be729bbcb30fa89efe31569eb56ece1f7fb8e2d216b0605f8caea729c80dfac6

Analysis

max time kernel
96s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 948KB
Sample260809-x9k76avaqe
SHA256 be729bbcb30fa89efe31569eb56ece1f7fb8e2d216b0605f8caea729c80dfac6
MD5 b989d912d2ba52020eb6e10167845f3f
SHA1 80904d8147fe321475cf2626856527b1033f2070
SHA512 90e14d52bf752e6829a1c59aacbfe627743a224a74886fd416a9ef7ca17db13f4b450507a9e1fa4498d82a4e728795ac5265e1a2ade7c212e672d9f88f496724
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Qw:A3k03kHRJl
TLSH
T12725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4324-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5d0-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3716-9-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4324-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-42.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-443.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-498.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-589.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-620.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-705.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-874.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-987.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1061.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1122.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5d0-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-12.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-42.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-223.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-443.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-498.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-589.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-620.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-705.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-736.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-874.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-925.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-987.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1042.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1061.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1122.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1218.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1327.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1340.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3716	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4324	2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3716	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b989d912d2ba52020eb6e10167845f3f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4324

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 be729bbcb30fa89efe31569eb56ece1f7fb8e2d216b0605f8caea729c80dfac6
MD5 b989d912d2ba52020eb6e10167845f3f
SHA1 80904d8147fe321475cf2626856527b1033f2070
SHA512 90e14d52bf752e6829a1c59aacbfe627743a224a74886fd416a9ef7ca17db13f4b450507a9e1fa4498d82a4e728795ac5265e1a2ade7c212e672d9f88f496724
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Qw:A3k03kHRJl
TLSH
T12725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 91c865a30a64f0dc0c4bdbb771b322addc18c769632641be02d440ac9d37c81a
MD5 8e0c6604601eceebde7077bdd8697d3f
SHA1 0826bdcfb9f234cc5825cb9b5d4b15280a25075c
SHA512 8ef146e04b4c0ad5df85b9c98ff7b1e4cb6c9a586a6f511470d17f2a569e4b305925f9d55560f629c9e4066e760c9ac9ddc087361059416cb813efe4d7e9e9db
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QI0Le5ji0hmxNrM:A3k03kHRJhPji0Aj
TLSH
T187658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 963KB
SHA256 264e63f220cd406f398d0e8b76852e44d284f9b7d4b1718d3cef7d6a16e0d7f4
MD5 d1e483216c32232c2b8fa9780ee434e1
SHA1 6b95c51932648edf295e5450af91f0a63d65f12d
SHA512 3503df2f4abf47c3b2da631ab4129e3ef54b48dffc3586aa20ddfab45d4d2ba0b98572e5f69e22e6296e3821f47b563715c32ae29b8daf7561baba69c8da8dec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Qya:A3k03kHRJ
TLSH
T1F725AE13EB9504E9E10AC174AAD65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 972KB
SHA256 e99ad67bbc7f3ca478e59975815ccd24c0e9c0dddba3e59cc54868002f64d39d
MD5 3286b582a43166570ba7a2ba27a63aec
SHA1 200f2cfe0c46d1006ec3278603f87511ed743c98
SHA512 335bbb8cfc3ff8116cedbc545c409810497e389dfa371f791dff23c5a7b21a8988132fe326fbc782a11f44fa1f65e2afc8d929cc6c5ea9883aedb8cafd048283
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QD6:A3k03kHRJt
TLSH
T16425AF13EB9504E9E10AC174AAD54A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 972KB
SHA256 97477d6244d4ba03c9cc05f8fe6df168763649e1cd074b794b9c572818535b64
MD5 d8f08a5b2a3f5f5257d5e7eb591389b7
SHA1 b6889d97d97e69ed59a9da1498ea60b12a2d2b84
SHA512 5ff4d5fbcbf40ac7a8de9a18d88484fbd23dd04df3b5290dce0e36be3a05a98a829199bad01d364ccac5176d0615a69071fc99fd97c92e2e8dc37bdc8fe3eb56
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QtN:A3k03kHRJM
TLSH
T1E625AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 972KB
SHA256 7508b871a9f8d1b5844b7f8860e2a70dbaeb0be1b5052519b85e79a0dea97d05
MD5 2841efc1fcc91c52cacfa0cfc82ede5c
SHA1 05a6d1868127d835c53a5630207ec60cf9dddcd0
SHA512 cc0a282d946d4a907cd52310b86d7abfff2bf7021adecfcf8959799b49a995ef5b3778849a7ba10f232f26f6b86b6741583cddb5ecf5bb37972c3ca99c88a469
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Qbf:A3k03kHRJs
TLSH
T15025AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 972KB
SHA256 37bf49737c100473c8ba94ae1e79676f07c1eef5320d4cf1712db98db0929996
MD5 8a4fe3126e9c4105cf058eacb18fc01c
SHA1 29deee759c5435d20f77406d60a34da95ff78133
SHA512 90158f370c15117f9a82acb71b2d147bc422802b4d458fbc36908bc6c90405ba4497ece178e7b3b01c392c639f043bf287a17b0dcf85654a176da8974eacd8d2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QNo:A3k03kHRJh
TLSH
T1F925AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 972KB
SHA256 a61c5bda9c95fdbb80afb81582fa9267ee53cbba939dbf374ce8f382d54c6428
MD5 fbd89b795198fc16072d443d9a736fbf
SHA1 2384653fa4eceeaa2594e732abef884b92125b15
SHA512 25d0744b1832da228b585dd44358f4d99691237e88526d15afde4c174c0dc1ee78ad384c841e5f5a4c7dc32f0eb97a6c8122c52ada95bb35262fada6393eaa1a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QNu:A3k03kHRJz
TLSH
T1B025AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 972KB
SHA256 ee127333bb80396e0f9783417ee7e4e91123b8c3b6363f32f10f83e681045dbf
MD5 9cbf1a24fc31e174024dc9eeec6e61e9
SHA1 1439b17b6cb425f56b385a19428931925bc3fda1
SHA512 e0aba905c5c4343c0e4e13d6448f078a5a1a6ace19fce498e3dfa988c74d462ae085eff8a736707cfec2b3d8a6432340d3d555c7dc0dfeea8ac6061dbb998355
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Qj9:A3k03kHRJy
TLSH
T12925AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 972KB
SHA256 c5e721facbca440d329db49168dc117ae4cfc9f4b8ab837e6df8a9fee5c0eaf4
MD5 bf6cdd7b62513f826cd1ebb7936dfe5e
SHA1 7125994cd987783c4312275cf086876728dcd8e0
SHA512 d07111a26ccb0b067df320c1d410e00fed3bbb432748dfaaf9fd5a50a470e1dc3032ec3b00526f9a30233e0d4c99a9af5deba45bf99a59141e07d5f58159256a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QPc:A3k03kHRJf
TLSH
T18825AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 972KB
SHA256 88e815129a450ca33be3b39f15266a0a40b1349f0312921d4e0e79c21bcfd588
MD5 cf6344014d12630d88cb51c4b1f7c7c1
SHA1 3942a33d79657fc8c81b4b76c1ff85cbd8436b92
SHA512 b55f95247a326e4cf36007687020ffa1f469467cc21bd22fea36ab32b5eda5974cc686105e40561159a8205d7db63d329517ede255c3a968b1dcd93b175f2107
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QIp:A3k03kHRJ1
TLSH
T14925AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 972KB
SHA256 d8b444817b8043c9ae84c492ff2bd5c4aaf5e017e49b3e18bf34ad258982d9bc
MD5 eed1391ea0b9f285903ac7d3299e9a84
SHA1 7c89bfe00eb5445b805a9d954da66fdcea9c774a
SHA512 a76b0aee285cee9c5d00ae031dd6b150b2252f48bcbcbfb4b009112a6f9473079e549ba7bbf6621fa8b4c3aad126e83065b83d4cc325af36d330c69591acfdd9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QfN:A3k03kHRJO
TLSH
T12E25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 972KB
SHA256 a40016ccfbaacaf2afc20aee4072546cf9e02544c52b84b57c82351c36899c0b
MD5 b965feca3c31341d7d2235d1a4141810
SHA1 588b8f73b6ce8f30239019a69db27272e3e2ba21
SHA512 fda2169f70800bae4f6a7b2133d3714c4498aae2e3f81fc9e92238742165134396872d32dd7f485e30cec87a31e561a9d3e2b75458cb8230d65e6e4fcbbd470d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QdF:A3k03kHRJM
TLSH
T12625AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 972KB
SHA256 39eb4fc8488f3baca8a0bf301644c9dfdb993db0880624ebccd7ae253c7879af
MD5 c5627a5cffee60b27dba66d9cfc59392
SHA1 82b438af60bafc472365dfa0559a54f0583160a7
SHA512 541cf6938efaafa9acf58708c1c8093278c949b6543fb9dc309ec19350a0c072a3393e00e472d2f5366887a0d765a1b6cf30c92f1ddb0d56a461f7a2979ba1d7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QuC:A3k03kHRJY
TLSH
T19E25AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 972KB
SHA256 a525ca09ce378b9e01ef6eda99b80991f4e549c65bc0cfbc745f8d3dc6a26d7e
MD5 f6faba6931a835a01432a2ba223c8043
SHA1 cb5f96beb4fb909aff932f7036b5d64c58075fb3
SHA512 924ae1db24f4ee80a9b63c625bf795ac3c5ef792963b4b9f5134cada6949be24d8cc72afc3c26cc5aadcb9e27595f24f0739b970894c84747bd0b81c396fe0e4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Qxw:A3k03kHRJ1
TLSH
T1EE25AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 972KB
SHA256 712e3c11aa92828ca0e7b82ec97ef8141c452905189ba4f70536124900c8617f
MD5 27117653230b303f98671c2f3cbff115
SHA1 09bfe505a6d5fcd18a55394c6f2e46c70be1ae89
SHA512 fdd1aa7620c96da15e5d06de433c2c202fbdc299cc34b08cec6ba17bd33fdbb4e3fd095722e119e9dbe02dda4a43be48a2e8a22ee04abb795b2be36046a1e928
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QYT:A3k03kHRJp
TLSH
T1E625AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 972KB
SHA256 3f56c82b85f45095ad55213f83c9d9907a1351d813d5b0403afc588e7150335f
MD5 496d3b6de3d802690f591a2f61061334
SHA1 488af246fa9f245ed13a3006a4b71c355f89c8b2
SHA512 633fa6fbd27ed0b39fe07a1c4c8bfc7b3f2c62491eb61ce78e31569ea8c7c3d943265f712b14837b2f757a9731a31d43924807634d194b86aa3139590cb5269c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Q0u:A3k03kHRJu
TLSH
T17525AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 972KB
SHA256 337cbe1063768e7a8c13297cfb0a08c38aee8e670e29609e3400219d7324edba
MD5 35e70c302826e66eb482496491feb6be
SHA1 9682344d3fcfbe16fef1fec67fa3926cdc39a5fb
SHA512 d7c6645286caa8e44f91379bd9cde673c6b1cad0188def38d48af607ed752e49c83f9cf5ddff9505f79ceb84b69cf57776f9c2b3c53f03aeb8d3d283258fda60
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Qib:A3k03kHRJv
TLSH
T14E25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 972KB
SHA256 3f1f919281d416e8eef6b36e9711d2463f4dda4b3f5f85bbfe9434f371d6bfb3
MD5 46d72313e4aee04db8e9a79bb639eaed
SHA1 0389467674352186a69bd858ca4447d207b031a6
SHA512 05d534a49c5253f32176558fca42d67e41947e33e033ce33383b59a5e89a7776bcc3a4c88c947de13b56d9ef7e63289eb37819bc066b9fad1459805b05e94d24
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Qkf:A3k03kHRJn
TLSH
T11E25AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 972KB
SHA256 22693d4969f90540b8d809cd566da56685dde9cf8a18dc8df2b082cf47a6994d
MD5 b80011f5a53fb60717a697ae5cba1a89
SHA1 8a4713de4c0033ecb62554ceab8bbc2cee8b4349
SHA512 e22809b0e76167d9737f2b68dedaa851653e00687d77366a1b7b3e723eee7b8d237d5b11003438f75f7388d9896dd0d15b6c470bd94096b3d02bb382e959bfbd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QBK:A3k03kHRJn
TLSH
T1A125AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 972KB
SHA256 5087abe401c02c9b12ffc4c31a6241d0456372ceb6b872d29ed6ddb13c67cf83
MD5 ab2bfefccf2e53e36a63ef46875921b0
SHA1 f9cc11505d77679f38deb7ddb94db1c1c7e40faf
SHA512 c4b4b004bd839e6c7eb6a91c68e3da657c186e0b1d4218a4e735831fd945dcc8e7b9b363379c2ccedb77548f71158623c31e796c122421b17764f832aed2aa63
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Q6k:A3k03kHRJC
TLSH
T17925AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 972KB
SHA256 3c9c7a316126cf0f8b0ad8e87ee9d63ef6f10475ed2e2cc9d6b65dffefe35d60
MD5 861623ec5fbd1c3c485e054420bdcfe3
SHA1 baa10e12bff83707bd1188a193dda8e4e26ef605
SHA512 6e8ea74eb4d271d217f17f178e727e95ca736ab81350bea5ec4b95594727753e041d9cdc2c00e981c4a9f19a64bd61e4a1538cad3b3f43d611c4aabc8de727f9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Qf0:A3k03kHRJn
TLSH
T16425AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 972KB
SHA256 96f84f8d7cc9e4d53864747a8ded22386666ca5801fc70f550db59e634d494f6
MD5 182b95505174aae5331109dd15a9a999
SHA1 d900c2849d752ea8a6e3e54adfe27abaf7f2f699
SHA512 ab25924fc618c83f64f73610d08f58de48287376c53f98c28e7951fa57728646bcafb568d5d3f7c324bb0769808062a61a1b6ffb9d36ca644492298b4b081480
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Qug:A3k03kHRJa
TLSH
T16F25AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 972KB
SHA256 39e984d3ca5b5441290632e7d0f5ff918d87aa2557488cc33000ab860a0d7600
MD5 805fd03e8bc6a09002aa9c54322e287a
SHA1 3c136d1d47a5297746627127644c5b006e86078d
SHA512 41c544d170b3f45b607b4758cf7b400ef547c424848dfe84be543b10a87ea89a03e9b1a3ba3a81a8219ebd83697474591eac398b8b159c9e970eb48c87d459db
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Q3r:A3k03kHRJk
TLSH
T10025AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 972KB
SHA256 368021f0d2c54fcc556afa3076e9d7d182c67dd654f2183c9c66645baf6061cd
MD5 2060ee6328f1d1aa95ab2e000e8be99d
SHA1 e8bfb05745a721455585e91ce03c65641e72d645
SHA512 e97976050d04be5fd378e5a26bb34d341978aa489343a0025dc6fd4e673f0b15cb304152ed031c3dac8047f0b640716370d175621634ec46d2b2431c6d29c8f9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QBn:A3k03kHRJ+
TLSH
T17925AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 972KB
SHA256 835d6d69862b5e2a4b071568525c91b8811c2819fc9e117030ea7be5eff023f4
MD5 6d06d8946da1c4f63d0ade29d253b731
SHA1 7611d6c8dd18a48ccc87d54a04a7baec6b89a3e2
SHA512 13e1938d42f4947a48296c7b46fbafb5bed6ea3ea26563dd16397b72ee0a9e490dcca5e37b21f38589282ccd095f2d490436039cdd3187bfe9927e20bb308181
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Qtx:A3k03kHRJk
TLSH
T13A25AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 972KB
SHA256 9457e248f6a89fb20ab23faaab71299dabee0feb25efb5ee3b165b232545a994
MD5 c5bb41c9b376857bd6e3053b757f1e36
SHA1 a323609d6158c8c4abda354bcb17f6ceca1bc045
SHA512 a888f2264dba008a0f538816b9363dd6137c7d7c03a06029a5e8138250d32f532d8379dc1f4c04d64a2de78d6431e2a7776f87151d3e61f6e4988c8c38c462c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QzA:A3k03kHRJP
TLSH
T16525AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 972KB
SHA256 a23b26049628a56acc0dfc4270f46d386ed4eb4910591efc8bba6453b5f9b936
MD5 ada7354c51cdd962ecb995e526397e75
SHA1 8b256047d9242ed6a11004999fc286eee4f5b079
SHA512 e3d980ab160f99af6d4a9abef78bf16b1d081a0111b0f7c13eee6522a944fbd30d59fed128295d33baf091ce61de22f87d0c9034e3185d39b1fab4b6c4696657
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QE9Q:A3k03kHRJC
TLSH
T1AA25AE13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 972KB
SHA256 f87d2aebbda1ecb7c4ddd053e2a7aecc30054db5447f78b34113ea0b4c9b64fa
MD5 2f9cd2f7dff9c93215ed5e8397af9945
SHA1 ce4413f743cda43e515e35f43d191c75683d12b5
SHA512 6b1f0167ea2ff2dab0c23c9e9ffd9e22652c8a3e6a9a8f910a4af7185aceca11463b409d5400f06533d8cc20e7ec038bcdcd31c72a53a66ad197d348a11840b4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Qd4:A3k03kHRJx
TLSH
T1C625AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 972KB
SHA256 cbbf312bf3b646ff9ff7d3c04a504574ccbff441934ead3fd0aa39a43e5244d4
MD5 7ea02d0ea51e34403681ef041b30f3fb
SHA1 55097ecc50980c00f7b3336cc9934ac81d8a55eb
SHA512 b84f2f6b5f892e29b9bbd74820c85466a35a0227a192398f3029bd5fae86b964618ce76791242ce289ac2553fc5de5a53641ee90b883c0945f530ef5b5d4701e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65Q4u:A3k03kHRJM
TLSH
T1A625AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 972KB
SHA256 3861197e3ff5ab94320a8f338dbcf306c455c02310e140406f066cf93290b061
MD5 d42719cc7bc55e56619d528fb2aa4234
SHA1 b912bb3c6c9e92537d1f1a4fca2f7ef213afbc91
SHA512 79b4466b8d7a2dadc923c3baa602dec37a0e9020fa7b5240717ce3a46e827ad4c954a8cdc7dbb13e3aff8b0bd503b134c262fc0c5021498c639f15109c0b8137
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QZj:A3k03kHRJO
TLSH
T1AD25AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 972KB
SHA256 4f7b500600a6de5c93e26ea09579340da5f824198852523791c5ddb44be6b11e
MD5 80dcd27fa2a410dd17e99c95bf07997d
SHA1 c717a38d8bc15abf281c42265c8866d1ecc44c18
SHA512 42b1c6a47b3a134bd4879292dfc779f765d943b675231f36bc85ca1ea006516eeef82c0d4a498b91fc4652b696b3be53f9d974760b0a275c3ecab4d797a4888e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QAg:A3k03kHRJC
TLSH
T1AF25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 972KB
SHA256 493d0070c1630f9c37588ede1a2003fdc3754e77e2a4e3bb1aff1ac9dad5e5b2
MD5 180514988103a6a49e39f26a53c10580
SHA1 8c1f1ab4cd02af8750e7fac99c2561221fe28d04
SHA512 cf000643406a93a4ad8c389ce9fadff03108fb3f65dc8bbc86e57c64865b3b710a93282276c1128f8ac49794d5ed433c160e1fec8039a6f86aa8796be654237a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QvI:A3k03kHRJz
TLSH
T17F25AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 972KB
SHA256 4d652ea3ee45fab256b81f62ff747f636bdb12207ac1b776337783f6549f5b0b
MD5 49f6222a7c0c2853ccd79befa2e296b6
SHA1 751ee752226f688ac6c1eff730fd116c3fdb33c0
SHA512 b438fdfef02e335ccbeb5eb0deb12ec665b108fb738813adbd452deb2eaf412f3bd5ac3485d0c9cdb42938139ed072225d76aec86e38003880fd3ac4c292c6ee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QVo:A3k03kHRJN
TLSH
T10125AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 972KB
SHA256 e5ea62afdc2c836fdef644745d50deb2df0e5d5e4e30e52097dd5c8834949d59
MD5 119e9fb782220049d875db36fdfc2226
SHA1 76f0e6d817d5867ffc7a053f5546652d71869e8b
SHA512 848c9a5adf92ccc50e6cd1c017ad78d67abb0c97b8db94d1527a0833a02e7ae17a03988b2b440105e2cd245767cd276947e1e84dd6ef601cc9b4d92c608d79a8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QG+:A3k03kHRJo
TLSH
T1CB25AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 972KB
SHA256 30ffd03533cc9cb6a2732e388c2680149305fd81eb28c4591ad1d9ad95d05158
MD5 2db2b2efa0f813dbc0d28888fb804b73
SHA1 c9df8f5e74cebca27bb312691c67fa3611b4dc78
SHA512 8ce8e604c0d962e338c60798e73224ae3a9acfe2d43fcc5c910fb2acedfe3713f1f94840709bbe8956199ff9a5805a64b172ac1fd13ea2736900404daec787d2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QGQ:A3k03kHRJo
TLSH
T14725AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 972KB
SHA256 53632452e8a2f4b2c6490a715ca9428667f335b10d7c1b9e25171743a25eaf9e
MD5 81cc2a1f183d7f3a194b3ca9a6d2905b
SHA1 767b6c9f69ed62efe7a18d1e8c64993b89bd0a5a
SHA512 178fbde5450398cf35960ff8a40a0d65cea260ca46d9a1b2ec45e3eaeae08bed86d4ea389d947e8e5a7c5e2d5d6f4988d10f4bca9c196ca56febe0c86519a508
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QXX:A3k03kHRJY
TLSH
T15F25AE13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 972KB
SHA256 aaa0ba03651d9797078d6d6673c32e08ed9c510abbc91c0f77acab94c7134d49
MD5 5d90a3c1d127866a541a7c65a09f0dcc
SHA1 861a1eadb098269510e1a126bbebd83799d60d9b
SHA512 73f905c73b6a4b18a4335bf35dae367d788ee4fd97b620d5829fe92fec8def6037821d0d82c26456316a5b3bb8fcb678cf430ac35d1cc0a662190b04ffc89151
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QNL:A3k03kHRJq
TLSH
T1B225AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 972KB
SHA256 8c814c0f9edd29f6fbd6108bd3e8c258ec8ab2983c074899602fc7c070886d7a
MD5 49f0db4405db4f1bed5580bcd52654d8
SHA1 5b5bef84374fbb535c3f4f63aa15ea2992bd4319
SHA512 9dbde774c706a9ee2cf1e51b969bbd40feab39ba1f89af875125081be84ac43afbb40750bcf4c54e743ad453227792afea99fa9d66107aa6d802dd15d9d54b85
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QLM:A3k03kHRJn
TLSH
T10B25AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 972KB
SHA256 ea5162aea6b0bc891f05f21af34f1e731c6c4236d753b1d1e17f77beb5283cea
MD5 e61c052b61007a3f94347cf2d1b4b760
SHA1 f5dfba3fa8863e7c0dffcb81c1c408f6b29f2043
SHA512 bd4bc974731a6c515208f091ea38ce2817e2e801b6cb9a9c715294c2b0eb7f33853748d72b033f07e3fa629b0f60540750768b225112b366631aaa3a2340601e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtz65QMh:A3k03kHRJZ
TLSH
T14225AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3716-9-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4324-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4324-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads