e7e5493ac6a9d71fa0f967fe19554dad8d5b91231fcffbc2a60a29aad71b0ee4

Analysis

max time kernel
110s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 844KB
Sample260809-s7m7hs1clc
SHA256 e7e5493ac6a9d71fa0f967fe19554dad8d5b91231fcffbc2a60a29aad71b0ee4
MD5 edb5ad15bff812d0f2844f02ed384441
SHA1 aa60ad0eb7c9f9b3f0eefa98540ba2ccc9b03715
SHA512 8f416b47765c3cdd80a13c3fa2f58ffa023f93d6485fc89271529531a8f80622b58d966a3ae097787c9d96154888ffedad9d1335923b8573cecf4eed20a88ef3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL29:A3k03kB56rx
TLSH
T1D5056A13E6840FA4D10FC1749A968662EA737C125F2097DF1354AE253F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/3488-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c59c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b311-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3488-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b316-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/816-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c96-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000188d3-203.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000188d5-210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-241.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000188d7-297.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-460.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-564.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-614.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-646.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-731.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-750.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-799.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-830.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-861.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-880.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-900.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-939.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-959.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-990.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1051.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1070.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1107.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1144.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1189.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1227.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1350.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c59c-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b311-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b316-40.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c96-60.dat	aspack_v212_v242
behavioral2/files/0x00040000000188d3-203.dat	aspack_v212_v242
behavioral2/files/0x00040000000188d5-210.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-241.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-260.dat	aspack_v212_v242
behavioral2/files/0x00040000000188d7-297.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-460.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-497.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-564.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-614.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-646.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-731.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-750.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-799.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-830.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-861.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-880.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-900.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-939.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-959.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-990.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1051.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1070.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1107.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1144.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1175.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1182.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1189.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1227.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1331.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1350.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1375.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1382.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1389.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
816	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{F9EB52BC-12F8-400F-88C0-E0E8FB418737}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3488	2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
816	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_edb5ad15bff812d0f2844f02ed384441_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3488

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 844KB
SHA256 e7e5493ac6a9d71fa0f967fe19554dad8d5b91231fcffbc2a60a29aad71b0ee4
MD5 edb5ad15bff812d0f2844f02ed384441
SHA1 aa60ad0eb7c9f9b3f0eefa98540ba2ccc9b03715
SHA512 8f416b47765c3cdd80a13c3fa2f58ffa023f93d6485fc89271529531a8f80622b58d966a3ae097787c9d96154888ffedad9d1335923b8573cecf4eed20a88ef3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL29:A3k03kB56rx
TLSH
T1D5056A13E6840FA4D10FC1749A968662EA737C125F2097DF1354AE253F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 28ab3376309b6e97bfef59bb117e67a66b8c5e2b9048822ed1e9900ced5bb0a6
MD5 4530cc9470c701bba7cd80c7d2a08024
SHA1 209955515327b6c9868dec2c98e91dfd50ddc58a
SHA512 66a4a1966ecd3dd2be371eac6221d7d6947bcb8133079b2b498b432ec7fe8866afd9ff3d8d58a61ded812f061e950fa9d51952a89ff2e779b7fd78907699ec6e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2J0Le5ji0hmxNrM:A3k03kB56rNPji0Aj
TLSH
T18F654A16F6A44B65D02BC078C5D29666EA733C421F3087CB1354EE283F67BD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 859KB
SHA256 d62b29657c238cface7ae7d731b46a56ffa54db2a3d7af6f489dc544b0684c44
MD5 b0b8b747e1635f0ffcd9df74d7550b66
SHA1 d8335fa4a75ecbdbf623ed4d919f3a6b33166c35
SHA512 7190b12905776a61521e35afe93453f4a2aa8f313345ff9a41b6890b0ae65aaaff581bb8789f433887487c7754e3290c5a86aeb79e7c7ac03ed4eb0ee692d7f4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2ba:A3k03kB56r
TLSH
T132156A13E6840FA4D10FC1749A968A62EA737C125F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 892KB
SHA256 882eb67eacd6a66cb9b4b50c5426ef84a11a291835548fefe5794e0c67a24595
MD5 6244236e95b5bec20f134153df4a6f7c
SHA1 970e99842039a9071056a0066028a34236c3c44e
SHA512 ddaa6010de4ff55b6b30cc515eea9f8d0afcc4929105ae91dd2c5eba4fc225cc7964f4118ff0797648d25fb93649e30ef224b0e2c7e19f85f30e2176a623bf53
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL24b:A3k03kB56rMb
TLSH
T17B157B03E6880FA4D11F81749AA58672EA777C421F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 868KB
SHA256 a3a6e5657c6d287e7bde9c5e6e4418f5a7ba40c02eaa00bde8e6173bf37d7ea1
MD5 cc0c073965213d6b4cf6e19fbdc623d2
SHA1 62054484e49d1501a81b833549d6ed5c91f7fff3
SHA512 4017762f0ebf390b73d26765111a04ae8e5d0d3ee225e4430baed1f2d70fda9855806f0a3fda9aba6558d69d3a5ffa9e21cbf274a86b927d1b63d40b5c8cf732
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2jZ:A3k03kB56rh
TLSH
T144156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 868KB
SHA256 06ca38d0691026a3fa67faa211e0ac1abb77328b255b333099ffc18fc045669e
MD5 feb484d17847404aa1a8ce7c3b4591f6
SHA1 4ae8733172ba6c66585176755243328dd228440a
SHA512 dad24375bbda5f47aff7ee2b29a96d5001e95b618713a71f08159b89655b66005efa813e3115c6bd05a1c9b7a5738a6eee42d51c896146424004950f02496cb9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2Y1:A3k03kB56ru
TLSH
T105156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 868KB
SHA256 74e5a4b48f8dd677372d37520f9cac58f3e45a8a45591083150b100ff78142be
MD5 6b099e164dfb689b6057d78914424c32
SHA1 3324cd546c0ce98c8a5ba111df0369363a7c63b5
SHA512 213ed89a2cb8dbfdc788b30045db00ee193eb08baaf60dc91cdfed916e551365dd1a2bb86f669cc9a658ce934d27695d47c6ce92f633cb344839628a9fa22265
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL266:A3k03kB56rp
TLSH
T179156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 868KB
SHA256 6df71385144ccf04e917468e183d05e44f82006606f5cf8b19dba982ad21b83b
MD5 1801ba816c807be48b5ac22688e302e8
SHA1 df7d9210be987c407123ccd4a1662ce07a0fa97a
SHA512 8f5cf2506717cc6899bc5966df6f628a2939fa7edb7a647d0094c52b170b888d2f079fc356e786be250cc32dd88fd441798349fd4b8ce542a5c1711f42354297
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2Co:A3k03kB56r1
TLSH
T176156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 868KB
SHA256 91c30eb988858d9ee7363a5ffab48ceca5a66013513231a859b3adbcc898580b
MD5 7201dfc64b23851d5bfa08e71a52f574
SHA1 c36273ca4feb8bfd0b3b7931f832eb7e29fff00a
SHA512 f4cea20dbd3cfd94a49aa42623b85ea9e497d6648fa2ebe01b63c233e99174b2c4c67ede2bbf72691810df60a98bd5706266ec250651f8af7aa04374780e69a9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL22u:A3k03kB56r3
TLSH
T1CC156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 868KB
SHA256 79a5131febaa64f2a7de46a3b38164d0b920b6b61aa4d13302f5b4eb7887958c
MD5 e9c6be753fd3849d2b1e1c9405fdd4d9
SHA1 e7249219ac73e408852ba2ec435e4ad4e1d3ddb9
SHA512 b4799625c50a412b48ab06a7edbe1e78e5f0af53e6b16155231836699e9b677ad89f51f2be7cad5fb74b1e9758365214b60af6046501f132a59c220d6452bb40
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2q9:A3k03kB56rW
TLSH
T108156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 868KB
SHA256 4c67211646d98cd8bf9111d5ff49da4d4a052f667a2255bedda092684e6f8bb1
MD5 dd575a11be1767b3d1f6d01edb79851f
SHA1 3e1c04966334cdce051298ac3762964cca97d1b2
SHA512 844e835845c39c3802bc1616d24788b65c7cbac93d83b6c5e625c76615f723fe5a2c24a605d88ed1b58e1fb7aa3e6677b926908dbe1b9828489ac19bb7fb4a24
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2qc:A3k03kB56r7
TLSH
T191156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 868KB
SHA256 97d53cc65404700bea59496692bbf03609f516d0182f3464460c81a9e0ed5cb0
MD5 5e51d2c29832e7e31929e8260b9d592b
SHA1 6433689926162fe576207a582dbf270cf67d596b
SHA512 e60d2ee55448577da6144d17b29901edcb79bb4a8192c15cfb5085e43c0d6886d5466d51ff036300459f4fb07f3daabfadde5b2f05f93fafca209f1061ebee55
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2jp:A3k03kB56r5
TLSH
T1CF156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 868KB
SHA256 f13f0988a77b09eae4a545b86e1d0b15d10c68b88057846a6e4baddfe65ee415
MD5 19f53f46d4eafa0c7dc158ce921ef925
SHA1 5814384045c3c96f7ff786bd5d4a46c0bd84de74
SHA512 637499c7fe7270bc467355d2b0afcf995b9833b5916ffd6f1423846cadab0dd6460a4ef4265395496f429ae3d6e802d8466adaf6608c9c4f07f63e3f36cb5575
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2EN:A3k03kB56ri
TLSH
T167156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 868KB
SHA256 92b1a8f2467927baa66050174193205c530b584bf880ac77978d4e77b45ebe49
MD5 16fef53d1bbeec107ef320bc196f7d1b
SHA1 3027a9ebe867bc30061f8fbe35d21a526af62b5f
SHA512 927a56cf3e520d4c08f302c2461612d914f4ebbd3cf958929407ba8fca88c0ef0f50f27653eb9e58abc188250a216af973f18cae152056deb3d7726a080fdda8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2sF:A3k03kB56rI
TLSH
T125156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 868KB
SHA256 01d81787265d4aba1149e52e8a4897100e75bd796b7d7f76f5277b48d78d7d78
MD5 f7b53490225c8b3d721d590ffd927fd0
SHA1 85e5265bcfff96b7d74761adcc278c51fe2dc2da
SHA512 8057d64630d0787eda2a70fd867c737cb67d6f2dcc0dcb0fdf3cbffd98e3bdd77404184a9ceacffafa52ece4bc2f0e54eaaf31f91b1372a08ec658ba5126bb06
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2ZC:A3k03kB56rc
TLSH
T191156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 868KB
SHA256 a57d1274c53fd30f8873e3e316f5c1a9aca51263e469de1a53bf4d840706996f
MD5 e8fdb3b8f0957467b9fa8e856e9ff380
SHA1 9e2bd8b7260b6e1740a7573360161ee1a4e7aef6
SHA512 a1d34d45f1eb9c5db78153224982ef1a83a159079162af88a0b9df323e26809336f0221c76c8e5fab50f653960895eb5037e3130822adfc8c641867962fb486b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2aw:A3k03kB56rR
TLSH
T12F156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 868KB
SHA256 ab7723d881ee9cd8cfc59870845dc7745e27ee11e0b6b344deab65a5069f1593
MD5 453736c8153e580af89b57a3f10e1cea
SHA1 8604016b46931cc1401e9785655e53970806a77d
SHA512 5f532e77840cd1130b6a215357658e091b5e4921f02edefe869e488f58d6e36ccb2ffb19c3351d4544eaefac97d1e391d08d6961acdd980fdbfd7bc74ed92556
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2hT:A3k03kB56rF
TLSH
T1ED156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 868KB
SHA256 291eb78c122950a178c82e28aae701a30a414aabefed0875ae56a4a0a243f4ca
MD5 26ec6e93ded73d62f851da04c5e4fcb9
SHA1 e9d0631b4ebcb7197c4512aec001aa3a956127d4
SHA512 558bfc47f3858b5bad8c5c997e7bfa8fdc8767616d097363c2b07708cc854499b288d33122fc83b23e02f609521675a0e2a644285057b6c9c10c64ad519ecaf1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2Pu:A3k03kB56r6
TLSH
T1E4156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 868KB
SHA256 451d16367226cbb74083c9911a7439fbf9137bef8318aa023328582e42f8a569
MD5 61fa6689b63c2d97eab5509779f80ceb
SHA1 7b0a26d764a7281ebc3153eecb8c9e5079c5c7a5
SHA512 11c76311941adab4a5cf4204d014851fe2e846650e68b059947b95c31cc69f1da05f599f36dc4c316a662691bcc3b4d5dfc949f7a6152f0e52a096f78952338e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2zb:A3k03kB56rb
TLSH
T1A4156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 868KB
SHA256 e1540befb3eaa2f52f5b23f362ca66a75f6e9958e432cda50613ac4717b6fdfd
MD5 8442c47963fd93cb095745fd35f041d7
SHA1 aad8fc4dff7a642683ddc9c241c1efc79b836f8b
SHA512 d39a2648c7226a8e3dcbaa20ed13d937f87088ffd765c1e5d550702f57c8af433ada7f8655792bf3180e7fdcd507fdf7f0e16ab421aaf400e7bd87703a281f2c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2Hf:A3k03kB56rj
TLSH
T135156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 868KB
SHA256 d5832aacc1d7b7841eeea8ec3261c3e9e896d2c41d79bd3dc3e633cdb7e4a18b
MD5 634ffadf3014307697ea022981a8e190
SHA1 60a09d6fc9fa18a55687350cf4aee1e28d923e2c
SHA512 6fe58b64ea6ae2c632ae158a45e6baa57b18c8db33c5a6472b7022f1dbf436a186e78dcf217602865a30403a3b216c40e662fa2c417ed4bb218665535d81ec50
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2wK:A3k03kB56rT
TLSH
T142156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 868KB
SHA256 e84042b2b65959a9d799035284f202550be1f33f62280c5cd5f3412837702d70
MD5 f8922e6697b074adc44d274b90f62d08
SHA1 467543240e25da11e67172da284856d8f36823e5
SHA512 ec6bbe5627677cdd90b289e808d385e95165beadc2857ab6a45f136566ed6e6e79d6e6389fb1f36912e173b0051ef600c81151c290e325f89c92abeca264f919
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2tk:A3k03kB56r+
TLSH
T13A156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 868KB
SHA256 c1386a42f7d67dc8aa6338c4a7e416275e42b17e29501dbed8a262e1492340fe
MD5 73b77da0e4b907496454880634ece9c3
SHA1 89db520cefa5a749628ac92bc2e65c3595a0be1b
SHA512 315ddc75db1e232d163942a7163b2fcacb2f7b5de2748db3d94975dd9895eb2716b47d2ee1785e4e78e9524417383166e49de4f3f924b320091216feab295477
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2y0:A3k03kB56rj
TLSH
T1CE156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 868KB
SHA256 51a7f11d55c151789b80ad961f9fe25ab32a4781a85002b3f68abb9b7ebf66a6
MD5 1ca5a81bdf8c1b1bf1add89bae52e247
SHA1 a467d8f71298857c4ed93e26a2403a8ff863bf63
SHA512 02f0f6fae3c63183bb5b53935d8b4665c75f16d0c59b6e089afcc1479964c013a7a2c2eb634e4818fef3cf9803bb19a0e17743065b8a6740ccf9b93d12f4bcc1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2Bg:A3k03kB56rG
TLSH
T1B6156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 868KB
SHA256 4e6a5d3b71ed545ba4472c361cac329283b0410a00b17e85b794bb625c9995d0
MD5 616feec36183b851eb0462f7469f1647
SHA1 618239ef8993cb77cbdb5f61f2a217111b1d994a
SHA512 d7eda962e3cb8e96d7e72b54aa459362d71e8893c663a91ac0478aebbf30dac8220b1905e808cbec54131086ebf7e97d37e013bf77216d9a455810ca4e6d2801
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2or:A3k03kB56rI
TLSH
T1C0156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 868KB
SHA256 142f3392ddef827e1e9aecae656ccb3b918758b7a0f389905d6a6e0db08da4b0
MD5 9ed5ad29848e09a85941ff41d4ccd65f
SHA1 6c825849b59979cef5c3a5c7374279684e3c5792
SHA512 478dc357c0028d5bd8928cabeb46407f57f8105c19dba7a8d3d5324b00a0554697d58920d60e69bb640fc8a0163fafd46b02b695d62a2a3d0977d57267dcd1a5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2Gn:A3k03kB56rq
TLSH
T1A6156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 868KB
SHA256 ce6a3d49bebeb2755472701f27fe849905c09e14d2ca4311d0c2ad0e4f414c2a
MD5 bc5248f39f7b79008c29d94975a735bd
SHA1 16eb3c7a188cd9ad353dabdfe47439223f542990
SHA512 7271b899ebbab909f3758b89607672d8203ee1bb1fff4950bcbb42b8f0bcd0d283e2a783c794eedd31e6659369d774197d6de0d7f1175e8a64c7bc8642477f22
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2Mx:A3k03kB56rI
TLSH
T11A156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 868KB
SHA256 9f014934dc2942b93c0203afa9fefe1c82ada9223a7053e2307f5ba8e9e24aa9
MD5 3de45ff316173af42fa57fae0072ce9d
SHA1 2a194eb03c70e1b56515007e629b1b7253a38892
SHA512 d601e123d1446b5192ad79e71c21ddcb354d52622550a119a810213382d377e5b7e0a67b719e63365772c514691e5233e86e248fabded5d1638973d3da22e199
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2GA:A3k03kB56rL
TLSH
T1C8156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 868KB
SHA256 f383a592870c022713ebf120323d6d206595e3647fd739813c257ca68ba9792b
MD5 a3cf4d5882127e3c099198d397dcc258
SHA1 c1b75e0d1173b1cf7d5eac9b5820fbbdad84dfa9
SHA512 6960a31bc4813a30f237c59324a82caa9c7428f9472b060806faaf0c2bb95fb705b0f620a01eca9e33cc28b2574bf65b19253e9420bdbf82df35d2282f04a1ac
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2f9Q:A3k03kB56rG
TLSH
T15B156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 868KB
SHA256 9ea1808765492f53b8779eb3df99a482fb13fdddebfc32aee135936d1035f58b
MD5 1a0d6e6af7e9e19625f0e690b2d4a90a
SHA1 b3c6700d0d5a0407732d9e045f54b83ae6aa30f4
SHA512 b133b0a0dafb95cd6b9ba05e7ec1e4cf7145a29d964175a493ba132268e2e8773a16c0d1cda8f7d3facd82b73a70a3e13e15750399000cf2d990b49ffe8d6312
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2W4:A3k03kB56rV
TLSH
T19A156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 868KB
SHA256 708b68c54a2d7cfa9df4ffd5e2699bebe37d0dcb44386aea44a8c021aceaf968
MD5 245d63bd48ee16f87b1e058a788e2216
SHA1 a52dcc8ea5bd02090d8b662ce00bbf0ad1ec7b9c
SHA512 60d12691f8012ae0f343f22904b854b9bb5cf2a8b12db64b62e3e3ae4d4cd3c933ad26e42392a2b08d6b9a0ed0b93b0968df5b1a13ab62af359eb3338e09f4e0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2Fu:A3k03kB56rA
TLSH
T174156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 868KB
SHA256 21ed53e2c0ee6900be8bd15c883fcfdd33e3906184388e4442d6fda543938881
MD5 75abcfb7c59e2c421db04232d968be5c
SHA1 ff278717417972386b088ae13b200fa956835e47
SHA512 1128aa52d9cafb37227f3cac1735bedff46d9da63bd562e17d7617e973fcde3360f652ce5010d41b0f4793cfda8f6b46d41cc7a6bc4f4815039094d9e1625d41
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2Yj:A3k03kB56ra
TLSH
T114156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 868KB
SHA256 f66db407389530b39dbfd5fd57148e981e15213f716a1da3a8730735f25487c6
MD5 9d71917049d1ba80505cb484af578196
SHA1 f1bae6965cda3e7b22a79750def1390d12152a98
SHA512 6da0558c9449e091a16f985909eff0a88cf5d22dbb28f863c1ab72d65aea9faf39cbbcfbc3a09441f7e830d0955a1d8d26a955c7f8e8d0c504192ed9b0236a71
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2pg:A3k03kB56ru
TLSH
T180156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 868KB
SHA256 6bb9b4a094ffa1684d39247d1fdf8d51f89937667c8f834b247d885ee0aaa99d
MD5 d62db977d03584c83013034b01576b15
SHA1 769586e171f57316400acfb5f477b664472a6fb6
SHA512 9d99b866c06741320ea3197f70d4946224117c9e4470f6bc548b7c1215115905a0524beda7bf27b3e7c663abf9605cb956c4884d63d6a7aa1444f668f862481b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2wI:A3k03kB56rn
TLSH
T1A9156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 868KB
SHA256 c283ac01d85d80cd93776bec7e35d2600de7adcd21abea68e9132838ef5e76a4
MD5 fda6bfdc2979a6dc9255f2b36361093e
SHA1 3210eae2876a5f996e598225a7377a7e1c4ecf0d
SHA512 231ce17366c5862bf7ee8c5f87a533b228f7398a2c54b042e163c5f747c01d83359999c6623657189b058391c47153a75d5d4dd88f5007dd3a7231d81b7fb644
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2yo:A3k03kB56rh
TLSH
T181156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 868KB
SHA256 c8af2d387dfd8a68497d4330a6fb34c611d086b0ab39d8b215eb898ce5d12416
MD5 24b889d4670e2117ce756c1f7b4aaaae
SHA1 8c22473173c795b2b7d1025200765b8b6246fe3e
SHA512 a641b228d3ff16b565aaf71818cd05255869acb051475653a373965171bffb79d3a0dd741bf5f6d2e7d6124cddf29a1587fe81f7579cd7302680f696c3413429
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2p+:A3k03kB56rk
TLSH
T110156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 868KB
SHA256 0142d12494ec07503fd1e3c0eb16e85e6ce638c482e8fa1e7d79b1eafb2e5804
MD5 6a671874f3c932583f1e4d87679aed59
SHA1 a563230f90e393537ada9a71cd6cb5a8831dd509
SHA512 107e4bc9e580c841cf8f3569ed5fc2e09096ae7539d6bc68269b39e8c802c295f9752cd2eba7deec10581766beafe2864d1e28e3b900352253b2b6f7edac50fc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2XQ:A3k03kB56rs
TLSH
T10C156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 868KB
SHA256 aef9b9fc81071a565e9e480ea9db5f40814c24e2e561f7796de9c0da2d9cf471
MD5 885499d72ff53b413f65709b5a88c405
SHA1 9feb16f55c7c4fa8aba45a0594727a5d563d2f78
SHA512 beb618e6ecbb01646d70941324e49da9ccdc0c4b88f38b2ffdd607bdafc0b95ff1774d3ac4c27834e7be3feb2cfbcc97795e82e20ca94b4751decc80729083fe
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2sX:A3k03kB56rs
TLSH
T19A156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 868KB
SHA256 56b4898a76f1be8c153c77ac19432160a08a544c570c43ce3010580e72c1fbce
MD5 cebc36551d979c346964529dd6df2e9e
SHA1 15d5714117dd0b8c58a0c4c1def9756f861a7d70
SHA512 16f63caafe694773d4e62544c63c7bc5d77af8e3f0622eeecefbad12bc2e5a68d0ed469960dffedb659051ecb428a8d1e0b8bb35801771addc6d1b74196494bf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2KL:A3k03kB56rW
TLSH
T18C156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 868KB
SHA256 c6324cf515c2a8a19e03cf96d1d622012bddb1a594a1bc97871312d8aa5c172f
MD5 cb8589dae1889d8bb33660166976b7d8
SHA1 e69bdcdcf9aa91460440a115a4a308bbfa40b85e
SHA512 5ea07e015dd34a1340b4ee623758b4a18c528c08e20fd4bb2fdfa40e23aff7f5e0d12596fcb4750e75112134dfa6bde976ddef169c8693c883cf5b7436a800ef
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL2uM:A3k03kB56rT
TLSH
T189156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 868KB
SHA256 21f1e350decb1e1cbe62781518c1fdeb0fe195a0c5a96b9190f683cfa900edc5
MD5 f946fdf5b3f00c48392b32d777357b29
SHA1 c799ada5e2a25a5bae60af26b5e0fa0025e75ffe
SHA512 123eb6944176960df6cfae8bbfe5bbd4c7092876881c7e62f65f3c4699eb153a76ea96716a9b19f0280e95ca70eae9889bbcd0a373331ff7a0b925e4b486f90d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYL23h:A3k03kB56rN
TLSH
T1A7156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/816-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3488-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3488-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads