7a91c1afb4a6efe0aca80b81655c54b8389b0434ab719ceeb72c02a5ce8e29b7

Analysis

max time kernel
108s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 933KB
Sample260809-ptefnsad93
SHA256 7a91c1afb4a6efe0aca80b81655c54b8389b0434ab719ceeb72c02a5ce8e29b7
MD5 4d20496ccd11a4ba8b0dbf9e30ddfbf0
SHA1 74c866a09d010dba750b3ad346fcfecc5ef7ad4a
SHA512 bdd96221bf5c9267195a7b003a81df17699cb7772184e6dbbbebb5fe4af1d66c876245501c83414ba98436ce465984746e9bb96fb155fc7aefdccf0684f89972
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Ao1:A3k03kHRJ8j
TLSH
T1E815AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4140-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c522-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4812-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4140-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-589.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-694.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-976.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1019.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1105.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c522-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-589.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-694.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-737.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-920.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-976.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1019.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1105.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1219.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1322.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1366.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4812	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4140	2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4812	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_4d20496ccd11a4ba8b0dbf9e30ddfbf0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4140

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 7a91c1afb4a6efe0aca80b81655c54b8389b0434ab719ceeb72c02a5ce8e29b7
MD5 4d20496ccd11a4ba8b0dbf9e30ddfbf0
SHA1 74c866a09d010dba750b3ad346fcfecc5ef7ad4a
SHA512 bdd96221bf5c9267195a7b003a81df17699cb7772184e6dbbbebb5fe4af1d66c876245501c83414ba98436ce465984746e9bb96fb155fc7aefdccf0684f89972
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Ao1:A3k03kHRJ8j
TLSH
T1E815AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 1de19252260bc1f163a6c4e472d61726a150d0e4997bd53ed876e5e22d4b2ad7
MD5 4e4391253f2cc3ecf0ae914e0da63d3e
SHA1 721e67734089678bddb0551c1183e6719f7492a3
SHA512 7837fe7f13535b9527eb579d586aa7929a3a74509bbdf3c2af4970fe482935824d60da8218380607b48c4b516d7028f64cba38d45c37b153ad0d185347bb085e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Aox0Le5ji0hmxNrM:A3k03kHRJ8fPji0Aj
TLSH
T110658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 948KB
SHA256 3cd69b1c4f7f0edbc1c09a1523c9dbc24c78719f32a30bfc852d4ec79d238063
MD5 f339bdebe9d505e26e8a50236a24871a
SHA1 4fbfeeb24534e44bd28f42b8a1899f387a0bf3c7
SHA512 462283dbab0b85a36f5c577c016ebe26a8c5b046e317a570dc924cd7945bb0436e3974b2491ba5ac198e0df87687f0dd90fa54daa1ae7647a534eb6e9b766702
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoTa:A3k03kHRJ8
TLSH
T1DA25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 957KB
SHA256 614a5f0b8ac8a60fe73cf51c02430e0eeece0e0bb6cffaa61cbfb8f988391b00
MD5 1cbb0ca6aa68d8b3ed71582cefaae2b3
SHA1 6b8068a74db5d6e2530f17f9bb390c028999cbd7
SHA512 dfe9ffb7fd902ae4da09c0d130200b3c8c73b6c3cfe7888db0a667fa2b52df881fb7d05e581630d3130b9edf330ab3adde3385de160ee9108ccbd2b900326719
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoS6:A3k03kHRJ8n
TLSH
T14425AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 957KB
SHA256 a92e071100dd8f977f9755479b80bce1f1789b13ef954baef0cbb70a7c9e537d
MD5 45bdaa870eca4a369aa548f0651048d6
SHA1 629a391aef7dab37875a832e922894dbd1f90e05
SHA512 f553b8e29019ee906b663b4c255443850ca88b28254f1981e40afe86550d68f5ada37adeb443644ab8c236d22a55348c2b956e31235d9423561d24b9038b6d29
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoKN:A3k03kHRJ86
TLSH
T1AE25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 957KB
SHA256 be19fc5cfa58de529555f24c6eaf3b1df676c19188cc2b59910002ecce74edd4
MD5 c2dd666b8daa7e6920832816f3d47209
SHA1 30f8a957a96076901c8420ecafa35a290279f1a3
SHA512 00d683c079ff1bd7f2cc539ff311391a94c9f35a1db5a037dc513573a980599eb6a869ab9c74850383e0a4d5a212d3b6ce3c994470ca8c30399be71a8159f253
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Aowf:A3k03kHRJ82
TLSH
T10C25AF13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 957KB
SHA256 8b9196464d13610586f20b68907f1f324f013897189f43856a5f16c35f5c653f
MD5 4ad6d94564636db5069c66340155164d
SHA1 2123ea4627aaaa1aab536cc74655d24be5d9c936
SHA512 d3eebbc0d4eb851a85812daac0627d9493eca150bbfe439bf5477597f0f4f2cfd0e6950f3d0e5cf77cfb969c2fe3d4141871b04ffdf5eb3e317c0073c4a00bee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoKo:A3k03kHRJ8X
TLSH
T1EF25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 957KB
SHA256 dfa8e650fb592458b81268ecff25ab92b528bca9113a4dd9513491856d8f3d20
MD5 80311ed5be1e4c8f71aa0bd25705fb81
SHA1 d9e5632f255b4b0b7904685ef1542d0b3b37b460
SHA512 69e6a8567f573c4a2e4783f32afd9780d1c5303fb21c283f5e0593ef84ddd0bf9deb6d575a695d1b28d22600d7230bd68d9c61015daa61ade05e58217a57c2ed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Aoeu:A3k03kHRJ8Z
TLSH
T1CB25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 957KB
SHA256 9774b77501f1a9bab91a07a809a0485816748c3206f1bade65287d56173185d5
MD5 a37de252b9c04efd8a8a08ace4fe86ff
SHA1 a7e7cd34e37c6879647d316f3f731bc3c69c495e
SHA512 c6a4983a54c10953e67a6ee1311b09d0867e96d7fc5b420c7e2f00159d7afb63662e17aef8422abe6393d81ff9e0692bdc99ec4f9f83930b664412b40e246c39
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoS9:A3k03kHRJ8U
TLSH
T1AD25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 957KB
SHA256 c93cca2b8852f65964735138d26d8817c4ee18e7d3ec00cb49132000175c47a1
MD5 edc56f21c36170ad4807805d1b359bae
SHA1 237c05f69aadd65e8ffb852b9b213d73dee49387
SHA512 d8c4b05784e696ce03d81b0250945fd474c0aabab944eccebdfffef15e0a3caa15fcc6de3cfa5bb61530178055c24ff353496c3f6f6827644d37af3da2882dca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoSc:A3k03kHRJ89
TLSH
T1EF25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 957KB
SHA256 5699d1475adf9f16c3b9b63f06f4beb3654be827b16d8112cde374a27c873b57
MD5 61fdb86118be23cfe3a60f2bb9b8440b
SHA1 f47ed005080c247236ec0f9cad03671ba64c1696
SHA512 e286e66f3ef826cbf35698d99cce5d27a2da4b1bf829be46540f69a9e3b3731a0117bc7dd5dcfa49a207d0340bc84f9efde8550949d86d98f8ffb0b58a5018e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Aobp:A3k03kHRJ8j
TLSH
T15025AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 957KB
SHA256 a5b7602a2b2d8ecfaedc90de8bf82755658d57b8e408f311096d470ed256ad96
MD5 0248e768a59c986558212e6e5d21d8ad
SHA1 0293b6f8ea78a9402e9a3b7042b278e9060082eb
SHA512 2cf846db1549299016391ccc5264b6ce438dddf645dcf01e6668de516cd594d69886937e32046133df9150e86e641c4f218f0b26219092698cfe5d10603fbd9e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AosN:A3k03kHRJ8Y
TLSH
T13725AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 957KB
SHA256 8b952af56be9dac4edf70d0178a50985833276d3b7b98c96cb8698130268bf27
MD5 79a902f62913052e7caa9bccc7d3e6ec
SHA1 d49e295d16731f61eaeaddd66ee2d8fa7b723a71
SHA512 87c08603055c22731df59b48ed77854ad639437cb90ee92423e35202a4b35faa32811ad34b2bc9cd187f5f77c1d83aff394b9beb0000e56b448ad94e5f63bc20
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoUF:A3k03kHRJ8u
TLSH
T16B25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 957KB
SHA256 97b78c18304741fe7260f36f8003836e3537488495b39b3c1439a7ed63f49051
MD5 66ea49fa6d3fcd18974efb51ec5978aa
SHA1 94cd2c2b124f5a92ebeee76b403f1845d51be12e
SHA512 ffc95dd572e0410e3b4dcbb9afc50340f0212660184525fda3e23be5ceda73166191203c70ea50d59ec0c57278f3a17c6f275404b819a52f7745e1acce32ce78
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoxC:A3k03kHRJ8K
TLSH
T18E25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 957KB
SHA256 beb161a0d6dead835e1caa74cc15977814d415fe1b65a24fca9f59c46fe93af4
MD5 28c749979bec4e0ba41697fcdf316691
SHA1 cc3d92822976563c14c2fc549534f4f648cafb7d
SHA512 5ff160bfdc7d6fefffe7c775f607e34cd06a957e817d86b56a0e9469a946ba46b031972c73a5231a2bf6c43826bbb078cdb8416d77a2bbc5dbbebd199f030d8c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoSw:A3k03kHRJ8f
TLSH
T13D25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 957KB
SHA256 6c4d868d41571217cb66f3376536112a6647df7f0d836f2300b82cba01c7d22f
MD5 708125282986e2f6a2fd1ad5d1a9882d
SHA1 a46e0412295a801b43f96a7a5052af9ef0681b54
SHA512 fdfa4741965f0f11f2aca2a7d42b78f75c218e546a89c2e282fdee391e7b7c076755d50757a7071a0d9ac0a7c803c81359b853da8a371ea21035df45b4589ec1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoZT:A3k03kHRJ87
TLSH
T14325AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 957KB
SHA256 0b5a6749b851fe8576c2484ac9c5f2595ec6548c25d64ed537219dd00a0b58ad
MD5 b6e665234e6bf766b3781dc17471b2cf
SHA1 b199b3d5f100b282170201e7f1ebbcee067504b3
SHA512 59dbcfb34140f1ae85c17bf83cd7ad0994d22b5726a76edaf347ed67a99e0f4f4a4aa3daa2a517ce6e94953e0712d33574dbbece3ad7cce4791c78e6a84e9c8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Ao3u:A3k03kHRJ88
TLSH
T11625AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 957KB
SHA256 0be947b89d65fccf83d33e463369806af3a61adc1d4a3381598a022b67b8086d
MD5 2f272592ecbd727773afa6501e110e8a
SHA1 055a46833347d0890b23c661670260963babe97b
SHA512 df03cd67072e820fbe058c5c762b585409f657b34fc901bb3cb2abf698226b40ea12f70a6a55ea2190a1c70a71b209ebb53463ee1371fe30022eba7b01181ea0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoLb:A3k03kHRJ8V
TLSH
T11925AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 957KB
SHA256 c81526447cf59a4df4962df7a7685804dd6d7a6314103665757ed384d531f52e
MD5 be2d9429b6dd3723cc8eb38d867f1dfa
SHA1 8fe4e461109fc41011fa27d04745eb598f28051c
SHA512 470f9fbed89adda63de3a8548c71596607f7c974b6164ce2841029f78574a872d90136fc8644fdb653634c72e2944f3038c016e6c2ea233d5b3a4bc34883ce13
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Aoff:A3k03kHRJ8V
TLSH
T1AE25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 957KB
SHA256 207316d38d00a02bf30e4ab14794ad90ba09868498ad79f9f050c3f24c69d056
MD5 48aebe2db69030ecd25dd8de89c2772a
SHA1 2eec3d225c21a191ce10dc5df20ea1878ede5e11
SHA512 983ca6ec96c087054c1f908ef1a29960c55895c94770bc09f5dc257d69ae6c20d4c63e260dbcdb08ae362de26b76c78cabebd0a5dee6d195943f2aab4a45cfb3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoIK:A3k03kHRJ8N
TLSH
T1F425AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 957KB
SHA256 2d017f57248f0ffb841fc8ea5947dd99d9d3de4c57a39ecba52f63a02e885243
MD5 78249d333c6b7f87206953cd21c6b457
SHA1 89a832ff52ce4a1f5329f3ba78134ed68072c4bb
SHA512 f1e2e75f94467392ce0cf40dbaff2aa6ca9ed98c5405d178e45e6cecc09e8b517f81b4a5982b46e5033f22698717ac31288cb984c74db7e77e8b78d88bee6cb5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Ao1k:A3k03kHRJ8k
TLSH
T1F425AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 957KB
SHA256 a9b96d0eb7a2e8913ed03bc5c59ebf509ee6749901e6756b05922cfab8837174
MD5 d7c38236233d21ef7f7bfcf5070c2dd1
SHA1 7874e9cc657c6bb91c65b4dc9caa91a817dcb54f
SHA512 f0136c3cc8bc7cab11ef54df8bee9bf00e930fc89a2c76310eb6b0e16c7ef31bf1fd80b5dacc2fba791e5116f11215bff1acee75028b07ee779d7fa77f3ca6fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Aoq0:A3k03kHRJ8N
TLSH
T16925AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 957KB
SHA256 b35a9d0259450f6d4e6c79ea6c5c7c01fedcc75263a4ec8dc0c586f26219f3dd
MD5 70e3ed5f481f02efe00fa31939963b8e
SHA1 aed4d11b03664bbc2b1ea8f882196082df4c1956
SHA512 f610d129bd14ad8e8c12fd911c7c0672b259fc30496d5eb708f1bbff09fbc7bdbd5090c359825abc05ff78da659976e1e1364261ee0ae971e9cb283dac9d801e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoZg:A3k03kHRJ88
TLSH
T13525AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 957KB
SHA256 55c8c9f656368124e5118ddf4fe8c74f2d4a4cbf4c16ae6925b79528aa09a8dd
MD5 7c9b271e12f685b52bb0e0b1646c8a04
SHA1 df910640fb90ae6a9d22f30887d2f0778faacc6c
SHA512 8e0e744c76915c4600cfe4f436f7ca11cf0364a4b59a6a4f4460e14383834a37c70bd12b44dd39eecc96e26bbe8e26cc1c21c11fec0d0155eefdbeb33aebb1ae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoAr:A3k03kHRJ8O
TLSH
T1DA25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 957KB
SHA256 c81ea60d0c3ead9a5f671aa0e592a7296c0a2fba3c04e7b33c96de83259ff96c
MD5 92c90d9da7cb693a754a998147604b54
SHA1 860c6286040b6cc08f9d2c91c75f4a8bef4eadf2
SHA512 c7db4d931091237be84f456d9406ffdf29eb1f45f23a1288964d5b0c57ebd74da7074c9bb1703792e5b100709474d5753323561cacc21a475e00c3f9c3f2de01
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Ao+n:A3k03kHRJ84
TLSH
T13625AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 957KB
SHA256 4e20a00640d5bafe58fc5024cc2714781567c284337396ba6543dc2505a821a8
MD5 b2a8fcf93a6aefee7b2e8b8913f4886b
SHA1 eb810a09d0fd3c8a278e9bb4a13054a02759f49c
SHA512 0bd144255c53d47da90d3db8aa9a9c461652ad6d5236902f613cf731973291ed1f04e37e0cea0b780e39818e32188ca2b0c10575144e349b470d8631c4d5d55b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoUx:A3k03kHRJ8u
TLSH
T11E25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 957KB
SHA256 436a4603d0723c841fd375ccf7ff4c1bc7be34f149ac63697f413a7e010ff04c
MD5 4717e114f23cf4d544f474b5b600fc7f
SHA1 7b07a17de8b7601c9b4b5eb4e1379bbfd5155a02
SHA512 fd6e9f8253077d5005e0fac14337e133feadb7892e5fd0b04a7b8abebb1425111b1decc8a197e6a9b8299cf7009752fead0daec4b752aac5844c87e4fe9a276a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoeA:A3k03kHRJ8l
TLSH
T11B25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 957KB
SHA256 c17caca200b9f9c83fe27a2d15a87519b928e9d7590fa4d9ab5d8897a86aa574
MD5 709fd269ee9065eed5026de428fac631
SHA1 a7b8aac0ea7c1ff222a168e3d84db0902cfa0e2a
SHA512 359200b2b8304afdb39e093dc6c8b27f9ce49df3d04c314c1f3e9a05103a9eea6f0a28e52d542b2e0c6440dfb3fefbc009dfcea0be9d6c4cc1cadb866dc71727
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Ao39Q:A3k03kHRJ8E
TLSH
T12925AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 957KB
SHA256 38d5264152820cf3343abefc0100bb6b0b77693ddacfcf3bec6dccec84eb1dd8
MD5 d00c71ac06a2eda2f078dd7f547d8007
SHA1 d6fbad1b35ab96dc72331f067bcb9dff6c7e4212
SHA512 aa6556d78d88cf2cb7516cd25150661cce5379e8a5b5c908f86d2410a877a14a26985abba5351088ebf3c0d6b509e089daaed62d4a48f8afb30a0cce241ec146
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Aoe4:A3k03kHRJ8v
TLSH
T15225AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 957KB
SHA256 092ab3cd15440733c3ef97cea566eb823cb0d2eaf98b47940b8c737367aac364
MD5 12202aa2caebcfa3fd2abfc3f96101e0
SHA1 3f6449a73527c56aad398f975566e5d9f46a9f25
SHA512 2bce1fc18ef131ba94b092d0724d84e50b6e7e0486e834aae3bf474688aac4e27336ac3c88984f512664359bcf4ef1d16c515b95f77a20267217c0c45902f8cf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Aodu:A3k03kHRJ8i
TLSH
T18325AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 957KB
SHA256 97d9c87754c91e4ad7e55cc62226f9fe2184888283716c362bffec2c1ad5d47c
MD5 c387cff191f1c5249a6d9afb5a1976e2
SHA1 1565736855831b48133ec3d7a182388c637f43c5
SHA512 98b34e2ce721143b48b2a41d8d8388d3786a917aa409b05f3bd8cc4b80dcbe8b29577be49eb7d8194c85a81116026a496310ca704f59b25ca582536ea5588604
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Aowj:A3k03kHRJ88
TLSH
T10225AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 957KB
SHA256 19a746bdd9a1b05948bcae4feb241720b0f73022178367cc0209cb5d7810c37f
MD5 5d7f528dadc852f84fd06afd4400bb68
SHA1 2ce30484890dc676becdad56d80d366253752fe9
SHA512 bea7f363e6a9a63196e7b25dac1049710e6164c0fd4f2757a8a25f0ad2e6a5b1fafcd3cd592d0ed94a39b8cdaed8629f7e901023ff48abc515954ded11b14332
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoBg:A3k03kHRJ80
TLSH
T1AE25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 957KB
SHA256 bdb1e775b654ec71790407a7fccc60cb15dad63ec51a01ebc82b161b83115fc1
MD5 6eb207f1da474da4486efd6873726ea2
SHA1 03e0d4c30194c04a2dafcaf6f8aab3a0abfba8c0
SHA512 db23ab18c76a8ca7c5467687e392cb6fb86d0fb3d931852cd0eee42a7690e9236994bef272acc520bbcafcc466592cff2bb0dedef95421f5264a60631aa21835
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoYI:A3k03kHRJ89
TLSH
T18F25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 957KB
SHA256 001edec3f91313440d5d41caac80a7287265ce35c9fa7d6b4f87df07c9439fd7
MD5 6f3e0df8c6240daa464f37701953458d
SHA1 2982c39e5cde3186249739a820302f8d473d0c31
SHA512 5fd9512c82a86052eea1037db85298836cb74ec0563696aa7320f0b1740260c896b542d1db4f1a6c44d229bc2832bf0896d5baabad22d052abd051ee1ad4b28e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Ao6o:A3k03kHRJ8b
TLSH
T1BE25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 957KB
SHA256 41648f4e474ce3567f79626b0ead0e2130d10a8b0517eede0e52abaace3a0dae
MD5 eabd490c3d5b53ace57ae9e824654f6e
SHA1 e8a667fa38fa80c0ef34a5a843e206b0a978869a
SHA512 8f426453fde55607d44e383f9b7f6dc48243bb613c9d266fdb26c2f0f3812954d33c18234faaf3a1548cbcf2113342baf416c03e6c40a7f6bfee9625a43d9cce
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoR+:A3k03kHRJ8+
TLSH
T16F25AF13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 957KB
SHA256 8272220e00ad7288483ca88a963df421504c7eca61fb4bcaf7bb6e03ce92a675
MD5 97fbc43717895d3b2568037fc5b5cdae
SHA1 353476920830a871f2153d5ed83885fb8ac599f9
SHA512 6129bd04de7f5d120426282fb05d609664f70c83bc746a4f323ced45023900dc3df6f4bdee6d094e7c513141b25a689606a919b9b1730770e4dbfb29ce98471f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AofQ:A3k03kHRJ8q
TLSH
T1EE25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 957KB
SHA256 531ccb25533b88bb9649c21dfbd8cef18e8071679b1f1367e71c814d552f3f17
MD5 61aff7a701fac58d74c113e0ab68a522
SHA1 7cc610857a22f19f6743a2e451e132945c5cd421
SHA512 cf5a14b47f43c0a62a6e1f44825860d1876adbd1843980c5cf35fc6578d00650f99f1ed5947ec2a486eefa25b0eb2ff8356c0c604d05b5be0e35c41a4a4e91c9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AokX:A3k03kHRJ86
TLSH
T1AD25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 957KB
SHA256 17a661d1b3ecb6d18d39385bc7633fd46c39cfdc5631b988647d38b9694db1eb
MD5 f1f1b3437d5e3d6fd82f2c715f4d4b3c
SHA1 677312b517f284c0b51d770ff106b8ebf40872dc
SHA512 f1e7737dfbe525399b782c37dbb5f023c4dd04dfabb2cff1b90f414026f682943e0038393e08a064c99e6bfd1051b3d1ef2f2395505065103d90c998787f2e05
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoiL:A3k03kHRJ8U
TLSH
T17C25AF13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 957KB
SHA256 4ac1fae320094449db23cdec508401aeacb03474cc385792c09f9b94e943a70c
MD5 dc5ad32066dd008f08a0f765505960b6
SHA1 7aac504330846620fabf39a599b83f25b8161318
SHA512 2d5912836762094d906694ca506cfd8be9ba8b6e41f182060870e0012e5854202bddd1b50c52346293ad631739827558bbe9b5110b71a991efedb115138e832d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5AoGM:A3k03kHRJ81
TLSH
T1F625AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 957KB
SHA256 456e6cf5d3566facee4664b8f0d9853c0de27b898094ee80ff73fe334c948ae9
MD5 d81dc6b9e430504d3a3fa3878318d96c
SHA1 cddfbb48a414bc08601a706574d578e8914d9107
SHA512 1adec3d15a458cd03e073e9c31199e5ed7098ece8d0b04f6a872289872e9f3ec27e0f4b8c2cea28fec622a5d078f843ab20111dddec9d96f7aec639d6c138861
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvOF5Aovh:A3k03kHRJ8P
TLSH
T17625AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4140-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4140-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4812-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads