e8891f11140daed8b833ed70730739535acda901f1ad5a812dc0ebcd221e8f91

Analysis

max time kernel
105s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 892KB
Sample260807-tflp2sgf87
SHA256 e8891f11140daed8b833ed70730739535acda901f1ad5a812dc0ebcd221e8f91
MD5 67faef4bdd4a6648b83f67cbc9a5ad5d
SHA1 470971b3e5ef50eeb385eb2035d42c369b338b4a
SHA512 b4e299e651d5626e25a23a16b1b93dd14454e6097f9f763ccc33a32d4f6eeeea417c4465918bfffa23e3bcbffbd152ff91c6cd7fc40dac6cd2200d55b429fb9e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmN:A3k03kB56rL
TLSH
T113156B13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/3156-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5af-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3156-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2892-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c86-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-549.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-611.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-642.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-727.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-795.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-844.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-923.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-979.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1010.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1053.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1096.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1139.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1198.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1357.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5af-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fe-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c86-60.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-226.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-444.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-493.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-549.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-611.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-642.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-727.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-746.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-795.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-844.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-869.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-896.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-923.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-979.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1010.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1053.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1096.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1139.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1198.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1325.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1338.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1357.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1376.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1383.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2892	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3156	2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2892	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_67faef4bdd4a6648b83f67cbc9a5ad5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3156

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 892KB
SHA256 e8891f11140daed8b833ed70730739535acda901f1ad5a812dc0ebcd221e8f91
MD5 67faef4bdd4a6648b83f67cbc9a5ad5d
SHA1 470971b3e5ef50eeb385eb2035d42c369b338b4a
SHA512 b4e299e651d5626e25a23a16b1b93dd14454e6097f9f763ccc33a32d4f6eeeea417c4465918bfffa23e3bcbffbd152ff91c6cd7fc40dac6cd2200d55b429fb9e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmN:A3k03kB56rL
TLSH
T113156B13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 08e2f6d806feaec56eb3028a7a9bfdc904b0d95c48b1709336235d88b68f71e3
MD5 0da082cef4c52f669808bbef81aef364
SHA1 84faa9d80210480762b10be40f59b9dc037a4f5d
SHA512 b44673d2004bc403479557c8b3fc01a2e19effc7d9e937b4fd35ed4534b6ee0d1f2798ce457964f57b6ab1f09e069a30cd7a56d8412e6b7d71d97eaa01b68d4a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmZ0Le5ji0hmxNrM:A3k03kB56r3Pji0Aj
TLSH
T156654A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 906KB
SHA256 b2c2d21619fc97fd178d0207a625ec392fde2ab5a921576cfd93910ad16808bb
MD5 d03f1d2494a3a6cc9b561763c12d5991
SHA1 4fd26eafe8f68431dce077284a19c3f4127d3269
SHA512 65904d00c05ef629039b1e3e2028f5aa5432adf1e7c22f9b1654a46b4a0e57f20336a064b0fd3804af7d27aa31229581b7b5a5c982ab47c1bd89cd3b0b485320
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmLa:A3k03kB56r
TLSH
T119157B13E6840FA4D10FC1749A968662EA737C125F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 939KB
SHA256 d6163e46678c961274851ba4012bd68cd0bf9da297c63b874d64def92d12e16d
MD5 bcf186ac54bdc6bb2cc7cfb174f5cdaf
SHA1 fa6bc7b82171380a85734735de165efbd69171f9
SHA512 e3bec104b7e956c742d0f0c86a64707a80739010df2819bd87299e4e674469dddb0d22759cff12e4862c60327131ae5b8804378eafd98dac32c6d92683d06dd9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmIb:A3k03kB56r6b
TLSH
T19A257C03E6940FA5D11F81749AA58672EA777C421F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 915KB
SHA256 ad5a3bbec0aa1728efb258e3ede62b28457dacf5e333ede0afc5ee5360f2b23b
MD5 19484906bd4b9967c60b6ef929333714
SHA1 ce94a4cf15d06a7c328d41237dc94e6378501a74
SHA512 601a39e62c444b6faf043351d70c6c2d3516714875dbc39b0da61d5dbf4eadb0633404dc504c5f89413e2ca2104749b13eae3c868c2206a37e67b921f8e8044c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmK6:A3k03kB56r/
TLSH
T12C157B13E6840FA5D10FC1749A968662EA737C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 915KB
SHA256 1cfcafad3200e53630ac670f402a2d0059498727b2bd267bcf04ea7252b43419
MD5 691319f6c0d50b9ca63f22d49e7b70e5
SHA1 12053b5ba1ac9a0235f0dc132f04653604892e3f
SHA512 89ee1d20c1bba05882d1856b35bbe7ce34ffde4646026575973de455219ec0afe4c9926a694608350c2c5351a13c3258a156611a16f3d3c98ca1bee2fb787408
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmiN:A3k03kB56ri
TLSH
T1AA157B13E6940FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 915KB
SHA256 1d1a27ead1c302dcb31f76c4903dfcc492a62bec9e38723cb21625608d785a05
MD5 3d70d3ee390f467ccd55b114279f09be
SHA1 d04e5a1c2e5d85079e2b92c0e99d94db79a30aa2
SHA512 177ddbea2e1aa07d342ea5813697e393570bfd456ff1af909f374fb908ea5d21f06ad454114fdc72224da5c4f3b36cab8ead07afad976c4a45486d2739769125
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmYf:A3k03kB56re
TLSH
T17B157B13E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 915KB
SHA256 3aa10631e8fa55f3940b3a0747db2ab176f592ee7dc3f94de4e89ac8c286b0b2
MD5 b7ff7bc0bef58cf92a507cf26b8fc2c3
SHA1 24a6f5e232f50eda6a8b38ae94e1b910e574d2a7
SHA512 121475dae8143918bc72d54a3f6b7b440df7014fda94abd6e03405d78f3260a31de78cff2300d0724a0c6961a5153d7673fe2c5d0e7b48d838dad08bd70fafdf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmyo:A3k03kB56r/
TLSH
T1F4157B13E6940FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 915KB
SHA256 f1d989426f6535731e7bfb8d62756f8fbaadca8d146443caf52c87c22454f23a
MD5 3354b7ddac01906f719e35bf984f48b9
SHA1 e75d1c58cc7f8b5719838fef536aada48af44568
SHA512 a1064bb59c31afd22bf0c4bb68b0dc3d04f34879228a62ed97cfe46375904647fb714b388e6b51c61f0e5dd6738c47b02eff3fd1cb9203e14cf13234d5a365af
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmmu:A3k03kB56rR
TLSH
T14C157B13E6840FA5D10F81749A968662EA737C125F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 915KB
SHA256 3cf891a20588917369ed9cdda17e8ec118b0a1dd6eea8534bb9fb6acbb7ef355
MD5 338c228e04ea04f76c3e6a5bd2092764
SHA1 8ccf0aa331048152caa0a6abe68fe2e9eb6bd7c7
SHA512 851b4ae9fd3978226e406c5e3e89198c56e9609b339b78be0a463962b50ca5eb747edaab3dad5cfb5f9c12af25207b2fa0d42c243a4849c79beb05d923f4423b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmma9:A3k03kB56rs
TLSH
T165157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 915KB
SHA256 5e09929b35183fd2063a204c9e5407135d070ba711d61dbf0108c334218db919
MD5 26493e5a0d63ffec5b1c2694fa359c05
SHA1 1d97d9784bd98770afdcc6a408d02235336b68f1
SHA512 77cc8d6787e202a51e6a45166f2373d7a947ac71f9c2f37d4a4e2765eb1bb7e0f10c850fe8808f58ba87872f82d4332c4ff26ed130d7a310a7756eab372c0d6b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmac:A3k03kB56rl
TLSH
T1B0157B13E6940FA5D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 915KB
SHA256 022b31f003d108fc96ded12142c6ae9048a3f70c767e7d1716340f243793fee0
MD5 0be7186a0417b6447b17320be3ceec1b
SHA1 303b888def01a681b86b54c3181f7b33b85d0658
SHA512 93d00d5622e4587099079d9b483f3ac78f040391b9e971f3714280305da1d0ed73f7b496773910868d51724a78a51a915410f9175eb092408b6eb6b75d5f4fbb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmTp:A3k03kB56rL
TLSH
T142157B13E6940FA4D10F81749A968662EA737C125F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 915KB
SHA256 491842af15fde5e624c3e8d66ef1d2af52e4af61c49d0bed626184f0eca3d8d2
MD5 e8a4623d5767bf7856c015e7ea43d7e5
SHA1 d5704f3c7aed4f12e8c5f6a82d97b8e2680121a2
SHA512 17f581de43af2c4dd692050a44c90efdc36d3743659874b11942a352b3587bad6b27b12ed341d29e31a6c8e9a94a5a6f7fabf490f65180720aec13d0ca583a78
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmm0N:A3k03kB56rw
TLSH
T1F6157B13E6940FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 915KB
SHA256 17b7e9979e2235817253c8c39ea77430fc5a1265dcdfdace079961aeb7315604
MD5 1286522e9fd64a7795d64c8b8fbce16c
SHA1 effa16365f8350a8b56e0bc68ff729f0eb279ee4
SHA512 73380b9b5957c8b4760a1f16b2c9572b11ef64cd1b3c9506cd1008de03d654b97b82c59cfd56a47dbd617ab80ee803f142dfb34c4ec5603f5bfc3b30864b7848
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmcF:A3k03kB56rm
TLSH
T1B6157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 915KB
SHA256 8d7a92f4a6f1218e3997df3a9489bafe102b0811522c21deb4242756b560833b
MD5 90cf6f7f46c099ee4db275404f26c5c6
SHA1 482e08ce5df794ebf757122dfd0e77e61398b0a9
SHA512 a7ffcdb19494582b5965b2bbcb42979f2a9894f8919fcd4596816231a8f1356bc84096decae3f0ad8527544ff0bd5a8123ac87a0cf69f0baf2fae44cadbc7453
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmJC:A3k03kB56ri
TLSH
T17D157B13E6940FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 915KB
SHA256 7bd37972ae3ea8f1a09c614b7bc36d61741a45e7058db91056f769bde6de6488
MD5 48cb28c1c095a7bb889ad8184d165f1a
SHA1 aeef79460e2c6ef4fdc5c04dd0325c4cc33d7e9c
SHA512 35409c92a32dc900c0f4523a42e23b941fb7cd1d038c33c3e5ca59c83c1033797c85ba1662e6bd23534f97b44ff246d0b391e87031e782da1da3b9db62a11c6d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmqw:A3k03kB56r3
TLSH
T18B157B13E6840FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 915KB
SHA256 5cd33c33a61d224ec4557c41892b1fc10b6f9f8f49fc22efaefee1407c21be94
MD5 c86b818102dd949499a8594f51af91b9
SHA1 7d1fbfebb4ee1f4dbbca24757e0a0a92c0e67db2
SHA512 df89ba06e27293c5b8b51778785958b3780af8ae016ad206a793c32e9bda373e2162be9ac96e7a22b3ff3457b8bd007ce6d18e5ce8ee3ebc1ef8df7aff23aef0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmxT:A3k03kB56rz
TLSH
T117157B13E6940FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 915KB
SHA256 df419f5d4f9192a4caf634a18623dd4c7465b01ee57e288acc20cae1646b0821
MD5 75f7720fd1af44b89f0d879590abdcb9
SHA1 5aff2e198804a459c88169836ad3b5b91fb2f657
SHA512 15523e2446da847571e8579a20c08c727fe28f15931ab8edd56049d01b75de5ec9d29e488f8fb236f9fbb95794b73c1fcf6b77b95686ccfdd0a3ae78e9adf90b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmfu:A3k03kB56rk
TLSH
T1C3157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 915KB
SHA256 4827579ca9f01fa593f6590d3d4fdee8f2a61acb85b7522ccf4eacb98066eeca
MD5 865ef8a0dbff7017909ace25daeb908b
SHA1 c27ecafe87b8094d0aaa2f3bfb8864a5761dde5a
SHA512 1920571ab0242ba1cc19cc896147dc431a4531c9960ccb1babdc4986e3b422fc89749f3ce746a0941998c3d66e531420fc381745ab08ff27daaa7bb7fe6217b8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmDb:A3k03kB56rN
TLSH
T19A157B13E6840FA5D10FC1749A968662EA737C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 915KB
SHA256 34fb0b6863d4756a10b6864bc3d4eb19f7026a46a8db2c6ee0ced57bed771aa4
MD5 48a2f7503f9f049b5f42432b8cc0c3eb
SHA1 30b9ede4b15d8b33d1b34a5543a1f2a74c34ea1c
SHA512 a5c0476ed13ed46c0c058b667837b84d73aca385077c829de06aa7bcc005f02c7872c2b09aba6502a355164c39fbb3a5ec39b63ec85ff80607736e4a1f3463de
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmXf:A3k03kB56r9
TLSH
T1EC157B13E6940FA5D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 915KB
SHA256 7838cb42557b1cf8ae3b3aed60c7e1677adcb84502ffe16a26332a5dca5c1bd4
MD5 f560312da032607ccd19b276bfe2a1ad
SHA1 d6778a1d3548c80f7e16d8a0e288419e3f2ac070
SHA512 8893a14aeabad22f95c9eb32ceae709837def1fe277cf04fc7d7bd4aba8cdca1b30ff52cfba2ae7581bb6b939525130fe00a147eb62f0cf75a3cd4500ff23833
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmgK:A3k03kB56r1
TLSH
T130157B13E6840FA4D10F81749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 915KB
SHA256 083ad9a2a99286c8a5c613994d84038fe48ade2a91bf98f205b5e7de43f76629
MD5 a198248772058c781327589f2357d395
SHA1 6c0000514328a331a17ff8901f4cbbb521802cb5
SHA512 608d14c51066d1573f04438310d2e8d31155bdac45f1a6ad8500746bee2315a8a484c93b4ff55c567132afccb244042234dfcc56d881d8443578bff477139599
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmdk:A3k03kB56rc
TLSH
T123157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 915KB
SHA256 c1dab84c13fe278f7c964b27b5c2ff6ae7b1db3228eca4c77e75c10ae4e2f6ff
MD5 d4c43b653c94bfe4eba7639a252deded
SHA1 36ff3fc87803cc7dfb26ff78419cb5c69f49eae0
SHA512 5140360455b27288487ea4830fc25ec2375c20047c5b7d844a6a0de671b469fa4146e3e00ba32aafb4dd3384556d6afe05b0d565bf029cfdc8d89c146b04abd7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmC0:A3k03kB56rV
TLSH
T1F5157B13E6840FA5D10F81749A968662EA737C125F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 915KB
SHA256 3da96fbf33f43c1fa2dad536327a6c9b437445bf8b54c3d686eaf8d25ba49e65
MD5 9fb8fe22c3ac4ee27616075e6dcd5b9c
SHA1 164d7c1d954e33fb2fd2b8c9c1b9c6a82e72ca2f
SHA512 059eb75d3ce10ec7707e2915443346e69b82ffc5d8b653b503eb07decdbdb3e2a575f43ce2ed6d853ba2c839133950b2d92b104b72c948efbd0206f79e0a7ff2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmRg:A3k03kB56rU
TLSH
T12F157B13E6940FA4D10F81749A968662EA737C125F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 915KB
SHA256 d2ae191d78cc497ca786a351fb9d34a0ea56719850008c6f609c751f69979eb3
MD5 f301b56b03f743a934f842021aaa6ba1
SHA1 ba333d0dbfcb65f40e34a3ce2f53959c36d251c2
SHA512 87c7b408bda62814ae6a6799ae46ba4000e478917191987f71b1c8711eb4881d7e1355ddc09c12c5366c6c9336846b4d3577f8a3584b6e7103858743b040d392
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmm4r:A3k03kB56rm
TLSH
T11E157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 915KB
SHA256 c43a05ba64e4ee5509bd547f328af47749baf8f27d56d94959f7eea3c757f8ab
MD5 a271551829b04127565634a16eb87c83
SHA1 0731aa75d70f8cdaf7448e0451ff097c527c2db8
SHA512 87cc9d0017cd8705e697ebd8fdc1d86a556b0b5b2342eed38f4b515b89025060dd67e8331dc870fe0a0842d75b09a9ec4dccde9429e370cfddd71c27eabef6ed
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmWn:A3k03kB56rA
TLSH
T18E157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 915KB
SHA256 5d58625cc3ac3d33e7d9ef211cd77fd6901a76ce744872b6a900af8a39a5ce7b
MD5 ad533508e32e24b1b348e03da52539a4
SHA1 a08bd00f85d52827d697e1ea35d7ddd723e69998
SHA512 f4fafaf5aed36bd43cc91afbbd4e0b8f9adfc7f9d16959c9c16956baec76f84f01bc657c75060acf83f2f7a546ab33a5dc015d73b0ba96bfd02d523392b7acc3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmm8x:A3k03kB56rG
TLSH
T128157B13E6940FA4D10F81749A968662EA737C125F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 915KB
SHA256 3b115514582f82c093a79b2ec274c914afa8c619443ba6158b8de5b6d3536708
MD5 bac7f1f80569d9899b1cbab0a9488757
SHA1 91a7b1ea19c5fbcef6086b66c429c9d367936512
SHA512 375d4f9c60ca8cd5a27d832f1612eb649d14f563bccd2dcbca732530421057aefe68cb6b4ca60805e62ca9a583125d2b8d779a3e6d5d568453f62d6720949654
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmm2A:A3k03kB56r9
TLSH
T1E9157B13E6840FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 915KB
SHA256 4b1391b62a1938c3baa2c534f1580b127444921ef18a6117611be0acf7385cbe
MD5 4a86e7423ed07f6b0ad0e78d93746709
SHA1 d2d97663f7d4b0f6ae4dbfbd923125bebc504dca
SHA512 da31f595acfa491331457319c08aa1d2ab1d203133459626354f4a7ae4738b1fb15cdfa0888e427aba88008d7e68bd79aaf700ca6d3474de5c806d7a08e0a14e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmv9Q:A3k03kB56rs
TLSH
T155157B13E6940FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 915KB
SHA256 44315d2a2366a596e319806d3b912c319ec936554946c4687d4a820975d0c921
MD5 0e41c54586476f0b3ee19c12edbe3f84
SHA1 6b1c819a299f0e47fea657cb03da5a6bc57a3613
SHA512 0ae9f49e4894df903973439a5a87d35ccf5e789d44e3821d252376239a83e17d1a4e04b9a97ec3440e28adc8c6aac35301d014a126388265b5ad10e5e75b7c1a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmG4:A3k03kB56rn
TLSH
T10E157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 915KB
SHA256 05eaca72a9b33e82415c7f79e5f5f87711d73eaf647fa37c2a27c93cf191f234
MD5 d9bb8582958a27edddf5a413e2ed022a
SHA1 54c1740d0ca1680a6e4d3ca18b51bd12a7c71349
SHA512 ec6a6edc2c04f2e46e408e307051bd7f60e8e4248b06499266ed370ba9ea0b2942a1c46db2b87789ec40e99d97736205f0256c01c813159dc9d643b50524c916
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmVu:A3k03kB56rq
TLSH
T1CF157B13E6940FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 915KB
SHA256 258e23959224e9817b0057f740cbb7dac95ca0e7fd55987ecb8bd3cefbb3e403
MD5 def03d3ac0ffb85c35a615edc2879a92
SHA1 c8d7cd5d219ad73e7563538d335821b09899f246
SHA512 0d5439647df5712becd0305a78558b910d9be07ca319b1bef57c87ed7198aadad986a7cc5eb731abe8195c29bfe052df357153e98940e7897f15f590f54c0f5e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmIj:A3k03kB56rk
TLSH
T1E4157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 915KB
SHA256 c5ed1524b1e3725e5f8637977f7611b6e84b42ba26560132467e288a65367912
MD5 1e1f5d4d341ca7171c7544356a98a1e0
SHA1 93b455729cfdec93008ccf1ed8e6bbabd2979184
SHA512 f641d1cc0668611c0871be170db5ea5ec62fe0156b11cdb49bf229bb21cedcef46d1094362ae013a3394f43502d746c2e1875ce7abeaa4a5b99879362756ce68
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmm5g:A3k03kB56rs
TLSH
T163157B13E6940FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 915KB
SHA256 7fa8ff86410ba0913454e34c780edf33102ab900f37ea9e2a5f90f1afc250c3c
MD5 ccfa0e8ee19cb3e521ba74e6a2f30eb3
SHA1 26a71c83d2fd5d697eac272f9b30e55f1d32b619
SHA512 2411d7245110e0b3f652baa9aee0d06ff63ff3b0c6f94a0c7893a62ea22b300a31221289a57c50176df741e09233f33f77005fecde631a5d1672b9fd79e70870
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmgI:A3k03kB56rl
TLSH
T1F4157B13E6940FA5D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 915KB
SHA256 738e15055950430d3d5c0a3f45d6e5eeadfe8c033c4f626a0001398d02911979
MD5 7f1b5e694c9743adda37143e6252a7aa
SHA1 34e208a18b6076bb80694c9a2218e681b489a483
SHA512 a05b5dd81c4eaaf87bd9c1dbf827d316420c545d22fb30b328cd1f47f3f0c2eeab2208b52e8a9b8d0e7de4dcda2082cb3d3e5ef7976c31d7e2cc6c648e084374
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmio:A3k03kB56rT
TLSH
T151157B13E6840FA5D10F81749A968662EA737C125F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 915KB
SHA256 3e40af6034c3631510734c1a9c196789006224390a45f7656c5bce400511efa5
MD5 d70f27a9c4f498df91e3df45658362ce
SHA1 2514d5621aed0c415f58ca8a61c86addb131a8de
SHA512 b48bbe679332aee76976e867a25b633a8ac89b205102bac45aca789799a669b9007fd799f03aef81719d6129d09ed184976f4a1002ac09d24fa232ed56cfe564
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmZ+:A3k03kB56r2
TLSH
T1AB157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 915KB
SHA256 b4565c61207251c7e5269996b6b3431cc6f876381f19d311326d52681c6c1e24
MD5 88ae99fed2182f30c7439859f65c767d
SHA1 5c0a5598447b8102030f81810b472531c5cf9060
SHA512 2ea33682c3289a9c5e43177f6881c454779829f0f6ad09983fcf611d4fee9babf1f6efb40c63f8250c86c36d7e4ce6bf3815583aa3931a059739079361120409
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmHQ:A3k03kB56ry
TLSH
T166157B13E6840FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 915KB
SHA256 7c77c72e3129a45f675b549f7dbb9c9b9d3726ba0253bd5a8b7e4b5536d9c882
MD5 acf878d6816b93b8557fde5bd30f74a9
SHA1 bf1f0361809383431f186ac565b9c036cd0fad9b
SHA512 94b2a8892a1a508e720f7eada589f58c4847466b8882713be49c0f2da027209f5f5bda57cbac649595c29af412edcb01f063c50d226f13edd067b987682808ad
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmcX:A3k03kB56ri
TLSH
T105157B13E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 915KB
SHA256 5dbaee7458ab7fc5bb6be2bcd59d16ba8a80183accfd765feabe0949965ff597
MD5 3590f0fd3bc81734b35b647043981d4a
SHA1 3bade907287bddeea7869c30c31b60e08ef6a020
SHA512 3ec148012b281103f576cb38d1215bdcb5e8dd16ab5a15326978a0c0fafba26bed855944a9cfb910223f75bbeb0093220f02ff811a187fe6100451db7eb6d931
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmaL:A3k03kB56rM
TLSH
T114157B13E6940FA4D10F81749A968662EA737C125F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 915KB
SHA256 e4ebe75a75cd42172f34d18b200967b59b37b1f8a6ae39d611d47bbc58fa3664
MD5 e5daafa07d3e15840f89368a5e4d9ed3
SHA1 1ad92e7820ea009157368523a79688b1aff81e19
SHA512 58b188881fd43f4f3521d07034421a510896f1d0d9a990d4d45de6ea3912779361410493e4a201a76286182ec0b514ad376e3e8bb4a1baff1a2eab542238794a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmm+M:A3k03kB56r9
TLSH
T1B4157B13E6840FA5D10F81749A968662EA737C125F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 915KB
SHA256 1292f7c6e05eb1464da65d1fe3b697b4db45914be99b0e7fdd3a3651057f793a
MD5 ec81bb4f28ac4becc243aecbd655eca2
SHA1 2d285c95f9cd853f152ac31757437cd729af3694
SHA512 d1c2ff3e0be90f89a0ad9ac7f7a3c625f580c1431bf4d29335d772f8c47db693895086000188cf4c175294ba5a2c92eb480c35fa2ef5e9944ceed9e71b5759cf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmmnh:A3k03kB56rX
TLSH
T1B7157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2892-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3156-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3156-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads