ed8f6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPmu:A3k03kHRJU
TLSH
T15B25AF13EB9504E9D10AC174AAD65A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 191d332adbd6b0f0d027295970143266b66e2a36365b869fc55ae667887381cc
MD5 0f410faaef797923d89f33062936976b
SHA1 a786fdf9ce04d81924e483cd9861013edfda78ca
SHA512 d9a9d76c8febe276c2ae728560d2d597b215b183c1f8367fc3263d31a959cbda166af3421e3859f6caa0029cc22c8c662f2cee3fd485348b9b2a16b4e21fc909
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPXj:A3k03kHRJ2
TLSH
T10125AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 2bb06b2cceeff9849c9a6c926de275c46716f1382055b7ee3d0eea0d28a899be
MD5 22096afff7b4d306b102f6d85a656637
SHA1 4b177f49a3f0aca6f26bcf3bae6e7886ece37108
SHA512 8e6e4ca367e151b6238a95b9f040fa7c11d1d2db18ce0d2528430be05c7b9bd689c5845604145cd2aac44fbc5dde13d2f61effe1d94d248ef286e229040824e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPCg:A3k03kHRJa
TLSH
T18225AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 df8e472ae49012602344d7bfe37c0b084c532043ce20ac180a93105f961c4419
MD5 1d7070594eeb0a72e7b67b37032728ce
SHA1 7f730d9d031cdeefe087d3b0653b2289cc1de6fa
SHA512 b745ccd445805a11b96d01dd69ebfa1f697619524212f7bda68b4f8893587f61e3de71995f0080221eda71914c13b5d520d614449ae8ef8f9a08ea22f03c6cbd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoP9I:A3k03kHRJb
TLSH
T1F225AF13EB9504E9E10AC174AAD65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 e1cb8f003fc83e4f16a7f8970725d04597b9dd2af346e2197598a98c87b022ea
MD5 c68a48b0eba4c1f65a82ec62c77536d3
SHA1 9b539016aea86ce05e8da6a09663d7826359acda
SHA512 4909ec53df4d720ea90ffb112f51de86bf6f1e6106d597275d7588b7dd10ef1235178b0525adff5e4456963e45b76feb523e3870cda8e860288848b08abb0a4c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPvo:A3k03kHRJl
TLSH
T16025AF13EB9504E9D10AC174AAE54A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 b58f21fc45343048483eb5dc7b2df960a4236d02534f6ccfbba802d323e5f3f2
MD5 e5775d05db184d4ba1592d1a8b4bd713
SHA1 e5af81d8ccd201899525e63c9141512ad97343e7
SHA512 23afe8a311520969480cd24943bcb14f360c532a5bb6ef3ef722b3e96fe5ff67bcfb40f911a733132de0d262e4da4e0ef2279f81fe1e7d59d86225c68a26d4e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoP0+:A3k03kHRJg
TLSH
T13425AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 2d65fcb9901b1d31059e2b24e6a24542ce6de8ca8a3ec7ec4a753a6dea53bf2c
MD5 6867c5891d9c1637bef040150e70ce0d
SHA1 6984acd770e878ee98e20287b760c3c52af02fa3
SHA512 9b545e4d2daf3acff9351aa7e00b002f947f05921aeabc8400aecff5b5f5a6ca60db381c44fb63257418535177c51f6bd38d53f4b0332d57184536ad3ed6249e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoP8Q:A3k03kHRJw
TLSH
T13E25AF13EB9504E9D10AC174AAD54A23EB75BC56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 21002b3096761098c849bdc1ad173aea5f43111e576bc5da91a49617b87697fd
MD5 534ad0b69d0e23c36c003f2491f07d86
SHA1 b9c5b9ca42a326e881b283a169a1b95b39e2adc1
SHA512 f7301562a3d5604cc2f38be908c83c9c4a8235054e95184ebb2e0b83f4dc98708abaa9368f241bf6a678503ddbd1e65f0d19b86345d36b7489de82a1e5b39e56
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPlX:A3k03kHRJA
TLSH
T19325AF13EB9504E9D10AC174AAD54A23EB75BC56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 9a1b79b6fdd3550183512e51e7914c4905b77ef169a6ac8fecf1e3bbf8800ae7
MD5 9eb9f697375bab29dbb33be90f80247e
SHA1 2624c43890b42b18218deefcca0a2406a6705d43
SHA512 77edcf003f4aedf0175d541a8ff8defbb670a1bc9ab82d1eb2c1773ab4ca3320579933526c37caf9b9b9cf3825f02903087c93693f2c9eb5bb76a745619c8d72
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPHL:A3k03kHRJi
TLSH
T15825AF13EB9504E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 09ae04693df59f51349c490be12a9e788d5a5398d3845d48cc7344423da5df58
MD5 9e6e4fddbd74253b7b88e93a6b312b5d
SHA1 e2bd26a56f4758d01484e2bc48cc675f602a5bbe
SHA512 124bd718f73b48dcbea1fe55caf66b4770d7c8db8674acd1955c541a5d571bfcdebba0f2ecf0802a49c8efe0a5cadaf5594ce3e5fedfe6fbdc54c16643321ce3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoP9M:A3k03kHRJv
TLSH
T19A25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 afc1c362f49497d83252015c4a735c3df78fe0a018808ad2bb3e9cf5afea1616
MD5 8a7a793c6d159e25454ca77635766b60
SHA1 3a979d82b6e6debe9e17f787681767442c1a38c8
SHA512 9aff1315d0f6ef085c65e30cd1321f35c4e5fbd488cb2d205bf7a590bfaed5ad7937f1b93d1ead64dc41762b68336653be91557ef46e3831743d6150210e9f8f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahoPuh:A3k03kHRJh
TLSH
T17B25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2264-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3376-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3376-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads