0985141ccf8e9187553abbfb93997335da6c7be680876beda742ec325e694ed5

Analysis

max time kernel
104s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 20:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_6efcbf93b7112dd2cad48f075647dc0d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 946KB
Sample260810-y1lyrssvgv
SHA256 0985141ccf8e9187553abbfb93997335da6c7be680876beda742ec325e694ed5
MD5 6efcbf93b7112dd2cad48f075647dc0d
SHA1 2fd7d17339089b87f6eeea3d30e77d55f4af4d8c
SHA512 cfd11c861bbee9a13552b4128480fd582496d6c2c2ffab7a518c9eab88a297a66bc005709853d30a1b5140e544a4f49f909b0254107764520eeb0987e196a290
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+:A3k03kHRJARJ
TLSH
T191259C03F79900E8D15AC1789AA69A22EB757C561730A7CF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/552-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c525-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/552-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/352-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-588.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-704.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1086.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1216.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1319.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c525-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-224.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-261.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-442.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-588.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-619.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-704.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-736.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-786.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-823.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-854.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-885.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-892.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-905.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-930.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-949.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1005.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1049.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1086.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1135.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1166.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1179.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1216.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1319.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1338.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1364.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
352	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_6efcbf93b7112dd2cad48f075647dc0d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_6efcbf93b7112dd2cad48f075647dc0d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-10_6efcbf93b7112dd2cad48f075647dc0d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-10_6efcbf93b7112dd2cad48f075647dc0d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	2026-08-10_6efcbf93b7112dd2cad48f075647dc0d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-10_6efcbf93b7112dd2cad48f075647dc0d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-10_6efcbf93b7112dd2cad48f075647dc0d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-10_6efcbf93b7112dd2cad48f075647dc0d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_6efcbf93b7112dd2cad48f075647dc0d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_6efcbf93b7112dd2cad48f075647dc0d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
552	2026-08-10_6efcbf93b7112dd2cad48f075647dc0d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
352	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_6efcbf93b7112dd2cad48f075647dc0d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_6efcbf93b7112dd2cad48f075647dc0d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:552

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 946KB
SHA256 0985141ccf8e9187553abbfb93997335da6c7be680876beda742ec325e694ed5
MD5 6efcbf93b7112dd2cad48f075647dc0d
SHA1 2fd7d17339089b87f6eeea3d30e77d55f4af4d8c
SHA512 cfd11c861bbee9a13552b4128480fd582496d6c2c2ffab7a518c9eab88a297a66bc005709853d30a1b5140e544a4f49f909b0254107764520eeb0987e196a290
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+:A3k03kHRJARJ
TLSH
T191259C03F79900E8D15AC1789AA69A22EB757C561730A7CF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 217b84589b1526cea53169b9a6c9ca275eee57b7c7ceb207d6b2e23aed5b09bd
MD5 1be5575302fff28b460414f971d8cec2
SHA1 fe3ccb455ae5fa8bae0554a362c9ea17fbf68b62
SHA512 5b05c0f5553a8b041db38ce0680d39f284a586da000e78c653a4d2502a373343c6fd4e3f9e29143f15ec636ffcc27d6b9ba3c93057ddbc5e1fa540de2189f453
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+P0Le5ji0hmxNrM:A3k03kHRJARJAPji0Aj
TLSH
T132657C17F6A802B5D067C178C5D29A5AEA72384217309BCF1394C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 960KB
SHA256 cbd4812a834626fc66c6b2209a933c43a8920c974ad435ea535abdf4aa073079
MD5 422e1fb5e6ebbfcffcf2df52c2027eb6
SHA1 c18d5f20907da4978300a71724a0532f4b05730c
SHA512 fe4b1701bac30582540c9d2c49fa738339ba9f89e430103f342909f673e35032182d9596ee93bfcab4e2903ea2eeb663d7928e5232b53938a3fe55e93a0edf7d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+Ra:A3k03kHRJARJ
TLSH
T156259D03E79800E8D25AC1789AA69A23FB757C56073097CF1364D6162F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 969KB
SHA256 8dfd258c37e7049a2bc31e21f9c817ba48ed11f2fdd307c9725258307fbdb8c3
MD5 2894b915bf69f742b11d0e41100a19fb
SHA1 6c3579e728e4212894500cabfbf90dc0a75dfc92
SHA512 0c9c8b2d5b6548fc3e6871af3f887dcb8dc55f554fff11d19cb8e5380430c542f9f4dde9935c860cfd00e04fe32c205baf49f100e481dfb9dd93699d1798bd99
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+o6:A3k03kHRJARJO
TLSH
T1F0259D03E79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 969KB
SHA256 11a3fb9703a4687b56c856770be678c8b33d03af4065db83e9a1ae00593968f8
MD5 e7a34261e24f8058d4634c59cc5860be
SHA1 fb981356b7ad1e2b399724b3e7e8dc73b7994b66
SHA512 0ce7698b36983af0e1b9626e85ad66e51e5fc846a6e103706e361301a2e5b90921a288ecc76fda5fd390a457332c78f37954aa8f9c4923cd6a131f82f18ab253
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+sN:A3k03kHRJARJP
TLSH
T151259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 969KB
SHA256 0cb91284e43d3ff735ea7a5accde733a18da85250955c5b3bf094cab31acedf4
MD5 345578a97e215b89c7061eff0de77d7c
SHA1 2c2284733c53abc1cbee805cdb103e01c73dde2f
SHA512 7c266ad7acb1af044abd6bf9500d0b88c6ac208eedbb17e01d0eadeccc2219663e10ae3dd0b73bfcddb4c6d381e4fc1cce095ec933551854a515b6f91b3ccb65
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+if:A3k03kHRJARJL
TLSH
T1F4259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 969KB
SHA256 04fef33a75517da65f5481d093c48b0d68512a136133b9596c88178fff650265
MD5 eb0584efcd4f19b8c96ea51dc368556b
SHA1 bfe778a6abca7585898f7c3030e898d6d5ae1ade
SHA512 e120842c7e6b15c56f8ac10e40d82515b7acfede41effbdb343a9e53a1a444b5203d1833536226877a05755038a6525b68d8b0a0a197687d23ab814542b8bc90
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+8o:A3k03kHRJARJa
TLSH
T107259D03F79900E8D15AC1789AA69A22EB757C56173097CF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 969KB
SHA256 08ebef133d0e48c35769d0599520949a3e31c7e0190eca40e147dcf480025483
MD5 93cc4d7ac44aa1eda891c0c9f6c03a7c
SHA1 d6ee91337f6b43050f3bcbc0c1191b991a9fdac0
SHA512 f1a9d6ae879552b2f111f6d49d37790c92f30a22ca4290e4994eacfd4c21fff3f27ed5cf49eb9d345ee1d52c235fc0fb48a276f9527121452202b705df6506c2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+cu:A3k03kHRJARJ0
TLSH
T144259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 969KB
SHA256 cf361b4c50ebbe61f0fbe5c769c2c6495d7ebb0ec0ada86272bc72edc786b1ad
MD5 4ba0cbd1e3e7c15f30b3ca92e961a2aa
SHA1 a508bdb7319838a88efbc10857870fb045f1bf1b
SHA512 d6a18d6fe54f0751190e9cf6308f843a87c648fd2faaea996bd8eccdab7bc4cc0f6ff10fc4e96aa42aba10cba877c973ddf14400743778893c2058bf603a6bc8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+g9:A3k03kHRJARJZ
TLSH
T1D4259D03E79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 969KB
SHA256 a6fa1a070542e137f486ead5fde5317479b3b022244efb8c49b13eb755bf929d
MD5 d8792c2bc6df6ad8240783c68845adf2
SHA1 7c64a46c25480c3c644f03941232a1103e3baead
SHA512 568b068823c282f2cd660bc426ef451ee28020755c68e1aca45357f7c65307a0cdee5701878a8ad5b033224d2b663e5171b5a38734513ded9718d35ab51b1473
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+oc:A3k03kHRJARJc
TLSH
T1C2259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 969KB
SHA256 26e3bf7546c56c53e4319753ae94666ec6aae728e8953798fa24194c323f8d13
MD5 65a5c22e88eb9a710e95ee6746c2c2c4
SHA1 1374a5c583068c6d55306424b5eeab23a3970b34
SHA512 4fd3f95176dbf169cbc3aeda3c9ec40b4b7e442ceb31e91caf33b1db2ba418975a7c62b3d7598ce5ccdac9b907c5ee28c20cdec48787f5f918fe3423ba7f875b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+Bp:A3k03kHRJARJq
TLSH
T1D9259D03E79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 969KB
SHA256 9f16a27860717866b23c5e783d6a8f8e75db75ebded35571b61a946cd4c00557
MD5 b66f2ff9ab744cae027d1036f9440dff
SHA1 3de9d94ec8f076d22009e9e22d9e628ff083dce3
SHA512 3b9ca6eb584570a8990ce8687050e8719c61e1710332e8a6abb837a3315d13e7b81875928431884cf421d8d607f4679cb9628430676f9ce909479e41df8e295f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+WN:A3k03kHRJARJd
TLSH
T1B5259D03F79900E8D15AC1789AA69A22EB757C56173097CF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 969KB
SHA256 0158042383a847375f4bf20146c21d9bed87edd2742c1441e1c5384002c17424
MD5 f552b7930a926f697686f539be58780c
SHA1 ddb3d0e4f6a33d08a666c356fca268e3fd75babc
SHA512 6503694185b6abb64d301cb82264980b665312f11ca59cd7330262e52b73a8fb8c1c7a44e53bfa34633539759f8997c93650310d182280060f768ad2a4c3e9c6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+aF:A3k03kHRJARJH
TLSH
T1CC259D03E79800E8D15AC1789AA69A22FB757C56173097CF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 969KB
SHA256 3a29da3b0383eaebfcb2d4b529631db5f8a94a284aafb73c5edc95a7031cb5d6
MD5 75f6768fa4c66e952d1baa6d049303d0
SHA1 f1a436286c51651205353c9da29fd93704c0fb3d
SHA512 e0c3c13f0d2fa43258a677245d3aa90efe02f67e4e2d163f039ea682683dab0df6eb4899a4b9ac4f75ef4df0a585f251140e0084a9d68ccc360624a53081d762
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+vC:A3k03kHRJARJ7
TLSH
T179259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 969KB
SHA256 26b0c539256fa9f844f0d89e16a992199286565a16016c9a80396675a1e36e73
MD5 f52c2a17a44184a26f1d6ae89e40cccf
SHA1 276c3c755b8921ae77e0e1c2d05eb9cfdedcc767
SHA512 69f446a7f9f4aa29cf11daaf46fa76a06baf615a79b045fb17c16911bb5bb0478165913e7776ec90ef81815bc1bfcc62f5058e7dee8097889ab522867b72a3fe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+Qw:A3k03kHRJARJ+
TLSH
T13C259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 969KB
SHA256 6cf82a274053c8bd74fef6c08802720ec72895903a24dca67cb72710cbe3bee8
MD5 07139919883cc93c91ca91390b77ca95
SHA1 856c5cc8e8a56bb47b808a0d00448e5fffec1075
SHA512 d399c0469d4e9286855c83f285e0b3650699e5161332d722ffaae02d574e608f5bfd1c4389e29288ffa768159a259f3e47eba357d67a081d9712f4774195bbc5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+vT:A3k03kHRJARJe
TLSH
T1F3259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 969KB
SHA256 7e3f63257e602a4fac4de441e258f890749339f8efbf135a5015f111e3d5ce73
MD5 d0285f534bec60866ddaa910fbc22409
SHA1 4d28df3a4edfe752848694f5866316abb20e8c58
SHA512 bdef8cb642f2a1ff82b10375fd3d780d085795ddd94a196d922547b081703d424c59a663fca7f2ec3c09ea5398c31b6b1527cb1503331ce2fd3443d242ec3848
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+pu:A3k03kHRJARJJ
TLSH
T19D259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 969KB
SHA256 923a7573ee575706f3a375b344598f5eb5ec865ac1b688ca7e5ab02bb6c7fc9b
MD5 00ad6f4962407f2dc0379cb74909e7bc
SHA1 a2d2111a71b4dfaf112e359a88d9a3fb2ed5183c
SHA512 27771d72847003687b7d7547a40b843ef762af0a4faab2c7aa2c526f87d3c049ed17e9c7bfa884f50e7bcabba6cc12174874b2c72a2136820de2a4864f7e0bd8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+hb:A3k03kHRJARJ4
TLSH
T1E7259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 969KB
SHA256 c5e408eb2e6d6fdc18808cf4ed4c8cb97cc5160b07a1e5d646332b35cc16dfe7
MD5 bd6958b5131f7b40ec53b5d2b478d89a
SHA1 2b5fd7644df9d65f1654735b16e6d3a8dc5316d4
SHA512 a58e07d744d8694b27bbf1e8e6e109e30eedbee7de6c92151ed327380a6296b216ef63d542ff25d22f717b9f689f27ed4296f4c5a7d1519287899d2f0cf03f4d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+pf:A3k03kHRJARJ4
TLSH
T1AF259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 969KB
SHA256 17111c608439dd008a4fb10b42e6cd7b78f1efc2188095ffc4cf6ef0ac038cf3
MD5 36dd8b62049cd6d2797e265c699a4177
SHA1 7c7e11b2d31667a391a584090861542bb24df54c
SHA512 0cee3e838672ce1e11d270df86b6693a036c3936c502d67bdb74aa175a1e0641981e6b5819b021126910831a5868b8cd4824700b39896d631bc9046d6a82dbf9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+SK:A3k03kHRJARJ4
TLSH
T19F259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 969KB
SHA256 b446313db3ffccfbbc0f6ca852d42efb37b418ed8d1a369c788729ea87d95376
MD5 9510127bc5711a038c8b15c11c62cb49
SHA1 eee9bd7ee8d252b922964205668e4934d8183535
SHA512 a43502c3ea24c4d0751d3b20852bc7e8818c809ced43c5e2291974061e88e67a8879c34983128cb70dfaf99bb7510ba6fcae14c886358d390b3aa08e16d703e0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+3k:A3k03kHRJARJR
TLSH
T119259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 969KB
SHA256 21791968a881b2e337ea7d44a7f656a55bc4c9dc7aefabefa4ac645435b85db4
MD5 43d96061aeeceea88e8f2754a52543d8
SHA1 182f8e17db0fd64a2c9c9793749a42c5acafd9c5
SHA512 1cd858c510ec7fe16c611514da86c1eba24d526842ab83c63cce3aba8c4527e637ec2aa7f988776b35f632d6e9be0885eee82da12f87ee67f45d086ffd9877ef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+A0:A3k03kHRJARJU
TLSH
T155259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 969KB
SHA256 0ae51a142bc0d8a99e87835009b8cc023f14eb26d0bc7a58bba2779a9e322852
MD5 cc25519c28267fb7f1614350d9136b0e
SHA1 b7a841ffa095be041c69cc22c3e9a9ef63cd946c
SHA512 4ca5566e8141ba5c7143f1c5599aec9fbcce55884c30dc8237fe9929eff763ae875f337bda6da0ff87606a140e8dc0f9a9563d9532ff86e7ca3159b767c0d76c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+bg:A3k03kHRJARJp
TLSH
T17E259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 969KB
SHA256 ade3ef6af90e4d73bd313b79260f37cc504cdf0ad32422155870fb1f3ef0cd40
MD5 1c1912fe9ca45f495f27e2ee48c1bbae
SHA1 31974863de035535c9fc4076a14d83d117261e71
SHA512 05dfa8a2d7bbfff6024e7225d96ac464b1ae8ef01e02cfcf2e75584d4d1691e00549d76f3ffbd28a8f0c2c1eab02ff4a431c716353b226bb05c3a44f7eebd647
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+Wr:A3k03kHRJARJT
TLSH
T14A259D03E79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 969KB
SHA256 dd3fd77c3c8b263dd626ea65edf0376172d248827125fabccae414bde19e1d27
MD5 1885f31d8ffb9317fedae6f1704db1ea
SHA1 c279c84d2910a257cbf48e6e38898a508779f2dd
SHA512 32cd66256cbb537dd502b53a2461dcdfe29d7a9d47404a1e90489e72e6d94051cc031997081427902bf5d1b6fe57038aee273f51825734eda0f7a2b793d55db2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+8n:A3k03kHRJARJV
TLSH
T113259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 969KB
SHA256 4b58a80351505745971e64dfb72411ac50e978ebac5326618e58c227f3b4655c
MD5 a1fe583b4f61f811f0dafcf79c0e5385
SHA1 550ecf1111c8d3c02bd6b9d41646172bab85e5bc
SHA512 6ad70db5996fd9919e514f1607b91d2fd2cd95e5d5ce93c64bf9ad0f219f7db911d9b544d5e9097062bcb12c7b7431185656b893157681c1232d175dfd4ab188
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+6x:A3k03kHRJARJr
TLSH
T18C259D03E79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 969KB
SHA256 102ae0268640fe9721ad6747411c8487b371ccf98b5fd3e89b5f7192df81fe9e
MD5 068e6c0d9ca97c7be1a3426aa9e08c24
SHA1 76d5e98f168b823f502bc2dda9b84f151a60405a
SHA512 a1565892656b4965d52054bfa8aba43d3d6ebc1b76762a58523c8bfb43589cf971f7418861a856217e89b5f22ed7c5138d1a59bd64ceb4415adcbfac190216ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+8A:A3k03kHRJARJE
TLSH
T148259D03E79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 969KB
SHA256 f5c8db4e5dc434fa5fe280eceb7d85d59942eabc3fff8ab2d61774f7d6586ab3
MD5 37c470f6f875c2c10d43efa182cf487d
SHA1 38f7e4dfa08f8f88cae0326c916f14c5e0ea7e36
SHA512 626a90c21eff6b7f3eb8298013da34e405ae245058c9c86e0caaac124cd6f488bd934958342e3f62c97d305d3f9e0127439c639ad1e479f0361cf02f01724dd4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+l9Q:A3k03kHRJARJ1
TLSH
T131259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 969KB
SHA256 2749271e03cdf1bf9e36ea9e1799c5f9e64fa7dde2135e8d40922a7a877dba13
MD5 651ebaf552ff2a11de21986568d67b16
SHA1 d5e3d490134b6a9816d34c22ccc0102fdca9910d
SHA512 6c922f7331e2bdf452b888eed29e468009e6a85d7f5d2637fd0b7f3366410f587e3685a03471b81cc597d37c0e1335bcc0d47c980676a67b50325c69edfae37f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+Q4:A3k03kHRJARJK
TLSH
T1C2259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 969KB
SHA256 99a72880246dd229f5253d4a70587b465e3bc04d6dd856e38de42d369d4e3f2d
MD5 ec7b4d5f74d868df99796624395dd20f
SHA1 5fbc4ca9e0e123002ef6f3e90af59ce811dadbe7
SHA512 50c706a43f3d82566ba2ecf9c258472d21bdf620203a639d43a7aa8503f383ee3a1d393be76cc0765feb16cb548bcf82f3bbb187a47b3e07c6eb46b85e231214
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+Tu:A3k03kHRJARJL
TLSH
T182259D03E79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 969KB
SHA256 72fbe7d27fc35fbbee05cf435a9d14933f430ec9f6fb0e0b477951bd45a08b9e
MD5 0068db5536cdc25b51fcb2cf6bb763b4
SHA1 89cdc14e2d49f1d92041373371c707649b6d0521
SHA512 79940762cbded01e397db5ad9506ee81968a4f4d1b57a64ced4f03a2d061fc490854e9094d8f1da87e3e50c94bf8a5b34d24e1d5ec4feab03e8dc10f276b5e0e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+Oj:A3k03kHRJARJV
TLSH
T1A5259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 969KB
SHA256 5568b728783d17ac7d8f98bf18e84c86270debc1ea381816c9980f0fc48ca72b
MD5 42b5214d499adbfe4b033fa31677fe68
SHA1 8e1ce22f1e548cdd4930b522c8b29b50d8642d35
SHA512 d36d858dceeda188f8130eec180593a5b41af5650be508e4d2de67f7de5aa52f342e69d11c5651a1f7c0fdb351c60cc7685ea69c75829a7aafe172d30a9db2d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+7g:A3k03kHRJARJJ
TLSH
T181259D03E79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 969KB
SHA256 05af7fb9add778c7296ac9a8e3ce4b11c6124e6cd37accd3553654baebe24741
MD5 83fb0a900ece64b2e366abe2ec855ee8
SHA1 4cc97ffe4a3d70eefcff8e39b60e87713789ee29
SHA512 cc9041555fe4e5de7322b13cd6dddfd8948c381073c86db5ea81ba8503aa38c325fee121ddaad70e0bc74176e8633697ff636291a7658acf0022b257b0d69e77
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+mI:A3k03kHRJARJo
TLSH
T133259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 969KB
SHA256 c962bee2b6792d4cd30f8159c62bcdcde4d6a1ca74765f2f1e60f79ff65dd814
MD5 2a34baf5522b229f96a3746655b7526d
SHA1 3c4f788326ca8935a1ee5fdc2aa2a28a1a567b29
SHA512 5c655c4d4642003edc5671c402e69ab5e392867634dc7b00ea51ed7e991aa2f831c74547523b0acec36ce7bf70d2d2aaf253857838435e1653d90638bbf7bec5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+Uo:A3k03kHRJARJa
TLSH
T1F1259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 969KB
SHA256 3b8a8e612f80be147ab04643a3f8abd439183b105d9c43798884c7a146a5f8b8
MD5 95a50b4a98d9e17e1a9ab729cf50a80b
SHA1 c7e3aded335ac8351b596ca0bafa1dbf9f9f6f7a
SHA512 505a9048ab5c593941cd14be246f099a835e70c4335619cc89f4c5923efffbb263f49f685a094ede300d8056df1fb1b1e5933d429f5c980744145d991a5ea63a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+3+:A3k03kHRJARJ/
TLSH
T1D7259D03E79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 969KB
SHA256 f041dc94bd88ae30dd24ea2ba98f1b37e9893f294cb9d8565045decdf41931eb
MD5 826de14a63da548cdcd5d43141ee8260
SHA1 40a13d9ab5c63bbe63d5c05430196f699bab7403
SHA512 ce1e8abb954d10c612538649accccd5226d56ba505d8a170d518a8d73a7cbd12a174f60107d75ac49214c0754f265766b95b6db11b04c2700e989120dd3d09de
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+NQ:A3k03kHRJARJb
TLSH
T18A259D03E79900E8D15AC1789AA69A23FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 969KB
SHA256 157251ccf6a3a0544381f5b3a23753c56fccbad891c482e1b5a89f7f63a7a632
MD5 0e147ebd4a421845d4a6b7a54d3182bd
SHA1 d08984aa823acf1176693ff4346d13c85e6b0447
SHA512 db4c5e6c528cbeff08e16e80686cceed84bf87cd30bdd17605ee13e4708c7f32d7127926ac6de3c80ac20f85e3a933a4f4e3e0a597f3a232075340551c1eacfe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+CX:A3k03kHRJARJv
TLSH
T1EE259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 969KB
SHA256 437df170ecb58e573ceb0d4ebadbc9f611258ee21a472c679e7effa04561e32b
MD5 97536db5a7f389ae64137f5bd0dacf9e
SHA1 0245be42e3da4e48455f13bba555dad80076057d
SHA512 27edd130e0515610591e13b74d25a933bbe31dda3168714befdf5840b6b782bba7bc1db2713956eb63dd8db7d4900abc36aed80893b008cfc97179dd62139090
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+kL:A3k03kHRJARJB
TLSH
T193259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 969KB
SHA256 06d2305bec42b7e00b9860e116d1263cf910507123320de399be747b85f878ff
MD5 e511805989a942b76ce5a543f73b2674
SHA1 2f381eb6e6b0b8fc2097255d789f4c4b70d5315e
SHA512 41e579d580a49db093d5a4a11afb9532f18c33e1b1b0892ff0a385e7dd7518e62641245ed24823f85dcd6c0f49740e265edfd82d1fca92497c1987a163841d02
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+AM:A3k03kHRJARJY
TLSH
T12F259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 969KB
SHA256 e84ec318e6d396a96ac22149d614d3cc5786a6ca3b58aa44545ba2be185b71a3
MD5 d41b2e7265c7c38df1c15ab93ac96806
SHA1 38e630b275c7fcfa0c3ba75fa146064ac812dc10
SHA512 3260705df38a388c0917451b06fb760a2e115ddc1f44f2351de5de35cfa2f9288fb171a77b5407fda9a6d8ca18da4879d82872679dc5cceec4c1da1116ed1928
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRagZ7+hh:A3k03kHRJARJK
TLSH
T131259D03E79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/352-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/552-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/552-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads