e50a903db06f2df4f11f559516f36638aa494ded1aa49b27501ab6f7149ca915

Analysis

max time kernel
113s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 2.3MB
Sample260809-vd3q8asbpg
SHA256 e50a903db06f2df4f11f559516f36638aa494ded1aa49b27501ab6f7149ca915
MD5 4b0c7ddd04ad2627a2fd722eec902a4e
SHA1 51c2c59d69c7513ab848b49453a2121ca8b7bfb6
SHA512 f6549c776aaee6409b156a5d60403ff55325f8d728dd53fd3137d2914415ebdd8321f0f05125f8dd9815fd0e057513dad58a2ee591e93a73596627033f6595ef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCOapf3mnXoZ643mnXoZ6i6cMJlaj:A3k03kHRJP56rQ3k03kHRJP56rPpYq
TLSH
T1DBB55A16E6940FA5D06FC178C6929666EA733C451F2097CF1354AE293F33BD09A3A363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 9 IoCs

resource	yara_rule
behavioral2/memory/5904-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c526-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b301-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5904-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/672-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-272.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0027000000018947-446.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000900000001997e-598.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c526-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b301-11.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-272.dat	aspack_v212_v242
behavioral2/files/0x0027000000018947-446.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-444.dat	aspack_v212_v242
behavioral2/files/0x000900000001997e-598.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
672	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5904	2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
672	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_4b0c7ddd04ad2627a2fd722eec902a4e_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5904

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 2.3MB
SHA256 e50a903db06f2df4f11f559516f36638aa494ded1aa49b27501ab6f7149ca915
MD5 4b0c7ddd04ad2627a2fd722eec902a4e
SHA1 51c2c59d69c7513ab848b49453a2121ca8b7bfb6
SHA512 f6549c776aaee6409b156a5d60403ff55325f8d728dd53fd3137d2914415ebdd8321f0f05125f8dd9815fd0e057513dad58a2ee591e93a73596627033f6595ef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCOapf3mnXoZ643mnXoZ6i6cMJlaj:A3k03kHRJP56rQ3k03kHRJP56rPpYq
TLSH
T1DBB55A16E6940FA5D06FC178C6929666EA733C451F2097CF1354AE293F33BD09A3A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 2.9MB
SHA256 c6c6d9daebb20c20473562b0ab5fdd6181dd4e09832ed4c1c31110cdd9a27a65
MD5 00b2a856783081b7b08e1915ec9c406d
SHA1 cb5c2872eb2e0b677c0578594221c350a37c3588
SHA512 f81651f098bcc444ab5711fab94ffbd1ba37273968d4ddb1c6416c8823fa0e1af7bdfbaa1ecc9b827928ebdf8a711af200e8323f3b79ecb7104565c274a6e310
SSDEEP 49152:A3k03kHRJP56rQ3k03kHRJP56rPpYqjPji0Aj:A3k03kHRirQ3k03kHRirP6Gjo
TLSH
T193D55A16F6A44BA5D06BC078C5D29666EA733C410F3097CB1354EE293F27BD19A3A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 2.4MB
SHA256 c82a81bbddc038047fabf541792ad7a2332d40f52c0268206bad67ce932a01d4
MD5 1bd10035c4e83a40236a0300344ac803
SHA1 fe08bf32608bb90cc2953e4045362b2aa4e2acfe
SHA512 9cd40766fe1da74ad93cf900cf44e60b54a5e18544125df2008770a2b247a6cd56be8f2d1b204173cb6b4bfd3bd23feea5d1b778aa6fbcd660826191beb90e76
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCOapf3mnXoZ643mnXoZ6i6cMJlaM:A3k03kHRJP56rQ3k03kHRJP56rPpYqw
TLSH
T175B55A16E6940FA5D06FC178C6929666EA733C451F2097CF1354AE293F33BD09A3A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 2.4MB
SHA256 a43dfc841f795e019e19cc2702fd265d1adfea4090a747431f7cb3d4b06fe26d
MD5 9fa26005668e36c98261ed94ec1b2366
SHA1 f39cd91c406c9ea286a286ffee600b79dad754e2
SHA512 8d6afac8266e478cd9ba21d1d8b3df79cbe5427bcfb3dd81ff24fe67f207e53062620e8c2e822b38ac289203754f69df1273ba077a3748c0ce7860894d5f9f6b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCOapf3mnXoZ643mnXoZ6i6cMJlaC:A3k03kHRJP56rQ3k03kHRJP56rPpYqW
TLSH
T14DB55A16E6940FA5D06FC178C6929666EA733C451F2097CF1354AE293F33BD09A3A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe$

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$
Size 2.4MB
SHA256 d0a529764e5617d6f8ac5b7a39c64bce70be25f46c5382e7d1da07f46b11850a
MD5 1f0304aa003c9d3e835f3732a723dc3d
SHA1 d6a74d2896b69dcbe5a08cb7480e1a634770289f
SHA512 69cbc187cc41a3ea03914350ea3586acbd6bd96b230601edd044b0a3c0ee6fe5f0e8f2a3444ab41b9a73440ef9e1737c47c187347980dad187f7bbdbd70b1eeb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCOapf3mnXoZ643mnXoZ6i6cMJlaS:A3k03kHRJP56rQ3k03kHRJP56rPpYqW
TLSH
T11BB55A16E6940FA5D06FC178C6929666EA733C451F2097CF1354AE293F33BD09A3A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
Size 2.4MB
SHA256 1e564adb7a57d374fbddeaafa695ed6fb926eb9621c7841de06a3b1748d8e9f5
MD5 177cd3fe648cf68b48e562e1ab9ffedf
SHA1 09991d1ad5dec8158292065fdb490c533c95a893
SHA512 41bf4d9dd005c67deeb7c8865b499c6d99246f4cfa6f94e4499b48c7ba1c3508787b38c28866c68a03bff987a1ccc2b3b868bc914047dcc24d071c6807d0bf91
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCOapf3mnXoZ643mnXoZ6i6cMJlaR:A3k03kHRJP56rQ3k03kHRJP56rPpYqN
TLSH
T13BB55A16E6940FA5D06FC178C6929666EA733C451F2097CF1354AE293F33BD09A3A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/672-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5904-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5904-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads