4817f498e01ac87c3ea7c7131d4ac5e5334cc41743dd4664c0bed06afa479064

Analysis

max time kernel
85s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 940KB
Sample260808-c552jsydpe
SHA256 4817f498e01ac87c3ea7c7131d4ac5e5334cc41743dd4664c0bed06afa479064
MD5 d0819cbd9eee4c9b409ed7f0b7d2b6a0
SHA1 36a9b90c55e1c13c3d6adcb92e8d8fd6e876821b
SHA512 ba18b9d21ed572e033b5eb58d6839712e93ebc8d0454ab1e902e5b63957c25b428bb9b71125b142669c401a10ede786e48ebcce24ddd420c160beeb4ba8082ff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNo:A3k03kHRJq
TLSH
T1A425AE13EB9500E9D10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5724-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c495-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5724-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5548-222-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-464.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-702.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-734.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-819.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-851.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-972.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1039.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1058.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1101.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1133.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c495-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-221.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-464.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a55-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-623.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-702.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-734.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-782.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-819.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-851.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-947.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-972.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1039.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1058.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1101.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1133.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1215.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1318.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1362.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1389.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5548	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5724	2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5548	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_d0819cbd9eee4c9b409ed7f0b7d2b6a0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5724

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 940KB
SHA256 4817f498e01ac87c3ea7c7131d4ac5e5334cc41743dd4664c0bed06afa479064
MD5 d0819cbd9eee4c9b409ed7f0b7d2b6a0
SHA1 36a9b90c55e1c13c3d6adcb92e8d8fd6e876821b
SHA512 ba18b9d21ed572e033b5eb58d6839712e93ebc8d0454ab1e902e5b63957c25b428bb9b71125b142669c401a10ede786e48ebcce24ddd420c160beeb4ba8082ff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNo:A3k03kHRJq
TLSH
T1A425AE13EB9500E9D10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 7a02a54f720c63267d153ebe9f877f49b1c027b3fba7b0834f825e21b7f1b006
MD5 82928cc198d481e23461d20a699b108d
SHA1 c42ec203f0fad9463f746900ca47f2d54dfde3ee
SHA512 cab88bfa2bba170e098adefe0d62b6d044e9afe79c386a6a6b0171a83f4604d2980165e1491e21d90bda1e23c6dbbbd618298ee7caad647de3d10b70b7cc5e16
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNw0Le5ji0hmxNrM:A3k03kHRJ6Pji0Aj
TLSH
T17D658C17F6A402B5D067C1B8C5D69A6AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 67ef4f1dfaf09fbf44e8f76b7e3a1d58ecf6f7e94d5617da5b5a51f4493b319a
MD5 ed7118198969e431e187bb43d4a30484
SHA1 73b3e146da800797496322a7c2d165b087729a83
SHA512 788a762061e120b7234c1b8e9808f7b5ca717fac4729f675686a6a4c0af824b98d6848ce2f5ff3fad71867f3caf1c753220807ffdfd09bd6ebea639e55d398cd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNKa:A3k03kHRJ
TLSH
T17D25AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 b371c19cbe7533dd9804c4adc70d936048c88b90eb57799479072da997728d43
MD5 df525a2b11f5fe0be80e8e5e238ae06f
SHA1 80d248a26c2d00759b2af302013dc9272d7f886a
SHA512 e0e8259d23af7cbe6d1e592d3d6aa7972b63c097a715c0940f132161d113124fa467f117a962ebac5113f33b5975e009edd9f27a841ebb86f9be9453dd9067d7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TN76:A3k03kHRJE
TLSH
T1BC25AF13EB9504E9D10AC174AAE54A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 963KB
SHA256 2f85c09f9151f693e2fefbfab8fe39f38dc7b23d5bdf46aa263e51b705185a18
MD5 bd3ee6070b1405d751313c296e4c104d
SHA1 f948d79c052b6f82708f5520fb19cd9a80f33b3d
SHA512 12cb0d058dd3923f4dc171328867ba5c90dcc0b0b5568ebdbe68d2d502d1c7b486e2ba1f28331a704a8a45324da2cb984b45628672b3e395385d99227451a3fc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNlN:A3k03kHRJZ
TLSH
T14625AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 963KB
SHA256 9d3918e7da6e9be09d1880177b6075e6695e64f959a6b62c87b839dea7012ca4
MD5 0190ebc289c2995f91ee93c4e852bdc6
SHA1 085df80a142706b00c0705e2c9a2d937aa99d926
SHA512 4763e10efa6ed06d06428e60dda653231c1e813ad3b92afd4a8cf8c288fb97a21707fb5217a85c906993428e4be8a1d93ae72996b148f99a4a05db37590901d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNjf:A3k03kHRJ5
TLSH
T14225AF13EB9504E9D10AC174AAE54A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 963KB
SHA256 0eef51f9014f9373e15310ca62347ea516c5368b6830f773f143b91c2337e572
MD5 3eb01340001a091183483ef080cf951a
SHA1 f88c55f2fa07bc5528f7aa2f7b86e356648d5e1b
SHA512 f4ef56579d85907f4e1ac39c49914bc73b4cc4f27fc1a987be82b47c64a6061ff997d1f6439036bbf1e4f57d57cf010d23cc083d32bd563f318d42750aa4ac74
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TN1o:A3k03kHRJs
TLSH
T11125AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 963KB
SHA256 8f1416c2d0de18678e310886757ea588f969ad73a221021b2e5b959e1b914689
MD5 731c32021326f70467fc51982e17fd1b
SHA1 6f9e86a24c1619199f7fd091072bac251c04c44c
SHA512 3735064ac4b8c266db0ea50e8a49ce9e597257238a9df54ee8a41b906ac80ff114325a552b355f2ea01beb50229a1f01fc5864b0fb80f8bec6ebd58cdc85358a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TN1u:A3k03kHRJO
TLSH
T16F25AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 d2482942f026f350baf33c08d02d91498af82042592fa98ef6f2e71c827fd3fb
MD5 100975d3abba270cb404768cccb695ba
SHA1 686dd8d58cfc9b90102679ea1041bacd6181e41f
SHA512 47dfc304f84c8922427c8e42466cf356974d19affa03db609a08267e24c0777cfa451a041645cbbb1e232946109cdc2d09e76b04e60c9445c41930144e98b6f4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNr9:A3k03kHRJv
TLSH
T10925AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 e80670efa44992046655f6f4f6ef520ff3fcb97b29b3dd955256c43e8f86cc70
MD5 bb709e0cbe35bc03392c31606ff2738e
SHA1 a39b69df4d598bcc5863e9591dcbbb1b93f04e11
SHA512 2a598687005c9423122c9e9fd828adcc10478be2079d2d084b75bac12b99b9718af3d50c7e98929ebe3941dfd322d955ed0c90919c83dfe5c47472fcaf9bb76e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TN3c:A3k03kHRJu
TLSH
T17625AF13EB9504E5E10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 2cde1282a7a445c5df0aef2b654edf1906e0842e65a746aa9893a6a9987d09b0
MD5 a858f0fe671aa9dcd753ed737d3ecec2
SHA1 fc1b03f30372d4082a2fcee638649a1527940130
SHA512 9c3897a6cba50bf989ed64b6c300ab2102d5710074088da3d88c3bf76487a9cbb6452b5323e4a6e8fbbd4f26b6f79a673f6ff46b20f02b1c645355bc82df3f9c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNAp:A3k03kHRJc
TLSH
T13025AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 d2d4188837ccd373ec1a7e65a2e8ffebcf17595cf551f0dd346427ee96c3c8a7
MD5 19e6fd2407ca4f63951e5ee75f554159
SHA1 807f461b31ce9f007ece9c7a2a31a26722b89fdb
SHA512 338d08c1989abcedad7378cb45d7cdb44d7d71a3af223a4ba328508436ddb0bced1dcc68566329887e86452e2029e2afc12a441e6d798f7fcc35c3a861b9ce93
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNHN:A3k03kHRJ7
TLSH
T1CD25AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 f847f577505719b2defad0f9ea7b19672c14033966ef7fced783cc4c24e41f9a
MD5 13461d835fb4cf3ed897c212d83f3f9b
SHA1 c4657273b4a477cc8d73eeaea9c4649f74932845
SHA512 533862105c1986f4b67c6eedd2042a885c4d7a753ef465409cb0be0b9db052010c6d68f91d511b335475e5b5d1a20d21f22683db0e4e0e5dfc3450d581042bff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNlF:A3k03kHRJt
TLSH
T13B25AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 76120f3b8179fec7b1960e691ce8295e2e485f2929b2a7789bdc78e66283d67e
MD5 30afca806754d83a8847eae97006c906
SHA1 f90a13e1c31b4c449c98f628e142d2ca8ddc77c1
SHA512 45ca02bdc7f74e2cd64f30b5aad5726960b24d099f2db337a8ceba8d2d5f70f5970c1ae56c0d3b0988e6ad225e88c98c13477f469ffc27bf00af4d6b1bb98f42
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNGC:A3k03kHRJR
TLSH
T10025AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 b74812911f7db75e09413143adc290ba91a7aa31d163004df3a2d26f2ed7cd38
MD5 da480a3f786776ec95036cb382412960
SHA1 ad1f7a9db939d043ec2c73ba28fe9c63e05c870d
SHA512 4ff7e0486d0e51ed93b110245e617a8d85dbbe6667929a7e686237f0fa00da663466c39bfc1283438d6213928471449522964281b39bd2dfc201c1c54b43d79a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNJw:A3k03kHRJc
TLSH
T13325AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 74672cdd740e6b073089a05c6d3dd539a00b5455f3a36b8f0afab0c32cd2ad79
MD5 c50fa412ac228c5e106db0b31dac84cd
SHA1 2da9d4d01c509cdd828a466e28dcbcb23f2773dc
SHA512 08d06f7eb336b7a4c41d044fc9ee78c40f8fdd389dcacb1df0dc21e5534a6958283a2c53a8f884573a780446b122d6e1c6a5a76e1b96c75fd1e158a057d682c6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNQT:A3k03kHRJE
TLSH
T14125AF13EB9504E9D10AC174AAE54A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 eba2b38383ca38046f7633e157559ad05c1ad8f5db601705b1de9390ad332927
MD5 23b6a297a26445d9f878ab040dcf4ab1
SHA1 1f3bdcfba2640852556cbafaef0a5065a1d37f45
SHA512 eac73581865752cb471d48e2388ad64a5085f69360f3b32f570feeb1d28c305149d4a2a812c6e54ff3872d1ab0949e6608a3ebc6cfcc5ee93d24e5a2b9794afc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TN8u:A3k03kHRJz
TLSH
T17B25AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 2ca704d1e59a82ef169747a696a64bfdecfd01d40c464ef9b60a711a86213474
MD5 d6253062ec3227d3a3b0db2ec99cd7d4
SHA1 85b7db9234b7209cf295d4b3879ad517a30c4e1c
SHA512 893ad1fd6bc5f7b343e607c5e1155f4e5b5c92ee5edc1ac97b330c1792a618ef7275cd98450985e81075d36c939ec7133d2e976bf91fee87caf684697a485d83
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNab:A3k03kHRJ6
TLSH
T1DE25AF13EB9504E9E10AC174AAE54A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 7eb666c9a741a74913cfbe9a3e6a752c221a9af04cfe49f6babce26cc1cbe1eb
MD5 a598505b63c1c408a343ca7e175d111f
SHA1 0ee5402021fe6c194b8ea9499f6cd97319b9565e
SHA512 e307def88da761669209571a4d46de6cdcefa50c7bd6e7ae1aa0aa2c2554e9268e8cbaf457bc8afda242db5190c7dab1c7c1da43471597fff16c6c7335760718
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNcf:A3k03kHRJK
TLSH
T10E25AF13EB9504E9D10AC174AAE54A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 df7b0e4064bc85fe43d80dfc1de76a4aa00df200e1c42aabce15bfaa96338777
MD5 db31ba17279a739fbbfce3088684d7d0
SHA1 d6d545e9f9e44f9352d55e207efde1756f923df1
SHA512 c6d49f8af926ba72a957cc8e0a129fba0dce3ccbe46fbbda7494f00bfee6c7b97cead8d7b0f4ea4bbf0cb59399b59ed6928d24aaca6e9087f77822d1f425871d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TN5K:A3k03kHRJK
TLSH
T18725AF13EB9504E9D10AC174AAE54A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 88588a497a06a50568150a033e5f8db8c411aaa6ec5208b8433090ee091de15c
MD5 d0828e4b0dac175587619cb687960e13
SHA1 452ea08240ea481fcd8eeea106d9bd9ca692d661
SHA512 b61f46ec16b366d7adabf2f8a7b9f0716a19954f5d1d752cc121634026ab3ed3d3c8d9ff5c3f85e90b0abb69513dcf481fe604521725158721fd7aa887427525
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNik:A3k03kHRJv
TLSH
T1F925AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 bf9aa91434bd2dd451306474459305e7cc79acded8ec6136222e8fd643f8b34f
MD5 157eaefde9da57f52fa4666c1c9a9bb9
SHA1 2a936e57903dffd9a792e885a2c0dfa79bf703fb
SHA512 53b6af2024042a48f11401cac25fa51c784c7522112ce2eb03cd57ef4280362a45fb58394753af51bfb69af6230527221b2b9b4f41fdc00259f2a4bb3564bee2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TN30:A3k03kHRJe
TLSH
T1FD25AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 3d3415158b41e5880ce90afc30ac4210b24545a94ee96a9348d695806a3cebf4
MD5 3d342f9792442249ddbec2b1bdd7e514
SHA1 f890e35bb766e0c32b759b48041c0609d2b219bf
SHA512 348326de523943387919571966ac2c5d67f496b9488c1f11b43092a7424b70357c83bbc405fb7d3040966b47a5fedd594e89c537a09afbb8d35a05e8e390022e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNmg:A3k03kHRJH
TLSH
T1DB25AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 0832eb038d828be90a5332fb3ecf602e288fa25371d051220dc9a08c80408336
MD5 afc215bb8171501e2e4faadcfe8e4941
SHA1 9dbd9e0c49b1cb050d99df72f7342a4330a74c0c
SHA512 a5bac821f38e66dfa75553638a4ba04d010ed7ff2f795c62f8c451c8547af7d8e47eb5e07feda500f69cd7c67a59625bc7196b13ab4e9449a89d14d0055872a4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNvr:A3k03kHRJh
TLSH
T13425AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 f64d93ebd100d2ba3e5b9a1d787ec98f6cc720c6352f10bb57e19d46157bdf64
MD5 4d90dd835cc28e138d4bc128ef7a1361
SHA1 aa5f0fc20d794858c612492c4e633abd626f5e72
SHA512 c0efda363d46cf38cfee216d4580b37bd65e2f553e767eed764877444857e31aa1862dad627a13fd5f80e8472f33d069a158f7800a847f4b011156f41f31d7ec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TN5n:A3k03kHRJL
TLSH
T10E25AF13EB9504E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 9965ff60f23012d58037bf9749cbf15380d59ff0d8185b65dbd8084d4c79c231
MD5 d8a1243dddd603f0836c0ac07bcdecfa
SHA1 3212b74cedbca8b3d87658942c72bde6256afef3
SHA512 bcb672e83f6a5b992a74016a8416baf0ce866e4f0e587ffb55ad83b745cd3df3abd22063841492c1a4171ac5fadcd94a20b1a189b1ed0bb90dafce00f820aabe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNVx:A3k03kHRJZ
TLSH
T10B25AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 317aafe7dd22acf9bcd6a1fda1e6136904689150b06332c38c7b16d30dccaff9
MD5 1ac665597f2370601c282699ee201915
SHA1 24f55196d72ad43a7bf87de9d4d9721c480dc570
SHA512 f7b76c3192986e77a9521a41608dce303a6ef1d668c8bbcc302d3f80f4f47e0c44a6b4e2947a7dc2b93395baa93df5d3c9e685c812c8f8ac2bf963250aa2065c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNLA:A3k03kHRJm
TLSH
T17A25AF13EB9504E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 6a6b64d306080935aaef366403723003f4b9ca91987ee1c78e5c9f3e2c738295
MD5 a60f074ae2656405da58adbc7aa01adc
SHA1 bd59ed85148652f3f27aba249c67f4d15f70cb7f
SHA512 32aea7053df58db4eb0f9140c2901c76db4ed8d2b066dd6d98a6eb108c0eb73dbc704b6ce1a3a545d117e90cad4f78b35d2db0f6b0c80820213f00869bc17c8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNc9Q:A3k03kHRJ7
TLSH
T11C25AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 a52abe7c2e811ad7d5fadc6c1c243413384b8dd275a62198f151d06c0510384d
MD5 bf3a8b3696c97773455a66331cd764fa
SHA1 941b5f847ac700314aac95c5c4b7cc49421b1c16
SHA512 480fb1f2ce0b777da4eac1b2bafc2602620d0eeac271cd3403a84429435461bb43011f1c4be39a4d4d2e54cebf6a1b46408d0c3a0fc5cdb19dbe890a6968ee40
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNF4:A3k03kHRJs
TLSH
T16A25AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 4f46ea0c96557b325e09443343762e098112f451633e3bedb723a15a01b94737
MD5 2a786f1c0a1e08fba9525c5524134c8a
SHA1 4f87718c1ff2ab7968a42bd801d1eab75fefe4bc
SHA512 d2c680330c632c15e07f78f280df4962544327518e8bc4e654e0598a801b295de227cc1f4f7e41d839c2033f63384910922183d599b5d3e778ebd15e3e8b03ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNQu:A3k03kHRJt
TLSH
T1D525AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 cd412875ab3786feabafa4e43aa5dbdc477ad1cad2de6f4f6fd5265b4b3cae00
MD5 b109dff909b4d65292211caad3c5fbd3
SHA1 d8222c3665ec9d5ede3b94022085bef05f30623b
SHA512 54fe473b9e8bfe0a1077d51354b059deecd3afee770bcf5a1bd3686099a4d7f6cdadf146375b1d06dee4949fb4a2997dee3bbfd89ff54030387a1d1896647124
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNRj:A3k03kHRJP
TLSH
T14225AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 f49251af30e9b63d2cd5425b59fb890187c5b6560ba85b9a9027807d271f0a78
MD5 2b30ee82bedfb1b01a3ed1ffa94a998f
SHA1 32997c60bc482187b43af7744b4d1c9b3d93bf6e
SHA512 7c123a91f48de76fccdd113ac2e1cf8876e504e5867f2f9a745e2d7b1ba6adf52ecc6f4eb8e94f4894604cf32e9f0de51db38ebcc02309aa0483bf6789d3e5e6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TN4g:A3k03kHRJH
TLSH
T11825AF13EB9504E9E10AC174AAE54A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 e9ed824f07009d2964fdba0a59dd72766921d6a7d1abf014aeea2e306b7d85fa
MD5 776d2bc198792daf43042957caf87549
SHA1 433295fb1691b42742f79a552de348d3622effcb
SHA512 21537765406c8da93f3bcf4e3e642eae9f5b4175ae3a9c3c8cde6065dd8b72964dace3e012986ef605864c4936fe4bb4ceef2fdaf5fee94842d7ba7c2bceedc2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNXI:A3k03kHRJm
TLSH
T16F25AF13EB9504E9E10AC174AAE55A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 ffbe3ccd4619cea7c65e937d943cfb2b74609a0f96a912a277fe83e0c1904654
MD5 1054151cb6218f288db215248bd76456
SHA1 26b1fdd505903a4e6fcd953e8ee54205133a8e51
SHA512 f7568b91344245a48759b90cdaeb92f2bc66267489b6098fcc501006b1042c415d9f2cae983be0f728b61800af2a436085b1d063ddbee635e9a3f25fc35849aa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNdo:A3k03kHRJ0
TLSH
T19025AF13EB9504E9E10AC174AAE54A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 4a967699d4396461d9d6a49924b81f2583b36f9a98fa2ea57aac38081d95e93c
MD5 28449b97449ccaf1bbf856609cc3184b
SHA1 cdc1ecd0ee79d400d10b2bd5c62c62903cd31637
SHA512 fe15e7b35e6ecd1c6ea1f86e554079dc6293b7c441e5db2a831e7a5c1a6f69ec8d09efde0492af5731f05ae683dd4400e94ea7d6c283e37f1773cc60d51911e6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNO+:A3k03kHRJp
TLSH
T1E125AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 43eb7ddb54832b61588c6ab9cbe8ae3935d65c0dab9560c653c37c399ca3f316
MD5 effc7d76469db63d309fb40aabdccf46
SHA1 351ee2c08b111e4065f2a49ab08c3423efbbae5b
SHA512 1d5f861033ea9280112d7a6e006b0a12f2bba58af3f940a4833fef66ecb6bff11555bed98a217f4a6a66e808edb3f0ec128fbcb9c315f40b243345a6cf0b7a13
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNOQ:A3k03kHRJ5
TLSH
T1FF25AF13EB9504E9E10AC174AAE54A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 636038781679f0036f1c2980363210ca0889f9d8349fd9b40a52a094cea53b01
MD5 f7a5271e622293668302ad586ee17edb
SHA1 cb4cfc88055a056718100b2d89f52c0c0ae7594d
SHA512 696de16c996c82f34c6506032fbd2e7e02f4a782901315965367106ec3c4833af8fb1f1d2785025ff38e5ebdaf8f77f2ff3eb371bfe09e33d1842e5e48e042d4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNvX:A3k03kHRJl
TLSH
T1D625AF13EB9504E9E10AC174AAE54A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 e9bdd3858561bdc7f22e11cbaae5c7b458a7c782f551ad76e7b882207a5ce487
MD5 49e41c583d8746a259355a7b139c70f2
SHA1 d81eadaf7df6b4ee9d36d6391b21bc0433eee013
SHA512 964e41d34e46d68e765786f511a1f96fe6c0d8a4c1d4b5e3abe214d4741a0e75e05ef68d4c8b33561188e0d3eb47642447e94839a9d59414fa97d6ecc5b17a96
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNlL:A3k03kHRJX
TLSH
T17725AF13EB9504E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 cc13c71994dc2bf423d2a05317778770fa33e85fded17a83b9e108d711ca14e0
MD5 1e6a026cefc8fdae77de0755c4b8e9a7
SHA1 b2faa083245a37af8780f5c0e089953365fdfd59
SHA512 0e6c0b66a730a774d00848b96bc55525a2603bfa80ab70f623f8033af41add561007b888960a88b8d94968163aeb9797f86ba2d037afa22e01d2905b542afb86
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNDM:A3k03kHRJy
TLSH
T1F325AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 042f0614ca652fc9aac27ef2772c10f4f712730e4222afdb27995d1eeb39fc7a
MD5 f33fa0b5348a8980d11a3e5a2de9f8a8
SHA1 fc4eb2510d41eef774c5a9cd0c030849322fe0a3
SHA512 3798189f6045013629de139deb2336cf9f235057ae506b548dafa2b0c08641e1e1aac4dde022db3f088432b58610541d789c84e073c2888fb21167f43c43f5f2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TNEh:A3k03kHRJs
TLSH
T14C25AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5548-222-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5724-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5724-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads