240698d67641bbd0ad9710c0ce94ae667e5487e5f54ff511064d1ed11b0f96c6

Analysis

max time kernel
109s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 800KB
Sample260814-2llk8stamd
SHA256 240698d67641bbd0ad9710c0ce94ae667e5487e5f54ff511064d1ed11b0f96c6
MD5 ff73754d46cba6f4cfe09db4c4d18629
SHA1 26b46ae3b85f5d6a712ae374cf42c27c4bf62a72
SHA512 eacac99a8359dce09f3e7cf1b08f25f3ef9023e7a1fcd68f0eb6d1e6d3f857a1b597eb582de96ed94c3f751bd58392fcca5f342407f89e0fde27c9a7280c63a5
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0lba81HfMf:A3mnXoZ643mnXoZ6i6cMJliLaba81/Mf
TLSH
T140059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 48 IoCs

resource	yara_rule
behavioral2/memory/2868-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c48a-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2868-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4116-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb6-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000189a9-203.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a83-210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-229.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-266.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-423.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-516.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-608.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-633.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-724.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-749.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-829.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-860.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-879.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-899.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-913.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-927.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-940.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-959.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1014.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1057.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1088.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1150.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1188.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1202.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1299.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1350.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1406.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1408.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 45 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c48a-6.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb6-60.dat	aspack_v212_v242
behavioral2/files/0x00040000000189a9-203.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a83-210.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-229.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-266.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-423.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-497.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-516.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-608.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-633.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-724.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-749.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-792.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-829.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-860.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-879.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-892.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-899.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-913.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-927.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-940.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-959.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1014.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1057.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1088.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1136.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1150.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1175.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1188.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1202.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1299.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1337.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1350.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1375.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1382.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1389.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1404.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1405.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1406.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1408.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4116	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2868	2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4116	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_ff73754d46cba6f4cfe09db4c4d18629_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2868

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 800KB
SHA256 240698d67641bbd0ad9710c0ce94ae667e5487e5f54ff511064d1ed11b0f96c6
MD5 ff73754d46cba6f4cfe09db4c4d18629
SHA1 26b46ae3b85f5d6a712ae374cf42c27c4bf62a72
SHA512 eacac99a8359dce09f3e7cf1b08f25f3ef9023e7a1fcd68f0eb6d1e6d3f857a1b597eb582de96ed94c3f751bd58392fcca5f342407f89e0fde27c9a7280c63a5
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0lba81HfMf:A3mnXoZ643mnXoZ6i6cMJliLaba81/Mf
TLSH
T140059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 7b1abb506fdc9dc00cf81a0c2abff21bb3355b34af0e6057d4d9f83b2ff2e3fa
MD5 0048fff926c881a3846d3c8d37759eec
SHA1 28582103e357142aeada49eac7de3e29d6e75f01
SHA512 374435ebe31138102eecb13d078b85f2dfca942456a0915fe17e779b250c4e1ddadec90ccdb52269bf73c5d80ee2fc9c842b8b2129d31bd099cb6ae9fefbfc7f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/ML0Le5ji0hmxNrM:A3k03kHRJUPji0Aj
TLSH
T1F1558C17F6A402B5D027C0B9C6D2A65AFA713842173096CF1399C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 815KB
SHA256 66f17106b231f4af66b38a09cd2c75661be53ca0864ea0b032dc6ca77f29fa1f
MD5 bdbd0f3cd7eebc7942cc40c5fd7a9bd3
SHA1 5c15b4c154648f1f8f8b2c6dd9ee3962ed896c1c
SHA512 9f592e773176d5bcb879e258447a7087b60476a10a1a9659da4926eb711a6a9b85819c0345a86e65300ea8c6d0e222ea00397b598030ecdbd37f84751adfd4ee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MNa:A3k03kHRJ
TLSH
T167059D03E79500E9D10AC1749AA69A23FB75BC521730A7DF2368D6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 848KB
SHA256 0b622e6c6b5b759945008d3caa0c512bba5c6b9baa1415242c5bfca8dc84f940
MD5 3b5520bcf8a7127c405180e55992374d
SHA1 c25ccfcf470c314180057fb3e61cba6afe3ff1f6
SHA512 2b70eca30f8feb2dd025a7d9887e3997d4453f352f84f845e3a38b8eb60addec777c1f28444b3aaf4dbc63c90c8b001ceb93b2508a5122112dfb8fe167c857e8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/Mub:A3k03kHRJ9b
TLSH
T1A005AD03E79900E9D10AC1749AA69A23FB75BC521730A3DF2358D6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 824KB
SHA256 63fed0411001d83a64d1d0e53f895d73a81ffddc003298ee9f3db0b1b68468b7
MD5 6c307e15c9528f9a4e498a117b4f4863
SHA1 c650c6f0f025b7d54b73e9658b7ea1cefa4f6155
SHA512 90fdd9fc7747f88b54f87b3c527dd9e7d50c1d31410d6747f5a536ea8443dc1b3899ca643722223b50067af9916a92f27b1d675b332ea1de088d87d91c746ef9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MtZ:A3k03kHRJa
TLSH
T167059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 824KB
SHA256 aed699b42563999126e40c417698294526fe2536a814c97bf9757160d5252e17
MD5 b1f01a981ed983c700e602ac17b6ae81
SHA1 ab0134bbcacb7f5b6fe15ff0a8704f741b8e7c6c
SHA512 c99e8acf7bdb2d432b62e2cd02f52c29cde9b3d46cc494748da06285fe9ff7ce8ef2f348dde401deb8932e5256ce87925baed19195effddec0df0119e355bf6e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MW1:A3k03kHRJ1
TLSH
T1AA05AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 824KB
SHA256 992ab5f01c170687c3cc049fa50228680e27bea719dba105e789549d7b889561
MD5 574645cdced8ab7eb40e8a7df0dca04c
SHA1 c2c87f02b279f0c7699af24fbaa28cf0b7e89f4f
SHA512 fd7bff848d13f06166d44cc76e86d3f7989983f25a7fc22e45ad4f20c6dc239918d85e27fb1381258aa3c187a3172d528fcaf306afef4a89613a622d3d75b91b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/ME6:A3k03kHRJC
TLSH
T16E05AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 824KB
SHA256 3b7a72024a47e4ef13dea92edf488328963620505c57a657979e2cae07a70b6d
MD5 914b959c43a41f69aecdb439235be9a9
SHA1 ae943e8fa764bda37692f7c4952589cd75aa84d3
SHA512 d9172b2bef3f67e62492af21b6baad23996b2eebd95b5b3ea3d780cb85634deec2b853d9ef2f8c163735c841a32846f07ebd3079455afcd58ffe61a697fd2181
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MgN:A3k03kHRJr
TLSH
T16F05AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 824KB
SHA256 4f0374ce070cb69cbd021e8597d68640bb46a9a8f1181e5a5b2a49cb8c31e2a3
MD5 09cce22ace187d8dc422a3d999bd717d
SHA1 8650dc692283545a7823dbd13c7b7956c0dfee01
SHA512 1d049e3fc2190df3e11768b545416536af92b33f0579b6fb6e2474b4ce546a0f861494c4daf46b17280076486828c17e6e01d0104dbf48a40ebc125d3aa665ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MOf:A3k03kHRJv
TLSH
T14405AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 962KB
SHA256 5eef2a08871d63c29535751109740db9a362ec8308e3768e535481fd93e38d20
MD5 fb5263e03a202d3de0da17cb79080a58
SHA1 66bd9a4ff9fdeea1d51529aad42e9d9a853a360f
SHA512 656d23c0866016fabda02009a6e377fd4ef998c10827d3ea570f7946a443cb87ede1b1619eefc27dd71c5ca258e03c1f350fe5b2f2140076536dc138bb432518
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/M1zy7:A3k03kHRJ+s
TLSH
T15625AE07E79500F8D11AC1748AA65A22FB75BC62173097DF1368C6162F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 824KB
SHA256 17a12b18f4dd2159cd6c2f87a751667c1f07f67937f413962a58585b2c879c21
MD5 2d6dd3443fe55976949eea7c05397b64
SHA1 1341ec4d55112f8f056970b8f6215f7c1102c02a
SHA512 106663147389bdd49996ec093b51c176b7a431d5553e41a6909811d521878d071e0c8d352f28de06d151ebb1af9c4d280b940488183f52700f65e8cf8d0362e5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/M4o:A3k03kHRJm
TLSH
T13805AD07E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 824KB
SHA256 1e9e1fa0a00d1ce692ea883265eeeb531056ddb13b0218b584a7e0c0e9e6b123
MD5 34079aafb77f19792669660aa531d17e
SHA1 90ed64a7f88ad5a87fb39beec01cbd00ba70bbaa
SHA512 af392341686bf52895d11be6051f0a5c189906f8e3dd809a3a2783eb466a0b567e878b2fc0207793a3c3fbe2f64e86e210597eb8a7804f48f2af2b8759624365
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MIu:A3k03kHRJw
TLSH
T15E05AD03E79500E9D10AC1749AA69A23FB75BC561770A3DF2368C6152F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 962KB
SHA256 aa80d7e43aa583d15e3b3a0b2b1a72e1055c9729556d6960edf03c0700952984
MD5 fc2837077463f5b47031561507468eb1
SHA1 8d4fa22f5dc427955a3199961552411a7cc84dfc
SHA512 276e46c095d1e97f66058b66a636130b3bc7f80293e9e9c09e72a4703aff74c6eea8a8e2e6d28003106a7ad328d9d66597ae9193727c4c23dcb94f292e7fa3e8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MEzy8:A3k03kHRJ7T
TLSH
T1DB25AE07E79500F8D11AC1748AA65A22FB75BC62173097DF1368C6162F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 824KB
SHA256 573fbb3405ed9f18146e76c1f44b3d3a12b63335a285fe03bc2c9c0dd624a0f6
MD5 b215d694768bc65bddaae660b900b0ef
SHA1 f9224f8f428358621cfb1dab890bde49019c00d5
SHA512 80cb0f7e4b79aca748c6fefca71ef891402b964a45cf47f5dd1c3816aa90113186901b9cc76f4ed82e51d322526cab3f2655d189e15a4711e2f0302109901a08
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/Mc9:A3k03kHRJF
TLSH
T1D9059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 824KB
SHA256 c0951236c692dfb3508ec4aa8fa731023a7a5ad44bf337e2fd97c5d7bd94b643
MD5 7f5771194fd0ee6e3a0341b340eb5398
SHA1 96f340efad4ce53ee724cc1ec1d9508814dcca9a
SHA512 da5680c8e0f829480cfaaa6cac876b7326077af0ceb9054e4bc4c9e5b0223a1504dbefae4973127ca4a2dd0836ec67ce8915786d5e8fa2f5fb575431b84a086f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MEc:A3k03kHRJA
TLSH
T190059D13E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 824KB
SHA256 fd6f4b21760a2012166ebb34db8957eece079cf8b270eb93cf0e5971b6374c70
MD5 53722da6b8476e0674b1e51b7b336c58
SHA1 6410a729372d1be7e1c762c8a204f760b32c77e2
SHA512 0e3385463a4897bb9ef86d12ca8b2ef6a1df66cfb73d9a109cd8eebc354ca71581267d32ebedec3b95a15fb8d247b423afe00fc68a0bfc13dd01f0d34effded7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/Mdp:A3k03kHRJW
TLSH
T1AB05AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 824KB
SHA256 2f2cf1200c7d80a7d2702640250f51b8e90a25ab09897446e21e53544b932015
MD5 e3dda7ab159c991b50de8736743a1813
SHA1 43ea046921f104c32a74bc1142e56d8b6bef3aa5
SHA512 6754b7fb5137589937e863c0f34d4c233e46e9141c9e2663ba88ea544bf2256aea243aa170c1cf45002352d12cd1d5f88bc3f61bc8b3d44483d85c6a5245ffd6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MiN:A3k03kHRJZ
TLSH
T16F05AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 824KB
SHA256 d20d06523e9e3ea972a46e151bb4cf60db5fae3f97f9513fb6875161a13fd130
MD5 9611e63cf072f0b9662ed37d295a756a
SHA1 9629b4cf600f48c9685fa003993c5b3956309e2b
SHA512 e664fae4d86a9a7e669f45aa9b31bfadd29ad0d8b6063cca8f159db112d3c91c1ff7105b8652b2c935fcb58b7b43303e901a95b98fdababc5d0be6bd63a3d13f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MGF:A3k03kHRJL
TLSH
T1A5059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 824KB
SHA256 f0b5d80e2211e57b33b5a96c3aa49bf95cf2195436982545485ac9964d9bf075
MD5 6300579c0d3855ac1ad5d993aeaafc77
SHA1 b18311683446fe675707dc0e1df36cce09b3f62f
SHA512 a7e35933e5504426cdcc38de649f0075bf6893e835b350c02817f9b0e56dc2b94547d4ea01fbea6da4edd2da9d6b8dcd457ca1eb5e5e888ea42d60227293daeb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MTC:A3k03kHRJn
TLSH
T123059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 824KB
SHA256 515dcd092077116baadea16368c13d343ae0e2bdbdcc525863b5d9afd027cdb9
MD5 dd4ed36312efa276c16ae58ef5d357d2
SHA1 88aa4ee342b9f90054d3c91f25cdc50a316fd0b8
SHA512 16d60c4a687aa0d60a0243338830a29f2239570e2b03849e32000d91fb64afa0d01b91ab6beae7caaa8059c46604d12e06ef275980d22aa7e21ec4379ba0156f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/Mcw:A3k03kHRJC
TLSH
T114059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 824KB
SHA256 392da05bbcea2eb7d76bf6d31610757e4ad445842326aa4c87ff35710ad349fc
MD5 c4b4666b3e3d0c5b5f4c1e769c430443
SHA1 dae422180a664f221b010d16225aec1094501b63
SHA512 99f8e9526289bd79ad85e82b84474d7bbfbd83375df2ef59fb3bae372f736a57f2d596f0b3906e75c5a20f37f3cfcfd813b808fe1c7ba083bbc7e2c7b951b5b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MTT:A3k03kHRJy
TLSH
T1B7059D13E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 824KB
SHA256 6dd3895e549ea4d6be9b9400020a25709735161683288a74b9cbc45d3548fd15
MD5 239916f35a89b422723b2de72a913bb0
SHA1 0e32201a44f8babef3d2d00548603920644065eb
SHA512 5bc27c0509b193b5232ddaa027e524afc6e4ad6164ce943912b49ca43e66e14e2a1eb8406042194d6f468adc2b4f449d488deb1258edc9a9860390b320f54aa8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/Mlu:A3k03kHRJ9
TLSH
T10E05AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 824KB
SHA256 266c1ec0be263cc79a0a0c41208fe727c619bbc4df7bc6e137bda2cdbf2e408e
MD5 9cca1af53dbe876f1954fa10eda99417
SHA1 ba7478f6b4986ccf672c6af9d8d9fd1cdf88e3e2
SHA512 3ac01e70d82bf82400d1b00068a941df010fe2dc6db55129cfbd7c847e1198f83304331c082de3431335aa8b333b619dd0650444c4b9f431ec24e291e32a0adc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/Mtb:A3k03kHRJM
TLSH
T10F05AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 824KB
SHA256 55dc539209aa6079a78256f259767bab038053cf4f42b302450fecb197797aef
MD5 ff439cadc88814030e11bee7c8325f47
SHA1 fa4814c42c356c17249dec8b479bcb10cf83dbbe
SHA512 3cc86e775d20e523c1abd38e3f221aab73bc3aa8ef3d005a4ab57bc4bce4304f2388c7c994ebbb0bb868734bf89ae45edf7541cc7f1e1131b29122d38212746a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/Mdf:A3k03kHRJM
TLSH
T1E505AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 824KB
SHA256 7f711c54ec198c8129d4e09fec7345899ecf1ea3eb1441ab9972da795d3a6250
MD5 78a34dd26d1687902e668003fb0b4845
SHA1 88de2533d56d8843f14b16ea80472bdee904a2ae
SHA512 6003a2d86743f986a4c62d37b680b4fc3618e50a60ac8b1b91227ae3a36254065d184fc4460412cdf09a85a22d388e5f42fe7c7ae88a50bf17d030f941ea09c1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MGK:A3k03kHRJ8
TLSH
T118059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 824KB
SHA256 ee367c1325583ca13273f6a9d24f09944bad00af21068b8bbd5a338f4f9e6136
MD5 efbdc344e61fe90009f257bbb4a16ede
SHA1 314fbfc8fc6cf7fa949dd1547f24734952846278
SHA512 47ee8671f79792a9e510342affb69a948f10d860ce984b0947f793791be1d4a05b187fec83dda96fbeb1e9b59608bd11aff46235895ff2efe514673369d284d5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/Mzk:A3k03kHRJF
TLSH
T11F059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 824KB
SHA256 53a2783b54bfe5a89bbf35b94b52b076c73358f8272af7b60fae1f5a50b4fb7f
MD5 ea6761ce50daf423bd66a36b521d7294
SHA1 aba1a8f624a10a81bf1268f80af06435a4837300
SHA512 142b1ff0bfdec0f508c490336d7ede8a56175358966a4d95c4e51a79d65a2924aeb6a01aa8c3ed585cdd05c765ec6afe243503a0f1b8eba704828053bf95a0cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/ME0:A3k03kHRJ4
TLSH
T1DC05AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 824KB
SHA256 a827736f6b8dcd50c6b1ce7437ad9dd510ebeac46dc720f627159968f735b255
MD5 54ca1b5c390f39930787e9d303c71332
SHA1 43fc89a7c66a6114dcb23ff685c603647cd5666f
SHA512 c0017072b264547459553ab13647762d0a384af7c0cfa71956d6cc0d118cf1ed375b504300895a45fe7aee2b888e90a1541d48f885da88acc3b114d869bbe546
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/M/g:A3k03kHRJd
TLSH
T15705AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 824KB
SHA256 83117c8492732481f78f3d04bb43ea44d165bbf274a6eeff8e077260518f5d27
MD5 96e48f6ffa32ca5a99bff58f33582c46
SHA1 e91c20f60974f22faf9ffc577dae299e749a3627
SHA512 0e431b49c6d7bd25a6bc0b9e9907ed0ee40944c8f24f952ac700493db78583e406b3f06fae0e0749444d1ebe1723f2adf52ee81405fe21bda766ac7716c2101e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MSr:A3k03kHRJf
TLSH
T1F4059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 824KB
SHA256 cae03f8a7da70043ff5ec6e18258a82b5e88495ef0ca2d14bede2fd3ec959b5c
MD5 b842346299fdcb8eeddbb20f662f31a3
SHA1 72da685a904ff543d56ca68c87c167ce06ff1435
SHA512 20ad84c0baf27cce65a48274e93aaad3279dbb3a9c33dabd82bf6e215a8c6f6df0c13de41babbc1150f45f2bd1e1e3fc8a867d307f5cf0d260a7e301fd6d48d5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/Mwn:A3k03kHRJZ
TLSH
T1A7059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 824KB
SHA256 3a91ab296123fe90de3e1339307bcc779a144a4715188a18be878c3b64ed5328
MD5 927253f9e6a23897407b67fcb08d181a
SHA1 78deeb1c4327491430cd12fe64a855fa6c24c3a9
SHA512 38345be9d9652d05757b12b18a9da640ebf5b4df795a62af5889fd7caa4b2fd317aaafd6decf4e204775273ca1e324c9907b1f176e30211e3621901972407ce7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MOx:A3k03kHRJ3
TLSH
T15B059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 824KB
SHA256 aef99240b8ed2cbd3525073b1fa9932ff67b821e96f9b9c66dd84d9b0a14089e
MD5 0715094235f122f5fe6dd133fb48375c
SHA1 7daedc71962b93e234b4ba8101466a9922723dfa
SHA512 81d21d76c560c24b0605a6de67a2545843670b0548456686c46fda9638c1ee5f80cb4dd0ade35773c9a76b032b26206d924bda1dae32782558a1bd8f832ef066
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MoA:A3k03kHRJ4
TLSH
T1B805AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 824KB
SHA256 68a7631c0472d0e910fa6c5181b3154b0a0038bbdc6080fd3dd75662cf0d30d0
MD5 2899d7096f569b8157380b7651f59862
SHA1 5dd170fb6c370f9c29bdbb96c49403217d26e7e5
SHA512 88e47cbac622f6d4010dc6d538c83da03c2637d4577b8885005d907059a44fecb0173ff263e320206c43b6052a69e87389944d2c70dd507e1a683c24998a4fac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MB9Q:A3k03kHRJh
TLSH
T133059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 824KB
SHA256 2ebc12c0cfbfb633da5753b564e1c72bcce8133e2b5e5f1228ce4441104b5a94
MD5 b658721f6ee982f479b03d740bf9ca1b
SHA1 54a8b73b4adbe0598689b4cc40adfc438f7e2255
SHA512 93a5287c97c3ec548833d7733f8daa9739905e3b42aa9ec6179a1571f68e6ffc0f686e9a5a123509269e47b00be24e4c307ce3d88afc98f4efc36b631fc0b8ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/M04:A3k03kHRJG
TLSH
T109059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 824KB
SHA256 8b746c64a173b26304c02d3f2bfc32e504ee67d9284a4012d6b8065519163a35
MD5 14f0be3ff23739ba059c1972d0876a30
SHA1 4da18d9465c3f20b8a3b2004560ca8701475aaf4
SHA512 b3f479c5e6d22a690677d140085951fca03a833d7d75f4178891b7f22408554be4e64d65750f2aaae0d53bd826a1eba5caf63c46abbcaa1442c71e823966d1f1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/Mfu:A3k03kHRJX
TLSH
T10E059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 824KB
SHA256 a8919e0b8c1cfc983dc226321eb6fa85ef651dcde8aca5f133b1a32e6e8bd1a3
MD5 218829b1b3f4dad0c0eb7707fc6862ba
SHA1 36250ca5e69f5f4a7c25e779a2bfe4cb77aa0834
SHA512 4b0ee8525fe98016c2a122ab02375af8ee957ab78cbc043eb387ef97e85f993e8daddbbf51aeb03f8704fa4d618d2f00e92b80ef70af6bf143d7ceec468ba17b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/M6j:A3k03kHRJZ
TLSH
T13205AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 824KB
SHA256 608cf7ef4787389847d9a4c39c8d189acc4b467b5f30f89f4cab42129134dec1
MD5 c1944ef7c1c4e7eec9a8e4fbefce448c
SHA1 2c3b72686b7e20b8b7b44e02b9649d749d011f9b
SHA512 a3b10a0cf957735c526688df73ab0b7c4b9854e7a20d7e6f7c021754e405095aa4a8893ec35a8bc9fd9c00c49114097af4f5fcd52ac01a242132d1bf2ba426dd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/Mng:A3k03kHRJt
TLSH
T178059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 824KB
SHA256 9c318abcdc3f7458a1ee057afcb40c7d4c8bcfdc0158a43dbeb3fc63b6396d17
MD5 a4a5e78687f5f907275948512abe5b80
SHA1 e33dc7844c76ac73bad48998ea8440ae9f264a31
SHA512 5ed3b801c8fa53a1b01e0094ed0d206ad4068fea34f43c1b25cadb52473422682b9f973d8f6bebf090dfcc23aa8b99e7e63427b7237dd1f3765276ae7949d201
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/M6I:A3k03kHRJk
TLSH
T1AF059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 824KB
SHA256 2345e32b707224db9e5c8d507890bc4b2a19b7ea3c2eae870f363f226efc2b64
MD5 bdb7cc7500634ab59d17304d63031166
SHA1 6f19f42ea7586ffeb922e03ea84b1304d1bf21cf
SHA512 85ce46f626014e250838f4cec769f9bad410fd606a3d81e03cf5686f8b9019bb8bd697f5ee761699f0ed1f5abd17fe317083f7367a55750809be13256f1ae33e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/M4o:A3k03kHRJW
TLSH
T19C05AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 824KB
SHA256 4f4737029dd4e219510a5bd7fb2b9dcf08ff045175b876e7fb83e593d71d3df5
MD5 64e6495dbe6e9e0488aeb22818305003
SHA1 3bfc4969e386fd6a171d63165a768a476c81e6e0
SHA512 f6311353efdb3e15b392a154f42b8434374ac80c513661067f0344d32fa8a62d09bc3136d71105bbe967e8337a057d92cc33152546901e084b59df2da466a8c5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/ML+:A3k03kHRJD
TLSH
T14B05AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 824KB
SHA256 2fe1dde0f461bd714bb235924876e623730f5ceb8226cd8c2776ac12dba7e693
MD5 14044e6408a19200f6b1f9dee6ae9b09
SHA1 084ad19630f8a38df7be8d6f3f68b182a5c51b6f
SHA512 c9a723d729a59829e2b6124d8a0519dd4a8c6a2d2008145db422e8dc4257a00272ea18439a94e8c044cb11b09689c852f0284260f08420798f5edb7e70b83c9e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MBQ:A3k03kHRJX
TLSH
T17F05AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 824KB
SHA256 a634c07da8643c5b1254f27d11f6f8a63843aba1674dc0d8cfceb07c381a5ed1
MD5 cc7e99a91386b6e6d748f1e58cdb9bfa
SHA1 e3c42c3f6ce71c248bef7c48e56706193cc12b23
SHA512 6b8b8615e074f8b5e6ed2a0e5f09f24bb3484625fb0965649ca4d3f0e255f9786b2bd163fe5de37061ab0bad0f8cfce91ae2b612795dbb5628e71f06571725a5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MGX:A3k03kHRJL
TLSH
T138059D03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 824KB
SHA256 c0abeee6b7270c6af1b933a5816c7e3bf77352b6e97ff34b11d541d257b121c3
MD5 b1e92104a394864f07293b1ea4fe6ae5
SHA1 fbd2fdbe299ffa8bec2d4aa72257bfe0f1a881c3
SHA512 56be00325ec6b21ffbd389342f6c2d7bb2ebba8ad2538b11927894dcf0ce247d967b2adb798ba202e5e891a75c2e05c6191682093ea3a0484d88a0fd731cfa02
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MAL:A3k03kHRJF
TLSH
T10E05AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 824KB
SHA256 74b41a20dd269a4a87950cb5b536722fc056d4a319d5281873ef1e9a75336323
MD5 3e839b0b274edd27f27d27ed6f765863
SHA1 1eccb6d624d760fc6f524a07a3cb633eb8db9067
SHA512 83c922af3fd5737036c124e33c39add770eeb449a38940de11871eccfa18314e5b551a27ec8f3591fb59f034fdb030de48c367bd257ba922e30f8bd5f635788e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/MsM:A3k03kHRJ8
TLSH
T16E05AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 824KB
SHA256 5a6ddebd2cc4a1d1835893deed6a50f7ee8f4e569f84b3f8a0f4b58294ef0d97
MD5 f4aa657a72409db4f67797c1d8b94876
SHA1 f74274fd117b3f78850e45804e77c68cfeba5b1b
SHA512 af4b6e0c0b534eefa576416d59ac23c67851e151917f3b1e0707298e445de26bc346fb18e996257595799f5a3f2c9af3d06d9bca91b3170a5469acde0aa7ec2c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba81/M1h:A3k03kHRJ2
TLSH
T14B05AD03E79500E9D10AC1749AA69A23FB75BC561730A3DF2368C6152F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2868-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2868-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4116-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads