0bc6f05d1ab4d16a91b0c564a7c1a80ff8e48edaf03bcc6dfafba47652830324

Analysis

max time kernel
107s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 872KB
Sample260809-tbvr6a1dkf
SHA256 0bc6f05d1ab4d16a91b0c564a7c1a80ff8e48edaf03bcc6dfafba47652830324
MD5 dbeae6afce3bf987c0c40a356635e2a6
SHA1 d65c54311987f4f12363407cbb6e5bcd43fe320e
SHA512 b97c519b2c268cf3a648034a6c4e3721336f115b9176549b35ecbe8f43ea5fe63315d951b2ff26660401c3bdd7fa8b9196074e03d4fc06c95ed5e668c6caacc3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/:A3k03kHRJi56r
TLSH
T14D155A07A6890FE8C11FC1788A968662E7737C151F2097DF1354AE253F72AD0AE3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 42 IoCs

resource	yara_rule
behavioral2/memory/2260-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4a1-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2260-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/808-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000019c72-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-238.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019903-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-560.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-609.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-641.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-727.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-801.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-844.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-909.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-985.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1040.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1053.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1102.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1139.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019929-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 39 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4a1-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0005000000019c72-60.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-238.dat	aspack_v212_v242
behavioral2/files/0x0004000000019903-263.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-444.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-493.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-560.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-609.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-641.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-727.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-746.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-801.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-844.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-869.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-888.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-895.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-909.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-929.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-954.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-985.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1040.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1053.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1102.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1139.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1171.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1185.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1210.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1325.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1344.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1369.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1376.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1389.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019929-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
808	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2260	2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
808	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_dbeae6afce3bf987c0c40a356635e2a6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2260

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 872KB
SHA256 0bc6f05d1ab4d16a91b0c564a7c1a80ff8e48edaf03bcc6dfafba47652830324
MD5 dbeae6afce3bf987c0c40a356635e2a6
SHA1 d65c54311987f4f12363407cbb6e5bcd43fe320e
SHA512 b97c519b2c268cf3a648034a6c4e3721336f115b9176549b35ecbe8f43ea5fe63315d951b2ff26660401c3bdd7fa8b9196074e03d4fc06c95ed5e668c6caacc3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/:A3k03kHRJi56r
TLSH
T14D155A07A6890FE8C11FC1788A968662E7737C151F2097DF1354AE253F72AD0AE3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 ecdf832ae4a605342711a233b3ceefe82d908a55ace91d7398e8c88f9b82cd67
MD5 18693080f114cf3fd072678f987aa350
SHA1 08f7e35e8747802ba916cf3e85223ebf6e57a883
SHA512 c3c3e5027c074ec9fb211d02b2b25ccb3621cae77f000b992f1fd1e4b9a1d8b615f4432573a758ba9f0d2ffc338ea5128c65dfab666c3a940832bdf67b9151df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/P0Le5ji0hmxNrM:A3k03kHRJi56ryPji0Aj
TLSH
T129654B16F6A44BA5D06FC078C5D29666EA733C410F3097CB0354EE293F67BD19A3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 887KB
SHA256 855d736a6d178d479b1092955697c575a2f5b5370d023e8fc9203d330b510621
MD5 3cee9a87fa65279c2d39179a43774406
SHA1 e379b481fc662d409dc2c63d3b2e7a7cbfc4c104
SHA512 9a97df8fd909e85930b7236456a105be69a47bd42c94109808b65ed34410ddeda0ed84ec22905a0c0b86b98ce164c05fb9b2d1406a230faac9621a6d40056275
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Ra:A3k03kHRJi56r
TLSH
T1C3155A07A6890FE8D15FC1788A968662E7737C110F2097DF1354AE253F72AD0AE3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 920KB
SHA256 1ec55b33616db2e1c6e119ad88545de067388946f4964d02cc61bfcbe3e891f5
MD5 56f234e9fe8cca3e24ea676ceefe67eb
SHA1 7a8329658561e0eadb180eb956ea9ad2bffb0744
SHA512 25bd025f4d78dac24da5a3b4a3f846f746aa1e084191208afe00b46b1e3876997e7830bde1c958abc357c5220bcc3b2f176c28b4e2574ed875ddb75214f6fd2e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/yb:A3k03kHRJi56rXb
TLSH
T16F156A03A6880FA8D11FC1788A968622E7777C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 896KB
SHA256 af651c0f848079c7844d4b0d07c37915e56db80f7b894a97134dd82a0671c4ab
MD5 f2b04a41bf93f911a1427a69ba8f74d2
SHA1 bda5fa68384e3c7b3d3823a03cd0a4df98946bd4
SHA512 8fa6daa74fb626844490b60e61693430eebb4300e936760704bcc20160f4b9650eabe12a8ad964bc3527942786983e1cb03e332cd0fd16ed90171d5b8075eca4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/o6:A3k03kHRJi56rc
TLSH
T1AF155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 896KB
SHA256 cdd728f44684bf41aff9a9b4cd8e439c394c96fb960e561072fe90b17d20735b
MD5 c49282b2e245448d485441f5d21c5de2
SHA1 fa241d219539a7cde806b65f28ecf37a0cecfb8e
SHA512 69231132f37fb60258fa1d31ad3a97f6239290d6feab44ae35ec00cdcbdf9f6314888c80e852547770a2a7ca7f8194e1bdb181c2157ef88bb621484802b44cbf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/8o:A3k03kHRJi56r0
TLSH
T1C9155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 896KB
SHA256 851056b0c1ee4a6d4da3856e6696cbbf7c95312263806e2625d57347b7f6d9bf
MD5 54c97121187b0d902001b47863031a8c
SHA1 45c078bb0da971ac2e0b41e2617584c2e6d4823a
SHA512 f04f3a539d7ffc70f74d06a9a86a813f42ef334e98da613872167c1e55f9aa8b48bffc6e3e6fa98c395d5666245131b4afce31079cad0a903715a055dc4cd207
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/cu:A3k03kHRJi56rG
TLSH
T164155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 896KB
SHA256 5c092172918f4412e583f597d2b3091c576ab609d23ec7a15eba910b619a4517
MD5 72579f3b6bc8c2584b8306329a78df17
SHA1 023b4d1ca525e41b818822cffab3d698778b688d
SHA512 527ba724032067d49047837a4eebfea2d00a43208ae6fc58b686212e8c21bbf902c459988ae573adfe9e95022ef0f6a9c4d2b4de9d61d5690d7ac2893d9ed0c2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/g9:A3k03kHRJi56rH
TLSH
T1FF155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 896KB
SHA256 57feb35755f9a8e90d17fcd967b42402290c54fb6bc069d542ec14fed87738a2
MD5 01cf2901d4200cae3f40f05883343ba3
SHA1 5dafe5bd2f13697a82b01988c40f53ff5e8014fd
SHA512 38f9d4dbe32c19fd2d780c1c68e820ed1ae79fec49fd73b499686ee8ff266cc10c8a41a1892d980702c68d6f6ae5126f7c80394a172f68016d5039ebf15aa50d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/oc:A3k03kHRJi56rW
TLSH
T1C3155A07A6890FE8D11FC1788A968662E7737C111F2097DF1354AE253F72AD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 896KB
SHA256 79e6f7404d83bae215a499eb358fd9ae01751aa2e5822378428d2b6c297786d1
MD5 c50cff51963fc79e2fdee1dcbee27f66
SHA1 56f8a517b453f1571bcca743ac3460fa27ffc88a
SHA512 0d0a7f261b99804c087ff8fe005d2608e37c7167c33d6da59de973989775cc71756279842859e29a0157edcf465ae8cb823b0cb72345fa905e5a45fb3825c825
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Bp:A3k03kHRJi56rE
TLSH
T1FB155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 896KB
SHA256 725d5d2c66dd8294fac6fa72bdcd9193e9e1f17c8bb83bb971f09eab347f0fed
MD5 649ebd7c68586b1eb67f3c8e131f9dcb
SHA1 9fb1350c0caa762be358a57dd75354ae802920f1
SHA512 66e73d38a3385b37d10aad0c0fa791e2f5bc2cc1d279a880a8eff5fc0477891d34bb72c6272b1db1d4a2820c78bddd122e16b4f54e63c7bb4d05f598bc649e7e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/WN:A3k03kHRJi56rz
TLSH
T162155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 896KB
SHA256 3ae1a92b4e15a8e1c390b743516a6e2b69bfc0c7fc3db65a020dcb6c90b0d40d
MD5 35deccd0c3047d653bbe4618898ff2bb
SHA1 303c8af06fc45ed9e25009d2151c6d9f4786be53
SHA512 c152ee59b7bc8db07293500911853e27ba900b33bcd70b869aeeda836799735a2f29617bcc762333048fafecfef43c8f098a702e02e27a4b093dae4fbd3d8060
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/aF:A3k03kHRJi56rF
TLSH
T15A155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 896KB
SHA256 0c4ac9c1206769b57b93bbe9dd3ace85903cc8f20197fb67abed140fada33723
MD5 c852e82b12f1699df5a072eb3a703afd
SHA1 d5db8e5714a43406d7c28c901ae6746ab5dc3048
SHA512 f0b67e2f301aa0450de1d54a8725455fb57f69061d975120847d74fdf684ddfd75325786647324ce330abd5cf0e1e4c16ee8ca5ba88bcfe577e0c86712416770
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/vC:A3k03kHRJi56rp
TLSH
T190155A07A6890FE8C11FC1788A968662E7737C111F2097DF1354AE253F72AD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 896KB
SHA256 360cda1fd893a922fe43759c5921b1ded4dcbaec5513576af087a67ebdbc91d5
MD5 3fac635ec045a6b7792b01bb8899defd
SHA1 4d3529f2ab93af68337db32d2e56d411dfb7a8cf
SHA512 cacb59712975fbf0bf67699b57ed2dff252a3a4d4d800aee8823d010250ddbb9750f74c987b840927a4231690a522b22caa8b28a77c1c9f56c68e83d3c89156f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Qw:A3k03kHRJi56rU
TLSH
T179155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 896KB
SHA256 e7523647a1438e9caff510641ae216a16375be7d7269f1f9b23d0cf73ca5d70c
MD5 d0f792ca20a1693eb4e17bd56609f7a1
SHA1 de05cd3fe9e3c63feaedd3684458e852972abad7
SHA512 4b7543f67e112fc5c04fe29d8e789134f158a59e60e5ca66baf11644609cd05f433634f333d062a73f5cf3a2fa6b905c707d4e5d1a70ecaeca4feccc171f0d0c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/vT:A3k03kHRJi56r8
TLSH
T1B3155A07A6890FE8C11FC1788A968662E7737C111F2097DF1354AE253F72AD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 896KB
SHA256 e0dd7492ac58b4d15c0fa41fd9b6271fdeea09568869451bf148456cd8207560
MD5 52ac7fe0caeaa61ffb8559c790e7d971
SHA1 e1e1440c0d819d5a1da1872201f4d7994045577b
SHA512 77ae69654a18a0fda4d7cfc16e417b4e6990076e63f0a5d8262d3e770f3053d10a0e93fd2e7d2fc31cf242cf2d147c46d80a559cc30feb06f8d0f4e593e50920
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/pu:A3k03kHRJi56rb
TLSH
T1DE155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 896KB
SHA256 7ccbd1454de2d693b4949fa1f3be3c1087910b20f659d119a8d17f92aa3f2ef0
MD5 93afac4d8c32d5dff87e32cfcc86bed6
SHA1 6a1906de8c13a4a4b7a09da9b0b15df3b2740fca
SHA512 46a9953075f491b5f23f802af02660dfa03c2af3a03e764c71260791ce5fa7e994a300bc6e155296d26135202aa7636cd86c19681d4bc3a286593a5e7cc66ac4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/hb:A3k03kHRJi56ry
TLSH
T180155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 896KB
SHA256 aae33fe75a10a0ce07ecaf7629e9f621cf8ac0891b406e0be666df8be32e419b
MD5 736cfc7c9871b8bd486da9927ca521dd
SHA1 9919f7b0fcd6d73534947245e5d66ab8425a88a8
SHA512 b7f02e17c477a3b42e8ce32237068022a2f0b4f249b79954771271d643e9f94c1874f06885eaa741d6ede6b4e9f5ec3e78c01e8639f4f47c4d5aa8b101c39c6d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/pf:A3k03kHRJi56rS
TLSH
T1E8155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 896KB
SHA256 9588152f8035c0c203b37a8c922d6658b171f7c9c1087afd450b43ab411cb65b
MD5 28c95ad7e592d3ce81eee51f7d1042be
SHA1 ed70bc17850718141134e80508b107ef8649dff7
SHA512 f996768c2c26b157ed04cbd797b7d8719bb309f7265b6dbb3d57d08a5846359ab2dd64c78295f456f4838818935ce6a385dcfbdc3ee2eaeb41fefda0192e5c90
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/SK:A3k03kHRJi56ry
TLSH
T125155A07A6890FE8C11FC1788A968662E7737C111F2097DF1354AE253F72AD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 896KB
SHA256 4bf7c898deca940f03bdb536d9e09e405956fd5f5b8835d6e7270a187ccc56e1
MD5 4b7af17b895e9dec2cfd4c84e53f4095
SHA1 fcee936038079ca5768bc22102159ceebca33a08
SHA512 c51f791d589e669253c5abd43699495e5bac543c48e45a716264f69a430376b452d8c4fbcd27fabb2fce8cdcb5135dabeec3cc6a52259aa39536ed9e8398bdfd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/3k:A3k03kHRJi56rH
TLSH
T101155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 896KB
SHA256 4cb5e79b80cc853c96c268e159acab9bac67ad599bc3f8f1918c734dff1e40ed
MD5 cb7a2df2a60be9029806a93e607855d6
SHA1 ef98ed6008719585b953b894aad88bbee392861c
SHA512 7a7cded176eb83f2da36f1ada01959c774e4e594c30ce3ee46f96cd857a4cc74a4001b3b7fb4c5780ddfc63b09b509b36b72baca6a43f5007063e9612275ff03
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/A0:A3k03kHRJi56rG
TLSH
T1EB155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 896KB
SHA256 240b78f4ca983b962f90efe3749aad07787024bbf293780d70513baf083dc9d1
MD5 9f224820f33020ad5cefbe298d954030
SHA1 a85592af26e30fcd6acab6cdb4a36732d5acf5ae
SHA512 70acc9e66d8380af599dc5c6199eb12f224a24eaefc136d76bdcbb02d124266b590757ea70b5ecbf27d78c5c1fae17903b6d7bea4ae4684ae3154de94f035c61
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/bg:A3k03kHRJi56r/
TLSH
T198155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 896KB
SHA256 6ab952dc08c52a65d1ac63a2c359888eeb85138baa426a08729c029197ace6a6
MD5 3b29e24b2efdc312a83d5214c891020a
SHA1 bb0497d782162c65e8334460df6d631e83e6f6fc
SHA512 fa286173f3397168ebfb727557bef31c7bd8f6ac6746d1d3e5154a8ac1e3454a30b6fb1cb4010ac70c018c42f915187e54d8ddb69f617802d8c69a3ba713b3dc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Wr:A3k03kHRJi56rZ
TLSH
T179155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 896KB
SHA256 c028dc328057aeaec5043277f2f7ff645414650bfae46d73927d3152426e3e97
MD5 4c0e0ec50db7cc58c755abc9cf8e00e3
SHA1 b88dd94f2bb19294b41740300ccc63803a237577
SHA512 454baf038d409606037d28db02af24ca1a58ed6faea5505b3a413da695e6904c95473fd69a295997963fc2f3ad4768a25271c7b787e63ede1291a77374ea7c86
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/8n:A3k03kHRJi56rT
TLSH
T15E155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 896KB
SHA256 3d7ec8e7ceb0ade58f888eae9a81d1de96eb48fb9c655f599ed0e596298c4968
MD5 ee6f84ccf790b75cad1e709e38d2628b
SHA1 6f557e49d6c40f2dbee02d7fd7495fb85db30538
SHA512 5a1da8a91822e6ef625664f14e49313beaca1eec9643cb0fbd2388a44c5df6eaeeab0c1035a387c9d2d9be54400ae31bc600d1c3e82990a7a5516c32ac779766
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/6x:A3k03kHRJi56rR
TLSH
T119155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 896KB
SHA256 ea66fdcb64e1775d4b39b713c0f16667404770dbfb1932b915bdec632d3e998e
MD5 4f21b939344bb488ca8dfe8632c721ca
SHA1 b1916cd8867f612f03b4bb9c28f151af8d9831c6
SHA512 b245f57aeab9234c8eee6d54ca9628afafd1c89476f79f727646363ebba62d059177271c135c5b2b41d55bbf602fd6b896d1bf7b32ca4fad79e0b331822702b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/8A:A3k03kHRJi56r+
TLSH
T162155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 896KB
SHA256 10fe30934b4c6c7bfd2c295fabfd5acb38576a862625dfe2522077e1e197a41c
MD5 6e572a3aa32a5706cdeece52fe284d06
SHA1 c6e8a21dddfdbdfae37ce25b3dabf145b46f2887
SHA512 0dbc845c0b76d8743df45579e497b8adf53b72e4b275e4286bfbb46daf323f4ad6f9c1378613ecc3987e57dec6785a82dee28479b6f41d69c2c79ffed28a53df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/l9Q:A3k03kHRJi56rj
TLSH
T14B155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 896KB
SHA256 c4b90a72f7e2d4695e70c3787b2828080a5b5c504bf7e2cf0afbf3374195b207
MD5 91a3ba27799a5f075ee9fcddbbbe40a1
SHA1 e61ed4df4cbe0c806a3d3ca816ce9c0c1a2633b1
SHA512 c963747f2e71058740ef3b29bf5c080bf062fb464ca07ff94d843b3cfd3e6a351db69694e9d42f68147ac7e8f6dc11d02076e1e93900c45848f2e61b90ce3168
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Q4:A3k03kHRJi56rE
TLSH
T14D155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 896KB
SHA256 db4b6370a5bd235c8c74aab848677b4814e547554fb7c7bf8e09469747fdea15
MD5 9796fb36d54197fb4cf41f789339a887
SHA1 c8a17f14a60b89f3d6f5760c8b3ac852bc3db675
SHA512 51a4a6247a26e29fdcb4dd5ffa83623238995755230991c274b2a3002c45ef2ace355fdc3bce93f11782a6f5ad74b6b505aafe9caa44d1390ab8e52dc641e5f8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Tu:A3k03kHRJi56r1
TLSH
T192155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 896KB
SHA256 923d9aca341ec7962bbf038b8ce13a16025968c3490254368ffded3c229666f5
MD5 f84878a8867689d54d9a66bdb1eb51ae
SHA1 7f64e18a26382d73e9538f7c061d092d56b66f8b
SHA512 8a90181e1a39642e6c3dcc4e9f3bc2159d96a0b0c8e6d0a52dcad68035adeb53193def67130db29470bd12f2b22d1c5044843e5a2ba95d84ccc33ec369db7661
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Oj:A3k03kHRJi56rX
TLSH
T149155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 896KB
SHA256 19c506331c81699f0d7606fc18739706adb35370dd9082a6af3a6e961ffb8f4e
MD5 3b6fb868aba0b4e7c971c42c6ba0066e
SHA1 644d4900f9deb8ee2db48300c783a5757e32c673
SHA512 2a02fdd1cd7e9ad5b536da27832affe1aa169ea8f9d757d3b3d84b24ac64977901b88af773e3fb86762a8157d8f596caeaccb5f3dca163a940efd409aa3cbbb0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/7g:A3k03kHRJi56r/
TLSH
T159155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 896KB
SHA256 161cb5596aec924ee2e5f92f08106b9eb1a3ae925f8fc370490b6e3772bb3d9a
MD5 75c2a48461d62bf7b467dbb6cb3c5f3a
SHA1 8950104a0e009420281497f4ea88c6d8d7a39662
SHA512 ce26e57ca993b32b1423522741c2d46db071eb7ce844fea41531da09cddf5fd5eedaf2d50c7a9756f9b5bcc765c43b85ccf8c260c514dd8a019d672c6ff21880
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/mI:A3k03kHRJi56ru
TLSH
T1A1155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 896KB
SHA256 de1cffdeac7fa5a2f6bd5676bec6f7fbb28fc650ed52693d05e75b232fc7b750
MD5 04d68ff048fb9f0273d9c18932e2a715
SHA1 e63d428235c04fddbc7e8bd1747b8d319ced510a
SHA512 d9cce5a1a8c34709a2c95cfdb888538522bd0e9385c8ccc63b5e4151b8ee912f3d33863df81602a31731794ba3e6e02b675085a6c27e02858547b0346c360aa4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/Uo:A3k03kHRJi56rs
TLSH
T1BB155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 896KB
SHA256 9d0b52d534b63f89cb5237999792eba494cf5edd268864d9d227db96d3503d54
MD5 ba8ab4d3bd594b635d867224654cdab9
SHA1 de3604cc38b70b4df2c2ddb3df8eff1531c49d1b
SHA512 cac2d19671fadfae2fd9d3014d2cd1c25f2728266920aaca23c3c3f6edbbd137689a3d3bae506deac50acdef4a7dd5d4824e10644c8bdbc1fbf479cae6f1f961
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/3+:A3k03kHRJi56rB
TLSH
T1BE155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 896KB
SHA256 d6b7e1d63383cb32937d8f6f96bac4e9efdc17a5767111faf28c40e6e79e902a
MD5 071df19fdd3083923573e2e2b4ff5fe3
SHA1 6977436f7bd3c883dfcd1f2e7fbf5eaa9cc92f96
SHA512 9627826499a7982411caab4f4127f45ddee9e49342dfbd79bb1fea043d2690ee1e0e4d4f302506ae2137edb78bcc2aef2c167769b256c13ec0c253627b9bffb6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/NQ:A3k03kHRJi56rB
TLSH
T1F8155A07A6890FA8D11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 896KB
SHA256 736df094bb30102001e11445ccf62bfcae4ff29111d9292590c2720a05b210cf
MD5 458257e65efa5a5f780cbcdd9eac7107
SHA1 76c8d730bfa50fe7e217bd5fd756f361763986fb
SHA512 b86738257b7d6e0c3bf97f791fde4b40ac2b09a66fb63d50e631898c9eb465cff46671f9b6bba9eea4ad681b52c992e0acebcb90732d2aa91d637f966e3b3066
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/CX:A3k03kHRJi56rt
TLSH
T17F155A07A6890FE8D11FC1788A968662E7737C111F2097DF1354AE253F72AD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 896KB
SHA256 cd4a54b7b5b05649817419078c5199f7e265e1544e56a38412a3432047e38523
MD5 06bf39fefb64f742d8df1998f48e282e
SHA1 324a47618969e189c344c1f912529b05b84e89ba
SHA512 7dafd236d63a65f997acee41b2186856aed5cd46b5e3250a93aa320f18ecd5cd82cb30fb00833b91432c1397905a40074c70cf255179a1e6a24303bc72e0a405
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/kL:A3k03kHRJi56rv
TLSH
T1C7155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 896KB
SHA256 da2906e25c619eb711aad936ed45c92a48e0b57c9c55f326a6ba8a9e275aab9a
MD5 78c669841dd91631da0bddb838eab7fb
SHA1 6da24ae45a10f9b0a778f9dbd4eb15594d999faa
SHA512 fb0148080a8bf0d8a662c50ad2af12b530903e58ea1148441943c80d99f4298a3e06fb3869c44f13f3be0b3ede86134be97e87b2d396d106d2cfb2baff6a783f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/AM:A3k03kHRJi56ra
TLSH
T1BC155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 896KB
SHA256 28e4aa733e4a73d20ec565ffb50832ffd5aeb6fa2105f7dfa29da3ceb64a5312
MD5 ed32ac1884cc54d2f553e02770a7964b
SHA1 0f3c9a0a6d338aa84fd8fc6a3d040e4da1f3ec19
SHA512 17f4a45e03af09d60ea5bfc852d53d48c9f5f0b44da352e66c500cd896189b54a93db57b0ea47beed56d03cf5e98e2fb38877def1a36339f3f4e8249e2caef47
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyHy/hh:A3k03kHRJi56rU
TLSH
T1F8155A07A6890FA8C11FC1788A968662E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/808-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2260-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2260-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads