25259d2e8db444899d35e29ec84c0ee60371b57054f18b97a7076aff5a391553

Analysis

max time kernel
106s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 09:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_15a39acfa4e1e61b07a9f9fad1f95421_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 916KB
Sample260809-k9bbqsvcla
SHA256 25259d2e8db444899d35e29ec84c0ee60371b57054f18b97a7076aff5a391553
MD5 15a39acfa4e1e61b07a9f9fad1f95421
SHA1 6cef2de5f7340ed0fef3a48a3585699c186a7ab9
SHA512 6c7d5d659085fdc51d381e31ebb86249449d22c6230bec2e60f51e833c6a9e45dcf71db734b252e5880c8e8d978713886e5afcc2c19f7a32b793bce72442ea41
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmg9:A3k03kHRJpRJh
TLSH
T1F3159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3664-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c58a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3664-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5452-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b316-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb25-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-412.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-522.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-607.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-632.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-724.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-744.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-799.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-848.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-913.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1150.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1329.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1348.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c58a-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b316-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-224.dat	aspack_v212_v242
behavioral2/files/0x000400000001bb25-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-412.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-522.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-607.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-632.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-724.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-744.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-799.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-848.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-913.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1050.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1081.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1130.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1150.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1176.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1183.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1220.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1329.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1348.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1373.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1380.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5452	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_15a39acfa4e1e61b07a9f9fad1f95421_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_15a39acfa4e1e61b07a9f9fad1f95421_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-08-09_15a39acfa4e1e61b07a9f9fad1f95421_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-09_15a39acfa4e1e61b07a9f9fad1f95421_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-09_15a39acfa4e1e61b07a9f9fad1f95421_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-08-09_15a39acfa4e1e61b07a9f9fad1f95421_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-09_15a39acfa4e1e61b07a9f9fad1f95421_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-09_15a39acfa4e1e61b07a9f9fad1f95421_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_15a39acfa4e1e61b07a9f9fad1f95421_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_15a39acfa4e1e61b07a9f9fad1f95421_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3664	2026-08-09_15a39acfa4e1e61b07a9f9fad1f95421_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5452	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_15a39acfa4e1e61b07a9f9fad1f95421_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_15a39acfa4e1e61b07a9f9fad1f95421_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3664

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 916KB
SHA256 25259d2e8db444899d35e29ec84c0ee60371b57054f18b97a7076aff5a391553
MD5 15a39acfa4e1e61b07a9f9fad1f95421
SHA1 6cef2de5f7340ed0fef3a48a3585699c186a7ab9
SHA512 6c7d5d659085fdc51d381e31ebb86249449d22c6230bec2e60f51e833c6a9e45dcf71db734b252e5880c8e8d978713886e5afcc2c19f7a32b793bce72442ea41
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmg9:A3k03kHRJpRJh
TLSH
T1F3159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 da08834f34ffe7b066ca04233cc865c1b317b76a8fcc1209153bd9dff3954d1a
MD5 fd67300ca5caae1bee7946cb3529c5d4
SHA1 95a0818e136f525e237024c6a2eef0920f27c8d4
SHA512 9f621d212928c9715fcfb00dc09324a523a2975e8826fb47422af81bc3ace604817491dc15ebab5270d36c3688a1db971db4fc364e5432a2665f61f594b7c305
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgJ0Le5ji0hmxNrM:A3k03kHRJpRJ9Pji0Aj
TLSH
T178657B17F6A802B5D067C1B9C5D29A5AFA723842173087CF1394C7292F67BE19F3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 931KB
SHA256 b45b75bbaac8fca579bbe83886a8caa8561573e3e14acc7ae65b49e90a7c18af
MD5 afc1aedfb4daacade967d2edd922e798
SHA1 8d8db8b17dc6d92a913a46f4692882794f70eb63
SHA512 ad8bb9460565aa12597de6b2fce8e2c08a500a6e2de9971a66952c09fb893cce0b801d718fe1f1e4741895ebff8b8acde91ce12d43ea071c9d1c2aa475e43e12
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgba:A3k03kHRJpRJ
TLSH
T1C7159C03F79900E8D15AC1789AA69A22FB757C560730A7DF136486162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 940KB
SHA256 4ac3e3633f5dc3050533134e8693fb82e45161ec2e4b9e24ae2ed3b7ec58a126
MD5 898fd8e4ee6f2f20c29d3cb193ef72fe
SHA1 253651564624b0f9493dafede0483f151e3000d8
SHA512 27e622671b7439a236caba289b2088245ae3869958c99d8b5569dbc9a68452d0a101faf72231a3040a9589dc3b8b4aacbbd778fac122bf1ecf4878720d2d5aff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmg66:A3k03kHRJpRJZ
TLSH
T1A3259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 940KB
SHA256 ca37a6a606a83150bd913eea5e426cf700aa0723dd498e8f010dbbbae0b8de94
MD5 66fed059a3d767dc4d557b48585afa97
SHA1 eba7e7796bd94d6f1fa4f2cfbe6ef5534a46cbaa
SHA512 c2cf6ab1a4d27439ae541febbaeeedc05bffe8cd32eab505172bc0a28f9857dc5d5752cc46fb34b46660149969b64ee0edd126d82c183429fd8c0743c58f728e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgyN:A3k03kHRJpRJA
TLSH
T1DA259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 940KB
SHA256 996211fd0ecbee077c0806ffec22630d7fb074ce95423bcac36d5391bd03f7c6
MD5 a1898b4713a6d9529c1386cd555bc9eb
SHA1 a2f76157723ffee2afcbe55865a38fd4d3266679
SHA512 1de0e2956e0815cdf575b95cc6f5a3b2451c47c62b18a486a445f43f0a2256572c0b4894dcaa0a0e070beb590a4c8559920acac31357a9ff176fd3f3cbc20bb9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgof:A3k03kHRJpRJY
TLSH
T19C259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 940KB
SHA256 2156d38219e197bf85dfb3786b45b38d22c9d263c537a6a9941cb025cd2b3c78
MD5 4154a6d51244417f417fe6855d468595
SHA1 fa59e3f06c127d460a16804a387bc323803a22b0
SHA512 0eac9222ac3a6c418d19f444d02d065026ab2637ecaae124b094a0c3df846d55baf6de94f165fea7f6090caf8249453f6dd121fde2b3af1019edc659dd279480
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgCo:A3k03kHRJpRJF
TLSH
T1CD259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 940KB
SHA256 1377cc879cc9c34b05e7ee8c80154c9dddd3f6235edd17fffb8ee943174ab5e3
MD5 be7932731002051dcf5adf1eb4eac770
SHA1 e41489af643408b9e4f5b0233c48bc66db9705a5
SHA512 26c8060b8824face52483193d0dc1143bab84fc77c4d7f9b5de38d085a42c72ea4cdcaca8ebff73d023b11cc64647f410864e29913b68b43bbbf8c2daf161e50
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmg2u:A3k03kHRJpRJn
TLSH
T1AC259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 940KB
SHA256 44b4f5f3cb0c3e0eeadc2767b4faa81f826ec49fce636f7f09c5d47c022cd805
MD5 9db466f72ba5dc1338ab6806f8bd3481
SHA1 cdc529903ad4eac98ac3b948d23efcfc26574d52
SHA512 a0e3b5253cdb9b6727ad284320c0935aa09954f76d0bdaae2b37380707d83df42998aa4bf12f0cfd92a1f7af5b4e864fe528fd3712e5383daa5aa38b9431ec85
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgq9:A3k03kHRJpRJm
TLSH
T1BC259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 940KB
SHA256 cfe17bd62ab895f761725d782e5c9aa6f0ff53ed08f515ad759469e17f51743e
MD5 8f2e61fbf1d8949e9aaf02b82aec0f99
SHA1 d00f72cd8701b0d471dfbcd5fb8c5702b0314614
SHA512 24f858e8ff3fffc958e43f7f1ea7a97127183bd64d1d3b0f73c243f4588c4c0ef608baac0486c85257e3874bf8aca245cd9ac0e58fffbd29a40a685b890102cc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgqc:A3k03kHRJpRJL
TLSH
T1B5259D13F79900E8D14AC1789AA68A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 940KB
SHA256 3bd4ea3403cffdb69d9f73c3b927fd17966c868f21215d355f484f6f39fdc08b
MD5 5a74efa6fbd653f3b3a1f72c5646eab3
SHA1 39ce437a5c905e2304cda266e89985e682e0d430
SHA512 5150df7db4963f2171dc0e48366734a17f549d6d8b433525d320ab6ea4724fb4ce36ded989f41dffe955b7b694693a3046911ef63478360d02cb552cd877bee9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgjp:A3k03kHRJpRJp
TLSH
T152259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 940KB
SHA256 c73b4133c2b44266cc404524589fdcda06d98c36551462a00d6ad0845533f4bc
MD5 3728c95c4d57c5c811d42920c1204323
SHA1 78e9c14fbeb1c0b38f618f722176b08f92212e71
SHA512 6f990ffc5f36f7972c53187e53dd7a13d416f98560a668023058210438a8861d9c53bb52596bef44119dd92ff1778fbd138bf55b6c184d0b8b9a55d6ae1bd4e7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgEN:A3k03kHRJpRJy
TLSH
T110259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 940KB
SHA256 08cda1dc2167ade51004853f0d97912cf48300ae9d02285bff923a5eb9cea088
MD5 169c0fd1f3fdec56cdfcf5b310cd1b14
SHA1 76b228192ec567b38953f0cabfefdc7cb6474a11
SHA512 3d75057c847dc13c41257e5992b4d9f4cacbfd56c37d64a6f2ce5cd0b69deb02d558e3ea3bade475867ace6e9f3c7225ed653735b9782bf239735e8187e3c5a6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgsF:A3k03kHRJpRJY
TLSH
T115259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 940KB
SHA256 7a6797b82b43f4a8d2b251daf7be9182db3cc04f4c470f227828c7d8cabde53e
MD5 d528e86ea1c1cb31db1447195fd3a878
SHA1 a77746ca0979effda0c06340bd26d7d8c0466e94
SHA512 cd08282813f57d95f586ddfd08af3bc20ae0a6ca875bdab7e06e9a1a918d9d9d8f5da0f6e07a4132bc8ef10347a86ba70dcc50fc97cb92c0c0b818755f5a62fb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgZC:A3k03kHRJpRJs
TLSH
T176259D03F79900E8D14AC1789AA69A22FB757C56173097DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 940KB
SHA256 d6dd1dda09f9ab2ec892f0aeab19dc89b321a1817acef376c945a8d247a36ee4
MD5 d2272cf1cd7f851b74fcdfd4b3b19a83
SHA1 1fc155869d47957cde0fc051ea59862eb333547e
SHA512 6c82811d9e7c8edea47bab674a1494cc3a37875e79712fb6b50cc7374d9057878c01d56185f39b760ba9bda4de7aaac49b8a7d84a2e83ccb2301f27fa4b164c1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgaw:A3k03kHRJpRJh
TLSH
T1F6259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 940KB
SHA256 53ec24dcb08be8d3b38ba2e039e9f3b03cf5f0db4c7ad3666b9e306cb5e9a2f2
MD5 a8a818baa2f7a43c7484205d4ef77341
SHA1 22f1c05da6980757167c175e5cafcdc74b2416ae
SHA512 283b76ae684f95e3adec97cb212bfbc363a7b4540e97b536929cef5d9af02e844df12f4e59b004c33207346b6faeae55644194c815655b8b7751bf4fedd4414c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmghT:A3k03kHRJpRJV
TLSH
T193259D13F79900E8D14AC1789AA68A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 940KB
SHA256 fdd069461a52453417d33e548b82ec76d9be1157d323be839ed83a2de834714c
MD5 7e2a846bd92be8ef81eae6499b1c216c
SHA1 69781798505f15bd4d13048dacab85b71ce037c1
SHA512 d621058a6977bb9c8aeab97d8866cf95104d240289e8efacccdaa6fccdbe542cf517034ebfdd6f946e9d0e37b576d62edf2a62af1ad93934de6d81eff6320db6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgPu:A3k03kHRJpRJK
TLSH
T187259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 940KB
SHA256 b23e7e7156c8065e062e46267b7dcffcbd1e80d703b62142206d36d92c3e42ab
MD5 2544528a8e0516f5b6076aab99ad93b0
SHA1 9be1e07d3846853f5219d72fdabd62d4237a5822
SHA512 380b0e9a864012910f910f0aa0dae4fc19c2b6f0f81a93b7e47b80672416e2598bb895b94b427914f1e74d54b5c0a52c2a2f7e0dda9983f56c38c6229d7c7a62
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgzb:A3k03kHRJpRJr
TLSH
T1AA259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 940KB
SHA256 89a533e9a2f8e0947593e88d804649bb8d1f29351462c692b42936127a5257ab
MD5 d6b98fe501d4ee67f085694ea458543e
SHA1 0f47fe8d2f5d7381cc4b812004d6c5efd7473b6d
SHA512 50a24ecf82ebb8c61a02c68f5d318d6e4b5e5100443305bef4f2643728b98c90ad4629ca2cc63820b4e50dd9e30e586f3321eb16d4a9dedcec079bc937365e50
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgHf:A3k03kHRJpRJz
TLSH
T1CA259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 940KB
SHA256 f5d8682afd545c9d615d86d5569ac87366cadf1c214da6f17cf1548899cf2418
MD5 62bd29822200092a37207ca2674e8704
SHA1 9d9b05e1dfb68c4d7d093b127273e7374ad6a2c2
SHA512 f9e4a62636cd38f9a15900804200fd7672ac2ccf4acb98e8796e659194d8df72f9d6332af3b9e64878afeaba3b2bca23ad49b51943fde96d92fe2644ca03e626
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgwK:A3k03kHRJpRJj
TLSH
T1B6259D13F79900E8D14AC1789AA68A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 940KB
SHA256 186b1483e67d44ded7a2485254778ca9e0a437d1847784a4f01e2ed93fdb13d8
MD5 bd91e20f8678ff7040889d8a0d5f0a98
SHA1 80be4e081c2fa93cc12ee609c6a6c10f9f883b86
SHA512 b2052b41516ddf64433fb234d2ebf4cd812f80c5ee43346197169482c2d95ba94cb29a6165a53aef636a5914c61607cdce5b99519347c64394715bd8fe8f6081
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgtk:A3k03kHRJpRJO
TLSH
T14B259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 940KB
SHA256 b5387eaf6c94ca431d48da23e043a3460770a30ea451e8196867e90ca5ada2ad
MD5 ca0ab0cdc1d79e19887104c974cfb4f4
SHA1 b2b8886422c7f97bad354178a9e4b7bd54e3bf29
SHA512 0f6f25acc73311daf06eb4a133e551d2bc7a2ef5bab84119f61219357ede3838ad7c53a40906e75883269e50280cf871daed3051e6f010e7b437d7d63e82d5ed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgy0:A3k03kHRJpRJT
TLSH
T166259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 940KB
SHA256 27ff708f1f87c4c9ab971e0b495246c5dc8e83ae3751f03bdaf0de20d5c78215
MD5 a2202890e10fce95b66b86fcea3832eb
SHA1 43f3ed0303818d99a8b3b4968f53cd10f6dcfc2b
SHA512 199e7dc3118bfd19cff3c20326c2ddb58ff2b4613db7ecbd6172f96de82267ba59be34a64fb0f2fca08fee531d3da996a7d7c5b656d8fb702eab90b9c29434a6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgBg:A3k03kHRJpRJW
TLSH
T145259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 940KB
SHA256 9d8cc2579ba4506e9195a05a800f9aa3753bfeb4ab4c7cf54bc87b584a3d7785
MD5 ca9a066ea55f1d14a8df42b461bf3b43
SHA1 466648f56ec6cfb400c66330591d4e82b5862cdf
SHA512 6d319284f09273f33f15487188a5852fdd8e8b5e8a95bebf820e63011ed55313c1e2cb6a6e5088ce99ba63351ecf7b5848415f53e29b3503042b4dc9fb432773
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgor:A3k03kHRJpRJY
TLSH
T10E259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 940KB
SHA256 f9a950c403bc8da1fc39be595c6b9849c672858e7d13f57c344a2915e90d9e0d
MD5 971c0e40da33ab5f579f4b8ea83c3b49
SHA1 dab35440f1e0225d07dce4f693f8874701f64def
SHA512 f5ae3abb46cf620b59e6f5a461cb3d1d32d6d57f0900e21dc6f5514ebe45c2e03e5688e0c821864658c7d56bf1011d26c13f389933f215dab469a9b83b7b32dd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgGn:A3k03kHRJpRJa
TLSH
T108259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 940KB
SHA256 51cf63b4cd0118cdbf06fe8f7591c53301c57083a2a8a101fef0a2707a81da14
MD5 45e69da8fe3ffc8fbdfac527e378e221
SHA1 92f7f2bfa127d02c906d0a6a8e5b53680619131b
SHA512 f716975c10983f40ccd18eb6d742457c5a85ef5cedb2b8ac28a79b35f9ccdaceb276f86c044aeafbc33e26654afff19b5b18e6020ffe10731ba25417c79264a5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgMx:A3k03kHRJpRJY
TLSH
T1C8259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 940KB
SHA256 d26493796cb23f1029247e82ca2aa43f064b7ba58c5966bacbcbd9a8337b0550
MD5 fbcb9809a8d59f03d355effc3d7dc6cf
SHA1 cc8b6400b238240d0316e6d9ad0a7593dada4602
SHA512 65d6f98148701bcf0e38700e454fe3167767f2c5e49484391bdd2deb58bac1da2d20c284a6ecdec9839d88103301a83736e525f770f9b67f711a99091015dd62
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgGA:A3k03kHRJpRJb
TLSH
T117259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 940KB
SHA256 6d0cc636a11dd9433117a8ad6e7e9d2656c79af5632c9819a4c9bdef3fe9c263
MD5 691199a9b158b8a624059472a52a3102
SHA1 ea7a824f98afa7c84aaf77aa364643bc19808397
SHA512 f670d39e1e415f6d6d9b951d7e889bf59179bdc343126174f9d455decb7dbe6adb8d9184a3d525dc60589ae7db17d7531665369a9aff102bdd58277081a7eb63
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgf9Q:A3k03kHRJpRJ2
TLSH
T1E6259D13F79900E8D14AC1789AA68A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 940KB
SHA256 2b3fc719c9688a019587e576d3709c19acf49e8e68bd61a5bf6f0f90fbee9f57
MD5 a07866c96a61148a2f5d8ceb38e45ddc
SHA1 ac9a7b68b1daf7b010bf054fe1b10dfa24aee586
SHA512 3084abfee05cdfe33cfae688af775c00e4ae2116b2b31ae85549b953d5a7f24ff59c53124013dd483ffddab1da8bd410b646e5eb96d386f3c134f632e0e4db67
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgW4:A3k03kHRJpRJl
TLSH
T169259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 940KB
SHA256 8d5bb004111ea4a02107a67be6302ee89255fe982dbd520231a5667da2db6c37
MD5 6c7fd978ef562c9bf8512f06acdc2f40
SHA1 076904cb12b97999666fd21fbea5f497ab954ee5
SHA512 ba01849bb2a5fcffae02089b83b7e03fc653af52d7444c557820f4044601fba34e807ef4464ec146cb889441590f8ca4684752040ffad261f273242b9b97b528
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgFu:A3k03kHRJpRJQ
TLSH
T115259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 940KB
SHA256 75a48351def65db76da820bd4fb08bea70488bd071958d50ea54ac68ef0281e6
MD5 1b811edb42b7fc88728e74bc9ddd8f91
SHA1 a92a6b4aa1794b762bd97389df6ad90ffc37f200
SHA512 819436dcaadcdf30d2ffdfb063e245f02b58939d41870d226a696b14402a5cb9b78ec23a7d779fcef77171539be48f18faa3bf8e9cffd32d99d4f8b2e2c9b00f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgYj:A3k03kHRJpRJK
TLSH
T190259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 940KB
SHA256 a3ced39a53722efeeb9af4900b824657bfebf2a32f1c12265d6e0fd87ca30338
MD5 1cb0ca16b2a38d7a75d416fc444d58ef
SHA1 54d76566b60c80c0f48923a23d87e8c39dcf65bf
SHA512 0963f2d5785797f44a4aeb993d4ee8fb65300da11826aabb22ff681ac98d5ad3c9f91562ab2263efc6a4f00ab5402901113b82801ba5a6d764f4afee78f08b38
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgpg:A3k03kHRJpRJe
TLSH
T11F259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 940KB
SHA256 b0860bc8abca56495789dbb3d845a9f65a54298949ac69814686f3de795248bf
MD5 8c7a6e623be1b5e068f24222bffb3724
SHA1 33da9d63b0b29a85f630f3bd72450bb0b3c8a0c0
SHA512 ea5f284b0a33eb27a0ca81cf282909f97b7401c8f0a711d28d1dc40bc3b3279a23a7c6e47e2b2dd09a41e9241a1289c1ac4b3c60ac435aec791e474bf14e1a6d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgwI:A3k03kHRJpRJ3
TLSH
T18E259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 940KB
SHA256 b965135ad60d1fde9a2b1f2addeeadc53a7795076d78a0440134be0e6c1de50e
MD5 91a0343debccdaebee3cb8b41721d982
SHA1 ef5779b3b308281cf644965fda1282d811d744e3
SHA512 b32524320d1f8a5275bdc0b9c496e8009b7ab43dfad73225009001e08d78cfd2c4896c70245f8a3caf4fb471e1803153c04d0c5be543b1a7429beccd224b6257
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgyo:A3k03kHRJpRJx
TLSH
T1A5259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 940KB
SHA256 cdd32a1b24fa6f437b4b6347ae1101d26bc4800422ffcff9d8deb6d17f0a58dd
MD5 f551102528f1086b52d3e502fe890fdd
SHA1 588283e187f69bed96d1fa1cd13c7fd3ae6aac26
SHA512 6a5ea8b653762867a8e0cbdcf7d2032bb3d5919a746a854168d8a65a86b6dd4da79fbccc57b408a4f9dcf02c981cf5af87685c03d788da9d199589926760b483
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgp+:A3k03kHRJpRJU
TLSH
T10E259D13F79900E8D14AC1789AA68A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 940KB
SHA256 1504a094f28c5bd99a97269e69afef53c138d9d5d48f716e184e8f5c4bc59812
MD5 8ad78e0f25769dd26057e86a83cb9edc
SHA1 653b627af9fa8d02bafc12ab5dd4ab5e80574461
SHA512 e575b00a1a2cfa3cab10e1941f91139f34b758bf88dd4c69b334a098dd85ce480daf30b991acf698038047a7cb7cd4e9d568b3311e5e666d1b908c55dccbb3d9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgXQ:A3k03kHRJpRJc
TLSH
T158259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 940KB
SHA256 4c86dc0e3c415fafe17827d5b4f9e6ee17b82f4c6920516eb0270694e3b70b23
MD5 4e17e2348df06b093502ad48ed37e066
SHA1 ae4a60b06883a7972504b99c90cff9f44971ef35
SHA512 301e1da7ef532ea88c2f384ba91525b6a87da22fa1309e41085ccb46afb4abae67683be8cf0da758acdd588a23dd381341395845be04aa992c607d2e6028f0d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgsX:A3k03kHRJpRJ8
TLSH
T141259D03F79900E8D14AC1789AA69A22FB757C56173097DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 940KB
SHA256 39ee70c0d31769bdda629d10efd2493b0fccbdd90cb206ee83cecb30b7f46dd6
MD5 e46b182675397b7fc8cc5d506f211b41
SHA1 8e916ddfe443effeebffd7ab776a65705245d373
SHA512 4228d71a9b8421793c047f6d18540e0804e0af97ff64dc99be5bf041322768e31a84b857b0b6d6f0a4ee049f510fcf5695e7a3f92c821ec5d29719428da73267
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmgKL:A3k03kHRJpRJm
TLSH
T1EC259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 940KB
SHA256 e81dee0f93ce7a4294d45b33767beccbedfa04c11d3e12770aad22846a252204
MD5 79f59d19c319c262f696af6dd9f86c32
SHA1 981d3082f334c83381760b5b66de5d676b7ba3c3
SHA512 904d1c1a9b278cbba9f0bbc3803e67d789f31a34b4bb76ec00c5fd1e81b60924aa3e45624910e869ff490022dad7221f2665d1e3c8d76109cc46602bdfdf6845
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmguM:A3k03kHRJpRJD
TLSH
T1E2259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 940KB
SHA256 012f52444913b3ebc965b8e0aaae388c5e42c043e02c49ce08aff267ad3bc8f4
MD5 2f2ec9717a7ecd5f2f42c92dc33e9a6b
SHA1 de79108da67598c6786194a1a4c86cdbef5bd308
SHA512 2516d05bc8971e228586c3f88897dbe7c87ec537ed705f188d413f3a371f7d0c44523b0426e7a82003858cf1719335b702b7eb369b722ea327d78533dda796a8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZpcMJlmg3h:A3k03kHRJpRJ9
TLSH
T1B4259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3664-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3664-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5452-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads