8073483cef45058f4dbcd680fa773e44f6a66be41a98816676d730720dd7c59e

Analysis

max time kernel
101s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 931KB
Sample260807-tb4easyfqe
SHA256 8073483cef45058f4dbcd680fa773e44f6a66be41a98816676d730720dd7c59e
MD5 780a3045833826bc8ed41d9aa926419c
SHA1 3cb9770765c9dd50aa1aa6e8fa3dc4b9ea9566a7
SHA512 721eb7468139daca13bcae031db33992972b767b59bd9f09bdffaa87d605925bd058c4f977852d70c402006368ff4cc942b33605128491c36e6068277d44f995
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMa:A3k03kHRJ
TLSH
T18015AF13EB9400E9D10AC1749AE65A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 42 IoCs

resource	yara_rule
behavioral2/memory/5664-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4d8-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5664-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2440-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-441.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-577.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-620.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-681.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1086.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1303.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1353.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 39 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4d8-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-223.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-441.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-491.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-577.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-620.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-681.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-736.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1086.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1166.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1303.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1353.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2440	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5664	2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2440	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_780a3045833826bc8ed41d9aa926419c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5664

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 931KB
SHA256 8073483cef45058f4dbcd680fa773e44f6a66be41a98816676d730720dd7c59e
MD5 780a3045833826bc8ed41d9aa926419c
SHA1 3cb9770765c9dd50aa1aa6e8fa3dc4b9ea9566a7
SHA512 721eb7468139daca13bcae031db33992972b767b59bd9f09bdffaa87d605925bd058c4f977852d70c402006368ff4cc942b33605128491c36e6068277d44f995
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMa:A3k03kHRJ
TLSH
T18015AF13EB9400E9D10AC1749AE65A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 31a4701852f8a8520a095104106202b6f6b8a5d271813802d0b56ea5ac8e7092
MD5 d301a9f96c6dd27748d086c14f142fb0
SHA1 912da64ffb5ab0b32360e563f437408c6c5f3b58
SHA512 17314130b1eb258074732ab801abf5fa3e26e7d95a520d206e17658c35a9bbecb8e6854bbbecbcd9b983bb9cab5121bee549594276fef21d99e61f60c55183d2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaP0Le5ji0hmxNrM:A3k03kHRJyPji0Aj
TLSH
T146658C17F6A402B5D067C1B9C9D69A6AEE7138421B3086CF1358C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 954KB
SHA256 da5043826e539f3ff7f9f97e02b1692515c2b1fc4265cbbfb27b771baef7fc81
MD5 3b7d37520a9630d3c310dee7df189aa1
SHA1 2557e924ef6188fb3990e4ae80a0a90029f25476
SHA512 c7e7e915ba2a5a7e7089fbd3c86b2e390af50f912cddab8a001a02ff8c04b8abc9191ddf8c55e99aaa56d33f46bd3f9a64308dd1d9f59dadc3cdc81f2c3079b7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMao6:A3k03kHRJc
TLSH
T14025AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 954KB
SHA256 51d7d8cda42e2e34f2d05523f3a6e5bcaf9fee5ebc094db2128de78590d59b74
MD5 a0c2f77b6e035e5ead460aa684e751ff
SHA1 9832826b61e3a65ab9125e16eba89ed2c7a77b46
SHA512 ea6e748bae043a9b57b6e18d7823c03b56e2e263a49ca99af2416f6d2b2e7ba03dc1bb39de1a34d0cfc19304a700ab8db18770c255f50d02c218062d5c993300
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMasN:A3k03kHRJB
TLSH
T18425AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 954KB
SHA256 d45555fe2f0ac706e5f9685ae265242d00a23dc960a32bb72d025e57be45f625
MD5 eb3ea0c6369a0448e24a2c9a108a3f1d
SHA1 ab21bd897edeb50d725961589e92e1faba606241
SHA512 b2922b244047295e29178216355e34ff11c8d6fbec1c2f46f1707bad8521b717f9de8bb8f4948ad008afc1ad4a39a45952ffa777f8c47109ba65e6c4fff889d2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaif:A3k03kHRJh
TLSH
T15125AF13EB9500E5D10AC1749AE65A23EB75BC56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 954KB
SHA256 cf4a445c7b4d4b34f250f6b8677966dc7a56b9b94ead1a31c1ee6bd4a701becc
MD5 6e6218a7a8750e0c4a7c00e80fedf645
SHA1 425a3a3d9f993198898121adb89177ae4ae309c0
SHA512 1916db458b672e3670770a5383a6cabd5bfd44144968ab064658b53787bb9ce9ab0d5507c8f4ae91cd5932a2325373d368e4ffc9e5fed4b6fc72b54b59a0dfa2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMa8o:A3k03kHRJ0
TLSH
T1B225AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 954KB
SHA256 3a362f726fb12badac03b4de1f19fe3a14be91e3cfa3c37468d65f4a67a517b8
MD5 3c7f3bc40965208b078523dc897d6515
SHA1 9012941da7bf932d76b56601c26a8914975b9de7
SHA512 a7462d07e17810bcc96cf2bb576d42b7d69ec5d37e919bff2fd99a2c30270c49781e75d494081fb3e49b0fb49a3cec18baf7241282d6ac697dd9a0165575ddb8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMacu:A3k03kHRJG
TLSH
T13025AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 954KB
SHA256 e53afd08fed3e11dd08ce111aa44b9bd1ff95b3d767a9815a0205447e9d75a0c
MD5 320f73af1173f7622656c4f15a10a0e9
SHA1 246d18ee333761a7cc0b8d18144653b071bddd04
SHA512 543bb98298959ec1adb9c08fbbacdd10265d54e64cf4470dc8790a38eef4e35488d5a83f6b4f21838ff393111b211eec90940c90b323138ab5f047cc0580153a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMag9:A3k03kHRJH
TLSH
T1D825AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 954KB
SHA256 d9a5c94f2aaadaf21eb93d6c41adc3284466df3753a61fbe35c1a5ef39f3aa0c
MD5 774f58e5ec45624575c723a102038689
SHA1 c08d9623a24a924b4dcbc516ccc2f87f8d8e0219
SHA512 b45ecd17ff342e711338901dc3d9729018f6062fdcd45e3741270ee4f8804b0a80d8a2e224211372cf7cb708bde8f195151e9679e8030cbe5faac9444bce236a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaoc:A3k03kHRJW
TLSH
T19725AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 954KB
SHA256 3319e58e86488b990ffa3fea7be653302c047b295c81560cd4d30c56f043ec50
MD5 cda17572ca521af975ab37ae56efc938
SHA1 9247222f668fbca8588367f9faf5151d0ca2c0be
SHA512 dbe681213a258b47c45ee3184fdcbabfb4d198f5c4bbd8a2a17778c2a5506e0707258db7303fb11bdb16ca03f6dab86ae4b3f9b75b17f59a8bc02b1ca17e61e8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaBp:A3k03kHRJE
TLSH
T1B725AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 954KB
SHA256 b70579ebfccdca0d12f937a24fc4d86550f69ab11481415d752d5b4a04ef6492
MD5 a4bc8188d58263c278a9199e4be88248
SHA1 6a3ba0857d4a017d135ed32fe510c8f7c6afed63
SHA512 7205a2f8c14e6b4b878a83f89af81bc477c468dca0ac1ea6f770f6be7f1b1edece4540fc5294d8f117c561a4ff3c4ce186f1519ab97eb87977aee63be3526856
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaWN:A3k03kHRJz
TLSH
T12D25AF13EB9500E5D10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 954KB
SHA256 cf5167f3d568433d5a485b6c1d155d82178fb6aa58ebf2d0b385b1aa2188c584
MD5 cc51ccd1d5cdf998fcfd988f75c06b59
SHA1 5aa03ca250f13c6289a50512857624bd25a4635c
SHA512 6c83c41bda65588d0fd54319c9c5b5be762f49b89191b2099be2bca51c03c0c1f3cf61807b16bdb795820ad5b3eabadf0e73820d16d31fcd3c78d071c4073477
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaaF:A3k03kHRJF
TLSH
T12725AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 954KB
SHA256 b566533e7f08b8e24ebf6e6a096a94e03b2959362042494bc584c4c20e1a86e1
MD5 f24a223dbe5c841492203657c9d76915
SHA1 df0cd7485a1f0faafaeec475753f04d2e6d4c86e
SHA512 b4fa951482a9e992728278f01f6f19e7c3aa3de9d2ffab5a71cbeaf914878089542a83d61b8401c38d7c6bd09b9cd9c16c36e885a1841acac2dfa612c9994a0b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMavC:A3k03kHRJp
TLSH
T15625AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 954KB
SHA256 c95de8c37cf77a60b78ce5fd86e5579783c1a2acf9db539eab4127f35ceee305
MD5 f868d9ffec6d6fd75f1f5c3579f866bf
SHA1 9a66e87c27217b7a63bc474a8c681e934c63cb5d
SHA512 062ce0ad9648a26d83e850f8775fd42594635b8e81c09e34a2b7bdb4d3b19479254b271c8e4dcc0dd93bd8e1c27bc99ef5d443043afd1313c87d06d733b63e21
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaQw:A3k03kHRJU
TLSH
T14E25AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 954KB
SHA256 c543652f7e5035a5dca917123b7fba7441002042642681c02d2033fab063ddda
MD5 2e4942a67129b390e634fd248d4327d3
SHA1 ec784f46de97c15dbe46f3c1daacd70485654050
SHA512 f9d23d614a2bcbb2b377336251e6d5a5d8bc3302190c208d4873f372b5ac29ef0f11c5de0c3ec76548d04c6b1072408caff97a2296f59f49d9e1a466715e089b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMavT:A3k03kHRJ8
TLSH
T18D25AF13EB9500E5D10AC174AAE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 954KB
SHA256 83e56fd41fb9565a770df3c19fa13b190157f10f1ee7f912a2b2dc42a92b2181
MD5 b60033685ccce2fe3cdcd7c2ae64a259
SHA1 14f67f2170c8ecfbcb266a7a3521183f9a95ac57
SHA512 92d3491b9b6460f8a87f77c90d1ece87da1884b16d822d3a9a8a613bdaa87e4253d446345a09ba88a63a00a732be0d06b0d856781e8ee0c2ab12e0666fb43e5b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMapu:A3k03kHRJb
TLSH
T17725AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 954KB
SHA256 53105ac1a94d0c9ed7548856640d0838dcbe7920ae89c217753ce43f1a484b04
MD5 e8f6f24a616224732dd8a59cfcc7e8ac
SHA1 62ab10eab096f738c365c1b3c189f7a992a50b96
SHA512 1cbe70a7a30421db8f7dfc6c2ba0670e1398963ae8d6a748c5ac82b86f4bcb197b6f0b02ebbf848700c7b0660f11739e8efb4396ada3e11f75b1d069bb8adfe4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMahb:A3k03kHRJy
TLSH
T1EB25AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 954KB
SHA256 e72d253308e4e6b69d3c62f2821a985c9d05fe6749c619644cd187e30fe28b74
MD5 8b1423877fd7a606b7bc8700004ad22e
SHA1 65f232749e1f32a7ac1833e136ddb056c65ce8b9
SHA512 7786497c5a3931b0bccec08bb7e8e34aade567d4cc94450ea218f69b409955d396fb2e2ff985efb0b979ba84d6003bf830b8bbd134e5aada90108756cdb35158
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMapf:A3k03kHRJS
TLSH
T12425AF13EB9400E5D10AC1749AE65A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 954KB
SHA256 136faafea58042e04a935a1f2037ad889a8555100f162b307bd414db5d9f10e7
MD5 0717d82bb28ab97dd09879d853e614b0
SHA1 ebad2e1e2005af083e15ec204d687e4b4b3f017e
SHA512 7265607c3c3ace3b807750bf81a190643ec811092492a46cccf58d22ad73af6939f2ee95aaecbc6ce3fc81409c5f0b9c47af8ddd3cfafe0e8fc3302ce9474861
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaSK:A3k03kHRJy
TLSH
T15B25AF13EB9500E5D10AC1749AE65A23EB75BC56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 954KB
SHA256 6d3cd6741df08ead33efa4214964c09c86bf41704c50ff00f7d29fc0245004dc
MD5 553136d5889d43acb3d2fe06909cb7e0
SHA1 e5a4b037dc8a92bf4efbe8787d40c456b5d2f0df
SHA512 b242fd3ef85769416502bbe2cc35e7f1554ee2931e90d76aa65c50ed1a8b118bafcfb288d8e18994a455205098d258ec36659b292cf6a7f74d8f9582c3289a8b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMa3k:A3k03kHRJH
TLSH
T1A625AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 954KB
SHA256 ad818a9458660affb717e3a1b08c0f2579902034016bcb217874d996287cbf2a
MD5 aa64711aee23ed00a5e9d96c76cdaff8
SHA1 8dbf51e8aa810d379d5425193da0f43f3de55e6b
SHA512 a0fb11dc2b5d857b145754d090fdc81d23b9bd8d1d558eb5d56d820fc534f58c9d7da1f5230d811bcf6ce5226c0cb3604515eadd8a6af77bc1b4c92242b1dd39
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaA0:A3k03kHRJG
TLSH
T1EE25AF13EB9400E5D10AC174AAE65A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 954KB
SHA256 a1f0a3880569735df9393184aeb79cdce56b472ee83cc718a7a871dcd15bd008
MD5 228f8094443ed98ad81087509628e55a
SHA1 baea909ba31173bddded0a56392c102917cb7a7f
SHA512 fcfef41f53338b63399bd01ce8892d60e9e24ce946f84028266b6359df4676a922d7ceb7f99feff0b690905c7ac668949ee8c370c20d8002ca9ac4e1480238e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMabg:A3k03kHRJ/
TLSH
T1A425AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 954KB
SHA256 614121fa4386f6eba933334d4cd2993233d7be82ccfa265c1903614c87ef9c9a
MD5 7d769ec701f1113fc958c1f36ef78285
SHA1 7af463e7029186a94eb96f2150065c02f34efa24
SHA512 29a0e0035e2d56a0b51f14adee3ee5ea2c1d98277acf55cfed1cfc24bb693654d8ebbd57de1b9e4140286232b59606cff01ae1a2c2a1200c8300a1a3d5aee88f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaWr:A3k03kHRJZ
TLSH
T10225AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 954KB
SHA256 fa97274e0606622c9db6139ef9b730199ab47eb4698a499f140bc6fcbe52021b
MD5 b97e87af9f8b8fbd0b4a751234ea6b39
SHA1 9f46dd10d7aa2958efff1e857b7e00fc5e9aa892
SHA512 4dc4eba0ae681e6689e996810c423137976523e4f57469017cb39d79240c543546599b1ccb8a2f8d96170603a8c52d91bd22d20f930416108c8b9a5c01bbc43e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMa8n:A3k03kHRJT
TLSH
T1F725AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 954KB
SHA256 d225372a7fe670c686cf7b5b3b3a5c2bf2f1bb52287e0cad810862641ac6dbab
MD5 4504f01776b5af62d05911830dbf0129
SHA1 29569038cb4ccbc6ddb7dc08a2c6071eb414aef8
SHA512 b74a1df4d9ce30c8184daf86bdfa308d2d27db36eade3f9efb7b3d6f498ad9d82d1fed3207c63cee6a7b4a1e657e7975ab65ee109fc652e5dcb8933136c7d51c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMa6x:A3k03kHRJR
TLSH
T16525AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 954KB
SHA256 c6b6c77c7d8b3a9714bd966dc5f394cb7c3ef9819bee00ec1f7023959d82faf3
MD5 10387ed58e131bca2fc31402650680b6
SHA1 153aca8520e0d735b347a1cfeee5dc4c8978e9bc
SHA512 0ea782bd6e9ff5e395a241a1e49ba7cc655fb533655df9b92e0b7b22b33ef5b04b569fe9ebddaf321d0777f4bbe2bf89f18fc5368f5184a394edaeac0098a509
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMa8A:A3k03kHRJ+
TLSH
T1D325AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 954KB
SHA256 724db9e52e225b4889681e063c6454d1e4295eb47144252c4a854c1f7b2bb602
MD5 73af02d4fb7cedff1ff5fbf47142678c
SHA1 c4bbf47854fa87d00064d4d478555e1d7909d5f4
SHA512 74217bee0f3b3966a81086717f098f0844e1bca940423fc77b1c9777856df528d6950820db4198e6267530428d56dc6c882285f79ad1bfefdf942698422a39f1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMal9Q:A3k03kHRJj
TLSH
T14325AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 954KB
SHA256 03358e0ce70742fcc474c7cc6fb495ed2b9c3d5417b0ef4526b526536eb88c7a
MD5 3a4582cdbff87b49084ed0a6c97c5ebd
SHA1 70089346b9b4ecd9ef264024a53f1302de6134f3
SHA512 6ea580ff7d69ce2193e8792242c3081abf4449b3ba61e9069dde9b0bacfb535c743164bbac83151fcf3adaf8477c0aa7a8419f38523fe14913a67daa4b426d82
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaQ4:A3k03kHRJE
TLSH
T11525AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 954KB
SHA256 6b9ad2cee3c8cbbf55a356f7fd21bc9ee3ce505e76616373dc09132bd200bcbf
MD5 368c9bc0240c9ee54e68fbc48a0d79f8
SHA1 49510a50050a765167a39d5e789a56dd213b01d7
SHA512 6eea05556c130a081d94acdefb5ac7fced160e648039d8494c280b922a68e6379c80e8462d16aa852d62ad0c708f7e29bc8433b3e759fa8e8c504575a7c91848
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaTu:A3k03kHRJ1
TLSH
T11325AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 954KB
SHA256 e46922959b06b6d62fbd44831c74746a0973584b8a97c81296fc2da179660e7a
MD5 4511d63240b9b9e2ed04622b6ce4e6cc
SHA1 b830b8a135860a0aeaef126e2227ed5d9fafc45e
SHA512 aa2314132edd973d758fe7d4ceff0958e642ad62f2a1a6873ce24f6adbbbedbfd14d59f728a747715ef21107b1a9c38a3aab6f636eeed561ed74c9872a913584
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaOj:A3k03kHRJX
TLSH
T19925AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 954KB
SHA256 a572a57e1bcbda20304bea5dfd88e11a6b5bd14d0ff337c8d36371aa83a99e25
MD5 45d79d2e1269565b0025fef9dec3e26e
SHA1 076de6a326968c5189c05ca5e77c9a6133aab43e
SHA512 3aba724e92a9e0dc1f4af2b29ea8c4ef26512716b5dbdc6c3a0d67f6dd8f386a15c6be84edeac6067c173d9dd2d256d3432448c7a6cb5d242414f46c6b746c26
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMa7g:A3k03kHRJ/
TLSH
T16D25AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 954KB
SHA256 ad86cdf039c901fef805835545a6b6a11b1d2b15f03de918235536c24096f369
MD5 f41048af7d0768c14ef0d8043398cac1
SHA1 2ef09bac0d3f7b0c06a49511bc4bd9a1155a20cb
SHA512 21423cd2c8e6a5b3d08f60a890f96f95039438458fb9bdb9f81dc324baafea21546c766ce6a1e0b040a4761be8faa96476311c94f521acebb1d4c4cf51a23a05
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMamI:A3k03kHRJu
TLSH
T1A225AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 954KB
SHA256 47ccd2b4fee162720b5b855d9485bea3645b5b175b82df981d67c3adcf15d7a1
MD5 7985c54797e2b995a8ec2cb58d8a9b3c
SHA1 9f6f9c0d5fb08e18c06ad55580014c924c31c764
SHA512 9d0c43e5d59bed2f6538e307c42d48ae83f9571b4980e618e27f54b9f47276450daa31ff4e43bad8bf2fd4608594846e2533e7f4784ba0a1fa9ec42119b40dc3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaUo:A3k03kHRJs
TLSH
T1C725AF13EB9500E5D10AC174AAE55A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 954KB
SHA256 81a382786442e6ba526d51a113d7962941914b2968e7a7d9603a0c460a393ca4
MD5 a242ad17edced7b0481d7b97e3f5d966
SHA1 8b528c9707fbe43b3744e9b11aab87662cca3f0d
SHA512 37e3fc9eba5b6a34ad5881eae5eeac1456fc114e02574f2a323b3f03030526a196eb2354952a0defe249685ea738dab1a2e83fd0d4368de6ddd6116c90d50bef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMa3+:A3k03kHRJB
TLSH
T11725AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 954KB
SHA256 77d03829eab5af51868c0eb7acd71fd54af4249d060a3996b604381b7e65a7fa
MD5 e080d720ad064b0882d029f9dc7df6b5
SHA1 c5fdbc93bfc9f822a99106632630193e5033d407
SHA512 3dbaba478a13c8c8807974211d422b50da79139885c0b3114e8d9679b697597bf1961164b1d848d08110339fdaf357322589ffe8d082a05c58a3a6e079211f02
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaNQ:A3k03kHRJB
TLSH
T12125AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 954KB
SHA256 08b41c05a44236ddb1bbb97b015ceb607247567d7612303f0aeddff3587dc4f5
MD5 0537da8a138366175ac0a954e696641c
SHA1 598b6d590a05c39c78b3c79a58bc307075b534e9
SHA512 60e36479a9dc1a15df5184e1056e205c8ab0e5ee82693ccbbeea790a118e053feff61aea9e67bef00f0bc7f0d6ad7b824ee0f894b7e32b61096fb4c518d13f00
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaCX:A3k03kHRJt
TLSH
T1F825AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 954KB
SHA256 2fb39b4ba7eb76f88bcc9267af92b3c6f729efb79cd7fdd5a803d08c4c62f281
MD5 300d8427d334ad35adf5986b9e56384b
SHA1 b781a3901afb534da18dbc060b68d05c656fcc10
SHA512 c9cbee2ea4eba39a0773102ca04e77235b9a49aca3b5b47265711a807c4a923d9d40d552f132e108c1f6bc0cf124d55313e7cc09d198e26f35fe91e0d27eb697
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMakL:A3k03kHRJv
TLSH
T15D25AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 954KB
SHA256 061422a2f001c1a9d25d966769edafbced29d33185d8ae85e1d0b0aaf6b5c798
MD5 736c3cc77787f37a8647010e52d3f854
SHA1 d323666c3606f95514fc258519820e22cb26daf6
SHA512 f76039f55c22b2929f0ba596bd21d0639948c002b36cac7e9df0d3823ca16e4897cc7fdeb2ff667f81b02a239a3999933d0b0246037a245607fb2b0228033515
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMaAM:A3k03kHRJa
TLSH
T10125AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 954KB
SHA256 29ca4127aeb09975bd7553b4f06c87ff6f8375859f304ffcede2e185895db3ec
MD5 19b313e62991354afd5d3d894cfd3bbc
SHA1 d3bb30d972d02c48625655c8cbb788b8661c3632
SHA512 3eff7863cd633040115c5b9eb5a30e42ab155cca190a42d3cf5f7f444eb10bee259058e893cabc70e294e73cb62c05ae796719bd8129f497ec843652ae5bf355
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2AMahh:A3k03kHRJU
TLSH
T10725AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2440-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5664-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5664-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads