9a9cef737ec678553aea6dc6d8af94e1a499b9b3410e9228eeb71022015e00f1

Analysis

max time kernel
112s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 11:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 901KB
Sample260810-njp9raxdrf
SHA256 9a9cef737ec678553aea6dc6d8af94e1a499b9b3410e9228eeb71022015e00f1
MD5 f07286c20f670a74420fc776b0e230f8
SHA1 bf128f8b4fc67162f48d7b8ff3e3ab5f4f0c1a95
SHA512 47eed5e9f00d58133979a06cb954ec4ac44b25984e96415af9bb5cd24eef5c535599f5e96bae906f722fb661bf5ddb3b711ce9c65deaba0c3ec52908fbd362ae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacu:A3k03kHRJ0
TLSH
T14915AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/3896-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5bc-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-9.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3896-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4344-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c89-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-265.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-446.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-580.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-648.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-734.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-766.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-803.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1010.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1054.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1085.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1153.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1405.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5bc-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-9.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c89-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-265.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-446.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-495.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-580.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-623.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-648.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-734.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-766.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-803.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-846.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-877.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1010.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1054.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1085.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1153.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1185.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1325.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1344.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1370.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1378.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1405.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4344	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3896	2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4344	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_f07286c20f670a74420fc776b0e230f8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3896

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 901KB
SHA256 9a9cef737ec678553aea6dc6d8af94e1a499b9b3410e9228eeb71022015e00f1
MD5 f07286c20f670a74420fc776b0e230f8
SHA1 bf128f8b4fc67162f48d7b8ff3e3ab5f4f0c1a95
SHA512 47eed5e9f00d58133979a06cb954ec4ac44b25984e96415af9bb5cd24eef5c535599f5e96bae906f722fb661bf5ddb3b711ce9c65deaba0c3ec52908fbd362ae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacu:A3k03kHRJ0
TLSH
T14915AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 8f63e587862611c31b95da1cfae09034bb160982722f52f7e9ae813f4e282e8c
MD5 9143bdde53c4f55f5c5e4fa82d8a997e
SHA1 30475867dc03750e38f7e2a948b141836fc72579
SHA512 546c89131c4e03caf95daa56336a3b1f96045c335e14e424ae0d313cdb49255c85944ab0d6af9caa386a9f492452c53610e811f79d40a890601cf2c991329529
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbace0Le5ji0hmxNrM:A3k03kHRJsPji0Aj
TLSH
T111658C17F6A402B5D027C0B9C5D6966AFA7138821B3086CF1359C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 915KB
SHA256 b035333282eec0d8a7784644c11a8701206c1a0d5904579faf3ef50e4e341f4b
MD5 ad8e7ed3007dbf73bf6795ee44297cf5
SHA1 2f741b1abd2f22703372e7bf71cf12f6936e54f9
SHA512 09bae71a63268b5e55e0db2ee3894aef60fba8f9dc9d3aa5aa318e8a67640e76086305b0597d5613f5eccd0f94abe0846865431b47cb1290118116585b920d42
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacYa:A3k03kHRJ
TLSH
T13B15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 948KB
SHA256 24f8bf757e2366e4ff4b2a9058a15a54a73079e25f3e1c1773b0fbff92b16089
MD5 6f3e0d26718c96c0ade416d4be56f527
SHA1 ce786fe9beb5251c3e6466f239eece01f2bbcf29
SHA512 fd16d5c6cd9c5b89ed697a9d686e1387357cbaacc535fedbe1e80d1db44ca5051adc13f874a5d9a3061b9c4dd53b5e7973e7c595d6bdff5fc966892102b83ef7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacTb:A3k03kHRJ1b
TLSH
T1C425AE13EB9400E9D10AC174AAE58623FB75BD56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 924KB
SHA256 02080de9f7c0ff355e07d72c91a3d49ccb121e76bf8e87b9232bbc7a43d4c1bb
MD5 ad280bdecf71e6e44c9d0887e139ccef
SHA1 3be201ea5c60f2261ff2e2b03e2d8944de12ba22
SHA512 861e44af525263a0fa2b89af55101d8825afae06283e7982d056b60372ca889e157f4c09229bcbfba1808be758190c238c0fb2b323732d08b2d51f1044fcf823
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacx6:A3k03kHRJa
TLSH
T16A15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 924KB
SHA256 d37f384dabb57e88c191bcd0ae90977f22c2136800ccb8f5b3727cf1d07dd474
MD5 de71839c4cec26fedcac54f7d18fbea4
SHA1 700fa64f6e1f788e051bc763da4c46f3f9af2251
SHA512 94503f0b62f9320d1bb7c2e2646df4af5a2ff15c08a87d858d19547b1a86014066020bb8aa0168119de34a695e866100e4cf20234a2c8a562d3c2e141761c9a6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacvN:A3k03kHRJT
TLSH
T17615AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 924KB
SHA256 f7780b7d319e398899885e1586aaff32be76cda4d7792f40d08dd87bd5e9b478
MD5 77b32ed0cda1299b5750b7a83f3dea57
SHA1 20d4b5bbae18ef422bfc07901a51503059f6468b
SHA512 48c761aad57369c0310a10083183f5408e3da287d8e315229270c9b3c72ee7c253f8b63a1ba44cc5c5b163c2284bc448da20d601d17001f0bb82c047cf4b3b4e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacVf:A3k03kHRJ3
TLSH
T15915AE13EB9500E9D10AC1749AE69A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 924KB
SHA256 561448587ab60074b8571baf98a3c9a91f5c2aeb39c21118105c3e261bff9c4e
MD5 beb0090e25471e964fa21250726bc890
SHA1 4993cd6ebd15b74035b11dca10c7cb4d5dea9058
SHA512 cec993915d9f7e0ba50d6810d8b80c1768b33b0d4a67ec9418c6570a49d1c2eb49cb3d9eac203201367af62a4afbf5495778678c15f522bf31feb2685c99de07
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacXo:A3k03kHRJu
TLSH
T1C815AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 924KB
SHA256 99f6eecac25579f0925e70531b7cb53627a2066e04aee755e98294d22beba230
MD5 48653fc576fba2235559e95935c88aa1
SHA1 ef78984530d70ab6eadf86a65651fb60d367bd3e
SHA512 4018d6294109a2d6f0072cce0a366dd8868662ed8a90393639a69c1440d9344355ae527badfb4eb196865ddb654f4013c541550bdc9bfcd4d4d4281a2c8d24d6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacbu:A3k03kHRJI
TLSH
T15315AE13EB9500E9D10AC1749AE69A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 924KB
SHA256 cb6bea907b240050f79c699658916f2535224fb7280073430818297bf9cd6900
MD5 37be6c21a3b0dfe13931c91cbc0beae5
SHA1 549b22e6f733245ae8f14ca7bbd7bfcf2d038412
SHA512 e9c3de398dfe5ca1e0ddc574ee77fabca73c4ee1272d4df0eb4bc3825747d5f02a42200cd87acd60464337a183335761e70fe5b56a827ce71b6054f1a6a15c06
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacJ9:A3k03kHRJd
TLSH
T15D15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 924KB
SHA256 2f3ee55ba35d40331ec1c275d7e69f3a3f8763b0bbd7c10bde8ef0fd98646a17
MD5 3085f863f0a7e3161e847e580e827219
SHA1 0cb3bc5bb69c91e55bf8e905796d7a8e93f49210
SHA512 1e793ce88b76f0670f5299d1757c06808eeeb2dcd4af8edaffc8ad92d3a3d3f7383b1c4d27ec30e3139b7dfbe3bd87501a25d0dc786bcb50301eeecd3c6391ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaclc:A3k03kHRJI
TLSH
T1EA15AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 924KB
SHA256 ef87ab6e3e40d353f83f94106f4cd61ca59e49af7c83028866abd6f067a8d2ef
MD5 57be42b7b61368c59e48d6c14e394c43
SHA1 6fe0475b9b96148a011068978dbe1648a864a019
SHA512 e3fe533dcf7122578980574b62244e1044e9cc3492a0ab6aa6d643d9f3933df58a078a1069f58d9363170e5fd4a3ea5b6a30e0c8225df71f3d72a1e38d37d743
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacep:A3k03kHRJe
TLSH
T10515AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 924KB
SHA256 49596f10fe044ff3b3ecf66a61d26d17c43ca8932cc48581239f7115ae563dcc
MD5 691a353e91f640432fb629f5704df60e
SHA1 73295e5fe55ad5fcaebd3d4b5c1d38a76294904e
SHA512 c97f142d66f80d2ebdcac55c0c7448dc9869e5fbd765a6a5c85f5ca2018ee501a991ed4ea122010642a18036b630ace21c181053b13600823c65f2f5b7df2623
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacRN:A3k03kHRJR
TLSH
T1DF15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 924KB
SHA256 f6374bd6ee98e1acfd1a77c8db54d05df07a95d6ab05bb5c0d03736348892ee3
MD5 851922838a131b4a5f2031e66d5fcd2d
SHA1 0ef6804026cb9e379a9fc7cbbc3b3a354ef3afd2
SHA512 0ad060f561903ec9ef6a7113badf5e25fd9ec219372a62f8c154a50dec847aff686ec6bc439c97294d335a1d398bea323622ca812711214d737274307b1b605f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaczF:A3k03kHRJj
TLSH
T11615AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 924KB
SHA256 d57c69fdab679f855b9cbe97c60cbb8c117f71ae4bb82c9b3bc02625ca53ed6d
MD5 24b820ae0ccc53642c33fae52ae59318
SHA1 a51ab479d6f664751526ea2aaa2c8bd3a6eb3cec
SHA512 ed74180225c611e5fb110218deeb5fb0adeb3570c36435d322f81265947d5157531cdc511e0ad1076460208b08495c7b162992e5ca4c9e05df297f5b224e93f4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaccC:A3k03kHRJf
TLSH
T17515AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 924KB
SHA256 ddc610a034095b74f94d5258de97a41719bbdf3f2da1435c5b9167c2f87b0bc2
MD5 040e4ac65a19e54da62c44b899ab94b3
SHA1 aeeff6ddb3ff769f59dfa6a1a3bc0756c453a2f6
SHA512 c89e6afc687d7dedd6e7cd25da05e6b09b158f405b085b242ff9fb1d6152f4423803a3887bfa5e5a12462144a396d17c9900de3d25bf7dca038a338f5c22c6eb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbac3w:A3k03kHRJ6
TLSH
T10415AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 924KB
SHA256 eee6fe584351cd65b9bb11d2de418615c595fe6d3672abbe3cf07d93f631d845
MD5 a93e3f273f024d883b90832dc4549fb5
SHA1 c8b310040a2a17fa8099b4a1266aac25607c451c
SHA512 ba406c9368e38427e80d7c1634372bc80a18d8e8335bb2b107b9061cd73276db86984e02ded19a12e0dfc67995bb461580fedee2e9d1b65a30ae3468106e1075
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacmT:A3k03kHRJq
TLSH
T14515AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 924KB
SHA256 5b6ef3dee613b49b5b73d509c0263393187c7322937f635d6a9e83e4b548e24f
MD5 6f0821fdc0e9e7b848273605c9bfe6ad
SHA1 f24502048e550a36615559c6b28a6b44c062624f
SHA512 03dabfc86428a94f844758aac95266c53e0bb2960e7ce48d236a66832752e9a3eaa5439bb03102645390f72065754d5ea1dbd02dbc37a5d0a4e2d33ca273212e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaceu:A3k03kHRJl
TLSH
T11915AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 924KB
SHA256 181ed153db95a766f191e2e366413f6ebd54eb10fa9f6c8f05338058a358bbee
MD5 44a6eeb263b46fa3f65ad9276507066e
SHA1 7b0dc9a9b01915c06bbd63c68eba94cdba791f3b
SHA512 0c40cc16bc8d9849be9ea44165e86899ce2322e8ad9a51f1fdb73d40b3a8231a530d99a188fc562d63a603805fe255ab59320702dd717b17fcd3d6e9d4f01f0d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacYb:A3k03kHRJE
TLSH
T15115AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 924KB
SHA256 5e5e3cef4423c7a8d1de48e04f946588913b14edae7d2ede0683e56b461cf0e8
MD5 bf8a3aae1dc362992e32a0de2f344f1b
SHA1 c863fab3bf857b0f5bdbb399ad71604dc5529a31
SHA512 b4074fd0b1aabfa93e63fbd1a094d48ea385b871f76c19f7e6ff3c62c8656fa654e97942cf075fbc125dfd3e541daeec7d0ccd007ce8b403168285114044274a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacGf:A3k03kHRJU
TLSH
T12C15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 924KB
SHA256 f7d3ba2a70054df1d5740c370e9cda97a850cee4a45067fddc98e9df5dc64795
MD5 2133284a35617444b2976c39944234e7
SHA1 a6a421785c8ba4f82b9ebf6e7459692dd1fcf1d8
SHA512 c93889520a4b4fb351795474d3de553a5cf8e430b872b7a810ea4b4f24ce28dd92fcc8bead4ea3b5315bc71bd0b493ad3cdaf250a11a4fed269682e5b4b03def
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacDK:A3k03kHRJE
TLSH
T18415AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 924KB
SHA256 85d73fd7aaefef26a0d14c24f4d971aa5f475ca6fff534b7df637b9d07d877a7
MD5 6d2f50453f2613f0da8cf9a9641dd99e
SHA1 847746f31477e41cfb921d1b9ce6ed80a438c618
SHA512 8fef9c18f478f34a45a91af95ee2ef3157bb301638cbb2af13a73d15cac9773d5b82d29a034201483eacb65dfd888c6ac14e17be8b35cef738de80c5e60d7da5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbackk:A3k03kHRJd
TLSH
T1BA15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 924KB
SHA256 d2a8987203e15b47e387189060aec8ccaf866cccaa937733d86e283047dfc91a
MD5 9524dd7934ce2410e321642de11157fd
SHA1 4bc8eefc95e44de43ee3cdd07df857245c55a539
SHA512 9ed7d637475afd4bae677643a75dbd39ec883301b9c860d6905dfa6babba711c98e7655aa4083f9bb2bcd59a2dfb1a27b9015055de780405da35e3be2df820f7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbact0:A3k03kHRJg
TLSH
T18015AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 924KB
SHA256 e39dd82735c0c87e91bd942de4a2367e2c3bebfabad545992cd97ae3f3ad0fe1
MD5 d5210cb2a802a5f3a0138d6a1dacd76e
SHA1 67c82e3665577cdf766df3560f3a7e9aecddc2c9
SHA512 c5663448a64916af908a49c670ec2ea1574288d82d2050fe003bd4d17f68f96550cf0490261d166a5e3e7861ebb57a2c83e4828f8cd0e5bcad8f6061c0daec4b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacwg:A3k03kHRJV
TLSH
T1D115AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 924KB
SHA256 71126ae8a8c7350f167cace7d4812836d3f1dd14f21e63262a8844f4aa149d80
MD5 be9c08ed8cddfd0bb1db4580866682a0
SHA1 314c5cbf30a1f5f74fcb35eed6ab156403fa495b
SHA512 3d84f576cdef10b12423e5fd803fcaf8e6b64f212d1cf5f4997dc575ecc267f9179bfd04fa3c8a90722312f110e1b327323407ca8414e2ff2d7e5c168bdb2292
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacFr:A3k03kHRJX
TLSH
T1BD15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 924KB
SHA256 58658447dae0f4350d0f7ba1c1b6da06e4c3c937980f0bd240628a001e7d15ff
MD5 ddfa945bc019e00169fc86f367d840bb
SHA1 b693fe724169e22dbd5a109771069fd32e898bdb
SHA512 7ef3a5fbe6783d6be88984902df7391b8781053de2c6fb25f17c45e7f840d4f46c5bb22291614cc160035d381cab99a2cc23da9e4e920cb765dde8a8e891e203
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacPn:A3k03kHRJh
TLSH
T1ED15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 924KB
SHA256 50d23488077ef4e711e3d5d57182596ee30080d6f3135de6b52544f4cb423114
MD5 4da9e9150a4a5c8c2b16b60d2d3198f5
SHA1 9388fe2453dd1e81190b503543b69cd418e115f1
SHA512 b3333f3f2201cd56a62937afe3d250f564a4df4f97d144c9d60b4f3ded6f813e28b2c16067a3385d3f405fac9d903764b486a0cd15b2e03859f5065637af8325
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbac7x:A3k03kHRJP
TLSH
T12315AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 924KB
SHA256 fe1717d05caf4fd62cc170cd7ff6abdb53d7a0d9ac6904636759bb643c5a43ed
MD5 6c6aa1425268213b410ac0412079098b
SHA1 067722bba8f638b8d271aaa1d89318a1d0e930f4
SHA512 ad2b721f0b014b7bb043d22edd7e24de66286565136e0f18ee8e772c8508229bfdc8524d5af7be1edcbb2dafb9f95094670134d05b875d7887d4ad494acf1f6f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacpA:A3k03kHRJQ
TLSH
T1FF15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 924KB
SHA256 188db13067ce838d6d4d0ea892ae91c3f211685ba704e2328f76807f6499e797
MD5 22cb07b97eb402c2a8de0eca9790fd65
SHA1 0636c7c77d2fc907d9df87e5472d58c0764ea14d
SHA512 a78b68c50eb764d71452818996c9811e9aaddb509b39de0a7e500a215f5d486b7b9e93307c849a9fea3603efdb3fd1d6bec348652a64316376e144cbb908dba9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaci9Q:A3k03kHRJp
TLSH
T12715AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 924KB
SHA256 40f8683edbdf3b6e98c536babce901581ae0213233a0679265facb518396eaa4
MD5 dfb6dd7c35fa8b65d43b86a3d5f968be
SHA1 c82a33a4ef8f0d7837cfc854799a1ea0764fc941
SHA512 4952997433538d7d9db7647e50073e09fa2a2d2bf2311a8c220e432d3ff2c8669c0fbb96b473158cca3261c10aa074ab6295343eeb6bf4729bc9c92cf9e6e1bc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacH4:A3k03kHRJ+
TLSH
T18415AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 924KB
SHA256 e50777fdc6e12adba4535b625c283c2b3b188d991314f6d2a3e579f8052ae626
MD5 97f451f11fcc87ca82ab6116eab236f5
SHA1 db0a44c9121c744ff57b8020f78c2542c966c05e
SHA512 2522ba1a76c9164718ee750253bc7a1014a189b66c41b167323c77a6732e52480eaa68a996a5705882c5b593a9585990fde9335c281fe7665d4c11a8b1a67c54
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacmu:A3k03kHRJf
TLSH
T17715AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 924KB
SHA256 6b8127604c89f8e9276cb694224f9b35626e35f7a5ef7622d7d5e408b7d2667a
MD5 084662f45f1b21756e42e74183b4e4e1
SHA1 bcd16136ce667f323c0659a039e04eaf235d030a
SHA512 9f57481b7ae1183d3a252cd28038dc81f0fc9bf24dbb912b81518fc65bfdcc59c27051d9734aeff95102d17d5e7cd7f41d939cd9b820b689ba8245c3fb9d7cc6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacXj:A3k03kHRJB
TLSH
T11C15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 924KB
SHA256 c40783fe510c527267fe137dc37ad281f4a07023549870f491a875b89bb5b467
MD5 b374561eb0d57fbe05ea329aa7082161
SHA1 dba5860d28da9f0a6f8ddc537fcb06a283c930df
SHA512 a20c271bd79202032e44e78386f083430eb2577ba4e78dd11bd34d3bbbf360636f9d72b7b93a50b8d65228805065090ff390a7ba9b8ad27e4e493b4b1eb25508
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacCg:A3k03kHRJF
TLSH
T1E515AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 924KB
SHA256 5ebe2e2a35d88fb7ab8cd72af35a88caaffb495ba66dd4c57633cf013fcfb8aa
MD5 dc74a422c7e7675feda003d17694ebea
SHA1 36addcfa93f801a25c508b279c0baa02ef8e0d88
SHA512 a1394379fa5dd76d7134d5efdfb70c25c1fd0f5ca410b9c114e234bcc60a8ddab6f141c4246c0c2aa21bb5178e5f1d58bc4fd4c477f198e4e6d0209baff5f1fc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbac9I:A3k03kHRJs
TLSH
T15315AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 924KB
SHA256 da630cda176585a72f8be516d13c01bd4a18e02543fde17090f95072cdd7b8fa
MD5 fbe658a9e7f03a178b040c5aa75dfbb6
SHA1 59e0f2842f49cc96fb7331a54b7161ee3c04ff76
SHA512 dd52a7108f0022b2e8d23f9f4c68a69bd0acd1ad1882517292b4c03211ef48d6f13665cffff173c4db9e59b4d35d203fa98860e5253982d87cc9aca529803947
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacvo:A3k03kHRJu
TLSH
T15B15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 924KB
SHA256 190fcd85e2deca12831d64a4293d531e2b7bc0bf7ce21899db76ac425ed73e8b
MD5 127e2a2efe0c91c9a7c2047f7ebbd4d4
SHA1 22d53c2cb7cb4628a5ae2474bdd97bd6300604a5
SHA512 30d987d958ce19a6423400c5aff0fb5f0ac3af43e924713052c7775534ab149623d486681d3ef30f5da4c58589a667e07690ee6a12933381606daa5f027831b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbac0+:A3k03kHRJ7
TLSH
T1BA15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 924KB
SHA256 1faa687787ef2468b1febabe9219941abc836f06365b1cf8edb1a9dacf4c6d1c
MD5 49bb43f03e07e8b2387aa32912ba293c
SHA1 10ddce1d5796303db5b7fef0f8c73221f9e4f7e8
SHA512 44b4a945f052e8c38d72ecda7e665200bab83ec4cae00b8968f3cce83a6e639f65398b23f0261b77651825941aa0091d404d7de8f75365aa218c08f379d02c75
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbac8Q:A3k03kHRJ/
TLSH
T1DF15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 924KB
SHA256 1a349626189f1baca9d4006b6bbfc6a568959bd4809c490130138ee0ec713aac
MD5 ee135609f0f8ee8e10ad1066ca0604a2
SHA1 8aece221c0167707ef5b73ead601f1fd26380834
SHA512 72e4c26834d0644c9a0f1b5a10493554557f1623ed5e893fcc35846ab16402628c68d125f01a7ba73f3ac4498ede13e7ccf1f2df79143853d37a20d862f20cf2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaclX:A3k03kHRJT
TLSH
T1E615AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 924KB
SHA256 228ca5eb24cdfa934566bcf50851647d1563879882bc18675aeee1f8a95f1ab7
MD5 8ddfac7f4f1cfd5aaf718b4009ca5316
SHA1 10dd4dd7167175a8656e81733f7fd130c06e58cf
SHA512 f5eeaffe4b00eb6668e0fd8cd656394a9c2b60a014932ae250e609ff7ae69da4ff28480f284d7195496a17b55c5370164edcbd829a5a1e398ce7fd63f2b5276d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacHL:A3k03kHRJd
TLSH
T19515AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 924KB
SHA256 324ea8baf4af4b32954d2daaef0b73fa9c1226d218b00d054999ecda18511e98
MD5 c1543e7afff25ed83f63846e48d23ace
SHA1 7232f98639c51dc1e5b9f4475ccb8bdcb6b3de80
SHA512 b5574a70fbf86cc9b08d37e313575796a329529ad05e80f8f8476552ed4e4d7ac3de0bf39947411c03010e1667cfb764c280e5bb63eb09ed8e1dae0986442d23
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbac9M:A3k03kHRJk
TLSH
T11415AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 924KB
SHA256 3fb20a792ced2159fdad2395f5ed055cb19ec5d87e29e9631a9f6aaf2d3540bd
MD5 a519960f0329375807e335e974adb91a
SHA1 17750dc1e9a0833c3bcf6b41b9524ec951bf28f7
SHA512 e78a52f45db3a6c61cb2256b56c133c5c46ebf7eefa89efe4fb68067060553af5b873b41097349d092e2e6516d8886603ae3656963903a134dd9c8760da26584
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbacuh:A3k03kHRJe
TLSH
T1BC15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3896-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3896-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4344-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads