9b79cd8ad04927ba785eab0a772a1bed8b32272866f34f13ebf328140feae1aa

Analysis

max time kernel
101s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_602511e3d91e4e97559a5bce3fd04bb3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 875KB
Sample260812-2b72gswcjd
SHA256 9b79cd8ad04927ba785eab0a772a1bed8b32272866f34f13ebf328140feae1aa
MD5 602511e3d91e4e97559a5bce3fd04bb3
SHA1 78004f6de2bb32e1b872364dc8ffa537f76ac38d
SHA512 ff89d6e2cf3e250e1a2f710b0807a78e4e6465921e99a60bf8e4f517a948325e07a5e4f63f4b879a794fae06b3e26ad6595ad22610a5e972ae9d7bf1e44e1c01
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaB:A3k03kB56rr
TLSH
T134157B07E6880FA5D10F81749A968662EA777C061F6093DF1354AE253F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5012-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c557-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5012-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1696-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-562.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-747.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1079.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c557-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-57.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-562.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-636.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-747.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-797.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-846.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1005.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1042.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1079.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1128.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1147.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1181.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1218.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1327.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1340.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1371.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1378.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1696	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-12_602511e3d91e4e97559a5bce3fd04bb3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-12_602511e3d91e4e97559a5bce3fd04bb3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-12_602511e3d91e4e97559a5bce3fd04bb3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-12_602511e3d91e4e97559a5bce3fd04bb3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-08-12_602511e3d91e4e97559a5bce3fd04bb3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-12_602511e3d91e4e97559a5bce3fd04bb3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_602511e3d91e4e97559a5bce3fd04bb3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-12_602511e3d91e4e97559a5bce3fd04bb3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5012	2026-08-12_602511e3d91e4e97559a5bce3fd04bb3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1696	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-12_602511e3d91e4e97559a5bce3fd04bb3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_602511e3d91e4e97559a5bce3fd04bb3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5012

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 875KB
SHA256 9b79cd8ad04927ba785eab0a772a1bed8b32272866f34f13ebf328140feae1aa
MD5 602511e3d91e4e97559a5bce3fd04bb3
SHA1 78004f6de2bb32e1b872364dc8ffa537f76ac38d
SHA512 ff89d6e2cf3e250e1a2f710b0807a78e4e6465921e99a60bf8e4f517a948325e07a5e4f63f4b879a794fae06b3e26ad6595ad22610a5e972ae9d7bf1e44e1c01
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaB:A3k03kB56rr
TLSH
T134157B07E6880FA5D10F81749A968662EA777C061F6093DF1354AE253F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 288211de08b1304035a58ed69c594d2378cd1872b22207df8d1dec36f3f9255b
MD5 8418164b0639e907cb2145183bce9ec0
SHA1 0a7ef600a507af6278a405d3ad6db6f88e4c4839
SHA512 b54ca4266ab813eaa7ebd116afa13da317103004fdf91c08b7297528672e40b8b57f76e5fb86485784477e3dbc6b94d1c9a5f9ae1f66a1f992b374f38a57ce7e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaw0Le5ji0hmxNrM:A3k03kB56rCPji0Aj
TLSH
T126654A16F6A44B65D02BC074C5D6966AEA733C421F3087CB1354EE283F27BD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 890KB
SHA256 df2577efa3f39eefe2b2e9361664a4d15370cf518b665a89eeb88c4da7d3f094
MD5 d3ecb74779c56159c7677b40b2695f9a
SHA1 f7907642bcf4d4835de62726d0a024da7532d953
SHA512 e4d24268e4f48bf9ae8b903a2bb1343db97fccd1f5be0a9c7e41375d26caa0fc8bc0e116b688480dface024a4b3b92b7d5dd282be9a3fe6506c455956528b41a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaKa:A3k03kB56r
TLSH
T125157B07E6880FA5D10F81749A968662EA777C061F6093DF1354AE153F32BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 899KB
SHA256 f1f4a1d28fd45523fc61ffcc812dee26b4c9d1fd2d0c3d1663756ddb66a9e904
MD5 93d24645508927f2dcce3c3972da3515
SHA1 d12ba208cc3bc07568d4484e410ee6f4ebcbe78b
SHA512 cd04a72ea89b0ead23fd05ebb57623c6a714d0a34f5da7529e97de52534a364ac8deb4a53de788ae0f3cabfd5bf1f6ea070df0d22574d4e3c62d34c25898d183
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDa76:A3k03kB56rs
TLSH
T121157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 899KB
SHA256 cbe47822f6438dafc35337d1dd29e1c31bba50ad2f4c73010e0343aa56dcd8f3
MD5 67cb3e1992d920edfcc98d8953193693
SHA1 b45a81c28d05925e0165dc017c2493e5558d4836
SHA512 5884a2f65f0ef76081f8530bcab661eeceefa14f50dd7edbde436c192c72018036a008cabb4495292a5dcce3d500b295ed25e1b123dd084812769361c862d060
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDalN:A3k03kB56rR
TLSH
T118157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 899KB
SHA256 b259c3e4b41c5d96e21c142de960f4f4898bb47d34274aff5dfa845fb4d0f278
MD5 f7041749be15c5fa26a8dc470e6d38b5
SHA1 10e6c828d1e9f0b4684cd5dbb752f7884d022c7d
SHA512 0f191dc29c25f5b8f5e56e8e3a36321664b63d1d423b7b7ebf4368855c73b55bcc3f268746705022e4bb8e1a9d858fd8089da1c7eaa9ba7bd8381e9334b48d48
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDajf:A3k03kB56rR
TLSH
T1DF157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 899KB
SHA256 7249560a9e07d10aeec83a92660f29f95c0400c76ea8a0dcb4064d793bf712f5
MD5 936586f91b8e8a103fa7d531d1d9d6e9
SHA1 971a66ec3d343474d16d7fd762d7867645b7d55e
SHA512 e37f0bc44865a2d81e5e1f2eb5ac12703433ebab7aab1c7d6b62819ceb6e60273bf2ce394922108a598e52824b3a269f5c71d9dc09e67a9f8f4e6c336e2db187
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDa1o:A3k03kB56rk
TLSH
T1FD157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 899KB
SHA256 9e0d6226cf4fc5a7bc05c5698bb69dd59e2621bb7f33d01e04a8f187e99e61ed
MD5 506b58fe8d5f7d4624dd6f1a30c55116
SHA1 5405cd4c7abed6b64e8e52e4cfd44af88c1bf51c
SHA512 43585ada440c8717ef8920fe60d2176976e1259b4247973a818a3680012829c7d7e6baef645e0d74079b22ccf82079b7cdd5cce0ab3fb62eb20a83b32aec554e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDa1u:A3k03kB56rW
TLSH
T1DF157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 899KB
SHA256 a155af61b69ddda9762c7f3cf315bbb3097b8219a8db6c1e5807d5c8496b85e9
MD5 756fcaeb2fa8197424de7d6f0705ea74
SHA1 efd9402d52c6ecf4a6a13093e64bb0725bb96021
SHA512 3c78a6d775cf9b120373b6eac2d2f3f89665ec01d3aaa0e3d060f5c2e8b6083c440e263379fce5db03872a69b5a7348f25b195bf9966e0df89e5d1b898f18cac
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDar9:A3k03kB56r3
TLSH
T12C157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 899KB
SHA256 27e890dbffa893d490a0a9721205146de467600136911f55e2ab4b0a184b81a3
MD5 1c7cd267aaa7d461cc61a951e29f4600
SHA1 261758033345aa8f25ded4aae51f0dff33988a69
SHA512 5aaff3532dc4ae56cfc3af7c7402a17367d557a573ff5dd8fa4d78ec83d5a8053684eacc5237771539e6539845e17f8fc07b06d3b62fc3f7c7c1a4278e29660b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDa3c:A3k03kB56rG
TLSH
T14A157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 899KB
SHA256 9f410d6386a1623c9cf96dea0307758981f5be30ed3c2013cf263e8eb70af49e
MD5 9f6a8c873ae4f0e8f28741814fdc2edf
SHA1 1a75ae3243328e14cd7c1e001e92225caacc1bf2
SHA512 c9c13a4834962b30d61f1419b309c6891acce68ccf5aeb4a2861131fd4ea21269419a2f2c597b3c498028add4609c3c09aeb57263b110f807ecb2891bd342cf9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaAp:A3k03kB56rU
TLSH
T12E157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 899KB
SHA256 4294edf5f82b0f2d587780a86436bafac2da09f20646283ac737d017b5609f01
MD5 18e14dbdeafb0f690c027b79e2a4634e
SHA1 84b753999d959de408bc277cc354e9dbdffa6533
SHA512 a178f86a945e1a6b6c496f7fe89e08a1ce9687c5a90d78521bc5ecd1a794a0b4353e30aca3516bda03a4a67491ad6a001e5ad45553be07b4055aef9a06249977
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaHN:A3k03kB56rj
TLSH
T1B2157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 899KB
SHA256 adb27eba34430e7038b21ffc4eca9254c5bb11c57638c0dabe126d3dff599762
MD5 c6e3b2d5971e809ecad89a278075f473
SHA1 99ed9e12058d987288a4b016b32f33e00e61acfa
SHA512 dee5e603406c8affa03ebe22b9e5c14c5acf595581023654bc4dd4eb437403871e25ada947b7ce3b3848a77f79db11f312e223ec8465f6879cb99616f3b1c152
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDalF:A3k03kB56r1
TLSH
T164157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 899KB
SHA256 8980b63d6e56ec3f9770171c5fd57c80257aa6fbe4945e36a101696c173b1b5b
MD5 063cbda66aad8fa6e972afa90dab5b04
SHA1 83794a3d71c8a21e703d1fbd4d263e5fd1a115df
SHA512 e7cd2cca66a1d8021952e65973f9700e8809b27a7f2dd2afab20c5262aab37df36904a227b41f71df58182d5c923d254323a8e95b9df1013ad7d3eb44b7418fd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaGC:A3k03kB56rZ
TLSH
T17A157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 899KB
SHA256 158a576551ca4bacbe0de67638c9d0cacc2082c8a927836db25388f5c57cd087
MD5 d05af5f8fc95041eb56416f6335e5174
SHA1 56ac6937a4363e4c08b218cc473643dae3cb2eaa
SHA512 0eb99cb36db66971f195f77646e1706512619a51105af01ec6b7b3214387f19cbdd8e7b1d774caecfeab367d621f40007686d81334cad2b9c1943aebe706f593
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaJw:A3k03kB56rE
TLSH
T118157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 899KB
SHA256 394ecd8adda2225d2a8a96835649abf36fd77bbffd6c9253f82cef5b42b9a28d
MD5 dbe967ebee172d076b06d3ae65df53a4
SHA1 2ea81d665256f1301b767b784912deafe88a4ef1
SHA512 afa568f486fc3efe7d0ffdc43107b28b6a3b0835c9a0a37fe602154aea00b8fa5a515fd655b311289b885483611f184186c18de20e7f79ae2f3c48ed5ec2768a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaQT:A3k03kB56rs
TLSH
T1BD157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 899KB
SHA256 b4a83f9c47519b4633315dc7288d462c8776081bf165e8ae59b6b00222d66fec
MD5 babc4f8008f02258740338cdcc8e10df
SHA1 1b895e50051dcdea8fc97263c5c0b47f8a5fa426
SHA512 d5419a658e0bd958a6efadb18adf4ba39a44c71638c08a84de1daf43cd5290adf596c981e5c06de89f64a0bff459f80a7368436a504d78ad89c2247d08aed1da
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDa8u:A3k03kB56rL
TLSH
T1A7157B07E6880FA5D10F81749A964662EA777C061F6093DF1358AE253F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 899KB
SHA256 c0720ea188c740d4f496cd748119d2e1bf5ec43e1c97a8f181307dbcb2ad3026
MD5 3343dd12701da5c2112a0c5820ef9f86
SHA1 45b5005c7dbf8965b95b8309f1e842906d77f786
SHA512 af497c8a712eead3b7a7aa315c4ff4627c7a2d94e4c70e292bab5717aae7c7abf0636395700be03892afb4d9969796058b801d23237076b9b7a017f61e823700
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaab:A3k03kB56ri
TLSH
T16A157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 899KB
SHA256 d38c2c430592301571997f524ab49bb47a9e76e2d377d0b0dd6c5377eaa9f144
MD5 d94edb1e6d9a4cb7c71ee89bc9d4998d
SHA1 3e1975783d3b7071242d750989b9194c0f2e816f
SHA512 71c5e8bc7989e97a0c38f8c70eff0a90fe9adb45d1219dc11d11c9125e4bc264cd5bebea5993a25b16e02e8fe63dc79dee9cda6388eb07054b46e7bd83cbfdca
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDacf:A3k03kB56rC
TLSH
T19C157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 899KB
SHA256 ffdfab28ee3f9f7c8a041a1d07f3754afc99107ca996fdcf9067987155818a1d
MD5 f8d0343475d410d2e785107f870c06d6
SHA1 ab9bc28b0b93b23ad46577263df1b9df8bffc550
SHA512 4807730b2070cb815e01eb4d061965037218ddf56bc9faf5fd86e0f149d1b41111da9e102ca3f30f86b6479c02013c966ede086a633830f002316aae5b3f9d27
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDa5K:A3k03kB56ri
TLSH
T15C157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 899KB
SHA256 95332572c5c85ae82d01ceb00bcbf9dbb3fdfc790e58772f5212dfb4ca1ca23e
MD5 da9bf7c7778fe182f2a7498f6769acfd
SHA1 c0932de524e21d8d8921eb6136943604f31834c7
SHA512 2674825b056ea04be728ab7b7449448dedf0cb06aceb4798a9215cb637c64ef12a8ed528b56160a0766614baaadaee11c6c47b85daf26317ef6a6ea166c448a7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaik:A3k03kB56r3
TLSH
T17C157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 899KB
SHA256 b4e0e1e89f31ab7bcc75b47881d2702e00b7d1b2fcad647e6afa8233f9e59a03
MD5 798e0ac656df35a950528816e6cda7b0
SHA1 5a14456b0fe417302f99b6bbda2fb4c64264c460
SHA512 3e2a6dd7a46755520288a1d1cedb143b82abe57aeaeef35692d11305f3cafe2702a6eccae4145ee8cbd8b509818785390ef4121d45235f004487365d146aa2fd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDa30:A3k03kB56rW
TLSH
T14E157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 899KB
SHA256 b466c7836cd7c07095f6d9dcb39752fb3bacfd39323050657eea2b2aae187e7a
MD5 1c616de56ce73e8b3c9959968ae073d1
SHA1 2d8c43d92c89a160fe00981248ba8ebc5e8bed3b
SHA512 f3945029915b4a8e681aa158742081ed5c7de9b2177af58a413c1c1704669228752895c6b67dab6197e3dd7068cd6360841c90567d13513c63b2bca9e77874b0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDamg:A3k03kB56rv
TLSH
T112157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 899KB
SHA256 8fae5312e4e423abe2c11712ccb58f2c7c4042e5749cc159d425c0e92ac79e38
MD5 31f531e79e76e0b4f2a14851e1481b8c
SHA1 dd834692a75ff0a61c531f07f4dc8321a00398bd
SHA512 d0067849535748b8a22e8d2be0e68766573ccc963b7560645cc7121910a363e66b9ac0ea47b22981b7ec9378a2918fd0322c2665b2ec9cc312ffc464aafbe9ed
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDavr:A3k03kB56rJ
TLSH
T126157B07E6880FA5D10F81749A964662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 899KB
SHA256 859e136039ee4c813bf3e16c334ef810070c9701c73c6e9b7b80d3cef34ab798
MD5 c37dad7d46bef1899459a700e5ce0840
SHA1 847aaa3dd0fd16d1f65632af416c2224bdf972ab
SHA512 4c1067c5e090860ea87feb040d449892e5b720038131d36a184dae9e847e8cabf6ee7e76b35847814874619a5bc84b13500556685a84c4208176105ae736131d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDa5n:A3k03kB56rj
TLSH
T189157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 899KB
SHA256 754e8a364b0d74cff823309eab2e4ae30acdf050eefcc851c57cd2bc604d793c
MD5 b18b5f23fc7b56478dece7c4f72030db
SHA1 374632c3e4609667400513ae954c583492df9c80
SHA512 3bbaea87fdb60480ad7320af66fcff50360b255eda51bfdf0239eea6319ab7f15ede48396b420313fb8c40124717d40ec818ea3c3fe3b0cfab68f1f3a1ab6e8b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaVx:A3k03kB56rB
TLSH
T185157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 899KB
SHA256 686ab642cf2a7ecea21bcebe084aa5f70af431d76519d475564ea2823b541c0e
MD5 50ed7f4db67f5bb0cf4f9deecbc0259b
SHA1 db95987e0a1f0ea04b9d4feebbc76df413f2cfea
SHA512 dedb3302408e0ced5699c44452d890d75a97121b7ea05e83505777abb4890a3bc46e7d8aa28c601aa4520431381475146f8bee6bc7e682b742b66d9aede43ca8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaLA:A3k03kB56ru
TLSH
T1F4157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 899KB
SHA256 886e1cb109c6c37872096e436ca2029ced77ac1245e643c0f6fab6c5cdf4d761
MD5 98d5ac14873f896a261fec1bc55719f4
SHA1 e50dcdf82a6aee8d46828830205026cd15432738
SHA512 8a24c807f56762e8cc4cb6f9b9c973711ddb14f2ff2fe6b6bf8d4e78c9b6500b5beedb8f33b000b58e467b093c968436df9703558d5ff2885750297d4e22cae3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDac9Q:A3k03kB56rz
TLSH
T1E7157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 899KB
SHA256 550934d5d964131e7fb87ca22d2ce34b7dcc8585aa2ad1a3283838e963526c36
MD5 fe3f0446a65eef3921dba465562b743f
SHA1 348d454653f04244ef5e0422e2fe3aacbc7d533c
SHA512 0fc0e27d035e4b12ee4fefd41d04fea3b63b1d234b946db7474ec87d6f117fd911a1c00a217c58f03c7832ddb58558aa3266cc592e0d132002f7ea5240083861
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaF4:A3k03kB56r0
TLSH
T141157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 899KB
SHA256 0a0f0e388a70c653c0def5b1f1d91b15d113ef49bb7ce11fc3257420663dbc5e
MD5 609ad72e1dac8e38439e9a85844f66ff
SHA1 472553a0964d27783783a595b0803a377aab3787
SHA512 d635812cc40d34bacc831d8a791195261ad2a3d5b1594e13ae8d5c9fa70a0ecb71aae401a3468fd04671b72bf79b13a469f715d30210ecd4eed3823fa2e124d6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaQu:A3k03kB56rl
TLSH
T14B157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 899KB
SHA256 da6b37551ed66bdd1860a45d6a67932a1b7b2074dddec30d05af0557baa30338
MD5 2e00b98fb4e3dba97d67871fef6d7036
SHA1 15708da16fe33be8a215c2961bfc4d4e674ba0a7
SHA512 af8ebaa9a587afa966b41750800ca8f5d57e3f9e2dce1876492fb1ffa79bc2951f4a49d830f44e9d7b33eb0dd5fbe7f07789f89ff7d4a96f4713d6326a36916e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaRj:A3k03kB56rn
TLSH
T1D0157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 899KB
SHA256 2adb038aaa6d04f51b7aa37805d24d9e4709a8375741accfc247e2248e2ca8be
MD5 595452ac64361fde090bd14b69e2673e
SHA1 a166604f4d313fa0708f0c3b2ce907c336edc4f4
SHA512 25a423e9c753d0aa73f9a20be3f172ef73cbb9244b9d5a21129750c3143bff5f25649c00c250a780a6abf2a4bde3c688fe609a07d0ed91e92a64ebbad8372feb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDa4g:A3k03kB56rP
TLSH
T10D157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 899KB
SHA256 98b9f831de3c81a4be98d2b9e227060646cfd1c11b1a9c2e98351d5dcee128c0
MD5 5f35a39d310c40226f4fc4657e237935
SHA1 bfceb96d5c21e6febd22521841de7f8116e9469e
SHA512 3ce6e7f55249b6661ec4ccc47b162a140a2c555f84eb75b0bcd07c819c6d6f1982c297885afc3c54074c91b0253200a913c27b2bf75b730ac4b537473ca8a14d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaXI:A3k03kB56re
TLSH
T1F3157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 899KB
SHA256 13978b7b05d96acaa4a4b0c3c3accd2c4b617c1aabe8e7b1bcc8889e4583ae0f
MD5 8cfafe9bfe7580a25f164e41a926e62f
SHA1 db1f1eda8ed73c34477f72ca9e98d287974aa28f
SHA512 bf2f35a0a4e3e5c3afa6811f7e8f39c4b51fd5409966281a4bf7b4fb00bb2d98b8f2c5139148778d672a0c555cb16cf15bf04dea4cec5653c347b412f063e9ee
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDado:A3k03kB56rc
TLSH
T1DA157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 899KB
SHA256 06decb6ce0af9ef7a123539ac16b806ac6be6f2d0309f0b48a9789f4861b1a01
MD5 84878bb46a92c416b1040124787e991e
SHA1 440cc4f35118d285f8930297f57312a05c5f8f50
SHA512 9971cdaab6e316d30963c966e51103476236a22ef7cf2a906037b931da0b2ccb43ea919483de10fd7bc4592c68d353b6ac799a706e12db2e15b4e57b2892165d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaO+:A3k03kB56rR
TLSH
T1EE157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 899KB
SHA256 be76b56d8a8d6a01c0ae4c05b60cd1b7451a171bafe84412ccd6ad91e6eb4886
MD5 71365ccf53c0467d6e407a76f5a1e9e3
SHA1 c56214b20eca27ba405d3fc433357d9220db58ce
SHA512 25c79fef5e3a54ef2ffae4b2e7f5f509742ee874f8b36159b57c76189924b4badddffe805ffe1977fbf8f252905894be1f63697f854a7998a20227db388362fe
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaOQ:A3k03kB56rR
TLSH
T107157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 899KB
SHA256 27dcaceed1c1acba830169d493609a9d681fb1294af69f805740ae68c94a9d97
MD5 02796a7816fed2e6a68806c94df7abfd
SHA1 13262e267073bba4d1f34e875b724b673551bef9
SHA512 f79b1d77a71e31c8f8c67ffb1e31bd4b2d9fc0efec1a65d2e89fbb3738611552ca6f6875ad5a6743eb6b179ca9c1e53d45273d56652408f32cb22c18dcab777a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDavX:A3k03kB56rd
TLSH
T1E4157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 899KB
SHA256 a345cbff2a8fece9c0a74dedd0badfd87682af0c18fada2edbb0bf22dbcfa7d2
MD5 2c57c907fb656944b1a3640244ffb2fc
SHA1 fca5bd4af54cd9d193b5382fe68778268c45bc66
SHA512 02a86e2308bdd104bfbd3e08c1bd727a6c9fda6c8b91c2cd1ad5ef45fda8e8399b8fb3aa166bf3e494c16e4efda23325c6a417d4ab34f16db7de8133f257eb42
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDalL:A3k03kB56rf
TLSH
T129157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 899KB
SHA256 49c08d2c0578385c431c73f5920811e93da211211145a1aac4a29426d8df6bae
MD5 ee6c72db0e46c4b42276f3b348ea2498
SHA1 e2db25abf205e1bac1b2d284190f70f63b02032d
SHA512 3d8f66b5ab16685290aa618afdea7ca50db741f91936631cb2688125765f6a228c1a9549c87f5bc640af72503996ec200268a34851375ddfc5fd45f0c9432487
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaDM:A3k03kB56rq
TLSH
T113157B07E6880FA5D10F81749A968662EA777C061F6093DF1358AE153F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 899KB
SHA256 ffc2762c97bb95729da20855af34ac3511eb782f103aa4000b5acf1d4c6bb278
MD5 a683b36ad9546116cb0a0e012360133b
SHA1 9be713ac4d256d0343d9d0b8e68ddb538d2afa53
SHA512 28302c8dbf6464eec66a3a9f32d7774a52e081353619cf0864ffcfddbee935fc7905e9911bb2b7bf135b4893e1d6964d72a5bd286b72e968727d8058eb6c5556
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrbaaDaEh:A3k03kB56rk
TLSH
T1BA157B07E6880FA5D10F81749A964662EA777C061F6093DF1358AE253F32BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1696-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5012-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5012-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads