ee915074949e828f78d5b9e1fc98caa562f87b8a7667e0106c9d3dff49b52ccc

Analysis

max time kernel
107s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 931KB
Sample260808-c73zzagk7x
SHA256 ee915074949e828f78d5b9e1fc98caa562f87b8a7667e0106c9d3dff49b52ccc
MD5 cabd0d5a8cc67fbdb8e0dad3615b3630
SHA1 10edb2351fab364a1bad52e0296f796e5f41837a
SHA512 700a24d5a642bd42e78ca3cbe06dda3874d59a5424f0d978d5ba67ad8a0bab6b338b29a0e2c2765f0774c8f82a3384b2c6c5ecfcec7e86f4ca1ac751576561d8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tya:A3k03kHRJ
TLSH
T18F15AE03EB9400E9D10AC1749AE65A23EB757C56176097DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 40 IoCs

resource	yara_rule
behavioral2/memory/6120-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c53a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2696-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6120-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001baa8-244.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-450.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-499.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-584.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-683.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-739.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-788.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-825.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-856.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1095.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1213.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1342.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 37 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c53a-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e6-41.dat	aspack_v212_v242
behavioral2/files/0x000200000001baa8-244.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-450.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-499.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-584.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-683.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-739.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-788.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-825.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-856.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-875.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-920.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1009.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1052.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1095.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1138.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1169.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1213.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1322.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1342.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1368.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2696	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6120	2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2696	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_cabd0d5a8cc67fbdb8e0dad3615b3630_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6120

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 931KB
SHA256 ee915074949e828f78d5b9e1fc98caa562f87b8a7667e0106c9d3dff49b52ccc
MD5 cabd0d5a8cc67fbdb8e0dad3615b3630
SHA1 10edb2351fab364a1bad52e0296f796e5f41837a
SHA512 700a24d5a642bd42e78ca3cbe06dda3874d59a5424f0d978d5ba67ad8a0bab6b338b29a0e2c2765f0774c8f82a3384b2c6c5ecfcec7e86f4ca1ac751576561d8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tya:A3k03kHRJ
TLSH
T18F15AE03EB9400E9D10AC1749AE65A23EB757C56176097DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 86e16e6261d4c753b79be33c8845c8a718cdde6a191c10d1bd59b8a0d46c0c2d
MD5 c5741f455c1dc3eeffdca589501c6e83
SHA1 4b954fd6a81c89a4a270d655ef24cd5bbbec418c
SHA512 9072f4024f926e3c477220417b3e5517a82193f9ae90b9caa8b07dc91250788b6d45d91ede0a7c08d74d62adac9111fc7fad4b31b87eceaab5da3879528da0e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaP0Le5ji0hmxNrM:A3k03kHRJ5Pji0Aj
TLSH
T12A658C17F6A402B5D067C1B9C5E69A6AEE7138421B3086CF1358C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 945KB
SHA256 8068ff67f5d03f40f91f44f08a17f5a74197e8dd9c6bf9378a85ab98c628abca
MD5 c756b5aef4d28c19586fcddb19ad9fbe
SHA1 e75cfac41d97b2b58073250113369bd70ad647cf
SHA512 10bc27ceffd9ce7ae14764cd861b95e91a147aa9062beaf36a6cd50b679c33a6e3e2f27aa02b2a9fa705f1b4d61bd9639f428df4801666338a1d2545efeb2a95
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaRa:A3k03kHRJ
TLSH
T1AB25AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 954KB
SHA256 8520fcc0d473669d35e934c3066bd8b0d17e694bd639477bd75421112b7ac2c3
MD5 733169ea187d836978db8c775dc18844
SHA1 7f77332d0ff13df37aff61338257791fe6655d56
SHA512 ac8cf7050c3fd05d5f4c1572b29728772fa09782a639f4267b0b6207a422c168c7d56072ceba1b6ed502f07309125fbde55fc85889a38dd383efb528ffac4e67
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tyao6:A3k03kHRJF
TLSH
T16125AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 954KB
SHA256 62f0ee008fb2d05e35ee920e71e445f7d094beffb86644d2b08fdc87c9871471
MD5 3e12d1fb18d82d7e28a38e16cc95ea3b
SHA1 868f4c973db1cabeb8ccccaec7e6a841f41f884c
SHA512 0dcbf93ea965d0a2b0050900b95959df476f745fdaa33130373d341094b157695505fed1200436251efa513a2b161f2d2b71cfaa47b2e004a7c7dd35c1eabed4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tyacu:A3k03kHRJr
TLSH
T1AD25AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 954KB
SHA256 3b997a137bee72fda20b8fd6fa54bd6f6403687798ecf5aa680b548e76f97295
MD5 e2e3a8d28ac1e7a7d4805bf9899ab102
SHA1 27ecc491e1670a8114e2fda5a8ddf71276b0c12f
SHA512 9c60066232cbf366e3b4bf218b2c8dbdb5095969dd5459287b37db56bd0efd5a3cab2de34923579ce1269faa818d73f5578c7c15e948cc9236ea08756b953221
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tyag9:A3k03kHRJK
TLSH
T17C25AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 954KB
SHA256 83aefa84c68d7eeb16cbd15d485b9dd1d6fbeafbd4678b1e8946a030c22ea324
MD5 ff52de1ae3b0124d3e079e84c59af48f
SHA1 cd67ba51296a09b4916501bb4903bcf0c03da496
SHA512 27284724d9c85b33cb84c54fede5e8c6cee8bfb557015808bd75339517e3fec5d0940a1163a659a8f40f24c76deddadfcdf8de0c827755934efb9e5935317000
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tyaoc:A3k03kHRJn
TLSH
T19E25AF13EB9400E5E10AC1749AE64A23EB757C56176097DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 954KB
SHA256 18f346b7cb712c96296f08166d81522f3b6b6dab830b9c4d0dc11450882ea2d7
MD5 22cf74322cef66cb148b4ff49e76e61b
SHA1 fc077692833751ed7ce64c90cdbe70c2af79df36
SHA512 f742eb6b7e1470eab75a5e3d83f197e9f6e2723ac7e84acaeec46fb616f350b614dd28b0a2f163799187338832dbb3162962d6d6e962e3bfcc1a7c8736ead9cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaBp:A3k03kHRJ9
TLSH
T12425AF13EB9400E5D10AC174AAE65A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 954KB
SHA256 43f001c96d12fff8009d2ae8bca0bc282a1da378bbbe10535b76a801688b05c1
MD5 48be5ca453b1b188bc2dfb15b7a32356
SHA1 ec89c7a7dfeba34c429a3d1e749767555aa9e5a7
SHA512 b5ae2544c801bafd6f23a76d67a628705bca9249b72d585b74d57b5b6236b1cbdbf4db26dec6228f99b951eded0b76d045653da05ad723bae8d44a3904d95f92
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaWN:A3k03kHRJG
TLSH
T13125AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 954KB
SHA256 b77dd31df69a09c87d885eb50d1ffe85edbd74f3ebff6ec023f0e20d72d4cdbe
MD5 f9d5145e78679b5d93f86fc241a3240a
SHA1 d522f530afaccce7ce3c21b200a41ed7c319cb5a
SHA512 9b6b60512eb4707c1f4f2a317fd6708fe2b8a66aafb3ddbe0e1619827c8b8dc7f9733348b55c3b855f74aedcd0710c132863cbf4fe718236df13368267671146
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaaF:A3k03kHRJk
TLSH
T1B225AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 954KB
SHA256 4effddff5b5859d54c169ea1e0d6c2125dcb2529d1f51f03c8dd35c38ce8ec1e
MD5 b9b0b2638b6542625170a33a39811ed1
SHA1 c52036187e26c4c11801729814fe0ace28014291
SHA512 f0ba86b7a29e4135b3e6a13e3c37559fcff0d59eec766aa2625ab222ac63fbf10a61e4c47fa16dae3afa8e04a2a57ead1d76e9a64593f424fc5007fc99f2a587
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyavC:A3k03kHRJQ
TLSH
T10B25AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 954KB
SHA256 02694aa3d99dc0f9691ef15af501cc4e3680053d97f6d5db9156a64e82119895
MD5 267e0b2e6ca06d7a0dc024824586bc7f
SHA1 956fa699be65cde07462811993a6f52f4046901b
SHA512 7da67427a751111835ac7b042ef7f0b10b08111094d58962ba4aacf669019b6c2fca12fa85a861143aa91792b6a92f3dae1fe62bfff94499a05a5a13a6df0009
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaQw:A3k03kHRJt
TLSH
T11725AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 954KB
SHA256 339b6c96192fce39c6d38e9309c46926931eea3365fc0d20ad0df43c7a88a308
MD5 98552581fc74e0ff2042005979c19e45
SHA1 000c67e053c0a51a7e9e4d88103e1f6931a283cb
SHA512 b7b3c65579c54fd30b2775d13832a5e9025a304e23477791042badecbcb6e7daf51a9cd6e2d25b4782c7bd9d4ab727d5d1891f1b62b4e46235cd4a9515d43a7d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyavT:A3k03kHRJh
TLSH
T16925AF13EB9500E5D10AC174AAE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 954KB
SHA256 96d55068e18cf600d98fcf31ff0e90f62e4d983a511d4db76c1d92a47e069d3c
MD5 aa18dd00d88f1a9d7c6fd4c8c5c92ef1
SHA1 ed6837ae36df8fcb5cc8cd4d6ef05c2dfd56ca4c
SHA512 e2734fc63f27919aff096e8e7b3b6a51cc4e79e157b4d22dddace087636ef9c13f0030f797f6c5381ef2888da0dd1448012603305417b42fe7d89c9b75e02ac6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tyapu:A3k03kHRJW
TLSH
T1A925AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 954KB
SHA256 eeb5acda1fdde709d3b8432cb930a597327918e3e57fb637461b77640093c74f
MD5 5dd977dd1ad23c225aafd583a6e20f57
SHA1 9d198621a510f60e96be65217e80f46abc5e6c55
SHA512 3c3cf7400acd77a33e2b8c43aaff3561cc446ab0fdf0a1836877973f4215ff7c01b36c3e76d6520ea7724ccd7c7e9c2b371a28d5e835aeb827d92138afdda361
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tyahb:A3k03kHRJn
TLSH
T15C25AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 954KB
SHA256 273fbf0a8af1ff6796f1f6c41fdd6e508f4e6fbda827200815d0f78794ccc627
MD5 37ce3083b60414a151348d41937c3452
SHA1 4e1a2ecc3156697380237cbfdab042a61fb78ca4
SHA512 8dd481d110cfa29a136f331aa75b29ace4e93c78d91f49846fd844859108aa7a9c68ad0f876be945e3172ef475c6e9c87256b119dae17039fbfe01d839eceeb9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tyapf:A3k03kHRJP
TLSH
T16425AF13EB9400E5E10AC1749AE65A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 954KB
SHA256 08b08a18fa1aef0758f8fdd1f3c4d645ec48c05ab6ad8aa23d4475e7fc6adb11
MD5 033db1f43bfdd20b4248262188fe40a3
SHA1 6cd1c87d2c09d1ab07805c2c0f2da655fd80126b
SHA512 989ccfa6060c9f06a2b33a3b11b6907b1e27ded565b173d1110f52118b8efeac08b0056300d00ed7ffb03b026dfd33f619e0836217084db42ddeadd0f8862618
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaSK:A3k03kHRJv
TLSH
T1CB25AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 954KB
SHA256 8adf6141ca93f445848ed3324d9dea0e78da648d572de58ead2cf8e1f83c6682
MD5 58c08f7eaabd4cefaf005dacd142aa6e
SHA1 5855ef39fcfa4a775977ce5cd3ef1a32305a1248
SHA512 d62f788180ffeca0e2b2893c8ccec7965cbba2336dc0de75c0793a72f06555e9c97c85594fb56bad47320a4256477ea65d73df7aedeb5616bed75e75afa8f1b7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tya3k:A3k03kHRJ6
TLSH
T13E25AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 954KB
SHA256 df8aacd8a1ee5f46847c58322dc86292b7e432e15ec7f5c208f15c1917df50ad
MD5 ed98985b1f3099e3d81d1995ce2a5629
SHA1 885dfd5ba6eaddc4cf3e2c50626eab1a336aa7e5
SHA512 e045c6f9fbf14977beae26423a663ae548c388623ed12fe7ec2cdd36d9c23866e28e9588f13072b646276483115d113206371b25bdcfce2ab1a807fbc1369415
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaA0:A3k03kHRJP
TLSH
T16525AF13EB9400E5D10AC174AAE65A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 954KB
SHA256 c2e89a9efcd33989dd9d01e6328413621d6a800ad0790f4251f9a8d1015e15ea
MD5 38f5cabd7f2c00c48edaa1f42cf44251
SHA1 045261070ce8143ac5bd8a8599e5fb2e1df3d948
SHA512 c9ef686c9e975dbbafaa2792f00e3a3277eaf14b64d39b83c0b038fd9a13b4606386e979477406afed67f4b8f432174e3f65f5ac49e036f7c97c7cc112ba2632
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tyabg:A3k03kHRJS
TLSH
T1CB25AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 954KB
SHA256 5e4f7b74ffc598ee4f044e93ddc1b67b3e81f5235729b0314abfaf11e562fe9d
MD5 ebb298efa4867042e62ea50524de0d16
SHA1 fd3576b67e8ed6b70342ac2da35e72775f13c69b
SHA512 9e6345643a1d00321e5408135da3f9c20671d8bc9f46ffe4b4a3519b6f587d30f509c49eedab2c1e76617ea20f9870a8ffd13ae423d061fccf8994c02f59b57e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaWr:A3k03kHRJc
TLSH
T11225AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 954KB
SHA256 d538acffadaf7fbae73575e7e58977e06d7a6ccb7744dad2330ce3807609eba4
MD5 42892e8a6f82532898b4c7b2b38fa621
SHA1 12dd8951deeb4a71c522dee2f084ec017bd6735a
SHA512 c7d0254804bf6c1f34dda2aba25c9e51dd1b95ddb9e55e7caefb7950850a67c62f97c84365a095567493ec478dc10a211a57d27d8355f9d0a9a6065d89476da2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tya8n:A3k03kHRJm
TLSH
T1A125AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 954KB
SHA256 0cf57b438a72d28fab18309c6d1b406a0ecc0f4216d5c6498ad44f838c31fc9f
MD5 e9412c3fabb5481fb9d64caac2556380
SHA1 4cb028379d352cb95c22e9bb856ad4a139a552cf
SHA512 31e4b8cd59ad1ef0b02c3748b446dc4203bdceef97413c1a503ad9958b655c9d0d458fe5b8e8f244359c4ec95dd7d6b5737559f46e040d372a75bc8f2063051b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tya6x:A3k03kHRJ8
TLSH
T1AB25AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 954KB
SHA256 7a9bbff3708c72b62f9eb5bf132183a4cf62e06af6cd6f5aa06856e231b16130
MD5 357bb11f2bd0950668aa1801b1cbf906
SHA1 ed957af67a5879c5e20df129ba89f0805d6394f5
SHA512 cb3462f62ea553ea822cba06d2ee546becd66f03ecf8f379c79b715f86b051ee0b60d93c79b52610b6747653fc31f40599f02f41760c5da7517aa23ee73ab5a3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tya8A:A3k03kHRJH
TLSH
T13625AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 954KB
SHA256 237e5f0c420a4c56e3d74bd4e27c0218caeb04377fab4649029633a20c286fb4
MD5 c0d7876a49318989caea8def5709f869
SHA1 26f843b0a19275a98c86a06a7fcf3d9383a19dbc
SHA512 b6dc9e458dbcbe88c31ab4606e1ca405afd9e87e1a84807c1620ff0bcfaa00969e661a02dab7df47de68f732f0431f03048d6ee994bd4ea027cd2a7e15efc7c4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tyal9Q:A3k03kHRJq
TLSH
T1E325AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 954KB
SHA256 01a2fae97cf3ee48b64d267c8ef37481a44f8ef992824cf8484a0bf11bac4977
MD5 675f81844ca524704c18a490143859d6
SHA1 6b88b5d94110a6ebf210c359d4e16c409ea362d9
SHA512 c2854f8064eaad8f5929f80eb31d95d476567499e56dc0f98218cedef686e3d6d4c9d17faaccafe990a8d754517d43a14ea9f90dd76d058e38df18320b616bf8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaQ4:A3k03kHRJp
TLSH
T1B225AF13EB9500E5D10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 954KB
SHA256 26f9eb93e75bbce4c04d72808ba769dffbb22fbf18873f43b38d3af871fcbdc0
MD5 fef1e29c54bb38d285802ac10faf448c
SHA1 e30d1a66a8756fc2818d27672b627de1e87d4347
SHA512 4d535fd439fab52747ca1a5e58605d81104c9bf2f7381da643e4c1cd230cc75e55be4aec162574008da811507aca42863a87b15f269825ca940db9580e0c0c33
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaTu:A3k03kHRJ0
TLSH
T17525AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 954KB
SHA256 65856e5874809334d348cf35c9e3f3ab6d2c0b1b9e35178b56b0149f72f37ef6
MD5 3de3bccf6910ebabdad10af6b580fbf6
SHA1 f99cb902c1148dface809acbb9148c5f63fb4050
SHA512 86ac9e9287d37ca17e96fd4ce3709621cf6a49c0a432afc4fee68607dc482b5a11cd7b012c0e1415de9d3968e4ab96f4fb57893f5ea35403851a1d70b55eb27e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaOj:A3k03kHRJW
TLSH
T15625AF13EB9500E5D10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 954KB
SHA256 bf35a0147da8131374794f08812278469b5168916e1e45ece0feb8af8cf2e946
MD5 d82b5a15ffe18b48802f46ec681490e8
SHA1 7e2717c8c6cd2ffbb80e6eb8a17b1045ee234bfc
SHA512 dcc4c6521ac44e8739af60af86a2ca63f677d7b32eed0f201c54b18ca0b04b6123c6e0777624bf197c02740a7433e5c577fe2cbf91c702ff36bbe6e51b3fd25e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tya7g:A3k03kHRJ6
TLSH
T16425AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 954KB
SHA256 a09fdd1f88072442b5a393e02cc8f360e6f624d0a30d93e0d61e03d75230ebae
MD5 d78d389c62c79aca461dbed2f8bbf845
SHA1 048e872a22eac7ebd32c696b3f8a81b6934c3fe3
SHA512 7d44ccd29ef6c6bb9862ec21b8300193165a599a3572d138633424f29824f39c49f2a2428217835f36cbbee5ea1ecd8ee0705d72b02199ebdab277bc2231ee5a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyamI:A3k03kHRJ7
TLSH
T16A25AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 954KB
SHA256 b658d68631e92c75305bbcc0b1ac79c0033060803f82bd8bb2649598e15e0337
MD5 cae3deab60146a054a6e8812d575cec5
SHA1 e8f28382422388b86deb464caa4f6ef8dc84d146
SHA512 ba0b8e3922b59ea33064b9a403427d12da4fbce728af14a00e3e6d01345edd6493426bcff8f1d6fab43d76a1dacdc84bc279b6b20fd4c222fce0efeaf8e078bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaUo:A3k03kHRJF
TLSH
T17B25AF13EB9400E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 954KB
SHA256 cfe9232731715a174f2344a5109d8266449339a2a54a2b4bb50a074a19104192
MD5 3f8befb44c877d232981eb9332e3286b
SHA1 7e2765b02efd653ef356181de27be3ea54ae5fa9
SHA512 22ecad8d6388da7d0d6b5811619ff60c698a6b8d0d7a2a48a63b4b4377593685dcd8755e217f542227bb2b9295087e1bc73388e63af8af5ee028444411cbe305
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tya3+:A3k03kHRJA
TLSH
T1FA25AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 954KB
SHA256 8a7767fc2089e7e41c71be3e1ebf62687ee63b40edfee4780a9330d2c2274944
MD5 9db7643b895f4017d1c1b526e1e9901e
SHA1 bf8ef8bb90e2ae9306ec668e7260aec5e06f00f6
SHA512 91172eb65d40d98a469735629753b066276c913136a0d5953714b4bd02ee8dc4a104fcab0fdd2eb1fd6e3740df9f8f0cafc0c7c3048b4953b22f7b86509ea756
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaNQ:A3k03kHRJQ
TLSH
T13025AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 954KB
SHA256 da07ffaaa2e59033360810b9a28564832efc19e5b5db8fe34cc515bd97a6c4f5
MD5 c6ed1ec9ebfbba21c21b2ff15f800869
SHA1 86dd8f544ce03443fc6ec05b5833587cd1f2681a
SHA512 46fb55973e31ae2145e83c32772e04e7aa751eb687a440316ad40b3f007556c6f120ac4bba69f20801d944a2b2a63b1c81fbfd692c2ac6c840584924fb62e3d5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaCX:A3k03kHRJg
TLSH
T1CF25AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 954KB
SHA256 590a627145c7100b2ee62c78a1e85ff87e40665313eae85d08511ad8239dd411
MD5 cf5a708fe5e184a91d47591f0880deee
SHA1 da52d6001325138a3dd3e9384b137e0ef77e4607
SHA512 3416a39e786fba01e4948e1a82b7d43ddb6dc6948ecfbf21132e15abfcb99f17cb9d5a2c7430a97913226fde3e14ead753d4cc218ce073bdd58d85825b286c4a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyakL:A3k03kHRJC
TLSH
T1D725AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 954KB
SHA256 f91f6c24413921370ea7b699c162df46e1b299ce0271a40ea38e89910f914b13
MD5 7507cb6dd8a8dae1356b0ad7e03c435a
SHA1 03063030a525735c7bb0af7bda87b76ed658bbb9
SHA512 436a876b03d8346a76e02570138d72417c1ffa16d1d03ade8654f51c56ee8992cf9e6f687003d6cc031dd98c126606e1c1ba3e4b5a2a95f7d16a19140332d465
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2TyaAM:A3k03kHRJP
TLSH
T1F825AF13EB9500E5E10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 954KB
SHA256 481177426cccd872e67b8a83132b68f9b90d26c98c42d0e18aaae4da8371ffe1
MD5 03a94398cdbebdaf923e816b4af68c67
SHA1 ad60cb17fc5140c1b67a955f390da05739570b59
SHA512 6defbfda065e87b5a311171f6f6f7e5682792c386995a60e968accbeaa28a6a9f67a1827808f4e736f50d7e1536aae50fa03faddfab02bd6245f9ffb438a8497
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Tyahh:A3k03kHRJB
TLSH
T19D25AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2696-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6120-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6120-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads