29533cad97423663e7419ec2215572205d231c6ce0b028771f09eaf37a207e2e

Analysis

max time kernel
109s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 940KB
Sample260809-tsnp6shr2x
SHA256 29533cad97423663e7419ec2215572205d231c6ce0b028771f09eaf37a207e2e
MD5 998f6ca9485d3e459d203de85b5e60d1
SHA1 7b4d2e69461f7294b6dcb6dfda57d706b03f29c6
SHA512 8e0d0c1302882d2d91e8c12da72abb9f4e4001e1d40424726fe4285a20a25f046d45551aa0eebc0c44757f6371a133c1b1762c5db973418e7ec76602a9f08a14
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+m:A3k03kHRJi56r0
TLSH
T17C255907A6890FE8D11FC1788A968622E6737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/2852-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000600000001b853-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000016b53-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2852-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4188-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bacb-235.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198d5-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-498.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-577.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-620.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-669.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-874.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-900.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1106.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c000000000140-2150.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000600000001b853-5.dat	aspack_v212_v242
behavioral2/files/0x0006000000016b53-11.dat	aspack_v212_v242
behavioral2/files/0x000400000001bacb-235.dat	aspack_v212_v242
behavioral2/files/0x00040000000198d5-260.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-498.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-577.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-620.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-669.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-736.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-874.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-900.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1106.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1399.dat	aspack_v212_v242
behavioral2/files/0x000c000000000140-2150.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4188	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2852	2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4188	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_998f6ca9485d3e459d203de85b5e60d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2852

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 940KB
SHA256 29533cad97423663e7419ec2215572205d231c6ce0b028771f09eaf37a207e2e
MD5 998f6ca9485d3e459d203de85b5e60d1
SHA1 7b4d2e69461f7294b6dcb6dfda57d706b03f29c6
SHA512 8e0d0c1302882d2d91e8c12da72abb9f4e4001e1d40424726fe4285a20a25f046d45551aa0eebc0c44757f6371a133c1b1762c5db973418e7ec76602a9f08a14
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+m:A3k03kHRJi56r0
TLSH
T17C255907A6890FE8D11FC1788A968622E6737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 e6d894026a042b0da32331a87b1949ff7cbac8c13ff3d77310a4bf227d5cf9a6
MD5 8a5b47ec64de52b571ad2ee5254bca09
SHA1 1c8b9a4b4b87342955e2a0dd404e50c6d72de90c
SHA512 caa23e7794547ad400cd076f96ae77b0b13eb3b510a2fc5788dbaae56eb246546843f0393d067bf6245be8c165c8c1d454c34fa565d396ea6fdbc5ac0d94ed78
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+m0Le5ji0hmxNrM:A3k03kHRJi56rsPji0Aj
TLSH
T1C8655B16F6A84BA5D06FC078C5D29656EA733C421F3087CB0354DE293F67BD19A3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 49e97fa8b61d518770ed382c75d318d9d1775d9d3398fea29e9d73e507c6c7ba
MD5 106b5e15eded03c8f92aa5223a31e46b
SHA1 0feebc46ef4d1534715afac573472c3a7e8ba660
SHA512 72746973a1d453a6ff7fef6e712570f69aeb1ed0dd0c219c25b9dc1fcc88969d5fa1970dd06d8996e7132fe9bef65eca4deaa18895e7fd02ab9990ddbaad3428
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+J6:A3k03kHRJi56ra
TLSH
T1FC255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 963KB
SHA256 053374352e0c8b990c0dcfb0dcdc46a0b80ba4d53db58b9806c810fc643c7bea
MD5 e0c2d44f2bb270422920d897f28e9b94
SHA1 1ca5c155fd8cb713f2d7a1b901a993fa9c4bea2f
SHA512 7b885d8becdf1820eb185eefcc99e60ed79ff2cb7b02c69522a325a4a1b8d2e2a204c5da53d79d8d9b9f4c974c9b67cf1781bdfd5ef049120e86e43cd9655528
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+/o:A3k03kHRJi56ru
TLSH
T104255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 963KB
SHA256 15c6ee6c4173a7038db55eff0db76b8f6e6c6ca7bf8895e00e240cd71a59fc73
MD5 09f11fe51689c0281bcb0d9aab73ecbe
SHA1 ef33fa787358915936cdcdaf713d1733d6181090
SHA512 0eed1a38f7ff42ab6904e74979a4a335e3c13c91a1a72b489a4a3178fb65b35674c5c89f99031de133affbbf5a30c11c2e28800720b69402ced7550a633158ea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+ju:A3k03kHRJi56rI
TLSH
T110255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 ed5c03ce64f18bdcdfbf8d711f7d6ddad65ebe41b3dce13b49390f99e9f326cb
MD5 f8b7f43a1c7e3e6ddce2318e4b516ff2
SHA1 209e96808e316fcebedf5b0c354a09c6978112cf
SHA512 b45ae2fb46b236230d1ca3e55b7d91c4b2c61a86daa90bd5aacc29a0f1f01040eefa642d6e67ec827ac22170b60c6c2916855ed7bb6de3f893e63def952e2f14
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+R9:A3k03kHRJi56rd
TLSH
T16E255A07A6980FE8D11FC1788A968622E6737C121F2097DF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 cec878204a71def0de80c6981c04dfa5fbd7a5f89d8de102409ee43633565fc5
MD5 dacd05a31cb9ec650250f9ab35c2a54b
SHA1 0538a044451746605b78e38272bfb09727f27634
SHA512 c4276c7a732a6e348d292974ccabe07738e863cbe5f64cba3109ab992fb8844073d13f25e0369e481225bee60a100046861d2eb49c870b6e7b5b4f634e630e28
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Nc:A3k03kHRJi56rI
TLSH
T114255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 6ab324f4a0fe7a331e91920f8daf5990280d0178bf42a4d97c09cde567207660
MD5 03fdf724623ddcdacbefc7f5f0220ae7
SHA1 f96e2c71ca506ca4440b6a69e46598f8ec79da2c
SHA512 5ad75f559746594631603b6ddff73022ea54053a87e2db5f26626a72e46d81577c6a029276ba46b4b4def61bb7dbd35519d5e37df635ca4d8894090457c98910
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Wp:A3k03kHRJi56re
TLSH
T131255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 964d90479288a55a4e42344e9aa6e24095235f580691d98665a7296ce3a60ee7
MD5 8aca7a0b13b7c7de7cb9e90b24b1948b
SHA1 46e3363ba06d4141c381c1322ef3291ba1a0c8b0
SHA512 f0fe1a9b2503c5e512eca982ad02aeb0ba1c8540118a54fb69d966d077db5f883cf5b7e144bf0dbac7126518c787f049ae37c0a3250a2b47a7eb24b8a517281f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+5N:A3k03kHRJi56rR
TLSH
T1BB255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 9d4f8307152899270daf3532c55613acb104921169c368d4a7f4a0a4d76831aa
MD5 367d586b0074104f2c330ba3b835b443
SHA1 569480d93629d0949133c1ac3d1a902c331831b2
SHA512 7afc1a195b6c65460d427899d52de3e329f2f71bfaeaa37e54678c116acb3c76cb64003162d497bbf00f575d4f34a380ed7f68ba5ae99957292a08f4716bce82
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+bF:A3k03kHRJi56rj
TLSH
T151255A07A6980FE8D11FC1788A968622E6737C121F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 a0c0ba5d45ede81436699545e95c13c28cb059a7d57f1eb36ae79667b25b7c8a
MD5 fdfd52fa5a81bc38f34d786241885a9c
SHA1 1cb21f67a728a11fb928aadbb65b9f34ccc4b3b3
SHA512 6ba901af9b7d297f4cc35e3532a9a70e310631575597e05d6128559899252828dfe524da1ebc5e1d70166184019df3b33dba60e5f32a0f59c0983c6771a3a175
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+UC:A3k03kHRJi56rf
TLSH
T158255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 24e49fd79d898c96ae1bade2631038ebdff43adee5172501388ab9c29156e909
MD5 412738653a0bc94d6f81db3fd5b82da0
SHA1 777106937d50e61d49a1cf74f3aeb094cb121887
SHA512 1fa4baedffc32c04a3c072e199440dbfbcad5ca5dba934e6dfc1a3ecbec1306a6a00143f93a12ff370c4782b8ee9bed39a7075b123aca13f4c69489592fc70ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+vw:A3k03kHRJi56r6
TLSH
T18F255A07A6980FE8D11FC1788A968622E6737C121F2097DF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 3364d68c41adbb80850644fe79d50c086cff8a46fd862a2778edfed1eddc229f
MD5 6478be19327ef1e6dff48e5b2ce0bca5
SHA1 9c57b99a8066fea7e1741fb993b902d3ef4b6686
SHA512 6948fb0431052e454636d662daf786a211472f1f62b87ad06aaf50f574f54671fef0fe47bdbcc946ec8356b7a2f795a975fc79e4737f21eebe3a55e118497af6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+eT:A3k03kHRJi56rq
TLSH
T1EB255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 39b4201ba75678b6f75d12605a2a6f398fc4e0d83f8b2f66869447010196f032
MD5 a1fdc072b562e16623bd4c95063889a8
SHA1 65d63c2054b2e97933bf3dee7c722824eafd95d7
SHA512 d5de2351c2888dc715d197e1aa143212dd3d50d90bbe0bf9d5c059b07389254a154af00b4195a72913df9ed6d3174d48afc001861a3c1203522c62801b4183a1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+mu:A3k03kHRJi56rl
TLSH
T1FB255A07A6980FE8D11FC1788A968622E6737C121F2097DF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 143354cb303b14e9e954446ecab7b22e4ec678913167e2b9a35ba72efcd47efb
MD5 7add10aa8444ee2af13761dd9fed70d1
SHA1 958a5d23090db25cb9dc31cc66d4d15ad6175539
SHA512 32c1afdd2e49f6c774b65a0179615790620650917d9410464d78444bbeb78af44058fea0d44162e2c8cb5dc9ceb0a4fde568ec1649a023480c7dca79ec18364a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Qb:A3k03kHRJi56rE
TLSH
T133255A07A6980FE8D11FC1788A968622E6737C121F2097DF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 84806e2421e8c22eb465aee15bb81336df2d37e753a14409740f1556dbe80517
MD5 56ae8286951be02f5246a158d954e0eb
SHA1 6b31a1cf8fc510ebd9999c92378aa28615c24e54
SHA512 673dc49dcbd2b2e688aec704a4da68eca922eab09cfd46f3856e6fe30642d7cb6fdffd9a9a09967a488a393941eac81b77137095af0b94fbeef2744a96bf7616
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q++f:A3k03kHRJi56rU
TLSH
T146255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 1a050da18d97663e35112885397b8e2a973bfedbbfe5fdfdb3c4d865f3f03cf4
MD5 67307a13ea55f052b5c3a2684bfda763
SHA1 46df0a30566f1184458a5ae6661d132f090786d2
SHA512 e05ab692bc7299c201edc8d70e2bbc8e8e3cc1720e8c23dace90d29aa934d72e24d67562c8fdd731c7d71d3d0701d76d838d5949200f351906cafbc838a80b89
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+bK:A3k03kHRJi56rE
TLSH
T1BE255A07A6980FE8D11FC1788A968622E6737C121F2097DF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 02997e21d672f68f767c475d6d2ce77a9535df2971d2924573c0bc5909e81981
MD5 a97c9981ee1ef0a18038d49571b2f2df
SHA1 9c24cda1eebb408e3a762007e504c603c0bcdebc
SHA512 aa6d4a7421fd046e6e004ce3009efb27a40adf565bac9ba58429fbc23d532024dc9960142cd78783f638c6bf54df33b1a71811a82d1a7a688e1663068190e045
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+sk:A3k03kHRJi56rd
TLSH
T19D255A07A6980FE8D11FC1788A968622E6737C121F2097DF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 1c55e64719b4397be33eb13d282ef654d033d3abf454ce014ac08b1bc38ba629
MD5 33330367bd279b855cf9f274fe9cc3fc
SHA1 0c99da53d38db4d2c57a1a3366cff15bffeefc77
SHA512 9774b4f57c4e744184dcc2af8c98677ddaddf85d8be37b7920c49e8753f73cd6b03ccf089936f4f4f08ec503016b32c07ef97e88bf1211309db5b2eebb132613
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+l0:A3k03kHRJi56rg
TLSH
T1B9255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 d8ec20e23d643d7a543735a8a92cefea1918f937f5cbdbb70a374490b6c2d9fd
MD5 e6b7b7dea6a6e8e984c9210c1a700010
SHA1 9f1d5cc415cf8248b1215db1821aac76b154c345
SHA512 4c272e21eb2247766ab776ef80723bba2fb5504d2cd1fc50a71015d221b35cfbe3b4c642e471adf28666ec0b29cd3fde4003abd1b3a6e1a30730daeddff6ba3d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+og:A3k03kHRJi56rV
TLSH
T1FF255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 9f203b14ac1c9464d79271c733312760bcce04196c30ab9b747a5e64934b874b
MD5 7d9caf3d6c31db6b3caa2e42501ce448
SHA1 9ad52dd1c02ec7654e9139487aa3c446bcbfb145
SHA512 f1d1927d1aab868ee5dc3eea697de2f991636a50c19a40b25a9a3a08f7ee43bc4593565ae04c18c9b78a222860d9210b1921abae93f911afa45712e98089d39c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+dr:A3k03kHRJi56rX
TLSH
T1F1255A07A6980FE8D11FC1788A968622E6737C121F2097DF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 50e5c97ca8c1b88a479b77b14a4005ee9f775c441d50d911584f65ce15150456
MD5 2a291b17031824c6328b959c787031e6
SHA1 4e44d4e8e9bfadb04a6b0ae28e5f6f7b5ead0b68
SHA512 d19cee7a7db59bb0f88ceea2aa60cf8312d9806d93be09d2ca46f94d0cc534fab3426374113987d5573c5c24fad6244c5bcb55a1fdb247fd34ebef298d4f3332
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+nn:A3k03kHRJi56rh
TLSH
T18B255A07A6980FE8D11FC1788A968622E6737C121F2097DF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 395ba0a429cb7e721b99374757265764246830edd3282908f326fad3af56b849
MD5 f5a4c4f9ede11a3b2c44a2e25e840835
SHA1 80a003bb08b986a01d55f36b48e6fef04a3784d3
SHA512 24d6b700258ada8892d678862505ba69f0cddfce0b4dd1e68b7fd74044fb1547d7ed3f0644cc4919c44b73487f9fb8eabde61cdc2796adc50d967c79140e3dc0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Dx:A3k03kHRJi56rP
TLSH
T1DF255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 b4c957899fbeceef00defe9b1c1d1cd59551e1ca559e570ab99a1118f8366f11
MD5 9c0d33a733ad1f75f92de34456cdf6db
SHA1 3ed279d3e8a9e5d242c3f7c3c5caf1e16179d7c4
SHA512 028e480d1df89effa61dc695c7f22c3e113f8a73e319ea8715ec347d0f91de8558867e8d41b6bef667799abc91d25c87c78f30c800ec7517a104d66b1ca7153a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+BA:A3k03kHRJi56rQ
TLSH
T16E255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 df8d1babf6434f0cab96a50a3caf4b1907fb326ccdf96d31165ab724feace002
MD5 2435849b135dbdc45b6000aaea0f7f9f
SHA1 4b8edb0083fc58cd2b98549d847e4b08351cfde9
SHA512 5e14a72f9a337e1ff0e5e9cf552bcfd974bdb5ece871e2716df65936fd14691c2e7d61baf242504fc436554ee7d313a7e6b97bf254210c52d204d30ff80a9f9a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+a9Q:A3k03kHRJi56rp
TLSH
T149255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 a917fb12a9746b2ebdbfd662df54f109c3ead44a032a8caef6a04e97686f9660
MD5 52e50eacd6835202bc9e9b0cd418a3ed
SHA1 66cd2ac4b51372454744095c4d543ee626177a64
SHA512 6799e62e6bbe368b3e26a5fd31f2c06d62784dcc69f2c2c6b55b94ca3a03fca1e8ecde8e20f8102f034b6dbb33cca2d43459064e77dce390c5c00fa41ef24d7f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+P4:A3k03kHRJi56r+
TLSH
T146255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 ca622647fbf52fa82cdda578f297579c723beb9c7a1399d4640e4e02da89355a
MD5 2480e6d65afd106c3fcb85d5573710e2
SHA1 ff74544ebf2ea1ab418a23c1e613f9d10e7ce594
SHA512 4b8bf492bb1b5aee3818eb2d0c183ffe3121fbf8810f740d071c9a3f0e4ecfc886647475f325ab4323af166d41f322ed01094f1db8e241ec531e04e258e3b496
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+eu:A3k03kHRJi56rf
TLSH
T1A1255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 3fe337f85f01d28eed8712d4c71cc16b14b99fb357799cbe739c3ec7cc46a955
MD5 c2dee47d5fd5defa26e6195cae8ec714
SHA1 7d4f04807bb9f46a24bf4c86700522b7604d4faa
SHA512 76c02fb18caa98d87367c798b5787476c5bd8323400d404382e413396c2cba9c167e867c3dbb8a54a43d9653f40aa52f7f2f1c732c2210a5ea06cd3125ba8302
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+vj:A3k03kHRJi56rB
TLSH
T12E255A03A6980FE8D11FC1788A968622E6737C121F2097DF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 3265422adf1fb44dca55f542f2e065c4174e5b91dcd63fbd69abb9ab1a6c5502
MD5 ff5074a83527ceca813e14350ec100e9
SHA1 4b437339f04167b7009e44fbb6cfe7ec1cab68e6
SHA512 4245d30a429bd20107becfd39aecd5856fd3cdf99e6fa3bca9365a8b04e1ef3aa46bbb0035873a24b2a50cf6bf257ba570f9bc4da587000dc9d0062fe01241c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+6g:A3k03kHRJi56rF
TLSH
T195255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 e5d7d8bbc5b2c4cb7b90b6924c48a39a3fb25de5e338c81f046819daf5de1669
MD5 aa4a8b02870357488c9f2d3f1db3298f
SHA1 f1b3fd7626ff7c1efc74717b5edca2b5390d673b
SHA512 89cff1b52b5177651dfda889e8b5dd2b98be1c619e509d66230c4423a1d779099742bc1214ed23c41df78eba5b36f8271c8b79a45c62f0f9cbebd7445d2189e0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+lI:A3k03kHRJi56rs
TLSH
T171255A07A6980FE8D11FC1788A968622E6737C121F2097DF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 d87822291a1da9a0518014899afad38d82f23421f264fe8bcc41c071d323c9ec
MD5 b2c47d6fc74a083121d5fb36530ba5fc
SHA1 d919f7893359860b5b5f7c6cd57e72250a215ca2
SHA512 a71e842290c0e936e77970e34abcee596c391b474c1197b01b75c8451773b8469c91edfa09d350117e7be667fac029767220e28967e0d3a49dad37a5f60dc140
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Xo:A3k03kHRJi56ru
TLSH
T132255A07A6980FE8D11FC1788A968622E6737C121F2097DF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 1e2de4cb6f80f533487241662bd65bb4be1ecbd45bffc1f1eda93d6c16c9e40b
MD5 a36c85731bac5a7028a6b9b0c0edb695
SHA1 f37e6ef45968078e9c0d9b5b9b77999f2e65daec
SHA512 ca4f2c5bff961c5bf407b6a649d323a35329b5685c47b0508e7d1bb8a6f5ac8dfebd2dd51a2399e133627e6c7f126c5a2d756dbde1de7b68f1f35e283d37b848
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+8+:A3k03kHRJi56r7
TLSH
T17E255A07A6980FE8D11FC1788A968622E6737C121F2097DF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 6debb760e2039ead06cd2e168b5471dc41b85713c65fa057859623b687352e86
MD5 6d770f7462d70454f9784b0399dc38f5
SHA1 8490c16a167173b7421be183542e3d1f71ff410e
SHA512 cd3bd493bdde0560dee0a2d988aad5cfe3681ed2df9ec835f10a1362f7a4b6f43f28370a48dfd87bf482119cd242b0e8a0df6455f8f473bdc2defcead8b02091
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+EQ:A3k03kHRJi56r/
TLSH
T114255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 f2d4116adff3d679fa270d6ed7f036bbd8421015ac07fb28b262aede4121946c
MD5 55628da9385c63981d572f77777b8d0a
SHA1 9d5e16b12205222831985625a0f54b1288ae22aa
SHA512 58d103f5da3b343bb5a3f6ebd0d7219fa776122bb4239098abf3bf4974302a23625c6fd720d53f4c342d1648b40eac4d5402a49a479241a89ecea41c9e45de68
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+9X:A3k03kHRJi56rT
TLSH
T1FA255A07A6880FE8D11FC1788A968622E6737C121F2097DF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 12dae2a56497b29275dcdf0675f4b8016cdd881af07893f82e4142407ca10f64
MD5 ac1c6ee917c28c62f6e552b200501673
SHA1 e61b3323879e978dcf011e821f28247183ee1c46
SHA512 530632aabe72ac1df7e829dde3e2c10c18a2f7271af83225fd2658050c288f54a84e336fa5992bfaf89cb3c761ca1e2aadabf065bd766d03b9cc078cfb9b2e6b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+/L:A3k03kHRJi56rd
TLSH
T1E0255A07A6980FE8D11FC1788A968622E6737C121F2097DF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 2107eda0a04404a4e8a9fba805439d12becdbfdc54f465e2351b701a7bcfaf47
MD5 0a400bf5ce207a14aa679c4a2dad1be2
SHA1 50d24de5d9d87d255600243846998812887aaa35
SHA512 5a2fd0619512f0cacb6486f03e87a720f1ab1fbba57c75122e986a12d432cdc11c3fecfeeea3adcd731c435356939a13072e021dc8e7ec437bc505fc3077421c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+1M:A3k03kHRJi56rk
TLSH
T150255A07A6980FE8D11FC1788A968622E6737C125F2097CF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 a9ed851314cae4f79a84fe2d88ca19b49ce81495ef2bc90cde0800dc049b9400
MD5 336ae1dee906530557c559a75fa0b2dd
SHA1 048557a81f3514c738788129c80e1a22e369a2f0
SHA512 eb41433505a16fec1b066b25190d1a6bed2dd89e844df20540eb4a4eabb2fc6ee861a8e1bf601a5e4748bf905f21e0f7fada0ee7d608f5a517e7189c9c359c34
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Gh:A3k03kHRJi56re
TLSH
T1AD255A03A6990FE8D11FC1788A968622E6737C121F2097DF1354AE153F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ComSvcConfig.exe$

Path C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$
Size 1.1MB
SHA256 c40e4c99f78774c45c7bacaced59f68451c2e72c9995bd4bf4f8acdbb1e18202
MD5 007736af487fa6726a6f0c88fb2090fc
SHA1 3e8dca459a57e6af1706d418fecc40ddacf4769e
SHA512 778aa1d61db81ab0368f020006613706984bd5da1688ce8d08ca609853c0b5f7ada2fe260bdeb7a3f20549bd323baa1845e3ff309f5517e8f612d71596894bc8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+yIiHq:A3k03kHRJi56r8IiHq
TLSH
T1D7357B17A3D80FA8D06F82749AA64522E6777C161F2193CF1354AE193F72BC09E3A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2852-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2852-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4188-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads