301fb673a63a92cc8bf9488b289ca938db8d07209592d3f6a62443531983291b

Analysis

max time kernel
98s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 14:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 948KB
Sample260813-r2be4asblh
SHA256 301fb673a63a92cc8bf9488b289ca938db8d07209592d3f6a62443531983291b
MD5 fbf33027d30d08cc1ab1f904f7f7f167
SHA1 fbdd79990f70ba6155dec0ea49de9df0a30b6c33
SHA512 c931e33cfa96c5548ed1dd63816bd09b3448e83dfe1e65ca7b7384b4c31524f84395127f7895c3c1d031efa122d0f4895b9d410dd3511605de61ee0760dca9b4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEa:A3k03kHRJ
TLSH
T12125AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1776-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c53c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1776-33-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4388-71-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982b-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bc-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-588.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-704.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-986.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-1078.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1345.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c53c-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-12.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e6-40.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a3e-222.dat	aspack_v212_v242
behavioral2/files/0x000400000001982b-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bb-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bc-496.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-588.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-625.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-704.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-883.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-924.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-986.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-1041.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-1078.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1127.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1146.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1326.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1345.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1370.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4388	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1776	2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4388	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_fbf33027d30d08cc1ab1f904f7f7f167_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1776

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 301fb673a63a92cc8bf9488b289ca938db8d07209592d3f6a62443531983291b
MD5 fbf33027d30d08cc1ab1f904f7f7f167
SHA1 fbdd79990f70ba6155dec0ea49de9df0a30b6c33
SHA512 c931e33cfa96c5548ed1dd63816bd09b3448e83dfe1e65ca7b7384b4c31524f84395127f7895c3c1d031efa122d0f4895b9d410dd3511605de61ee0760dca9b4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEa:A3k03kHRJ
TLSH
T12125AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 502c74359a3696c70893465979e18bab6a8a5e8c989da476a0079dcb6eef2902
MD5 51365d5be9ec8759699d1facb3cbff34
SHA1 b25f771224594dfbe30865b5a2569643219e7877
SHA512 6e39d93e6692496acead5337c483da5b5420c8c46b3a9766d58b6bc45c85ec1f87d3a36985d85d1fc17f93e1766af60e7ac16eb4accefe70080fd1520edb8f7e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaP0Le5ji0hmxNrM:A3k03kHRJZPji0Aj
TLSH
T19F658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 962KB
SHA256 2615b09af3ae4ec64b8dd3344f68532c978c33553ac2de965f23b18cf2507acd
MD5 9ec1255d7ca8311438c7accfd47437bb
SHA1 33bd1cbc58c0c715e09fb0449c8e84974f348366
SHA512 c3cf5cfe93f3176692265eea3283bc1626f686da726350d3fc3257ac58e75f38bb36d528bc931bf7eeb88eed9f8ef52ead4a426b3b5be476a03c2ff8a7aebb36
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaRa:A3k03kHRJ
TLSH
T1DB25AF13EB9504E9E10AC1749AD65A23EB75BC56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 971KB
SHA256 968e9fc1f4f6dd3f60ed4ad6c3473d2d94d91c761d33f651679685cedc291838
MD5 d2e30abff7dee7379e34be43c7ba17b0
SHA1 6e9dd6983ecbf7c18c35b1c6866bd4c724afd322
SHA512 5304014c0f4d830381a6f8f549056e5da1d1bd508cbbd4fa156d8ee44d93240b4e2babcee43a8510e1f5b583623cb866865854c14e6181fce75dfe5654927e25
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEao6:A3k03kHRJl
TLSH
T19625AF13EB9504E9D10AC174AAD68A23EB75BD561760D3DF2318C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 971KB
SHA256 bcf3c0b132d6fbbd97b5053aba8ab2068b7add4fe79faa480340a77d26bae6d3
MD5 a38d3a68822908d03f683c445781d1c0
SHA1 e314aeb3c5c592c6c16a0a1751024e33bff26b8c
SHA512 d4a69197ca8af131425edef933a07a20df0f3899349018c6d35d482e84c45c18b2de66885854e013c766942ef6ffeace84c0ff24440b018caaf1cec28b05b8bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEasN:A3k03kHRJ0
TLSH
T1A825AF13EB9504E9D10AC174AAD64A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 971KB
SHA256 4e46701452b5ee45d42de442ae7eabbb0eb2b8127880ebbce079cffd5dfef3cb
MD5 e0347579abdc01dda4d634fdafa28b3a
SHA1 ced2e0479040760c778807401e95908a149cf4a9
SHA512 672c3cb081afd17ad57ebc602badd149a366b05c9abeaf0e3cc07b17670769d23be17d419f338ffe4318a798d988fe2cb4f24b8969358ecbfea5d3ef78fab150
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaif:A3k03kHRJU
TLSH
T1C025AE13EB9504E9D10AC174AAD64A23EB75BD561760D3DF2318C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 971KB
SHA256 8fcbda5397e67f2b6ad2336f3bdce45ea3b8f79b55083b68f4597435c87c7d5d
MD5 deaad82635d34d8c0b9f39d615dcdfa6
SHA1 e73a6dfc1df01103d4bd9e88a0e9a4e4e92c68e4
SHA512 f9165b6483a4de7520af71d8e85247a31f32094db265acf95c4021036d92466f51843e20b18eb001fde9e374d2148aac785e9b837572e950a706e032afd958aa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEa8o:A3k03kHRJp
TLSH
T1B525AE13EB9504E9E10AC174AAD64A23EB75BC561760D3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 971KB
SHA256 955042c2d4f80e6ad1b44275afe0b9d5a72e405ec4e41f71b2c0190c8de73890
MD5 bf1f20c16d7ad44b2d8495cae3fa5a3b
SHA1 bcfc6447bce6139ac848809c85fcc051c849a081
SHA512 750022e9b43ecce7cbd14b27043dc8ba03de65dd711d67611a53231f8b1d3d63810a20cc4a0ae30c93956b55d5c49b98df3773e45ccfbe90e055714200366daf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEacu:A3k03kHRJL
TLSH
T12C25AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 971KB
SHA256 a97f05f6acbead7865353f43ae0b72407ac6db37b67d2a2cbd29f22848d94fad
MD5 ac904341e979d6bffd04a50adf0fa477
SHA1 eaf9c8d8839f33c4fbb48560672f2d2eb0db1521
SHA512 5a5e9386970e94fcfce5a44821bd31671f938126377cb85fa55f8e99a7632f9f2e3d64279cf4ab9a4b7e01c223753d33fbafdb1e64f43d31fdfec2a45d9bed2d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEag9:A3k03kHRJq
TLSH
T14D25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 971KB
SHA256 e76b05a601d4cc969704b443c948a9ad7450f73914a240d5a8205b835e90d77a
MD5 6aa8de8401e4bb6ba28071fa80788c2e
SHA1 29e6e976d410589fbb0eb430bded6eb1f942a53b
SHA512 975fc541ec0ef5a20506a828aeebd2b9c444fb8ba37cba6f24ec206bdaf21783c9b2a0c2b5304e128a8d0fc85f13f334c3b1bcb5bb3d352b585d4f3478d4fa67
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaoc:A3k03kHRJH
TLSH
T19B25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 971KB
SHA256 292acb6c05939c416d33629e251766cd89b432b50337b84c65af486d49fcf705
MD5 0178faa1b08ab39e470937ef9dd0bb0f
SHA1 fde0f53905f044d2df3c9930faa0a035326d935c
SHA512 cd64c6688af93c7d7d758289fcb3b14584c5923cea44236909f6b5dfe0454a2b5c61cab0c4e18bf5474de3eacff0d9362960d477c2666c5361f066877a962e59
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaBp:A3k03kHRJd
TLSH
T18125AE13EB9504E9D10AC174AAD68A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 971KB
SHA256 37ac58c5b9f7673ff3606886956f00c63eb31c9766a2bad2bff0552f17026de6
MD5 716c753221f4a02b1d9a999807701edc
SHA1 88c5564fdf2ada20ff277662b54c5d0a70b2f583
SHA512 d0537ab9a4e5fcef2ed360eb945b2a6bfd7c707f79339567132a36c7738b99a74623b8e5313f456365c88b020afc2d606712ec99e7d3aa966cc05a1228d384ec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaWN:A3k03kHRJm
TLSH
T12425AF13EB9504E9E10AC174AAD64A23EB75BC561760D3DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 971KB
SHA256 7baef79c4a56246e31073f71cb4c61910b14aacb3fdae268eeb316251881bd02
MD5 910450db9fb4db501dc7233f85d66b3d
SHA1 e84d0b80c1e0400613347bafd61a2db7b9059d87
SHA512 6d35ab7b261e2df5441103375c26306827c1f1cd2e12fb302e5df34d4ad2bd4d69e704d11364a12e68ee381e0791cca2a23944d9337d1704c146eba7124f2cb3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaaF:A3k03kHRJE
TLSH
T14425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 971KB
SHA256 27d309305c25fbc56b7beda38751a3ea8364ca151b2b2ba56d2a94c577e5778f
MD5 fad164fab2d7d73878635350603c6270
SHA1 0124009e1629231c9185697e88ff4860b2cf8b32
SHA512 e8a5253c334ae964b6cebe0987962f0dff5007a7ff3dbbee995abd442f540b26bf314abe9d8b23665e7e91271b3b8f11b1c56a75162fa9edf1eefb5054fe225b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEavC:A3k03kHRJw
TLSH
T1AC25AF13EB9504E9D10AC174AAD68A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 971KB
SHA256 ece056976a5d91930b3c4d0a954792fee5f48fae7c20e9a33b143af9a3e790b3
MD5 97807eb5fd562b833e4b07152a5b746f
SHA1 a2d874ca37fe66d7d499006c9439cb97ca465655
SHA512 144f165f76b4d02f1b372a92d6e3f4f07b3e282cde36426426d6a37da4db69bea02fb380ad17a83106b48997d9671440f7ade3a8a56e16fb3b16580692e8f9c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaQw:A3k03kHRJN
TLSH
T1AB25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 971KB
SHA256 8fcdfab621a51227368c304d297bd6ef2b218e79010d6946fed105205f4d8c27
MD5 dcaac92ef981505bde25bf1fda716d16
SHA1 23502eaeb9c651ebcd4ccc60bc0b170b60e2754a
SHA512 018bfc94bbfba4f012691ce30b6da8889b89394f5c4493ff8ad844096e8d7bf4bc9fff34fcdb7735709cb1d31130d5ed322ac4459a83fcaf490e7e43df1d3bed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEavT:A3k03kHRJB
TLSH
T1D525AE13EB9504E9D10AC174AAD68A23EB75BD561760D3DF2318C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 971KB
SHA256 06b3e6b75211ca88ac722e3a1ab5843fe123e6b556ffe87536ab7f974a61cf40
MD5 5d50d42a4cfaf3f564d87b8647015618
SHA1 4ed419ff3840423de18d81e800a429844014e8b8
SHA512 850fae43ad4df5e3b274b4f7089cfcdb62b539ba20c9b5cbf314398939d89cda1f2fe4c078a6ec8044de4b36648270adc7e1cc82743cd04757dfca9706beecc1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEapu:A3k03kHRJ2
TLSH
T12825AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 971KB
SHA256 e0827f21bb37cc6105f58b7aaa1c3fa2414c84c3f729496ba57a0da720e5e6ba
MD5 1974af555895f2216856dff0ab685364
SHA1 9602e110d075b8eb86e6dc248a02057d984863f8
SHA512 65bbc7277235b33c337ee303d51eef9d9cc0a0c82c0a19fd745fbec7c648f7ca41f795d8f78b5fe0f0feb8039d2abd08c1bad56ce541c89f97ce941abbf4243a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEahb:A3k03kHRJH
TLSH
T16725AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 971KB
SHA256 feb1822a410c47b7c57a63f6d0655947be8e31796323dcae38ab7a8fc262d502
MD5 1660e97edd8465b25fff5446d3226ad3
SHA1 3dc1ad0c61652dc822c02bc2c559cbe65a7daf02
SHA512 0370b2eb5e1df5f888178c6eb4ff792556851645df6b06dbbc7bafc625d5871a2f3e154d7c0c8304a133895c98259161725fa75986267228192212c98fb86398
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEapf:A3k03kHRJv
TLSH
T10B25AF13EB9504E9E10AC174AAD58A23EB75BD561760D3DF2318C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 971KB
SHA256 fbc646a07ae575e2133dd6c6d83edcb403c7d9d1bb2140ee4e7c4333ce2dd35d
MD5 2a3e9f50dfad62b99c4c58a006aed590
SHA1 c9bd7d1074a952425acc61f9224e55f43a8b8bdb
SHA512 908d0e02392ab863aa147a05ec71d72b8d9465bd222da09620ba703eee7cf0b02e96a301f1c3e88fae1685ce5b56a5ce91fc3386a603e371509d0c6dc156ce18
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaSK:A3k03kHRJP
TLSH
T11E25AE13EB9504E9E10AC174AAD58A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 971KB
SHA256 e046c9d7674bac82e7fb632414163d9bab733d88a1588020b35b5e6be40b12cc
MD5 8e43d70be32b1e8c31d6521f9bb008bf
SHA1 8a79423675b37ceb5d1665ab86d25c7f1cdaa39d
SHA512 c0a3985cb22e6c6e9b29d7bbc49d7542298e84dc63dbc988521db7765bbd0f9e17a17a6f07f76d0dfe21ee1025a8c43b623cd4fea8ada5ed9688a0b24b71d3ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEa3k:A3k03kHRJa
TLSH
T15325AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 971KB
SHA256 99f94092b40e1a610bc889c6bbabff141fffcc5318dc73171da7075a9f915cba
MD5 0aa62efd6834cc41b3da0fc8dc082131
SHA1 b480d8c3a09f1dd11e1c269dd2d350be6ec0ea68
SHA512 310782c7244b7548021b8bd08924a989d7b4fe67bd87d21ad9dc866490c38b90be132857ac56eaf8c61b200f4d70b2df525e7b9b5ef3301925daa0a8f8bc10da
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaA0:A3k03kHRJv
TLSH
T14125AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 971KB
SHA256 fb622d3c3de4a7a102b102d99dfd39deeda5562ec73dbef71bb648fcf9f2cb2b
MD5 5d112e406289650905d9495d5a04367d
SHA1 e66e65946868b88080d5fd98533bb8136b48384a
SHA512 6fc7c662c92b8edb8b44bbdec0600b9a3a3666496c089044e87341ef19d9f642f02f59d874a29715fd0511fd5cc06614690b62ee8d37f9566222ef2884bd0a3d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEabg:A3k03kHRJy
TLSH
T17825AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2318C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 971KB
SHA256 cabf0008df32d778d97c019f44324116400a75f5f531a29dd9fb971272472e5a
MD5 50aa847a849d05706e5ad66459cdad25
SHA1 60e38c2bbc5d623bfa9e38dc1bc1e1ff0231a3d1
SHA512 47d09f8cfdc2ff363d31982e6d5c15efc5d8d7773a72aa08f5edfacf86e637f477245a4db1fac63f8c04e031d458677919f9df8294d168429aac215055ffb4e7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaWr:A3k03kHRJ8
TLSH
T1FB25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 971KB
SHA256 f9a47abae23c41af06df0786099d31d547ded635ce026e7195c07b7200c6d621
MD5 200082f4bf02028a6e80c8e09a676c8b
SHA1 5383d16723251078162c61beb99314a1e23b348b
SHA512 1cc63f0cffdd78c0dcc6dd57e00a182b61a8c3265a437bf5c9f9e97ac7df4f40e5e1c31981d3759814f6a0cdf8e982cad7ef03aaab76217e3c4f2acf2944fdcc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEa8n:A3k03kHRJG
TLSH
T17625AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 971KB
SHA256 7749c6517868eac8d57adc0a7ef697e336f2e809e7c58da83765198ddf85dcb8
MD5 0413f9b5c70759c591c7d974fb608bd9
SHA1 e0341d41183a373aa97247bfc4d7772c67fd46ab
SHA512 ca1bd59a59debdab677cce56cabf8bb4eac6410366904d45093e6dd61b8fa167b796d3fb9203a98c26d20d18dc00eab74ec045e4438e52cb643884498e7af6ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEa6x:A3k03kHRJc
TLSH
T13425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 971KB
SHA256 7d0b4c94f153892a788feae60294c23da656c693ae78e41cc44b4bc8971492ce
MD5 222e061b1265906e8ff9e0f6d0d59315
SHA1 6ca62690fe126746e42c039df68718b423017584
SHA512 d8d7c240efc9bb86d0a726a3f265b4dfe474ff005b24e16545d0fe94ba5743847b029e44f142dbd2dbf69c24af9f5898dfe719998504437b7d3e0746b3f4df3b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEa8A:A3k03kHRJn
TLSH
T17925AE13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 971KB
SHA256 91f1de47171399700e0812a9a0146cca59a5d66c8a49eee0741be71f25eaf072
MD5 dda1ae0c39e4d201a4b08191e2e7c5e5
SHA1 0a7cb00793f4bbc1a6f7249ee4fa85094f7fd651
SHA512 9e34e179764f822021ecb28ef530281806f7d9c04ee157524dea0c1c4c684a002a4f16ebc8e3ee17261ffd5e7759caa0cde31eb29dcfd676fdc261e3bbb3f642
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEal9Q:A3k03kHRJK
TLSH
T1DF25AF13EB9504E9D10AC174AAD68A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 971KB
SHA256 ecd5405728139d5a7f81422605f6507244cd5e0de9095bd69611312d814b17a3
MD5 5466e3bfc22f8eafea4f21a1a565f647
SHA1 7547e7b6003c89397c5b417801ae2098e8658a23
SHA512 a52b5c2051b96efc9ebcd5c0a0a1d4ecedc1539e213947de30e631badc7c75f5f7167cabda06c2e2435361d4467468394fb48daab4559e74bfc668e4d2cbca35
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaQ4:A3k03kHRJJ
TLSH
T11A25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 971KB
SHA256 aad08fa3a6f383b4baa9e581adaba0d2052fea25cb4ecb4a92bc0fae29a209d8
MD5 c8c11d05eaa57527862780266da094e2
SHA1 4af31f92fe968e8cd96f8355119a47569b83b8b6
SHA512 1a466b01dfc9659adf9221b136fd483c4d381582ecbacd57450055283c27618cd3855ebad95cd41b51d9a4a67a84d8d4bd8a309d0bc7f4dc4618412c0dbdbaf8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaTu:A3k03kHRJU
TLSH
T11425AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 971KB
SHA256 b8871d0b62bcb8f1673dad3b857e6cd2f5be80ed619ad3662ae4248a5fb42d81
MD5 538599b71fef917fa9d02b79119b54f7
SHA1 f4d0ac2208b6802f8d618a99507681ef318b1d6e
SHA512 0895ca38b3edba8c404c6ec65c40c72350b7445ed66ee789d0338dfd5a19f1ede6dd4b2682339f02c47c5aae48f039da0f4011d030c96ebb7a49950ff480539d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaOj:A3k03kHRJ2
TLSH
T1E225AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 971KB
SHA256 14d85a19b69b1889ba2f1125fe85ef09eb6f3d083df9652b8c43ba3658e1288b
MD5 f39a6257c1d488f7154b8cac6ecb05ff
SHA1 16f2e8a2f08337a2f3dac68d5b0dcb0145c44ce8
SHA512 0756e1b0eb29027a34ccdc3ae8c6889f84b8cfca7e455a191ae3416afe795621e2a984b23c6ede2085d40a7989767dd641c94b82fdee0e793546c43898ffe3e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEa7g:A3k03kHRJa
TLSH
T13525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 971KB
SHA256 0a87ee22ab52578623f69efcdbfe9f3589e415a162a400b95e17d765d5818773
MD5 f816fd7c03ad093447e92f2f82229462
SHA1 9c06999a56d58ad2a3ebd7de666a030b32b0fbd3
SHA512 1f484ddbba62bc778bee3cde62c1871dc33c52aa169dd449257433951bcf72c745a8744e327b1f46e8558e7a756ba077edcf63b432df979f6df39b1d2c96dc0c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEamI:A3k03kHRJb
TLSH
T1DA25AE13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 971KB
SHA256 d967637cc39806d2ccd8b71ef8250e539acc096360974e8594d2e519270a9aac
MD5 d72eeae754bd9bee6384f8fa836bd0b5
SHA1 f5084dec85b414d979c73066e90c7a37e2d6fb29
SHA512 6f7ede1aea03b6373648fed26c0e633fc406599c566aaead088d53db2f9e739e448baad917db80ee250ad2863d70187bcaa81252079ba9bea7ec4e38af688b76
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaUo:A3k03kHRJl
TLSH
T1AB25AE13EB9504E9E10AC174AAD54A23FB75BD56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 971KB
SHA256 581b7a9667da3fadea02d4b297824f6f9fdb1b35aa392cf67e9c519072fa258a
MD5 b1f29ffa8db45021f78f68062b2dca98
SHA1 545a80d8dee80c614787d3ebab434fe0339a1e97
SHA512 08b7793f6bdf67aee27d71e99b3a64ddc3a1a77621a226ae57b2670809bde19df6eca296b31959426f9ab5c41837f4e5da57dd0cc11089a2dc08993f3c883be5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEa3+:A3k03kHRJg
TLSH
T1AD25AF13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 971KB
SHA256 c5dae2a61842573815e7399d90ac899f971c962d51c1bbd3404c8643177e1bb9
MD5 bd8476f2ea4c8e519198c68cc7a08d42
SHA1 f67f1577bec6441305ba821cc635fda702b3b409
SHA512 58ae92c730dbaaf9abd9c18cfe4ef1c10a4a0898110c33d0dd4d67a01ffc4839d243bfc3289efe4141cdd20ed5aa38a3358f8f841764b30d1b6706d5fc4ce065
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaNQ:A3k03kHRJw
TLSH
T19025AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 971KB
SHA256 aac559a435bc001f490a6f6901f57d568e5c39f75f06d1331f14f728cc98f281
MD5 7a019116a92809f05c8747d26d696d5c
SHA1 637073a85a86e277633b6c028392f3eb6f43a82d
SHA512 9c8ac3ff825574db41490bbfe82470a217c82e798b3dfff3bf77aa7a5e55cf22ef86d901e2bcc5d80ff20b41ec37a81c7867eabe8c915f00b8df499397a3c78a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaCX:A3k03kHRJA
TLSH
T12E25AF13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 971KB
SHA256 0d08d12f40c54d79b7f5451ae16bc1ec55a326dead53ec2f5e744e1a445578e7
MD5 cf617fdafb0ca56fdf47759725aa2430
SHA1 9011b3746af70510533f0c0cbe148920b92ebc04
SHA512 49be73a787182e11476ec9171e63d862cd92a339a702b01d2a8358467156c786d4771e82c719b4ed2e5f0b467d14edcaead7e565cce8c00bf687da1fb7635115
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEakL:A3k03kHRJi
TLSH
T1CF25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 971KB
SHA256 7c6cd211d2c7b28609325c1d0c7f54cdc457c3616747ecb1117ae8c25ebc14c2
MD5 db0beb63a3134cba757636b86c0e0ce2
SHA1 870f33b17e8608a0114eb42a66f6d13a183d5ccc
SHA512 afd9cd91b75e264cb1fcc198c69053f64d4b643e2d2fc73596e66991631827c51a86b39ed8bc23988ae76b1af3a541b9a8da9ccbbcedf8b91697eedd7ce7533c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEaAM:A3k03kHRJv
TLSH
T12E25AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 971KB
SHA256 e089dac0ced5de964a30ae06bf56c646b327ff88ca0429d69dd90964b20fc7c9
MD5 f7a0a1d716ef727b713c3d3393d57631
SHA1 669565b5e479f5c7d8d764738012c0ccb3217b38
SHA512 d2fc5475c707ea8eaa3b9c82fbfba5fbb7a457e21ed89128697b58e7fbadc0a080f0a2918b20e8b90910a26b24fd366a620cc8c89f3cb573934c401fc544f2e8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKga2xEahh:A3k03kHRJh
TLSH
T10425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1776-33-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1776-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4388-71-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads