26f017080fffe984fdd4f66d41b7f1c238de30729d2a33f7935de57d6c59e31f

Analysis

max time kernel
82s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 948KB
Sample260810-xmxyfawbme
SHA256 26f017080fffe984fdd4f66d41b7f1c238de30729d2a33f7935de57d6c59e31f
MD5 1925dfb56e3d474193bc66efdb1a21f3
SHA1 f9b14f83205baa1fc628bc9ac6c8a28a8ffeb70d
SHA512 1fa7841ef129652559984c96a74f873096e202bd2c98cf1c4eec5c63a22c245f1ac9bffa38b12192bcde25a179bbf1ba40d005e82a9dcd06275c3c879d268580
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiu:A3k03kHRJn
TLSH
T13025AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 22 IoCs

resource	yara_rule
behavioral1/memory/1532-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0007000000024593-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/3304-7-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0003000000022c06-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/1532-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/3304-23-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0003000000022c0b-42.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000900000001fa09-157.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0003000000020383-184.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0002000000021303-409.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0002000000021306-428.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0002000000021308-513.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000200000002130b-545.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0003000000021309-601.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000200000002130e-650.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000200000002130f-681.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0002000000021310-706.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0002000000021364-719.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0002000000021365-762.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000200000002136d-787.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000200000002136e-806.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0002000000021379-814.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 18 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0007000000024593-6.dat	aspack_v212_v242
behavioral1/files/0x0003000000022c06-12.dat	aspack_v212_v242
behavioral1/files/0x0003000000022c0b-42.dat	aspack_v212_v242
behavioral1/files/0x000900000001fa09-157.dat	aspack_v212_v242
behavioral1/files/0x0003000000020383-184.dat	aspack_v212_v242
behavioral1/files/0x0002000000021303-409.dat	aspack_v212_v242
behavioral1/files/0x0002000000021306-428.dat	aspack_v212_v242
behavioral1/files/0x0002000000021308-513.dat	aspack_v212_v242
behavioral1/files/0x000200000002130b-545.dat	aspack_v212_v242
behavioral1/files/0x0003000000021309-601.dat	aspack_v212_v242
behavioral1/files/0x000200000002130e-650.dat	aspack_v212_v242
behavioral1/files/0x000200000002130f-681.dat	aspack_v212_v242
behavioral1/files/0x0002000000021310-706.dat	aspack_v212_v242
behavioral1/files/0x0002000000021364-719.dat	aspack_v212_v242
behavioral1/files/0x0002000000021365-762.dat	aspack_v212_v242
behavioral1/files/0x000200000002136d-787.dat	aspack_v212_v242
behavioral1/files/0x000200000002136e-806.dat	aspack_v212_v242
behavioral1/files/0x0002000000021379-814.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3304	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1532	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3304	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1532

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 26f017080fffe984fdd4f66d41b7f1c238de30729d2a33f7935de57d6c59e31f
MD5 1925dfb56e3d474193bc66efdb1a21f3
SHA1 f9b14f83205baa1fc628bc9ac6c8a28a8ffeb70d
SHA512 1fa7841ef129652559984c96a74f873096e202bd2c98cf1c4eec5c63a22c245f1ac9bffa38b12192bcde25a179bbf1ba40d005e82a9dcd06275c3c879d268580
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiu:A3k03kHRJn
TLSH
T13025AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 735df6bd886ebaf3c7ce1c3c7a5a59ab3ba38e594c2f431d0ae8803dbacf6801
MD5 4276ace65433e8fa51e017a9dd5915d1
SHA1 960455b3401cf17aed19c0ca7315260751166250
SHA512 e4ca6c44cda5e50c00cf0179a8604585066fd301c0e85bfa8187ca41405a9f27189b8aec0dafcf5cc5d2cf934d07682252302441486dfc278847eb75b53eaf0d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjie0Le5ji0hmxNrM:A3k03kHRJjPji0Aj
TLSH
T1B9658C17F6A402B5D027C1B9C9D6966AFA7138821B3086CF1359C7283F67BD19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 962KB
SHA256 520a74f7f5eafdc37ac5885cb29ee6e294ffc9c042efa6cba11569f3ec47b218
MD5 6f9b35f4f2eb4174a8c4d116f55c57e1
SHA1 eb39a5e10e65fe9fe96f13d6a8c3c4812d4160d7
SHA512 01e8c918a34c14c9a71063bb48bd9adc03631feaeb28de2e77ad5837bad7f3e2f6d926ce663927d1a07851e201162ddaf8619ba97b677cc53657db749f3bcaf4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiYa:A3k03kHRJ
TLSH
T18325AF13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 1.1MB
SHA256 8a59c7068c3182f23bcfb7e9a8c6c9948590bff0dd47dc8608076ddfbebe8854
MD5 5e95be4bd7b159172fdb3076f7a5d4a1
SHA1 71e2075c1b61de87633ebcc5f442f930f81fc762
SHA512 403d465eddb3a294597b0499024ca8c799df585dd9d4def1fa8277b9634a8e4372256b77302371e5d018491e5905aff50619b47e5fcf69fc24c6ca88a71e02ae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiHD:A3k03kHRJk
TLSH
T153355907E69400A9D10E8174D7964A22FA777C5657E092CB23D8D23D2F62BC06FFA397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe$

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$
Size 971KB
SHA256 b414b963d0eddb4df1f4d9ca3e491437a75853f3b7904a6809ea00f2611e89ef
MD5 b79c8c146ef93308f3052423a2e20b8e
SHA1 573822491096a25e47e59db2f7dd47b3de8c8a4c
SHA512 93cd58c7ab0175ed2b67e9b7f0078d46d0d2e0641caded2c2617572845cdface6e1e076d6b808c75efd4da0b4da7f8bf8783833924fa003f5ba201c9f7318bb7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiJx:A3k03kHRJQ
TLSH
T1D225AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
Size 971KB
SHA256 0344c63285c4f6fc007a6c318413c65cbed1a58feb38e6b96a9d9534deb44ef0
MD5 f03c281a9812d16a2e61922585f84293
SHA1 db766eadfc8e186a92b8b4f11883aa427095800e
SHA512 96eb79e14f0d1bb6464aa87845c24a725a917f058a31a57befae27ea568033cad908fc6a6f2251984097f484540b3c0104cc143e2131282b94a44b0b49bfc3ea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjilF:A3k03kHRJE
TLSH
T1A925AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
Size 971KB
SHA256 9d7319f440f1e2629b31c573c78db952d01fbd16a1affc97e7134b6143973c7c
MD5 3d66ac2a3e1993d73cfccf034ef8f9f1
SHA1 aa765f87ca5e31614d8efec50bcd172391aaa383
SHA512 42644e9ed2ceadc84d7790ea50d37e8c695de76c66143d85fc7f7ce86845f80e4585e603a81ee528fae009d8b5d8973e40fda39ddeb765af3a2595059f451107
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqji2j:A3k03kHRJ9
TLSH
T19625AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
Size 971KB
SHA256 ac01355ab15d981c66bf6febc16088cabcfb1f3ccd7ecbf2ff610c5a9494abd8
MD5 37b9bae848292863a180b52218327dd8
SHA1 9de4b29fbc253a55f078c9d8f4520c098c994e28
SHA512 693829b9ce51030a641de5bb542aabeb7604f529d2b98c4f6828e823611b3f61256627f3517b3a4e5c8468a3604b1396fd28013bd8a35e1fea4df975506e2302
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjioD:A3k03kHRJP
TLSH
T14F25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
Size 971KB
SHA256 1c75cb0a6010d2973a3abae35c85ebb3602be87b04128b29ad0d514f2ae11fb8
MD5 5e0d3d3c96d8428c640ad41b0be992ab
SHA1 cd2ec20f4e318dea39850b84c46d8d246a314b69
SHA512 2a919af7e272f066944a7fbe5320ca02d504119bea69286e2a807431b9ffcfaf9aa4965e6f92432cd0e4582902116d129b034ad1c99e92eeca36926aa2ff0202
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiEd:A3k03kHRJZ
TLSH
T13A25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
Size 971KB
SHA256 3faa555d67d9fdb2e42377eabd111de1bc245f836b102135d14fe3e943e77b78
MD5 4d575fac9d3349cb1ce269995cc66902
SHA1 03a46b4e1cf67dc437072beab24b6c4c2a6ec1c4
SHA512 e3eecb7e0a44de0dfa7635aa29e8af848f60d8c99eb8f4683547ff953a9921fe108bd6f8f4cf28226465f9cf2efc8e93000c5f2a272375bcbb8a269d99d1ef1e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiQM:A3k03kHRJQ
TLSH
T11525AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
Size 971KB
SHA256 fd7c6eb4f23ec1621d837cba81eed44b4cd89af6ac0537deece9531ddde71dcd
MD5 044e102e46c685c0abcd6aa37f10399d
SHA1 53e426fe4897ce53c7b4d24cbd5970af6bdeeaa9
SHA512 230439da73245f64771837a102007141234d1741c517b734097fbd19aa6ff26c68b8f6aebc2ba8891d997fb9b2e9213baec857f309ef0713c724e42d8cfab4bc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqji9W:A3k03kHRJ7
TLSH
T18125AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
Size 971KB
SHA256 f3cf1adc18c170fb7a1e24dfe0a34ee18df4f422c150f94d2770c1f0f5b15a8b
MD5 acdfa2f0685eb7b6c28794a35c7ec082
SHA1 6922169d1188ccd5d351dd7bef957aab66ce0003
SHA512 93d9a0593e0b52463f74a4d090e8cb814a5b6466e76c9d97d82360feeacc9bf13dd8f140a9bc70099e48e604fe7cad5552163c1172675335c6c15780373e1268
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjis93:A3k03kHRJJ
TLSH
T18525AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
Size 971KB
SHA256 1fdaaf8b80a00effcfd8f936cf21acd339deee82ae24060d9f6e476d752924a8
MD5 6aef304995575ad8c96477467d366d31
SHA1 3be43ce6997dd0f72c143dac5ccef39a7a31696c
SHA512 c4d229819a0c3feeb47c781b1a00c5c553552c370bed9e0475b833bcba8abb20eaf15d0c3f6f50bb83dc1c3ddb297b3f77eb217e420b60510d0e30f55476dd24
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiq/:A3k03kHRJJ
TLSH
T1B125AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
Size 971KB
SHA256 a0306f2205d3733669c99f89488744d0d7b713f01e1510bead0fd0e26960c9e2
MD5 87cac26b03c88deab296c849fd02540e
SHA1 587e8596222b707d0d550fe3362e7ba742c6b183
SHA512 b968d54b06ed6f9b99c59a073517534521603aff987a874c31aacefe6b3445d6277fac9b8ec7d3dde2f65c780ce1e6850b9f5bdf4facdc39c832f17a2efee1b4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiqa:A3k03kHRJG
TLSH
T17B25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
Size 971KB
SHA256 89c9d9f0343c25dcf1c6740b28e83d43bdf7f4ac819411e6ee9872bd9520fc74
MD5 2774621587f4a841ef912f16c3d43934
SHA1 4212ea7ccc779a58a97484b5e3fcab79f7345af1
SHA512 9198aacebf1a7d7dc04c8b15454809a75328d697e9b54aa4d5a5fcec3f47026926bf84a55b4757f0a0673ea4158370563c054db7bc22a1ac8d9ce9ad8f3ca78a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiWj:A3k03kHRJT
TLSH
T1D425AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
Size 971KB
SHA256 bee4c6a68e96e8b34c842c17c504cfcbedcaac1e38155b893e1cdf277953fdf0
MD5 5c880a5fdeaa2a58af925c493ab1b0b5
SHA1 de81d2dfbb90404e0d7616a8626b8734f8ac4582
SHA512 b497041dde27d0155a4c8409dbeeb410e7fc91db051773845968e8464cd5d970f1f2e1f5937ead22e058162470bf4e092542b2a48d749b5f6ecfef5971c10933
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiHQ:A3k03kHRJT
TLSH
T1AB25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
Size 971KB
SHA256 491e6676b1a8cb4a5dd3862722da939d35f175f459566f5a80211e1a96cd3783
MD5 86b9eecc277503a8fcae448089ff7d03
SHA1 e3d173fe1f172b31d5305b18803c01f4d8c6a6fa
SHA512 bd6209eff669daa33e0393e8da2d5e270812970ed8b4005d75d2659a17c26189ebc46cd914cc769d3cee2a0ad66c0d868b3b0c67300a8d205076aea0f01a623b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqji+i:A3k03kHRJS
TLSH
T1AB25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
Size 971KB
SHA256 9ee222ce22db9632cc06457add24406f80a94d106b2c72e8fb0cffc0b5017351
MD5 46940dc16e33677e59f2dc780cb28e47
SHA1 0d45546b4494b3c75b860dbc5f569cdd537d3184
SHA512 050690a2f133b6266fe88f5fb656fba1780a6db85c8ea85e66ec61e80b85c7988c1a6cb810e1ca87dea7b8517cf77e23f02d4f8e80b2ce98053b87e50bd8215d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjik9:A3k03kHRJN
TLSH
T1D525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1532-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1532-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3304-23-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3304-7-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads