70c6c9cc215d031f5c3d28e78978e7ef56555ce60c8fb338c64853e9c2bd2311

Analysis

max time kernel
110s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 931KB
Sample260809-tzcaqavshx
SHA256 70c6c9cc215d031f5c3d28e78978e7ef56555ce60c8fb338c64853e9c2bd2311
MD5 804bf8d1a9fd842f3a2c43f045953766
SHA1 726b87c12b601a392185f08334bb0b933355626b
SHA512 6fa1f5d3f71ae0da49e8265b36afbfa88f329c74af455b7ec057ebe370556a74960dc6b2d2a846e4e57f26184148670095976cc1669697c6f6f13347c8a83f05
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6f:A3k03kHRJp
TLSH
T19515AF03E79400E9E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/988-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5b7-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2bc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/988-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2644-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2de-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-237.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00060000000198c8-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-499.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-578.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-670.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-731.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-763.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-799.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-849.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1051.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1089.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1367.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c5b7-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2bc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2de-41.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-237.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-263.dat	aspack_v212_v242
behavioral2/files/0x00060000000198c8-444.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-499.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-578.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-670.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-731.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-763.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-799.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-849.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-869.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-920.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1051.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1089.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1138.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1169.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1219.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1322.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1341.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1367.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1388.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2644	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
988	2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2644	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_804bf8d1a9fd842f3a2c43f045953766_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:988

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 931KB
SHA256 70c6c9cc215d031f5c3d28e78978e7ef56555ce60c8fb338c64853e9c2bd2311
MD5 804bf8d1a9fd842f3a2c43f045953766
SHA1 726b87c12b601a392185f08334bb0b933355626b
SHA512 6fa1f5d3f71ae0da49e8265b36afbfa88f329c74af455b7ec057ebe370556a74960dc6b2d2a846e4e57f26184148670095976cc1669697c6f6f13347c8a83f05
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6f:A3k03kHRJp
TLSH
T19515AF03E79400E9E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 98d2deae59f2691abc9005daa139f0c9e556915508f54f7c4bdd16cf0991a7e6
MD5 b60aadda9859afbb7d4a22f7d913b569
SHA1 93cee51a54d8e964b10df8ccb43ef433712e22a1
SHA512 8e76e97cdd4ac80cf16ae7199f300bfd67a149ceed07a9b47e8e2aee666a1a4f8bf6530e1eb41633315cb6fd1f8dbea791f6310856871c85efebcee8ebe40857
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6L0Le5ji0hmxNrM:A3k03kHRJVPji0Aj
TLSH
T18A657C17F6A402B5D067C1B8C6E29A5AFA71384217309ACF1358C7283F67BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 945KB
SHA256 5c47cf9cf2e15083e7167a2034204dc4a105be30967b2c00f38a96d920905d53
MD5 1cdb74d4ec0bed45e87e564177a69f5e
SHA1 a845784e4ae0360f1f4fcf1110c4aa4d26e9ada8
SHA512 4d21898a0f9d711d53c56cfe1601fe535cf3d69a1eca6fc15bd57afa9e7d02dc838b227159b847f913dc4c1bfd40297909a23dff8f0c4ced431c175e25bf3a42
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6Na:A3k03kHRJ
TLSH
T10925AF03E79400E9E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 955KB
SHA256 9692f979cab6146ce2fa9f39fa29991cd274e6be61002e7b0e8b0434b8c9f8d9
MD5 15cb90feb3fd87b7c04a9ccf60da438d
SHA1 19f47746156154a976e43dbe77719f76d4f409c0
SHA512 f69206a73b1481958c51ecd9a1098affac950c3eeed48198a933363a4587ab8ab21fcc156c617ea67b41a83c5b76f8a53549839aac7c60a8ebf249a3b3ae5170
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6E6:A3k03kHRJR
TLSH
T11D25AF03E79400E9E10AC1749AE59A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 955KB
SHA256 5ee780df8aa3927d401710096728a705f2f01590a2191a7fbac69d39258ca707
MD5 ed83779d40d3f90001d3b3c31cf0df39
SHA1 1032cc4bfaa94544446113e2068653badc55e03f
SHA512 7d78edcf2e88bccae321a9c4e56e833a5f8317ca374a18ac9a60aa0d61efeb47110d98ce354612ccb5b74aeab6ad47132671cb06a73c847bf05f49b949c98324
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh64o:A3k03kHRJN
TLSH
T14225AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 955KB
SHA256 640ec48fb22653aef5c5924e0316482e83bc1d5c786b64a962bf396b7466af50
MD5 d04ead34e3c157df6f6f1025ac77dbef
SHA1 2350439c4da941508af9573f5ebd76ddbfcfcdff
SHA512 44bc35306f833213512842a0d98891d40f8a69c5922de0d51e840c7c40dab3e1bd66b44db9dd31fa97715501b8cd03785d61bb7d5a1809da2498e9e9948ce9e6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6Iu:A3k03kHRJ/
TLSH
T1BC25AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 955KB
SHA256 fa87ee22be1f852dac80e36927202d411ea699cf9abce00b3746d1a39ec8e6c0
MD5 00ad20232e48cf27c0c4290cffe01ff4
SHA1 143ecf14a5f300ed0da0995b4a69a9640ae33fcb
SHA512 7e0ff051748593a6b03680fa3f8a11c0ca0537465ab350d43c880b739acc74bcca59887641eefab8797e4312b595bad5c7ecd79a4330870f4598ae309693fe75
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6c9:A3k03kHRJ+
TLSH
T1F725AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 955KB
SHA256 06ffe1ee569133d85e5fb4657dd31d9ca73cca67261294a3dbdee5eda4a15990
MD5 3d3b15c4aa458447df78b3b7fe67930c
SHA1 59ea5b19f3da4d5279bd56b1d2544e6ff0dce98d
SHA512 5b2bbb04d34c51f6e99009691622b102ef5acb150db2f54da86202d454b59fb5e67c84ad63696a70a44ac4907e7881882ffc9dded71d344a76860eb06348bdd1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6Ec:A3k03kHRJT
TLSH
T1FB25AF03E79400E9E10AC1749AE59A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 955KB
SHA256 e904549db8775c4f4266949e8713597b5a87c629d5c615b0e5179d73f8e16e96
MD5 5c8a17ca7f62fd139acb01b6ff493371
SHA1 5baf5f5c3965a526ca08423b662f8aac258e565c
SHA512 ed86b1061b353abbfc3c8511bc3cfb0bc35212a96314adc9cf8e87b02eef3eacb950612088094e3f58e1e836695dbcb06ce1c16e5a90f4a3f9f182510e1ad257
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6dp:A3k03kHRJx
TLSH
T17E25AF03E79400E9E10AC1749AE65A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 955KB
SHA256 a4b968a1ff5d17243e555941671ae07feca962f54d0d2d316c42f4b49cd61004
MD5 d2bd9fa1f735a449b0da16c513a2806f
SHA1 87e53722455e16921a3ce167df808c76cdfe6b61
SHA512 7868bd48d2b98f0d0c989f87fe404ddcec485b4b94cda90ef10ff7ca9a1676c047407ebcb7d7ecccecf9cfd12ee18fada117300ee86c5b06fad6445a203c64d6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6iN:A3k03kHRJq
TLSH
T1EB25AF03E79400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 955KB
SHA256 82b8fca415a15aa2e2381baaeb5fba10bde4285c1f5b0d2a84411826109905e9
MD5 f0764c1720db14dd2074ac206c0d3a6a
SHA1 d28975781827c261c05ea0f64199abd53eb56236
SHA512 5167f1428d3b4696f2e3ef30fd87c7148eca884dcc2fac74224a269f0fdda669acc59f3bdb2a12984c0ae72402620ad7f86e276e17445e09950ebcc00fe1584c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6GF:A3k03kHRJw
TLSH
T17825AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 955KB
SHA256 cceefa9b30f43f7adbb0b0ae97664e7965c09987f11b1fdd96b8e6acf514d7e3
MD5 96f6cf8a9387257e6b97fbfafb373078
SHA1 4a5171a01dd12baa9761234ed7c0479a7d582965
SHA512 c272d378256cc7ea94369b852468784b986a1fceafde8d217fd695a4d3d56af9396e3c988e8af33d46303813891ef15beb94c15901ce21a0c1bd0ae22710aae5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6TC:A3k03kHRJE
TLSH
T10225AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 955KB
SHA256 3bce0ef50536d9b16d3eb3c8bfcb2be4688c5de500b76168f4f5f1ef1320a2de
MD5 8720287a57bdf117d7550b49706f514c
SHA1 c5752d3029a3617be88c7dfb9fbfa1f190d304fa
SHA512 7791fb8d28464b1e5a5039b09e611b9224593ebaa8799e82093996898149fb767dad9768d3c9c391e499feca8f118ef83193fb6e07bd2316dbe2cf7a0075f9ce
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6cw:A3k03kHRJZ
TLSH
T1F525AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 955KB
SHA256 1155f5976d65bdadbe85512549615d2b9115b6bd3db75b67af075647882d5ef4
MD5 b6a1507d23bf3a3348a215b736a1a7c2
SHA1 bc7870fc3d3d06f2f5f5e335d19c25d3c4b63bd6
SHA512 f66a5498608ff5cbbcb858d0d3daf591160be5cf6c77c1b084601fbc816cb57f327e30c098ea300077e827abe0a58c61c439ef5d565bd7734d6782116fd85e32
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6TT:A3k03kHRJN
TLSH
T1C725AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 955KB
SHA256 9aecbf758b74f19c54d5dc0465b81d58aa58b61db620baf4352b59dbfe165cfa
MD5 24b8085afbc16d7616817a82c3aa362e
SHA1 6a5816a34184a5234fffdce47643263fab0db0a0
SHA512 f53074621d251d7bcb8e138580708461979c4264d1eff7301a64398a31cfd1bdb447e62c0d0a28c69114ac49de921860e69668e4a1afddf09ac3335b356769a9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6lu:A3k03kHRJS
TLSH
T1F925AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 955KB
SHA256 74803209cbeba6f980817a4bde176374cc03b0b1ab6a3e3bfd9228e264af670c
MD5 db3122379ee2dea6a787e23297db8bdb
SHA1 2019d7da70540cf99e2dbf0184406c6cb6da2abe
SHA512 f7ecd9c43f2155cc13832e2740bf8eb76ce006a9dde03516ee215383e8cc25e9b4b336c8492a96a6b6a7bcfb327ee7708d09cd952a3127b6e48ff034ce653083
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6tb:A3k03kHRJD
TLSH
T1FF25AF03E79400E9E10AC1749AE59A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 955KB
SHA256 8350c1317af55839f40ef472b2ae0cc73e74d619036fc59886c695f806a945b4
MD5 cf943470239e608f2cc81e0a138c11ba
SHA1 bf71d7c5929734b6c594a16472529092410d9951
SHA512 df08c40b931ce4c7c7c33b9039dce86422e5d579e047f6691b618b833b4175058939d46c4b2bc7677140ae0dca6abff8a324266b21443a0838af1ce166780230
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6df:A3k03kHRJ7
TLSH
T13425AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 955KB
SHA256 9cbbcceada6ed4f55875e307684037479cf4dc187fec8d966a7b2738917afe09
MD5 ca6c02250eec2d56b3ad29c4d6db4ca4
SHA1 e3da62cb7072d49c0436f9c7522c416e2e849a2d
SHA512 6df48dc9c5e03483e6b7339032279be09579bd927180ffd9c9d40d7c12022ae09666abd13da6127e2f78f8238e7286a31e99b4fafe5490697eb1010eadc43ead
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6GK:A3k03kHRJr
TLSH
T12125AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 955KB
SHA256 3387e84463f9c012124dcfa9ececa6eb6467a0bc7acf6cd5858bf64a5c7e8585
MD5 ce226496aee70f7167f310f7fc69c0a8
SHA1 61effa18d340e6c7d329fb4e753f64d7a986a75d
SHA512 dfcadbdf3d16def2c3eb57ab445c875b3222ca124b29b3492e1d04b7e4e77e1c47c91e1543d32de9efce59edcfc3df61ac96a225e3bd7047a08404738dc47ea3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6zk:A3k03kHRJm
TLSH
T11025AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 955KB
SHA256 f7460c6523125f889d789d8a06b0d72be34681f0b9bd2eebe7412161b40be513
MD5 1227969dc3874f9d196ac5d77856c189
SHA1 47d94264fc74d14437e7982662259d917e7ddd1f
SHA512 877c55f4372e46153cb1b93c41de9574ea1aaebecb2238785f1ca5975f0d347233ddef872fa3295eb58cc4aea91819c861a8238c25882ff8dc4ce2c6ad88f9b3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6E0:A3k03kHRJb
TLSH
T15D25AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 955KB
SHA256 fc22bd2369a5c56e2bf5ed1970e154efc335aa938cd0f5835c71cea176356b6c
MD5 cc9a86e2bccc15b154599e2e49ae015a
SHA1 0ed2bcb4a37753d733ebc8bde6841a3a0a713ddb
SHA512 20491b9904652be90562e318b5991144fff7bb858b857f4d4178723d7e911c7284f72a13d753bade62dff9e62dd6acd4f6e25f57e78faa1d107190c1afa41fda
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6/g:A3k03kHRJu
TLSH
T1E825AF03E79400E9E10AC1749AE59A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 955KB
SHA256 4550af8d08b68d792440fada7b985fcfd87908cddaad422d82bc6886acc038da
MD5 dd34c135866b7186b33a77acecb7e0c6
SHA1 1622b6eb44227fd1f6abeeea57ce2204682d9891
SHA512 15053d47d120fca95c697925b6ca8197abe1a70a6a1d381afd88aeebd7e22cd4f9bd7e4ae72b6d1246d6ba1529d9f5f5fe661a1596613f8b899781fca446e4ec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6Sr:A3k03kHRJw
TLSH
T18825AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 955KB
SHA256 6689e1700d2eeab2ec5f49b38065db7a87cf6d5e29fe0fbd365cbc88641c1079
MD5 0d649be506f8fe9aa8c89ea9deb50750
SHA1 449e9d57b8d2616d33a51967b8766366f7ff9abe
SHA512 e4a96043c92b8517b0124a484c6a9c8e3248f6f01a1d25fccaa9bde82a66bf4c6bcd3a7eaca1bc0ddb5abc44ee3dfdb585f7c84e384dfc5947eebd1d08c89607
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6wn:A3k03kHRJi
TLSH
T10025AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 955KB
SHA256 9568d617dd7952b1688cc7fd35549db82d542aca891624eaa59a9c54b14898b1
MD5 0379941ff6cb0f01a84b87b5ad46718b
SHA1 a4b67ecaf67f8864f5afc667925877fae4e40aac
SHA512 abdedec1657d5280af06f787a51c0ff945c753aeb06298db6358c74ce26649da1c46b241f0c23c81e7fe47e29948b7124047880e9c3d57b85fb738bc9516a6c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6Ox:A3k03kHRJQ
TLSH
T11425AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 955KB
SHA256 d967ba3575673c891f91f57948ceb0fe73baca35dde14f625fd27c021cfe7636
MD5 3ae732b78bbd8a0929438ef266ef88bb
SHA1 ef962e4fdfc9d31f9d5483a9fa8ef4c3430f7bb9
SHA512 f5efe778acda034866250d4c3a02269170333d17db248c4ebe9f4f972a3ce47868a699629206512297038a8f454492db594cadd8a6ce760a23472f70f6026cea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6oA:A3k03kHRJz
TLSH
T1E325AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 955KB
SHA256 86032458880ca87192ea639e112d69b6b63c74d420cd0881ccdd2c8e952dd369
MD5 2b7150c6407f8bbe24ffb92705a0fb26
SHA1 9bad821144a5821b4222547aea4a8bde5e512c62
SHA512 57f3dbe11ae8c3d4d85da6af226d87d0e8b9f6fd485f56dd84ab58c42ed92aeea51a15edce087eca11219d5ea7974932316ee9ccacc3bdfdd9df4bb303088581
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6B9Q:A3k03kHRJe
TLSH
T1D325AF03E79400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 955KB
SHA256 1cb69af858045a48f92ec2214c157138fbeba7b3c80ee09cd033780d04ad5a54
MD5 37269aa251bf0b0ac033aed66d3d199a
SHA1 bf798c0754f127176ef616015a6c6b96ace11c0e
SHA512 54d21ad75bd983212a02f442336d3e149935941dae799a454d195b43135b007b73233238a713aaa9c7e090479a15ba8b604bbb2afb3ef3eda193ce2cee15a21b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh604:A3k03kHRJd
TLSH
T10625AF03EB9400E5E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 955KB
SHA256 499aef1b976c08e911f6c412dd866c40f30e3856493e05690475c834b227e56c
MD5 bf12272475a2bed17a73c2adf3e011ca
SHA1 c4708874097db1d7f4d4e8ae3ded591975d8164a
SHA512 f30332cd999b93a0147e27fff5396d2094d86ff783eb04f5b95ce44a8702563a0d07bbec214ac92e2b7027b5226e7882b379b172758c52740902f1cfde078a25
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6fu:A3k03kHRJ4
TLSH
T1B825AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 955KB
SHA256 8887e213ed2048089f474573f250f47da88ad2368176630b90bd2c5b3f22687a
MD5 93b9fd9b20318ea2d1cfcd02b7f98175
SHA1 ebb2e0495feb053f4cede5b229bd012d6f13ee08
SHA512 0191f4119974d1e29ef1b3bac55e901742c81231ace490fe103ac63415c8a63da9c8d2de9199b9ce7a9e33a988e979181cb41d39fa66f7c5e62bd4d491802c26
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh66j:A3k03kHRJS
TLSH
T10025AF03E79400E9E10AC1749AE65A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 955KB
SHA256 27603a8da755c29612be32bd4397a9bc9fc75713d044e1ef8d5c63510ca4a7ee
MD5 36c90ffeb5859c0bee78ccf39d81ffbb
SHA1 60c12cfa37f8cf52a5aa9160b8c7f04eed254006
SHA512 5620426a3e32dcbbcdb3d1326b20ea7421008caa18d4d3e8842f02edc19be433e7252b90a04ada6a7a63f31cd15397a4b3095d0a380ec3822bdcc376536d8910
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6ng:A3k03kHRJW
TLSH
T1D925AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 955KB
SHA256 e1bf469bf3ff1ba4cf475584c7ed4873aa2d7b7f8e07d6bc8b789aa28cbd3c81
MD5 972b09099ca4594fbc082ce8db41f4ca
SHA1 b185553a3075c3ad253145f22f1a60e27af81563
SHA512 4ca340be8fb5129848696c5365c18c8faec5e2e245787ca936b5892eb05d86b8dbbd4315b379e32493d1249d890068cbee627fd1ded1ed5f1eaf3aa5fa30a756
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh66I:A3k03kHRJ/
TLSH
T1CA25AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 955KB
SHA256 3df9c6370646aa8dc29773a149ed3067ff28c7954e91456caa1f7b081a166913
MD5 ff023a69634692727e75d5c91557666f
SHA1 2c7dab278358df1d752a6d7fc86d8140e3ca9bac
SHA512 563dbf146841f0b02c72ae8aec41aac8b1d46c53e83638b9bee695187f765691190b81340dc1917f42b52bf96a397b9c7e7b73acf210191de80da2418033f4df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh64o:A3k03kHRJp
TLSH
T18D25AF03E79400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 955KB
SHA256 ca2ac25e7a328e418eca805ac1e21e53077ae7069d5525608407689afd8f0170
MD5 b3f5036437cd6584c94bd6b8fd39ed6d
SHA1 f81fde8d724cd044f9cf28f83a64a4c1e98f9462
SHA512 fdf9fc195597770e385f30bc0b84bcab58dd50d1887189b3de6c2e8a235498c425d396d69f8d26cde86381f0d2b673cc4867046d38618bf9180143e5ac5ed865
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6L+:A3k03kHRJM
TLSH
T12625AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 955KB
SHA256 81620af3038f226089420c0f44f05deb0585d8de4f8579c6ae1ff5096bf48397
MD5 1c4a9ee6dacedaf8e23d2036ff43ffdd
SHA1 d409c867c136ff55614325b06baa564939617a0b
SHA512 dde9728e50badd6cf2c9e0106bdcf03f633676131f5ec6300c52cc3170cf7afc5eadb0da5407d17f81a2590b8917691a84f3ae17d761e9d61b2dbdac174d0348
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6BQ:A3k03kHRJk
TLSH
T1C225AF03E79400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 955KB
SHA256 adedc9a1741da31f9f5edd5e89151298876c594d17d8d6a58ab75e166e99c8da
MD5 bd3e66fc4c7bcc5934e2b99610016c46
SHA1 b9a6eae9d880e325deadaee3b739b342434982df
SHA512 875a34ad90432b2d8e6da332e5a34c4ce66bab592310c3e161fa660db74fab2ae0f66c1d61a9edf092bb3e72a534cff10851945b249552fe657ef5bb2f7ca403
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6GX:A3k03kHRJE
TLSH
T1CA25AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 955KB
SHA256 260e9723084e3e0e442d3a761f923d15e9d4298905bca8bd70403f37d04dc8e7
MD5 a26235b5da1cb2eb3232c3bc5306dcc0
SHA1 3f4f5563145ab419a45902e051a97d1b1f5f0561
SHA512 4af8af0a3be745102497df9fb121720a9f286d0e04caa6536fb74fc7d320207e52b3b4583357f831776b1b13f8e8ea6696682e2e98d503e8804dc406343ce698
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6AL:A3k03kHRJe
TLSH
T13425AF03E79400E9E10AC1749AE65A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 955KB
SHA256 37c55fc057484bb715aa8e09ea07e3c1d5b6d1ad1ba063a107523ce3f7342109
MD5 b6b31e898e00424f459542313910bd6a
SHA1 1e0f94b823d0e51445413e0d8ebbe22135141704
SHA512 f058a10a35ba4aaf735ce1c107e844f4053f391118c36f291a90333a408784a7f058ceff88bb5133894655104b3d39b7e7d71afdf57f137fc432332059b2f19a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh6sM:A3k03kHRJr
TLSH
T14C25AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 955KB
SHA256 ad99605af2b677318502c7d3d3da80c1b174f1c13e4a9b6ff90460b28c1300bf
MD5 1fc9d0ca85f4ed4bd3b40e7bc7e409dc
SHA1 7a8cdd5dd1edc9f158411e512d2f494f04f84d1f
SHA512 ea5bd546869f68f5d1e0b4999615c09e9a22d423b3b1d8b283658f4eb08bb5e037cb302b057b412c8d86ada71a23c8390f0de861c0b9c75a8076a3dfeb31b16a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFh61h:A3k03kHRJl
TLSH
T17525AF03E79400E9E10AC1749AE65A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/988-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2644-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads