6bcf9c65d521c58f7d1fc6949d0f54656629243b1bb60a4802df83b96674e8f0

Analysis

max time kernel
98s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 844KB
Sample260810-lsbrlswcnf
SHA256 6bcf9c65d521c58f7d1fc6949d0f54656629243b1bb60a4802df83b96674e8f0
MD5 ac15880798eeeaf1ac2a969b38bac890
SHA1 64875bbbeec5ffa7e54ec478c55f68350e64087e
SHA512 d6de0361405688a8e742d7bd69a69357db0a129250c3c08f845a504bfd056fe349e49322e55b494906bd08b99d331895f5a5698c1f98a8486d49df6c86ca49e8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQN:A3k03kB56rV
TLSH
T184056A13E6840FA4D10FC1749A968A62EA737C125F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5956-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5af-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5956-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5004-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-520.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-716.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1099.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1304.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1329.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1342.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c5af-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-520.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-716.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-911.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1043.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1062.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1099.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1136.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1167.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1175.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1183.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1304.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1329.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1342.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1373.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1380.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5004	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5956	2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5004	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_ac15880798eeeaf1ac2a969b38bac890_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5956

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 844KB
SHA256 6bcf9c65d521c58f7d1fc6949d0f54656629243b1bb60a4802df83b96674e8f0
MD5 ac15880798eeeaf1ac2a969b38bac890
SHA1 64875bbbeec5ffa7e54ec478c55f68350e64087e
SHA512 d6de0361405688a8e742d7bd69a69357db0a129250c3c08f845a504bfd056fe349e49322e55b494906bd08b99d331895f5a5698c1f98a8486d49df6c86ca49e8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQN:A3k03kB56rV
TLSH
T184056A13E6840FA4D10FC1749A968A62EA737C125F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 0d24f3484d7fd05cb6ce55f33fee7919a1ea508363886d83f31b59aa3047b0a7
MD5 ebcd41c0b9969db2841ba3024e0b6222
SHA1 e662c5e55069dda104a2b122a4365a9a56fcffba
SHA512 83ab7134beb096b432aef5652719532ffc73d0579e869162782248fa9988b6d9f3d1cb4e00364d2dd8ecfbcfe9ef551481a556dd90dc335c6d54afc0eec9ec54
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQZ0Le5ji0hmxNrM:A3k03kB56rRPji0Aj
TLSH
T148654A16F6A44B65D02BC078C5D29666EA733C421F3087CB1354EE283F67BD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 859KB
SHA256 56a962cbf87f9d81eb88290b15044ef69bfd16dade41b8a5bafc64e225b5b6ef
MD5 5d4d0b936e49b9dce32e5c5004997bfa
SHA1 c783eec6e3b221fab368e1a0b9e33b289453ed97
SHA512 ef71f385848641ab735db007b57655cc9cadce1ed8fecf80dd366353ee6784ade1bc9a6dffb313a7ef98bf0a03b060c39a2302a6d61b6403b338974cc85b4188
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQLa:A3k03kB56r
TLSH
T1F1156A13E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 868KB
SHA256 48195b51a86ed9dcd818484cb096a3973f42c4a47db4153da8043d2c9deb26ef
MD5 6df594a50f7a0ea93059c04c1e70d23e
SHA1 8331ece14f420e2221c14b47664162ec3d8a6226
SHA512 fae082f74854d8f367ab34bc241289905c186a3db09c28975dca0a04085ad18946d53964fd15a8001b2f0808a278ba2021e222012d069b7b9e862c8af25952da
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQK6:A3k03kB56rd
TLSH
T145156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 868KB
SHA256 7f16a6f29145efaea510784f99ac36a2e2c38e0f4f0bb8ecd183b0bfd6926c75
MD5 6bd59a16e2f309e0c79ecce9c71ea3ea
SHA1 75417d24ff3836618a73d4f6e16a49b08d9a364c
SHA512 b012d3a074cd339623577318b09c7952c04f83d4288307c5ab93e5338fe7553a5083d6dc0062570ebc12d81ce89cce2d8cc9ba5ac7accffe2407328bd6355940
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQiN:A3k03kB56r8
TLSH
T169156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 868KB
SHA256 d0334d1700fd764f3b9c033936e4e2e4d9af258f2882ecde93db89596e94b522
MD5 efbf93f931152cda0b8a929a8ed0fe74
SHA1 dfe6312121202791fd3afb1a9a802b21509c73e8
SHA512 7c71bab1eb10c19f490d53049d165a2d5bfda55509f535fc5bb4a805a4e4e05ccc13e8dda48158f1d441b8655645d616ad1e357907760123af444265fa0745d6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQYf:A3k03kB56r8
TLSH
T100156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 868KB
SHA256 6fc5f257bcb6b2d2f35ee0fffffba359f075976bb65b2eeae2e0b2d716415f6a
MD5 bd5c9377451a2ee6c961b2e3c84de5c8
SHA1 598c06645839c459cf31c26f2457663faf939d75
SHA512 a6ca04bc61e0d57d220bca45c69874c25a9fe18538ff67e971b8b4d2a7ec8fd35532aa1a78b93f45937ee9d1bc138b53e83983d5446d7269a010bbe89acea12d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQyo:A3k03kB56rx
TLSH
T16D156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 868KB
SHA256 78b10c810030ecc099d6eeee62ce004af1c78a701a7b9d059a5bf040cf0bfc2a
MD5 63302d95752c33adee7b1d10563f243b
SHA1 27b2e0c4911464354f28ee911d732653eaab254b
SHA512 1fc93b54c79a8032d4272070aa483d5257dc2e7370dc36059a6e4edf455f8b309802512a6dd4496d33a5b0a3cd6115e8d620f2c28bfb524df48b5451d9c8f362
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQmu:A3k03kB56rj
TLSH
T11A156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 868KB
SHA256 410130278229963c3c5d7ef2d448961aa1001f7346bd4a50d6774d69cf3f8c0c
MD5 2d603aa588a288ce2b8122434136da47
SHA1 882df2120e2e807ce932d0987cd7662e4a90dff1
SHA512 7efdfde6f6f65ec93bd47e1630650460d30674bd0259b86b8a4c39b5fe7591e47853d025734abc4f679f00ecf96664240c7462fdd424a4a0ec83662c3a2a3249
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQa9:A3k03kB56rC
TLSH
T143156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 868KB
SHA256 80faa96256f765ec05bafb56593e9eb8844feb48dc2c9ab52adbc566f3030e10
MD5 f22b36935ead21fd3062fc9a0afdae0a
SHA1 6de922d4bb798356a513e4d417da2c4330f5d8df
SHA512 8a878f2877c0e7f18b2043c4453f27817c6e3f67f849b5c6c8fcc5c0b91d6f8136b5aa32bd3ed0998c9b3f49bb06c9262e3d6f32f13e74bd84ac8fe006336aef
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQac:A3k03kB56rv
TLSH
T15C156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 868KB
SHA256 19cfb9721c735cc5c5ce1bf6e36c8eb60afe869dbf54d16f42fb0233137fdd55
MD5 f88949c222815fbf38a1424d5af58f95
SHA1 6bddeeb26bc400d101b8381792de38287ed31b80
SHA512 7839145514adf361da66506bd469462b8353fdb44685508518dbf7503007f316b9a431641cc87515c3b72f61a7eca975bb87279c30fc8c1a7c4ae9710ec1dd9b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQTp:A3k03kB56rl
TLSH
T1E7156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 868KB
SHA256 23e47d643e3e4e993aa55e3f44be43aef3dd823cc6112bda22ce2770991305b1
MD5 f25e96c7410af338bba4f54f4405efc5
SHA1 d260a3f3a0792cf81b2305967a47e8e516a4e606
SHA512 9f2f046b32d7342fb7c8bed0cb5702f42cc8e4733d9d105574f181f9c2fdf40220a23566d6c30279eb18cce89fd4b1cdacfff0cb6fad296d1c04a48c93bdcaf7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQ0N:A3k03kB56re
TLSH
T153156A13E6840FA4D10F81749A968662EA737C125F2097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 868KB
SHA256 5d11705badb974f80ddd9f033c9fec5469c536a2ca5a8480232d016bec3a53ca
MD5 cbc9d1ff5fa41958bfc393786193e282
SHA1 281f00a4f578c33d96175cc63c490d8ef943a19f
SHA512 a6e6a1771aa993439485df2f26ee6290cee0a3c2dfaa6194773ff1eff45b7b741b8b164f1e5551acbf3bc88ac4d96d4119fe3a261793e9b5171a1d15edfd5311
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQcF:A3k03kB56rc
TLSH
T19F156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 868KB
SHA256 313e05bf90373f9fbd23450b6d5e647f05bedaa69f9cbd0d9ee4af398aa78a25
MD5 cfa7e41092fceb9624bafcb709980d77
SHA1 517e07540014a76519ec32ce7a77fe7ed04b55dc
SHA512 33a7bb45cdb1cdb26a1c0b62c544cfa84a1c1c58e2c231d8f29a9005f054f71ffe28ae76f044388bb5b684f552dccfa8c0ff76f9c3ee727065685dbbf36f628c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQJC:A3k03kB56ro
TLSH
T130156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 868KB
SHA256 8cae31279cbd18a55bbab69ad5eaf4ee11db8fd3379b11860c65b3eaecba1354
MD5 113c02b8aad1bc103087d3fef2de8ee8
SHA1 dca82741f240179c44821cff0704c44fe85ef3fc
SHA512 f643f189d177705804f95de2f0be7538c2e2dd99509d0d9fe5f5b1cad23647b49dc3bb7a9645ecd62c182bfc835aa2a82aace9fa73364e53d7ce89935fff3e38
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQqw:A3k03kB56rF
TLSH
T1C6156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 868KB
SHA256 41566873311f2ae300b8da26db70bb19f1b6bee110b3a4c94fa2759b5a3b0381
MD5 062f76373a36669fcc8d81f3df1b05d6
SHA1 c8a027bda4ffe4d7a73e27b2af4acb01302a469b
SHA512 cf8995634c1c90b6731ee3bf3222b4df854cc17b6481e4d5440c5d20c45b9765c1c096bd6d59647e2732af4d644f268baa3bf95225cd2866237712b1624e8c2d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQxT:A3k03kB56r5
TLSH
T1A0156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 868KB
SHA256 800663045894e7f3fd7df4c6eb25598e55419a60becda8e073ad52d8717121da
MD5 3a38e69b8e350dccafdb91681dbc8176
SHA1 6acd34391493dcf7a3295a6328644a7c88c38056
SHA512 c227aaa7cc42a080dbac834276cdc8c408d1fd4a89b9ddf8e9bf4e0ad311c4943b081f1731bbabeaa5f6091f5738f92d5237cfef8f9720daf3eece637527785b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQfu:A3k03kB56r+
TLSH
T1E8156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 868KB
SHA256 f0272a6840ba311f4d2b7a9bdb0d5eddf298f65af66678ca235cc88b71fd3ca9
MD5 1b203e53583206efa4a9dd8190b28b69
SHA1 12a8482c5e82479357fad4f84aa043de3b0314d4
SHA512 772b9c127ba3ccd6820028eb5f3069e0201544461034e57c2896f1cffbd4aba7928007071560e96b23533b2a886224de4edd0389606fa6915457db68ef219181
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQDb:A3k03kB56r/
TLSH
T1E1156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 868KB
SHA256 cfe83b0fcbce870c37036e3489a6c30130366b3b5a54a623498614b7addf1c68
MD5 ec18ef625f2e9afa505c09a10768fb0a
SHA1 19aaec5646583683debd882bed1f853facf85db4
SHA512 3495d7881dd1ad423ab17cda0f2ca22c066329acd16b143bf4e4036f69bd7e8f91bf20049d07ef3dd6dfd764a1c5385ff37374b7a92d0879e55606904b8aa336
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQXf:A3k03kB56r3
TLSH
T1F8156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 868KB
SHA256 17ff0e3f11dfc8cb82628dca4b15e1a9357b3d11dee6b3412b259611f95f47f1
MD5 7c0202207b3f096218a84d93cdeb6225
SHA1 6d70c8bc288bc9ef4f82f81526057b286febb207
SHA512 478bf862e92588902979e283c24226d1378248889247d63796aa45cd6dfb126b8ca368b49ae35936362da24020b91e2f7a39c2b9e94967537d1176da5701c6d4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQgK:A3k03kB56r3
TLSH
T17C156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 868KB
SHA256 7d0c1144380c8bf81930049e5652fcb75633a4b1e81366d6790f89fbabe9546a
MD5 4f2676c709ff8b17c756fbd575762d1f
SHA1 7067eae9ad9f8c32a961bd777b5811a0daf9c85a
SHA512 e5367520026e346fbf31614c7d9e435fecfd98874bf11696590e7a47cff3786921a492649a47a3be3e22eac46c95a14ef91cbfb9fc7901016ce8fc1935d3ee18
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQdk:A3k03kB56rS
TLSH
T126156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 868KB
SHA256 294b7eb09b516f9e0c482e428cecaac48d4ee7305d389211f9a853a462ae73f7
MD5 6d3f9f03f030e3446a6ac86dec48df30
SHA1 9a16a75955f6a29a5fe70644dae316f5e4bca2dd
SHA512 5ea91e1ce38ea9da4a57487cc3f816f0cb29de222ec76cd08f3318cf84c5e1b61b7486b6beb1f5e5413f46a80e7b812d7679b5f42397730631a3f3b888d68b39
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQC0:A3k03kB56rX
TLSH
T17E156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 868KB
SHA256 4c7e7b6a89bfb9c6d12b19f26d03ae61dcf7f01381706f9a147187f67b669709
MD5 f303637f7ccf023df0fdae94fa9fcc79
SHA1 b861cad4ce165c6550e49c1f0b4ff26199139e3a
SHA512 d0b1524b897ad1bef7237353075d6031443d9af096d920acd061decdc480843c2b3c4e99979ac47970c229bd73569679c9ffa8645e846ced8856d7ebc3a5685c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQRg:A3k03kB56rq
TLSH
T1CA156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 868KB
SHA256 b8103e9e8e2d1c25277c915e30463403d2959ab7fc62d304fa91a8cd16d56bad
MD5 74f7154b10b4fa40bcca5b610e674dc9
SHA1 77f8e6ccf21f5f01fdd717a444cdcbb6161d6ee5
SHA512 0e03bfd4c95f89b199c21dc1ddf47160d7947fc00abf5416c86dad34992cbc828c5195ee406acfa4742203b69e8295c5099bb67bfc8ed7e7699b78e65e708a0a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQ4r:A3k03kB56r0
TLSH
T1C3156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 868KB
SHA256 55bb7f3642343fef4e1c506a2f88f9c76e7ff168d69be8a92b1eb8dc682dbce2
MD5 113c1b633e15b71cebef356c5b8d6ec9
SHA1 85d4aed8da1c6398a02f80e91c45a9cef240fd12
SHA512 5639e7361e8e6f4fabd4b978af0ab88288d2a4a59cb9637d2546a0b2a8d53381ee0d8df0c9f9e89fadccb5f50e97f2906897e19bac63ad80337adfc55ad0583a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQWn:A3k03kB56ru
TLSH
T11A156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 868KB
SHA256 ca19bfd7e755509d396754fb72a107928699bf1a4405b20371b69122e70dd59e
MD5 0b06d020b6766aa538ffe19b830634ea
SHA1 6b38731a3bb5866a262cc8b9c2544877c9e6a7a1
SHA512 691c708eb1d2d9c3a98ac54ef5bd1f6e7ab1eebf20a4af7726bc5fa2d59913a20408e62d89e5073465e64d9270b7aaec259a5015a7c711252ed05e8cfe8f9abc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQ8x:A3k03kB56r0
TLSH
T1FD156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 868KB
SHA256 604f905d860ae6206099edb57bbeaf7002162319d44b6e6b28a53b9f25847f2a
MD5 fb1f4ed3cedcbf22d626467f4983325c
SHA1 d51238d981a9ca310afdbab9473fe53d4b20a878
SHA512 f509e24d9bca4a21d79f5d85b17dff066df20d0e8f563c37fdeddebaf9b381cb809c4869f9efd12e0f079616ae7313cae1ed36ef4df05b2680ad91cc2636a6c2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQ2A:A3k03kB56rf
TLSH
T1DE156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 868KB
SHA256 407d75dbd95169e9c2bdf1a39236d791e34ff55a58082ecd5381845a9a711466
MD5 9f2d9397058487fd2bbf330e924f0888
SHA1 f461459d42c8951168873dbb1ac053aacb698964
SHA512 5fa7e972a3513378e086ff25cf8c0c8ee627cca53283d826448709a148ab38ba79abfa549cf49dcfc3a6ae368074749309caecccfae63cd560c4914ac260e501
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQv9Q:A3k03kB56ry
TLSH
T1CD156A13E6840FA4D10FC1749A968A62EA737C125F2097DF2354AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 868KB
SHA256 03bac91bf33adbe37325a6ff7c5e841625c958d968eef428dd4854b71ff5d4c3
MD5 b493b558895d6acaa03c371da1ce951f
SHA1 293683d30a77f020b8098b8b880b1a3487ff6e54
SHA512 177934b381cd8e9d9e3fb6fafa7ae94a2410af2ea3b25730a658ccea8cd9a281b366af50a497b057232ea9979d0be6aa393c23f0ead233df5db54242b4a60979
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQG4:A3k03kB56rB
TLSH
T14C156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 868KB
SHA256 936decd518b5bda7305c5b8d440f3107638a0a998cdf814685e2d751feb2e1e5
MD5 73e0876c8e2fc6b4207f4a361a1ad2aa
SHA1 def87f96f56b8351cfb232a25559ce7e3631edbf
SHA512 62f678ad26d6818207d05f89a68c7e8c757d5248ac0015359404b758b163bd88a5616bf74e6401e25075c91a8e90635736e9375689b2adf62e730d3aa5f7ebee
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQVu:A3k03kB56rc
TLSH
T18F156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 868KB
SHA256 7bf00ef40c4179e7f5cf86bcb2eb3b320bb7d739c3be9af770d6ecd39a9dfd8f
MD5 aeab5be2abefb62dc9e942de9f82efed
SHA1 f895266560f584bbce7e3cb73c018b0d613ece37
SHA512 d465ae8786e11af4a382f667309657288d95b127fc571d390bf5d50e4815f644507664903760a4c26f9d6da0dc0571acdc09776b78c025ef4175643aee62d1b3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQIj:A3k03kB56r+
TLSH
T1FB156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 868KB
SHA256 e702b8f615d305c5b6eed1d3b13ec965139e13efc8b688384b2c4b16c8d8ad26
MD5 f8f3f1eb8f2eaad03ea96965b6f0cece
SHA1 39ee8bd0558c5793c632f9aecd567a6da9cbc2c1
SHA512 4d7dd80cbd1fb956f4d244d86f366a950a79d4d1bda798ce18bf54885aaf68c57f66c1c43000c25eb4b771effae6805c3dfa47454b6c7b34c3504bdd74f62def
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQ5g:A3k03kB56ry
TLSH
T191156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 868KB
SHA256 834432fea124bb1a6c0cfd6ff751db78555a8e8ae69722f79f29d4c1737f2522
MD5 87ab2636e89d2abfe7ad599669be38dd
SHA1 7c1b0540d361f731291a8db81f3481a67814bc2b
SHA512 c9ce844f6e7f056ade1134ade9e06f1f41e96ca4f102a1c9261a22f2e7aae0ed919046eba8c438f1076f4cbaf3065d75e32cee3dc94bccc4815715815a5d8325
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQgI:A3k03kB56rD
TLSH
T10E156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 868KB
SHA256 b41c57dcf03ed1504e761ff142ae9af4cb855383450909a18843cd4c3338a58b
MD5 535739c5d4eb782825b3f22c74d08764
SHA1 d93b3c9c4d2639cf1eb4dd10f777b715cd4d3008
SHA512 15c07d561eed60f0779d5eff7be91923413f5a9273ce68b38ef409631ad01f9c4a92b2990f7b212e4c4c5701eaf78e6a96b8ae8007d03b5bd843bae07a83cbd2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQio:A3k03kB56rd
TLSH
T1EA156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 868KB
SHA256 5f2519fd16a7fcf399b158ef76182ab747ee6ad643e0ce1bb88a0f9b6e25a9cc
MD5 5d4907c34136a6be14d14f2bebea9dd3
SHA1 86f88a93178efd488de4e30f0f901b7040816541
SHA512 eeb4574ebaf893b2f26ebbe9f238f41f939e49443d9d7c744f567d4d785bbfde8a705fcb01317ead1e87be39b7cd0cd8d5b1ffe53b3e4ae79ffa59584a9f3f84
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQZ+:A3k03kB56rY
TLSH
T1A4156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 868KB
SHA256 07459970c12c3f69e5c34dab630207ad2c29dbd22a4aca0a62f7f710eb24bca4
MD5 6b9d5123fa26dfda38a7a0732dc84051
SHA1 bea51dc923564e50dadcfb0cbac1a39aa16e7622
SHA512 d9ddc47476072f887eca7e4234096396dda6880fba75c461b230cf6b67d7683ab8474b37d49bfe621b0751780e71e502e7b9205cfd306320a2750870e09aba96
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQHQ:A3k03kB56rY
TLSH
T103156A13E6840FA4D10FC1749A968A62EA737C125F2097DF2354AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 868KB
SHA256 e7da7c8d113784d868bbc672fe6ca1d77220cc4f1f3210ac5d79b4949758c8c5
MD5 f2101676c6fc0d97338584c98e40950e
SHA1 1a30ed77fafa2f974180f63cbb96e073e3eabd3e
SHA512 6b6c83fd97aa660c0515a944838ce3c88616d06c57424a30a90cf418ca61a3bb0e263885e430466d8d3ab9448aca7dccb5dc7bfe1df8b5eb5ef99e47cce7f95a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQcX:A3k03kB56ro
TLSH
T1E5156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 868KB
SHA256 60da2d094fe71a2bc7d8ee719b1161086cb5474aa822ac610518308bd0d24148
MD5 ded14fb3974cb9ec751bff498ae4dd6b
SHA1 45361f60f4811e47020b371d4623795f266c0338
SHA512 d0ae93d5cc82ab78783b23ef8cc337cb2f19db98b8520cad0d1fe000bf0cd68c594e60bff21aa941a647efd13cce9b24efcc39fd7cc21f1003bb5087a5c21af2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQaL:A3k03kB56r6
TLSH
T163156B13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 868KB
SHA256 7cb7e31b4be317167cda600cbafdf0486d0e37f52d069df80f6ab266100a3934
MD5 7dab088374bc3f2ec91ec1b69318415c
SHA1 92a0185dcfa1570aa5f3d283daf49740072a725d
SHA512 832c6716c0132e9026aa698a4aab861f4da539c3d1d6e91860ebf3ec00a9940ffd320e127eecf0544e1148eed3da9c7698760d7941770b032312db15f49327ac
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQ+M:A3k03kB56rX
TLSH
T164156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 868KB
SHA256 5e4978cae0688853bdc67854264555610a8d115d0c72c16ee05b67f2e741b0f5
MD5 fff421772dbc0ccf00e40c76f4792c52
SHA1 d7b3c22de520e018d8fc7718fb2c5560499175ef
SHA512 fa9237150f70fec069754208d3bd6b8a11003a63596ba7524d769a9bba6b5d4d01ad8302737c1e2dbd8ada48f079b365260f8f6a03ab09a51a32f37c013c982e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLQnh:A3k03kB56rJ
TLSH
T11F156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5004-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5956-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5956-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads