8d1ef891dc0818fa265048808ce634b2dfe63678a2ada8937f76174a06b3656f

Analysis

max time kernel
105s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 948KB
Sample260808-rgwkjayanc
SHA256 8d1ef891dc0818fa265048808ce634b2dfe63678a2ada8937f76174a06b3656f
MD5 d3e6c1853c35364ff29633cd0c7f5c39
SHA1 2950282ee5cb82496abe3dd3f024cdaf2dedc220
SHA512 1436ea2aaf32b70d43bd9bc725621ecbbdf7a1e8fcdd60f6ea9fa749cc307e91b07f78d9992d8a9f55d88e62f7b78c7900cc3e01e01b7a1f9440322ea097929f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsZ:A3k03kHRJf
TLSH
T10E25AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Custom signature

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4904-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5a6-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e5-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4904-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6048-77-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019840-240.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-453.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000018a52-593.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-716.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-790.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1047.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1084.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1133.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1164.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1319.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1332.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1363.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5a6-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c2-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e5-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019840-240.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-453.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-495.dat	aspack_v212_v242
behavioral2/files/0x0014000000018a52-593.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-625.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-716.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-790.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-883.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-924.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1004.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1047.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1084.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1133.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1164.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1319.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1332.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1363.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1370.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1383.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
6048	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4904	2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
6048	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_d3e6c1853c35364ff29633cd0c7f5c39_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4904

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 8d1ef891dc0818fa265048808ce634b2dfe63678a2ada8937f76174a06b3656f
MD5 d3e6c1853c35364ff29633cd0c7f5c39
SHA1 2950282ee5cb82496abe3dd3f024cdaf2dedc220
SHA512 1436ea2aaf32b70d43bd9bc725621ecbbdf7a1e8fcdd60f6ea9fa749cc307e91b07f78d9992d8a9f55d88e62f7b78c7900cc3e01e01b7a1f9440322ea097929f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsZ:A3k03kHRJf
TLSH
T10E25AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 953e6648fa6e7293a352709479207ff2c0026f156d7d88f2ece8e8be0f6de301
MD5 8fbbcd635921be4e84b32dcdf71ced00
SHA1 27af0c15e6668d7b69e608c51d0a0a199c77ec0f
SHA512 ed54fdf36b624034edfb0342ed4f6d9940207323a522dfa414118910f758fbc7e96c67740b3e94ad1ce027acb61c4877aaa495ce0e64041d2e2073f0a2d8c865
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsF0Le5ji0hmxNrM:A3k03kHRJLPji0Aj
TLSH
T1C0658C17F6A402B5D027C1B8C6D6966AEE7138861B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 963KB
SHA256 3a0f688ba11959a972ecfc2ae499c047ff3ca5a7933f1248081756edeb65f71c
MD5 0f1cccb8ff38571f8ba7aff03747a559
SHA1 5d842f2d29b721e73ec3be62efbc53836c26b87f
SHA512 2f1579dcf055fc452938fb8a5f114a7127826dd6a33da237bcc8d6390ad8e63297d7dfb9ea1833e097aa1630fcdb96c3ea7709f037fbb8a496a88faf5423a32c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsHa:A3k03kHRJ
TLSH
T12D25AE13EB9504E9E10AC1749AD55A23EB75BC56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 972KB
SHA256 09dbccb4b888241a79c9e41279ad010c7470c84e02e059f7d588ef0e5fd5055b
MD5 e28b062752ff5ebd5aeb88a91c976ded
SHA1 1514e35e6e3424989d2043ffb03ea03ce2c9c32d
SHA512 cb79a716b3b3ed5ef14696599bc12799192d402f0c3f5be4a523057283abe16420353656f5a271da7e74ade21a81ef53209fbe5262da3b234029fa273ac770a5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsm6:A3k03kHRJT
TLSH
T1CB25AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 972KB
SHA256 69100c99360fc9fc383ad36363a992ebda6c8d94ecdba7e64910c754edcc6737
MD5 4228ea9db86cf7740607deb37717f3d8
SHA1 094e28373919ab9a9f3de16120384caaa97ae202
SHA512 e8d602312e066941239041a2605a4cca104afcdb683fa0b33332e96731b020274e58e766b4d46da3ae9d842aebc20aecb7239038105b4044fc25e323dc610b6c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQs2N:A3k03kHRJO
TLSH
T1B425AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 972KB
SHA256 06c09e4f9a5c3420586d8dac1ecb18194c28456b44df5b932388b84c9b6582f4
MD5 06b64c34817cc0759d8d0d689c0d28e9
SHA1 c99cc9bd0fab4e70ce7432973bcb3967b46843cb
SHA512 f48a5daf4d0d28e854888182cdfde8080f90e46b2b6648b106a515b1b479f537e4e1c18984d1b49cc4ddf3d0990f17759e6b04f110f6be64677270ba6b7634a4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQs0f:A3k03kHRJC
TLSH
T1F525AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 972KB
SHA256 13e0ead4de3077318977d7b63b3b11a1191fcbefbb3963ee5a6a594690e27078
MD5 1814e6391a85ac34db8e19dc63d464bc
SHA1 4bbbd73b0cebddbec9a7553255e74227bf76f5f1
SHA512 e464a43276101451cbb60fff0d75e9143aaf15468ddb3581644c22ef6c4fbf9e11c1df87cd37b32b63e632ac55906ef19818b8ac91c8e091c56c49fd6e5ed050
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQseo:A3k03kHRJL
TLSH
T14725AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 972KB
SHA256 007d45cba81e4e84e2211a1eb09cad4d793392ce546333291b4709241e33fd33
MD5 b25c37557b1ca34a09aad191c976c866
SHA1 5669017e692d630d191a6805f4daf8c811638a1a
SHA512 5e4a657d9469346c0db2296ba5ac422a0b2c969eab68676deecc071c0b2cae6ab540221a52888f47ce6d8361b19d4e9b5c6d086a91b6e7d96e5ea468092b3682
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsyu:A3k03kHRJt
TLSH
T1FD25AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 972KB
SHA256 6d789eb2fb58fb40955d9af963c31bf8d4b470c0d04880ab24b882d787fb710d
MD5 80b816c0dcc32bff2c7c791074b463d2
SHA1 0ec907fdc81ff373219f0afde5d8906cbe4e476e
SHA512 7a1f130ece13d1b66e0d03fd3103d2aaf56a08aa86dc613d485c280adab0ad739498cace52dbfc8eed4cfa58b38e7bf817e1898a9aaa6e7b17a64a1f6f87b845
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsG9:A3k03kHRJY
TLSH
T1E225AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 972KB
SHA256 a5b3c290814e196b60899c2b86f69c3eb6bdf54fd1ca4ef9a35b3ceb64d52c27
MD5 0552774d5df5166a17bd79d01bc18981
SHA1 ebe15688628c0d1065396137e2ab05aa3b3b76f7
SHA512 cc3e15fbc530b2381dc72fc3c395f89f40a2d20432c76665211e08b520d41e7acb01247dfd50e8e6050eead0be8f5e7fd149ccb7f753cc84b0a5f715aaaafc31
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsGc:A3k03kHRJZ
TLSH
T16F25AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 972KB
SHA256 c938f13440a4f56c0f1acae3bb59f01618628d8f1138d86190116985f9b7ff37
MD5 1759deeba4c562716c393a7fdbcf70f6
SHA1 d1556c0c1202e39c9b821f9000b012dcd85bcc3b
SHA512 d68eebd30cc16effaa0fb8a5f220e8c00ddf61e840cd1efbae3f9c216b8831ba3ca17c2b1e98409caf0e630f87cc77fe78b2fa9584b78d1ee275abee20c92f7e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQs/p:A3k03kHRJX
TLSH
T1D725AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 972KB
SHA256 c15b3552534602502b80d4d966a87726f888d924b1a845d278ae3531d2dca8e2
MD5 1a4c10ce4199bff0514a79179576b240
SHA1 1f7fe0a8f30fef87b36a1e79a8cafe64e1e104ff
SHA512 ddf284826b4a11045f925232f319390ec39cefdadd0eb9ea39406d8411fd5383ce40cf2b3c3284de825c54bf3cbc8bfa641fb55468d98a1892ce5e99037dda05
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsgN:A3k03kHRJ8
TLSH
T1DB25AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 972KB
SHA256 d9217d2d0e74bcf5392c733dc6efc1e30f306c29a84a2339846459450aff23cd
MD5 589b5815da5ca4c4050635770c254798
SHA1 adf4de69c25585fdbc5f6206e8fa3097d835fdc6
SHA512 ef309e6d524ad93adb0636136cc34079251bc2b7ce4b2b9fc1547e6d5f0ba2a951b9dd09da3ad2f0190b2a1e6cd87becb513a12139188164583ac9465a733268
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsoF:A3k03kHRJK
TLSH
T11325AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 972KB
SHA256 5697040aff6a74d7e9eecf4e1a4ce9cd07adac66906b49e4541df4bc27028ce5
MD5 2f98ab1d62ce4ba5609470463fe0ea10
SHA1 5b89842baff5a52f1e0daaaafa22bed08246d999
SHA512 97db384d2fe50dbd67c28b16e15dc8d651c0422c55df9421baa759678b5ea3f195e50dd0fab54ebbbcabccdd5a478799b884160f7bac2deeb43c670c3ac172e4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsdC:A3k03kHRJe
TLSH
T1BA25AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 972KB
SHA256 7d290fc1d391d4ff885865ea1700f5f68e24db93f7083431c92f632a2b8e4381
MD5 51cc505d17b608b08004159c14c1c494
SHA1 55aeaab99deddbe9d43dc69d5b6fd62e59b2b48e
SHA512 4ce4426ff95e504f823418a4b184af8d53b83fb1b0328c537fb110f30b08bdbd9cec41b224c0386084d0de6215715d04c58282278d6aadc06af2ec7260e0da05
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsmw:A3k03kHRJr
TLSH
T1CF25AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 972KB
SHA256 608c97d1ebea13406b0e2e5d80472001b3baaec0221d72d5fc4de59bd5d8b49e
MD5 f8cbaab396faee1e86db8336c37916d2
SHA1 d3991db1d90738d0b2a737a6e6d8753cc591d626
SHA512 d863ead59cd7a5301501058476366624721634dc8dde6734895a7dce460b1ab5ed3e9c9947c29d41e7787554972de5166889234dd8d68b13e50c51b593c8ca5c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsVT:A3k03kHRJX
TLSH
T1F925AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 972KB
SHA256 dc401b79ff01d236c198d54ef1c113e084dd60e83abf364beab45d14fb5dce57
MD5 c7edcb95b4646315da6642693bb99f40
SHA1 4ef572758c6d6e6679b26c30c84700265b3d04cc
SHA512 b0d59b75f70bcf69c29d12dc09c45fac99771d162c7950656a98a9e8a76cd3d572031ae8325130fd543f352450954e162919af91237059ddee27f417eb689db0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsru:A3k03kHRJY
TLSH
T18925AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 972KB
SHA256 1a721e23f838456b552243bab294a538d78ec66fd1384bff641548f5d050e34c
MD5 d35045a89736d667ccdbed5c35895ac4
SHA1 5babc27b66267d08f72336ced760064094412e85
SHA512 2fccee147e6cdda7b7899e0f2c637462f0c529554951e145bdd1355088b752a717f209e3d0d3439e29d3567822b104791623a85ab98bd22527333cac48f3cc27
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsPb:A3k03kHRJB
TLSH
T13625AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 972KB
SHA256 5f0463b0c86b1389bcb66964b9fcdaafcea05ad899d953355ba88009b4767822
MD5 7cf1f02fecc04009d8c20edf12e03e18
SHA1 6952cc48077625ce574657e1a196077af7110018
SHA512 77c2359a7c1335e466c307b8a5f24e3c83e1fa5523efeefd99673f0c467d6b755ff99598067bf753cf0a7147e35e1c8a04be60ee8d3dba9115a3d3d69bd8897b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsLf:A3k03kHRJB
TLSH
T14725AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 972KB
SHA256 d873001697f6e53dcb648f8677f7536321bca2a77bd92fe4614773a5d6f350dd
MD5 5b9ac2e5ac90090ae69cb7750386cdf0
SHA1 852fb9080bd8434960e938658ef6fff2bd4b92f1
SHA512 1de13d8f1eb50116292d281d83b0acba4106e3e76b8c884e49fbc1969973384755b936172286311d676422fdedb18c0a1fa529962e955b69e54f46cf1e5cebd9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsEK:A3k03kHRJZ
TLSH
T1FC25AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 972KB
SHA256 e8928712f81740caafda2e580ede31fe13fbf98e1dec0c1903079355f10cfc6a
MD5 4aa719379dff80e387aadc1f3c6b3756
SHA1 1600612b7e3453acca7f58bce8e5cccdbb420dc6
SHA512 6cf44328798d7594414938761c885492f2dcb0197f637f7fd3422c64dcdb13279207b7567a765bde3118ed56328a82513eb96a61e9b8c54c0ae44ba31c2ef449
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQs5k:A3k03kHRJQ
TLSH
T1C725AF13EB9504E9E10AC174AAD54A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 972KB
SHA256 725c4cda92636b86eadd35fdc98eb8bf79da2801e33bceeeed741602ef892cc4
MD5 b2512fd6297ff9347dee7ebf4899797f
SHA1 39f3e6ac2bb5e14647be0443f8f538a955c954fa
SHA512 458c554e974c40719c16533be7002aacbfbcffe7a53ced029eedb259a7c731d8741765b2eca7d574dd1119cbe587aab60272e40a279e02088d079e66a9e4b4aa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQs20:A3k03kHRJ5
TLSH
T16E25AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 972KB
SHA256 5117a644a33139c40d1961f0b81036a085d840b333b7062fa64db43e75f7a10f
MD5 1a7bd496f0844fdbe3dc2a16aadbc2dc
SHA1 9c6fb6b8ce06935b53db8270eb79b2c79b535040
SHA512 f4e5c8500da7dfa1135f67f3cba5aa1bcac83cede482ee59dff95de3835da6b60f62a4bace6574afc801f4a42e8908af39fe7ed1105a95c407e31cbf99fcd6a4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsFg:A3k03kHRJo
TLSH
T18025AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 972KB
SHA256 48fa30d64a4e561a05bdb3bc930c702c967bf886fb7142c06001219a85a46e46
MD5 b4162c18b8712644f2a0e6836d3d0ce4
SHA1 84872e970df37f06e195f0f2391a31ceec4e7925
SHA512 2bb96b552cec039c056965c267fa585426dcea590d830502f1b99f475899b9ad84c4f7b9aed858b8a0393c85d59f2d6e7579e71fd37cd56d023a6c4d605c1933
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsUr:A3k03kHRJS
TLSH
T17F25AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 972KB
SHA256 43a0c7e2b678a74dc5dcd9217569ce575fe7a7ba174a415b165ef6e94d314b3d
MD5 da32a32be414a8284e454b177f463469
SHA1 a70507f08d897cdb0adf7b1ec4c67ed870879d67
SHA512 06eba1af64b90e13f7944cfd5579c32ae71a817f39373faa25c5e65c85abbd330e2c43de32fbaf6919c87af8b9ac063f29140f67c33b9b55640e18e96c87f573
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsqn:A3k03kHRJE
TLSH
T11025AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 972KB
SHA256 3f9b870e18f2e528f4e2dd64e32491aab10afa0e4b0be1885819302fa88d5751
MD5 6a973f939ed1348d0c724fdc7d980872
SHA1 246fc90314c5f775ea93b6026cc4a0a8f4dead6f
SHA512 b4190af4e70a2b3e843ebc3df7f6b81dec1206aa86bac847b392ff3225c2bee7525b0e2b7b713e8eb6e4a7512a5932aedc4555c3f067415048cdb3bd4efdb991
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsgx:A3k03kHRJi
TLSH
T14125AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 972KB
SHA256 9ed74b4d63e8a651dc3e4154c6f0671f23c11d989eb4e63ef449edf3ed4432c0
MD5 d0ba19f33e675e6384d9d08e44db02a9
SHA1 244dbd436d453d8b961b365daac22f5e5985efca
SHA512 07711fc51570764cfebc5094e6955663a2c8ea7151fc6cda5f952687426c26599440ee006561c747d2fe0f272f32cbe8ff513ba48940ae6cb6f2aac4b10ea728
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsiA:A3k03kHRJB
TLSH
T1BA25AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 972KB
SHA256 48839c1c20922e85036eb34c3f3595cce04a7cd7e83e229d7689a93f7599744d
MD5 48067ae6c6bae99bc8aa55b12d46a1eb
SHA1 63650654463e5d5492e269b7071d99c9d179dcf5
SHA512 86eb9d79730d5d62b6c3e818dadef2309cdd1f4e3c74db5341e8673d748198f4335dd2e4470f46e04f695cbd3d83c1eaa383488cc8560f21cc2b1e6f332a0cfa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsb9Q:A3k03kHRJ4
TLSH
T16925AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 972KB
SHA256 8333d7b97ad10f13165a5a1fdb589839b8bde44adcb7029dc8ace3fa051c4583
MD5 d643c1d61f3fc09e07930b913712f461
SHA1 6c593079c6bdc82798c911c1d076ed90a0b04ca9
SHA512 384096aa1918ce5a53c7abdcad5fc065d98f04ba0908fdb88b8ac515e6e40a1a02836aafea27602649c76b96f0389ecffc592a70b450a21b7e0cbd3bfbadca73
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsq4:A3k03kHRJD
TLSH
T13825AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 972KB
SHA256 1cd9b3b5f1686a87425efbf85f176be1b046c0c4c4d1c97008df97a293d70a16
MD5 4715becde099974291e5b9c740f8aa4f
SHA1 5610ef493920feef288dd65074ecc3f191dd0448
SHA512 1b2955e3b8e7f6e4e0261718f7b17ca1c617a8bfb8ca70f420f506e472d6c77ffd4deb246d66cc2badf26d5d898db698e9d0ffc6aed28af7fd213b65de24f282
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsxu:A3k03kHRJm
TLSH
T1FA25AF13EB9504E9E10AC174AAD54A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 972KB
SHA256 ad9ea9c247ffbd2e741f7603e2c0ecbffdc2e9cdee99e9b3bd3a18b77ddf5afc
MD5 a1d729a778538c0f0ab5f35fc71bc057
SHA1 feeea92a2149b373be30ce03831544fccdc56865
SHA512 7d2b97a9079bb0b6afa9a718f2af03daafefd847c831d85cd0ad8d1c519c3752c06eb70b3dde4d1ccb90c30a08d878efec06bdfb27248c8072993bddecd2a3bb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsEj:A3k03kHRJY
TLSH
T12A25AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 972KB
SHA256 353f9f999513af9101eb40c159bf104a0b247c6e98d88cb572187f70f1de00a5
MD5 ce2e3cdc45830ee25475efc6a1d0fc00
SHA1 fa12fd2db25e4a3165b765a8971850f5b1d6919f
SHA512 45267b7f6e100180b1794f689457c0ce003a80fcee8f6d9999f29963191634b24b7d861d9408ceeae3dab13f7ff1e8fe01318feddb03ad9ba218f89db8ab2ce1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQslg:A3k03kHRJg
TLSH
T12525AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 972KB
SHA256 8202e2f1ee7620fe765cf4bd62f8b47267d3a07abd022b968350c433479e7cd9
MD5 0261c115b276dfa9ccf977bc7d6e9390
SHA1 a018a4dc3a827febe289ce9f0d37f5366cdb7aa8
SHA512 2d0a7aa4509420bc1286a522e41e705e7ec45a219982674e6ee7dcc8ee6890ab4bbbf8a7c8eea1d09c7c7daa4a4a0117a1029f1ab135267291e642c3edf09e28
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsEI:A3k03kHRJh
TLSH
T1A525AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 972KB
SHA256 750ed277e33352497581296bea3b575f87e83a00913a3ae3dab7bc23e2206ab0
MD5 68c23bf9517bcf0150b9e52a1fd3e327
SHA1 0395a5eb2d03528cc6734ebeedc2ef3e0c90ad95
SHA512 f5885de671fde1f49347c003225d58d62f801f267db778d56a336a3de8bb0420c5f5311e9a2b2288367c9ca85b55a05302e5699affa2fd3117b289a47bea9c8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQs2o:A3k03kHRJ/
TLSH
T1D725AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 972KB
SHA256 bbab43abcad6ba04ad8b1e83f3aef49af2129de8461b91b331c8c77c60c55242
MD5 6449effebc76e69f97c4f77f7de454d4
SHA1 9efc9377ff7b2449e3d1ca86d28d9a3b51c06be0
SHA512 130ea5f863234dbc762d7dcea7ae058c9836aefd4f55a636b05f7972c583ee891d23b47ddece35219b54411ebce20f50641f7560a07eab3ad4408ca750551970
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsd+:A3k03kHRJK
TLSH
T1E725AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 972KB
SHA256 bfa7a05830ae3cc696956524629b7397fe93305fd9d3ca3b6761762309bef3c4
MD5 845d207f051a72cb97fd5d28c2f9d5c4
SHA1 1479e1761efcba5a81d3cba28b23d3a760fe0535
SHA512 89d274051ece73e1b9a964da29d361ca9df66b949cf232d0d7e96efb4fa34256e5145382ddb163147a6361f5a00a0f4f487b5e434dc26fc191e04d9ef94936f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsLQ:A3k03kHRJO
TLSH
T1F525AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 972KB
SHA256 ea40b65bb16529c5b699c1811dc8265a9f1205670ea2cebd9092c1a8e62c57e2
MD5 8ad3cd386d878d6e0ed845ba4f7cb2f7
SHA1 b81b0802cf0ff2969da718a42288c5af15006812
SHA512 95d4bbb9acbcc4122079fef1e90ea86819cdaf30e036b139289038db88cecf65fed22c8360edeeeea2ce4899d7e61b0dc9f0bbb6ba78938d50f8b3133a26d440
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsAX:A3k03kHRJO
TLSH
T1A625AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 972KB
SHA256 2bb86ca4259dce6411ae3ba794465c4da0883558283ef45bdac1cc67827a6b13
MD5 c7473dc2ea9bb01010cc888598b97096
SHA1 ea9776b13ec9d0095401910a446ee1815861f7b3
SHA512 669a7cf3d8c8e4c4418f3891623b64d36b0b6fd2963f8502cd88f1fbbe23778bdeaf990c3953ccdd068eabd931b72c49e9a3731048a068ef3268af2a7159a884
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQs2L:A3k03kHRJg
TLSH
T19925AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 972KB
SHA256 203f8bef0903e1e54ef37858fbd8b4ba6dcb70d69513f4f557f28fbb3458f699
MD5 1d3a72d1b9f0aa64175dca09d0744d8c
SHA1 99874de37112f9a1fd67932c82fd29176c94e042
SHA512 aab5e80f042243f4f7ff03b71a2cadc80eae615718a97bd7f0985e598b097e634396a5350310729d6d0209af3522eb05ec954f4c915d5b2fb4305bbfe6cb6ec5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsKM:A3k03kHRJx
TLSH
T11825AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 972KB
SHA256 ffef2c847d1572dccd957f88f40ca5a6f5ddd594a30b9051bfb21f31cec06f57
MD5 7a9627f9ae2c272bd8c789aa7d968e70
SHA1 ce5bc5e1b1c38aca15117876be7895ff001eef5f
SHA512 73a56a53d72df38d58824f16b02b3b8daa0a2eccf564023efb56de6137694525f0cbb573a45a2e46464e45eb87e06b0d169aa5faa808d5bf56a2ae40b208e163
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQsbh:A3k03kHRJD
TLSH
T1FD25AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4904-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4904-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6048-77-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads