4be6c53370fc8bdc0008fed01e58bd8e9ac0d4edb7277cc02dd3d7f7b3cab677

Analysis

max time kernel
101s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 09:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 853KB
Sample260809-k4xmsacm2w
SHA256 4be6c53370fc8bdc0008fed01e58bd8e9ac0d4edb7277cc02dd3d7f7b3cab677
MD5 6a7c1773d49f8be99250d68289326121
SHA1 af1b2a95cf056f3e7d8351b03b22e0a0e3a06ed3
SHA512 66c14994a2cd86cfd1ff23b5d678c4fba32c77885b1e60cda7530bc5727629d063e2c14a16d06a8d58710b038d915ea3566481ab2bc72497ec602e5819c87af6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTp:A3k03kHRJN
TLSH
T1CD05AE13EB9500E8D10AC1749AD69A23FB757C561770A3DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4352-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5f4-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e5-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4352-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4044-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019840-240.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000018a52-532.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-900.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1063.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1112.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1170.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1293.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5f4-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c2-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e5-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019840-240.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-489.dat	aspack_v212_v242
behavioral2/files/0x0014000000018a52-532.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-625.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-900.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1063.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1112.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1138.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1170.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1177.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1184.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1293.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1330.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1343.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1368.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1389.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4044	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4352	2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4044	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_6a7c1773d49f8be99250d68289326121_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4352

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 853KB
SHA256 4be6c53370fc8bdc0008fed01e58bd8e9ac0d4edb7277cc02dd3d7f7b3cab677
MD5 6a7c1773d49f8be99250d68289326121
SHA1 af1b2a95cf056f3e7d8351b03b22e0a0e3a06ed3
SHA512 66c14994a2cd86cfd1ff23b5d678c4fba32c77885b1e60cda7530bc5727629d063e2c14a16d06a8d58710b038d915ea3566481ab2bc72497ec602e5819c87af6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTp:A3k03kHRJN
TLSH
T1CD05AE13EB9500E8D10AC1749AD69A23FB757C561770A3DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 aafd28290f88ee691291a4c8979166516a6941309ffb781f1a782e8108ff5b38
MD5 9987d436c8e9bfee77a9b87a3e312e70
SHA1 d2276619a3e84661ea72e7e0787839dc69bd4af5
SHA512 6c7046d6c11528bc490d099c2de5df037a2f01da57848da1e363ede816527acac3dde92e1eb447659ce0391edb1f21a35b73b2d68512a384f44c1e5b37fa39f9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTV0Le5ji0hmxNrM:A3k03kHRJZPji0Aj
TLSH
T1E8658C17F6A402B5D027C0B9C6D6966AFA713882173086CF1359C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 868KB
SHA256 c49964fa866861f8b71f07c005adf59f0c5dd0173c81e8a9df8ca33875d6a2af
MD5 a0c2fdb1db2c2da666de2d6fad45bed2
SHA1 c046a0f7b18c693feb7e818de549bf9c35d62822
SHA512 ce5f5cb30cc434c3bd5d461f6cf8c04251c076ef321112e0a8e9337cc0a5b249f05fa274f2f6407457fd592096832146a4a8003a61d4865bf2465d1e8b483b07
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasT3a:A3k03kHRJ
TLSH
T14B15AE13E79500E8D10AC1749AEA9A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 877KB
SHA256 cbe7bd4b606dbe81b575df4005f39b3d3fe8cbf81839e1758ace0d08fe5e4ae6
MD5 0f80c81032a7bd1886808b4d44a5ea7f
SHA1 24a828a699dff9e4e2ebbac150fcf60fd93dd0e1
SHA512 0b9f6509610e2a2ae49ea6df8283d37f8b6b0ae856c36dbf80329788d703d51f1e3191c7723b99c62ab0e70a44e57b0200c17369f0ba88d497df54d65f609e35
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasT26:A3k03kHRJl
TLSH
T10A15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 877KB
SHA256 0514ef8600d31cec7cbfe0b6c95dc6aaa83d629e9fc65452b4dd24580e1de43e
MD5 f48f64312db17c8f329c5569cc5655bd
SHA1 4e3ee8f6bbde81394a2ecafdc3b620c0b7ec2eda
SHA512 488bb15fbf014f5bff540d7ce26f726e0d4fd48b0e8a80a311b08ef9a7354670a7a5d804c53d2a867569d978461626d424c6fc572469355daf5e946d67254704
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTmN:A3k03kHRJ0
TLSH
T11115AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 877KB
SHA256 2ccf9a7d652e61ab269dc0374255225819dd58bb37c0e88443cba2864be2dcf5
MD5 d06e1e5c49e853cafbba63995a08c758
SHA1 12f69200ecd28f233f14895269e6e6126c25deac
SHA512 9ef70e8dccfa44fd2d1ebbea2449bfd0860032f792a3f986380d7d0ff596a319d3ed1be2759a55643af7cfe4d79690098dc8e76604146e463f081bb60e956f30
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTkf:A3k03kHRJU
TLSH
T17015AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 877KB
SHA256 844b9b2ed881252c7980d975d7449d1fabb7758e3148b28332fdcc321e019d35
MD5 6917307fe4104729e5a908dc2f213364
SHA1 f9d903a3e804035c7de24826648ec978833371e9
SHA512 491765cd5e8173c7ce28c42898a49315cb665e4d3aab17290875aa6ab780f3b4919484d94d8cdcfd0b5082c832536a4b2c3a54b67ff86b1c6bf7f42f205d176b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTOo:A3k03kHRJp
TLSH
T15815AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 877KB
SHA256 ea92c33595950fd70702ff7d748623b3b4707f97206ff8664439e882442475bd
MD5 b4492bcbd782b5fbb2f5bc2e78e5a148
SHA1 b5ea8bbe8af5ba79c21532b3bb6d257fd03f2f20
SHA512 19398241d1f3728cfc0fad643364082754517afced0eb65ff695a6b7a0228fec7ac95da12f35ec1e923d2b2ffc6340f26d011148d0259addcffa46dcf102a5b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTiu:A3k03kHRJL
TLSH
T1FF15AE13EB9500E9D10AC1749AD68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 877KB
SHA256 ca5bb48d7d9aa36025ddeaea4216cd04b983ed4f9e409d3fb93e90c72c1f321d
MD5 9d3bc6f67b433b169e8e8aa2319899a6
SHA1 3b977a3be758075dd348b50dd2811d0c7e1b756a
SHA512 750a43b41db644af943315ae36c3ae3d115ef0b958325c40c7a1408054461f176392f4686ed0f9fc155ae297761566bb6d66494504eac4362b7fe077685a5c5f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasT29:A3k03kHRJq
TLSH
T1F215AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 877KB
SHA256 4bcfe617cd3b8535381e1a11797bce529c8b1f2acb2eeea748c91517adb1de89
MD5 41d93a3892256ddea9d5ea0c54a4226b
SHA1 201dd45a2a5ececc705bb190fa015326eb61296c
SHA512 954bdbcb183661e10f3bb347d8d3e5a04b8140504bd7b87feb5164fa566e1d2f222daa116c7b26cf4adba9ffb4bc266acc4833a5656da9bbd35040106c66c62d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasT2c:A3k03kHRJH
TLSH
T17F15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 877KB
SHA256 3dea86a6272f9dbf05ef79f7c47a94a63c973c8fe46bffe4e01b92989c32569a
MD5 c5d0f22ab492937c8a94bbe6370d6b26
SHA1 c5dcb96408f941ebb4d111e245d8ffbc7c268f27
SHA512 a1bb2b734f649d4b352d18ef8a9449d0dcec798bf78686ea71564014488e1cd93970fbe9c8124970a5408f883a9698e009e11812506b075833bac3371c84894a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTvp:A3k03kHRJd
TLSH
T14D15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 877KB
SHA256 119a8acd6a229f5ea140aecd51a95ed1ac04309332c007f2f3200263e0502f97
MD5 460a29bf62e528bb8b66cd6949b1e6de
SHA1 6238f20c6d190666e2fc6c00190bb4f6693fe5c5
SHA512 3e9a9d01bdc2a03c8da6ce9651d1f4825a4e33cb0be218171f6a7e95aff0d0ff17b91fc0710349886216fd8544925fccd784fe25549ee8e6f0517bfccfa9eb93
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTQN:A3k03kHRJm
TLSH
T1E115AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 877KB
SHA256 3753180e2e1bd3f82537bad290e90822ae1cd37de905d8abc4753a22781c3745
MD5 800473f6155897cc5023beaf7678adf2
SHA1 6e751f30de55650da021715df5de4abc919487f5
SHA512 28cdef150eefa6d1067317ce3dffa6141344c7c2edcdedb8b154aa793d7be0aeafd89b65de1173eed3e22a4b991c52fc1fd846a336cf55fc1639abe04a7f04a3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTYF:A3k03kHRJE
TLSH
T1B515AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 877KB
SHA256 46603a81b5adc0c2ad1bb369ec70d480615944e6c906766ebb3674852a4feb0f
MD5 17e8ec54dc01ba3b461f47f984c9cf51
SHA1 fe6b5f99a5b8d02818ac5cc11ab9431ad853554c
SHA512 a81a2d23014f3f3d8574cd8277d1781809d978f788eca0a6e4a4ef877cafbfc24cdfb0ae4e8f59180b15293680f9b5466858f68caa3616206c3bb56c7837d018
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTNC:A3k03kHRJw
TLSH
T12215AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 877KB
SHA256 e351573c8bf3f173eec3f0bda88b9af190c34357cecfef73284a52fba128bcac
MD5 6644ac8b9100e1367702310099561f68
SHA1 744146a0d0fdf428622d3ad18adf351e4c20b2d4
SHA512 e740388fc03affd192602c44a79537cca1df89a7dc5ad33607c57e7312dde73c6dc88d1dc863d7e59a4276691a49bff35cf099ddf515bef202608955baca26a4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasT2w:A3k03kHRJN
TLSH
T16115AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 877KB
SHA256 8a4109b8c46fdd916fa63e22a63717e76b1720fcb6543cb6d50aa38db00fe1ad
MD5 dc81a5d9e0732f1f6ebbd43db56416ef
SHA1 3093de96ac30d39de7059585c19ac69b99c143c2
SHA512 64eccb7d791d1c21ddab4ef658012b749136cdd4dde8f29fbb2367c8a0256e7af76ebb80b4af0c7173e61c1ad0b9346f44914de2bc468a47a8bc0b15deb217c5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTlT:A3k03kHRJB
TLSH
T1E715AE13EB9500E9D10AC1749ADA8A33FB757C56176093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 877KB
SHA256 2a2895184e79f1648668188d9e430634ccaa25ccd4a5e46ec0195c036d9cc0d4
MD5 10745a99566f89f6f56c670d5d3a6b68
SHA1 41ac9600ace696551932b9550f698eb8a5060399
SHA512 20aa75b3a30cd73050fa81fe8cbccd33a1b83b96d234fd5027840639645f2040fffab9f5e12c41662fdfb6fa5828b7603c39007afd7382438d026a129a2fc9c0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasT7u:A3k03kHRJ2
TLSH
T18615AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 877KB
SHA256 2b19df9c56217122affa3385d859db32656548c0822b8b5e76c11ff61523598e
MD5 479439f48a52155f77ee6426da1601bb
SHA1 2cdd12fc6054da839f931c4daf77c90b624b6bb8
SHA512 7658d39da3106ed71c303aba0481fe603664af8d73ca05debe09513f28e47faccdfa7150094f83d6f6bff562cef3dc63bcbb8a955c912480706c619304bbd6e0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTfb:A3k03kHRJH
TLSH
T16E15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 877KB
SHA256 c7ade6bed5da04f08a4ed0af84aff1880fc982075e7ab1f4c4281ccbdd9bdb1c
MD5 f30527871e0bf2f3049df16efa58a14a
SHA1 579dcf7239b1a5f3b61fb2eff34e2ac49b746593
SHA512 3d0e775e98dae2a1424d95090ec8614885ce4ced2d37c491c4e3e573a69c85037e85a721c51175f908cf2e106f59407ddb1215ae4a7435e6dbded5d4a3686179
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTbf:A3k03kHRJv
TLSH
T13015AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 877KB
SHA256 a1837f978ca1c12d8ecc9d5ba5cc2ab4e030e01f9da94b1ca492e82a7a6eae5c
MD5 e6a97701ee0c524cc2abe47ca718b70e
SHA1 7cd2fb249c1abfeaf384d2f906faf5817d693374
SHA512 9069e7c2f16d7ced84120ae8718fb75b3a7709e684c9a6ebcf9055fb8aaf6b93ce0b7d237bbe7ffe9a6701a038aabf8b80f40fc9a1059ed91d3c1f77cafb261a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasT0K:A3k03kHRJP
TLSH
T16015AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 877KB
SHA256 ce0cf9b954f553615c0c39ba56cf866fccee89df6b1a4749ed6fead0beea40fb
MD5 1f59f21770cabdef36c3e3db057f69b2
SHA1 807ce6fe62ca40a1ae1b913b4f4debe31fab8ff7
SHA512 caf778e9ec03e58839ab6264fab1d30e2b9dbcb2b8a715f3224548163909bbfc89bfada0550d02e6463dc3b51ab0a748a06061140ad17acca0d389adfb028bc3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTpk:A3k03kHRJa
TLSH
T1D815AE13EB9500E9D10AC1749ADA8A33FB757C56176093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 877KB
SHA256 5a1b505fe0039dac3ad0aeaf27bbd8d9322d3bcf0c8608abb45b57a05126ac2d
MD5 ff466dc8f2b0788a943b8d870997debd
SHA1 e5c222051f6ac0dc10ba339a3298a23d8e1a30d7
SHA512 48f42118786cc9dafcc692b115c5bffb0ab73607d4c5dbe7abb1896a0ceaf1f251aa1259bfdf7c233b2f116d3732aeb5ba814bf7ff6fb605d300500eded85ab1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTG0:A3k03kHRJv
TLSH
T1E515AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 877KB
SHA256 024eb2ce0c91b3cde879f619d950822c47910cdd41765177178024cef40c86b1
MD5 d3e9fd212a195ee9d91f1206f9eda778
SHA1 fdb1962897c1061f3534211a29ce9ea2ab5d22cd
SHA512 9888a05259c85b3dbbaeebdb20320dd4e8fae409b7b26cdbeae89b89e31b103fa5ad95a17f0726296deb7e12fbe18b2f04e4be28eaa7afeee6f495f2fcde953c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTVg:A3k03kHRJy
TLSH
T10E15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 877KB
SHA256 c92a99902fc6d45b005b2e1a53bce682c875c5a02e4517d49c8d9134167647ea
MD5 86d2335ac9bb6a57a4ef8c67f04c5048
SHA1 5cabbf3641e6dc46c694bda36fde2b00493510b5
SHA512 91b52d6a14523e268965342422f5dfafb88d3aab804342e7a783e16578f3ccb060e6ca91206b1907814ee0b49336b61fbf6974ad6e9386391f7be83a40463db2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTkr:A3k03kHRJ8
TLSH
T19015AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 877KB
SHA256 a7f73f760d2b886e9298e9383ade4393bc1e8434e6d19255d248af6e39952625
MD5 2081e9cfff304fc51391576eccb9a114
SHA1 bfc0cdc474118461cf01dfdc8579fb4602dfc198
SHA512 af57964af6d292638b1f06852b35cd8e8f049d9de788223503532a79b52f6340d3f27c98f70b83f6b8744481d69855d15dbc06d63b441439cfc025c00d964af8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasT6n:A3k03kHRJG
TLSH
T10215AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 877KB
SHA256 087b31768b61a98f8a68912bc546d6d424ccffcc8c5d5e6b60ef1e081dcd54ae
MD5 a7c8eba7b60997b8abe81f612a6c6cc6
SHA1 34012dacb02b6624ff3392124ac4ead9a349076c
SHA512 bbc6e79712dd189b4571f07ea3b8c439eca4bc10505572be466feb699a8bc948fbb2da4e8aad67c4a5bed195f5425789f627e4cd2fcb51712bded5bd65dc45b2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTQx:A3k03kHRJc
TLSH
T1B615AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 877KB
SHA256 3bca4d7013c9396f2045367048bb5afa7a741cc506f47d9c6e23e7d4ba2b3f24
MD5 40c54585bd5659f28eacd463335e9e6e
SHA1 0468bfeb6ce64ca79f5821cfd2c974dc3fedd70d
SHA512 562161f93e5ec61263a2ac736a3520cd3a30139c093028ca9b356b1b996ac3fd0f47ba568b14eddaa12176c26fad9099fcf9261a13371116a8e86548d9c53912
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTSA:A3k03kHRJn
TLSH
T10B15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 877KB
SHA256 0120b971185127f3c50636c74c5b16b5f3600801a90054a101f9fbda8b1b31d6
MD5 6adc5ba85b52445795aa0ba137384c53
SHA1 cf12c4942fc9f209bad9d4278477d1fd9231ceb6
SHA512 fd19ce782d8c543ed2f1c0ab4f16614808ecb3b96af75b7e2083416946bfb98bf7fa28b87f67c2d408cb3f1e08262970b44a420ad5c8544e152cec2ad13cf755
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTr9Q:A3k03kHRJK
TLSH
T19F15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 877KB
SHA256 9b9c09603f20308d90e1a4f112bb27a7e1ff6331d9d1b7604bce44b7b3c60793
MD5 f25e2384841033260082b26a6dce64d7
SHA1 a354a10c89e3447639dd9a5f52f871e298d99d72
SHA512 3427878a5909fdc409ad59e2ab0a60b3288b40c627e1e9cd0e409773a84744891f9e1a18dc394fbece632a310b637377bf2324769ba7d676ad06d35a9c2deb1b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTa4:A3k03kHRJJ
TLSH
T1A015AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 877KB
SHA256 57a3c50199ce451814c979c3fd28b02398b6fa5628e1fc632d9b2c6238d22ff1
MD5 204f6f9424cb45be87d092c1972fa2cf
SHA1 15fe9531901f2b0972fbed08e89d5056e743528f
SHA512 897cd08f53df411f6bb15acfb8e1325ca8e9cac331d0176a6775bc34b246b5efbc5300bc8e4af3454058e4a0f049ce898433be4791ed8b1f54cd8489203bc083
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTBu:A3k03kHRJU
TLSH
T12815AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 877KB
SHA256 316250e8782ce8562196dbf92751efce314bf3450ba1c54e0015d67a9877f4cb
MD5 40b1c4cb50284c7c5e4ff663e7777ff2
SHA1 28afd03aedc541aa141ace005fda7be469d3070d
SHA512 2dfacc5922b57439bf63c2450b9725e16ddf8a84b8b86f4178082342553978b79a4b2d419c634b735a363971eeb5b5f99245b3f9f33bbfae522c6b1b93bac031
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasT0j:A3k03kHRJ2
TLSH
T1FA15AE13EB9500E9D10AC1749AD68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 877KB
SHA256 804192536ce6bf098288a9c4fe6bff92043ecf798d2baa91a211cf261d5caffe
MD5 2f56c835bc73dbf70a904bab51acf669
SHA1 364fa9fe39d27054add2cf4259af1e5dd03ac6b3
SHA512 a18afb3d5afef40c8f13944531400dcba4e42277df5155eeaa86ddb7cbd0bb3c5f34ec0c6c5afdc24f525b0fcc3d4087d73811fade73849dbc0b61d89f0329e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasT1g:A3k03kHRJa
TLSH
T19D15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 877KB
SHA256 b8cd2d01ad1ecd11aab72662fb671ea202f8ab976aeb800d5307f857ac9e911b
MD5 7855fec1697d241bfb37c75f5ae565a6
SHA1 7fbd5f3daa3eb44263fa18a1162801af6c9dead4
SHA512 86b91df5c94c26104260691ef4a4a1219a7a282bc64ba0035a8d3c61c06cff2576ae2f7d8c5df5d0c8d9074edf287b6beec32c2f49d8e271436c13582851b228
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasT0I:A3k03kHRJb
TLSH
T1E615AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 877KB
SHA256 ee8a87c392279b566079ad12c5fb5f8c9de911b8aaf3029e5901923b2aeebbe4
MD5 7ee16f96745fdf72f66321793ab4c67a
SHA1 8ae4655982df4ae681ce21cba57b3f1e2960ac60
SHA512 b3d84dc5d6622e93c08d800995e80846eb6aa0a863bca899d8f5600dda54d21d1d79cce370ae03d3a5694b0b822085d7700dbc3973cc0797cc81443c66a48ff5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTmo:A3k03kHRJl
TLSH
T1E715AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 877KB
SHA256 9d9530ef0d97034a4a5df97594ea36bb69f054b771297a329fe858bdecb9fa05
MD5 cb3c9d0902e802b24e545e12cd3c0422
SHA1 42746110b19ec4d05199812b3c007910f3788dcf
SHA512 8f7d982bca2ca1b8839f3f11879eba6799360abb099ba3b41855fe6036b610cea51d77522bfba7fb6bcbe230da68da3c9e557d6e237f3fab41782b3c234d2123
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTN+:A3k03kHRJg
TLSH
T16E15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 877KB
SHA256 5c0b62d454aa64a700eeec7b215ed22f5967444573e20903df5b5534af9726a9
MD5 fec1b1348db2df1d834fb95eac346b3e
SHA1 d37ac6e0c6a696e1e529e1fa2708024c08b33b61
SHA512 adbacf91e63f659f7c80b4d77d342b31c2ece6e35c25b65321b965777daf1f90016e4bd4a311e2404dea1a2fe0e81a47063784ad4fe8092d1459a0c12dfcc502
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasT7Q:A3k03kHRJw
TLSH
T16C15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 877KB
SHA256 0070bc0b29cecdf7598ead85284eb94e782a3f8ad16006ec3f8675c1784ece7b
MD5 2073cd0b4f86ddbe27ff795b61704c0b
SHA1 7021c58455db2d695a491f488828af9dde646519
SHA512 136fce885136978e47e2a9a39861b9021a20fc6d1d69113453175385d174a867779591076580dc09999d0ea78980b4173ede048f05b50c28a281c3f9e5fbd626
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTwX:A3k03kHRJA
TLSH
T10615AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 877KB
SHA256 f093d12e786eeee86e6b9e3308bb41a4ade34a375417d97de34036e143875013
MD5 a26c5a05fb4cac754944da43a30c5bbe
SHA1 65cc73c1c0948d6d11d1600c0712973fe9920433
SHA512 d5ffaea685f2dce0176944ae376c7f4ef670e1631b110c88e36dedc20cb45d1609d4679e270c74477ef2177d39c1a445ede2dc694649767a3dca307415bec172
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTGL:A3k03kHRJi
TLSH
T19415AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 877KB
SHA256 c88347a7992827c9cbc470372063f60549a1f26eb4be23488a5527d42a528261
MD5 aa46c9a8b0b95b336a11e72ac1a7cb9a
SHA1 31d8ea3a008d922a1ddd76d04a488c8decae8496
SHA512 5f05ab74f064afc5cb35c6b89513b82f5681c9476382155702d78d7a5a65557f173208d850f83347641ef49bfb1a2d8a399709a4618de16837b642fca812364b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTaM:A3k03kHRJv
TLSH
T1D815AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 877KB
SHA256 36e41997f26a24995f628c34f0a9de2dca88d26f11795eb64b39123796321518
MD5 af31cb5241b7913f04a59ec2ebc74644
SHA1 e0bef15176cac633d1e6406c7c661a586b1f25d9
SHA512 d51edbabb46521b5fcf31ecffd57adde528b7327e079e37ff51e70e8b8f7024d5eaeb9bf840d6c882993df9c33ea3c22282a12faaff7951d8d9f4a9899cc5962
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YcRasTLh:A3k03kHRJh
TLSH
T11E15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4044-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4352-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4352-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads