18d03a4b549acb59880fabd94449d10c5a1bad367275afc2e0434016f2f7140a

Analysis

max time kernel
98s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 930KB
Sample260814-3f7f7acf29
SHA256 18d03a4b549acb59880fabd94449d10c5a1bad367275afc2e0434016f2f7140a
MD5 8725db3cb2a51ec8150b3b91e5211bb6
SHA1 e26c8cb92cdde29d47468323475d33d70904fee9
SHA512 c735e5f1f92215b7cb9e9e1fc69f3deffdb0e5dcbce9a6ee6d0738e2c21397c454767924f5069c5d9ef74f3bcef68dc3cbfc6743f0fb59b97948f0ded5006476
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapT:A3k03kB56rM
TLSH
T1AD157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/1692-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4e4-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1692-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4772-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e5-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a50-204.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019840-253.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-478.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-510.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000018a52-601.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-717.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-987.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1061.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1122.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4e4-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c2-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e5-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a50-204.dat	aspack_v212_v242
behavioral2/files/0x0004000000019840-253.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-374.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-478.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-510.dat	aspack_v212_v242
behavioral2/files/0x0014000000018a52-601.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-717.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-925.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-987.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1042.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1061.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1122.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1378.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4772	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\dotnet\dotnet.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1692	2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4772	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_8725db3cb2a51ec8150b3b91e5211bb6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1692

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 930KB
SHA256 18d03a4b549acb59880fabd94449d10c5a1bad367275afc2e0434016f2f7140a
MD5 8725db3cb2a51ec8150b3b91e5211bb6
SHA1 e26c8cb92cdde29d47468323475d33d70904fee9
SHA512 c735e5f1f92215b7cb9e9e1fc69f3deffdb0e5dcbce9a6ee6d0738e2c21397c454767924f5069c5d9ef74f3bcef68dc3cbfc6743f0fb59b97948f0ded5006476
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapT:A3k03kB56rM
TLSH
T1AD157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 b4ba0eb4b040f16dc434019ca2a6222f55561313d720a4021a5b4f7ba2da833b
MD5 b14f6b55fc1733af835b3cdc60bebec9
SHA1 31d204d2827cc561a467ddc2df6d2cc55526d829
SHA512 fd2993118a7aa1fc49ac0ba995858fb6b0cdf871418b05709d1d826d366bfeee4c618a168d59675bf01aeaf021e94255d4455dd8945d591f18be3c3599d80cb6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapP0Le5ji0hmxNrM:A3k03kB56rUPji0Aj
TLSH
T12E654A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 944KB
SHA256 ed6fe5513aa4fcc26804f9c5ee3f7fb7ea63ad893d77a893ab2d06cc9dc48233
MD5 7209cce5ab2b094a6efc73c0915edb0d
SHA1 cbdc358730fc43cd981b4839a96fc56701312e84
SHA512 fd43061b6858d93f2638205ac4b8f930dfcacc7caeaade2a58df8d55e34a3ccb5a08b8b962879fc72cd42693ef722bd5f046c3873278b52b35199444c28c7a63
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapRa:A3k03kB56r
TLSH
T1E6257B03E6940FA4D10F81749AA64662EA737C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 953KB
SHA256 89c209b1c93638d20592227e85f018ace9f9ffd1d1d738439f8e207e6bc78a12
MD5 b8284f813112e5d3672c1440c1c80c7a
SHA1 74db0402e64bc7ed645bbebcb7ecf51c67a91cea
SHA512 55f04d7f9117c50e29724bda185bb95cd2cde371df87e2b8435e8556e751c356400887218e8995e67073f889db43cc49283af0f3175b88ca536ecb0115589b42
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapC1:A3k03kB56r1
TLSH
T1D1257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 953KB
SHA256 4ad584f203590868793f8d7610dbbc2f66f4d361e4cb7d4743b5dad9e0484aba
MD5 f258732b80c447602f9b18c5575a03c6
SHA1 c19223d5f91adefcb83c9a76f1fc4c9bf7806fdc
SHA512 ef657db34eb648fda32535a5e4a66ffdba437b6fe3c9ac70257500a1debb64d49cf002a9909ec564f5ec81c063e5d97bec22efd9e3a6eb627f347bea0c7faf07
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapo6:A3k03kB56rC
TLSH
T17D257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 953KB
SHA256 9c696906fe1d957f6593eb16c4cebc6139965a7a20d71e51e27ae2e82ae7c5cd
MD5 e7edfdaaa34c2141fdd16da8de2ce78c
SHA1 d8701d5c9c52468ae2e8b4321121df51c12700af
SHA512 dc45999887d566344f34ae7348ceeb154a4881733d4ca0213b837ae80b0f83581fa4d7f84b32ecbe191c2fdd349af0bbf15267a88b025de8eb3f66960e3c09ea
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapsN:A3k03kB56rr
TLSH
T12A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 953KB
SHA256 a2f39b5d2fa3b9f30e4c8e353d48776f462ad9f952d4089c62254c8b6f9fd44c
MD5 900ff87e583c082fd63876c848123681
SHA1 dbca539f1db895123e0a6ef067cf3bc98fd76376
SHA512 4f0636cc234ba10528d4e5de9565a676e13d7e19f9f1de07813fa92f996b92aca575be8b8d54b21a3a769abfef82720bda7c3d08eed6893d7666eabd39c31e0b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapif:A3k03kB56rv
TLSH
T1D5257B03E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 953KB
SHA256 4ca9947c6076051ebdf53aa7658834c6a2a02fdeaa39e6539511956cfc5067f1
MD5 132a13fa0766ebefc09b3f98d6efeab2
SHA1 f69187aa4fbc209a667ea67299db10eac815aa00
SHA512 e3498d49acf8732fde45f1dbd71af5e46d62f526f333ff1ca646eed29eac6724029f1cd278bbae698b10bc42e22752f8e7cf7ad4cc8619e8455b7a277179f670
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaap8o:A3k03kB56rm
TLSH
T15A257B03E6940FA5D10F81749A964662EA777C025F2097DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 953KB
SHA256 e86f394e892291637ac01e450d6e2e94097220df5024b69137f91b8315f4f733
MD5 b34cdd4b77d8f11bd1251642fa547d8b
SHA1 8dc56378b3d10ba71afa7edb2e3c2987b04062a7
SHA512 da437e689650291f115b99bda1b85fa60ed9537a30a1521c478878ec1a956b6b19ffe066062f229c8450ea2aa276ac41f9bb1f657daa093465deca15c21cd0fe
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapcu:A3k03kB56rw
TLSH
T1E2257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 953KB
SHA256 abb45aab4c664aff53451f99103d0f2e285efef915705b7685b294c05c16947a
MD5 b4bbb26ab21d184546092b20da2cf8eb
SHA1 7b5d624b511f2831c1a174f186b5727aea5b3460
SHA512 e05ef9af4e8ccba368f08eee381659ee61d42aad336daf5a2ab78e65c5dc7f83ad9e0cfc58cdc45a51b431ac430d8ec069c77bfb7b3e98f3c1791ee41fca0f90
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapg9:A3k03kB56rF
TLSH
T1BF257B03E6940FA5D10F81749A964662EA737C025F6097DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 953KB
SHA256 a89be221ef1361a37aa6d401b61d2420d68a616367bdfeb1540369c4e0fe728c
MD5 d15dffe2fe164135dc8e4cbd17f37f51
SHA1 2f89784f349220161d8df3ba00717d3b30524013
SHA512 52576ef16d6a9b6bf5397883185a785a4c13e8cc3a5868cc993d76fdbdc8107254df2d91094128201e15bbde96e8424cd80cd9a7aadbc334c28f173452ed63cc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapoc:A3k03kB56rA
TLSH
T1A3257B03E6940FA5D10F81749A964662EA737C025F2097DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 953KB
SHA256 e80f80e791dbb9410b8d1a164b06554369d268002b8f789366e8ad9c84fa0752
MD5 85d01ef4089212cf881ed969c96ca798
SHA1 2f4e1a2e12e9674aa2298bc228fe3149d854141e
SHA512 59765df06f3447d9959d68f67612c841a85bb55321160ea1d7883fb446524634a9898860d658ca626366ac3ac4335c03ad0a7a169aa7ad61688e7c62f135cd43
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapBp:A3k03kB56rW
TLSH
T15C257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 953KB
SHA256 bcaebebc2696505df6fb304d4296c417ddafbd32287e490345c004c2beb1f1ad
MD5 1b82dfbd1deee129a5a128e4f50c496f
SHA1 e3395926151ee34151e9e2288ee5951fcd92ec2e
SHA512 2924f08e4d6d4a6cdb68deda86fac714afbd5305d472f7605ad54eba9500b0a6432bc49ec8d01448f189af5f05b5b5786b7152729cb85675dbff7e41b1aa7639
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapWN:A3k03kB56rZ
TLSH
T147257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 953KB
SHA256 0bf254492cbf10e1c686db96ac6e4528666f35ff3bb89bde52ebc1fbc6fc50f2
MD5 cdfa7a1672e25cdd5442580b98a69fe1
SHA1 d44a807411cb7e27281ce232c22fed17b1a530ef
SHA512 cff153a91f7cfe129b7cb1835caf7762c65b10210113c4726b331917bd70737e9a47c5497d9861d73f98cc6995a8618cf6daf64022af6f2b6da89dd35c17028d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapaF:A3k03kB56rL
TLSH
T120257B03E6940FA5D10F81749A964662EA737C025F6097DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 953KB
SHA256 bc5c67d887cc2cf047056568cbd5b96477d5e73d02f6645662082c6e27a662c8
MD5 1a5d7d6494bda4303390124533685da5
SHA1 70d1484cd4f5e28aa8bad1927c376c9a09f27af3
SHA512 623fed804bec62daac8eafbd06220cf1a24c79709a973619ca37ac98a13a965f6f6212c23cd5db0999c96d982e5a2b36055607a8e22b606ab889390048bab766
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapvC:A3k03kB56rn
TLSH
T15C257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 953KB
SHA256 a0b06cdcce5ab47a5fe847872cfaca0318a88f0f7a0269e5a5edb1f8dc8acbe3
MD5 a14c24433f56003bb417226be40855a0
SHA1 4180055911d59da9df00082c75dce644b3442e18
SHA512 53c5941b72e5519df9e92e80d8129aa599f15718faf840306cdb6f9e7f36dbe1a1706fe326b09fd831d7f9f83a96d2ba272637c3440ceede2cef40f7459a7257
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapQw:A3k03kB56rC
TLSH
T1C8257B03E6940FA5D10F81749A964662EA737C025F6097DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 953KB
SHA256 6866a752545c070f79161490544acbc7055e4e325c98ea7ac7c9cf95b6aea260
MD5 ef94225259970b5105a7cecd9884c39e
SHA1 ab6c669b9a0eb2a20290bc56be87f29416e1fdf8
SHA512 ff686a3e8850ed3c988bb511a7a83f7175ffe35bd54460221cdab4cdd591b15783db829e8511fdc948598de06f9b5a343bbfdfff1873370223cf29b5c0bc08f4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapvT:A3k03kB56ry
TLSH
T197257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 953KB
SHA256 e4f974fe345c9372f0542f74c2e50ed12b9e344483bf022d44ad97a2634f04b3
MD5 c360d4c1feeccbddbd5bb152d2f5a619
SHA1 579f5c09ead4212e9094976b14ea2cd19b0ba2e2
SHA512 3ddae7af01bd8eea50125e159e087d6e1b4cf9c08492f505992185da958f641eb7c187f50801c644b2529b045ab8561b22e135c7ea03e6281bfacacb8e3b40f7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaappu:A3k03kB56r9
TLSH
T168257B03E6940FA5D10F81749A964662EA737C025F6097DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 953KB
SHA256 c23dda701eb85f5a529cfcf93524c971f04de351432b826435fc4108ee9c777f
MD5 46a8b6cc89f23668162ca74696e34d08
SHA1 38842014767585757eee34dff4fe1ad2d5f690ec
SHA512 50c0fe77838ed292152b1502c952b908407d76475202b147f766c57e238c42e33d89b6a4513a6440d35f5489b47283478cd631306ab6b2e4b0f14c91c2597ca6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaaphb:A3k03kB56rM
TLSH
T193257B13E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 953KB
SHA256 aaa3bbcadd3914b7faeb841fe9abd540baefef1ec716c1d5f57c70e4049af696
MD5 f606bf9c5468d9a1774327efcee4eefc
SHA1 6abf337d5c6f3e3f5381ff51801b540c264735b6
SHA512 ab047d150dcd3e219ac64e966cf52f2ead950fdc410840a6d49893e232ec96a8090b46cd429b667fc936fe399b00fb362e49ab7300ad2a19a06c723a0f79b636
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaappf:A3k03kB56rM
TLSH
T1FA257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 953KB
SHA256 b0b02419c9380d182a2bb7d0e71d1460eef4df6a93e66c3f418913071bf1da8a
MD5 a8a97f3418fe8777dde1373c4f74fd24
SHA1 4e15f4d4553b3aa6d0f67bbb007cce7a62b6e048
SHA512 20470d3ec86da2ef4871b5a8d00e1f71016ba7409bdad27e8888820711c7b7104162ed00850327f766089d033de3094f4a4f084b215ba0d11ffbad71562590f4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapSK:A3k03kB56r8
TLSH
T1F5257B03E6940FA4D10F81749A964662EA777C025F6097DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 953KB
SHA256 38330e0b3e416558df63b9044f0e441f260ff48f82aef26463f656f6bd933a56
MD5 4677f843c883d28a7632e325fb1f4046
SHA1 22d77477a7c148e8fe51bad5ba7ca0088cfb7826
SHA512 0b6a620c481f463f0314d1f29367d45d654639ab76381de294105d08650a4cea9f13d1d458484dbe3bd55fc84208a8b404b9aba16e3263b72c5ed98e9f42dc4d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaap3k:A3k03kB56rF
TLSH
T19E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 953KB
SHA256 24d679c4f74f84f3b3337a9bb48d3e92dccc9758132a25d34c04ec2cf70d8f37
MD5 59fca127cb5b891aa30862a2384cb445
SHA1 e2bfe453f087383d013f129b06c172a8cccc1cab
SHA512 6ea50ad82e1a46b9ba405178d683c01652660887f9c67768defbdc5113f947a298143a61cc6f0dfcc1625e20317b4df2a93ca5a9e5ee720ea58c05bd76dfd54b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapA0:A3k03kB56r4
TLSH
T1FE257B03E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 953KB
SHA256 482e2507fb937567bceff6bf53fb5fc55d69bb3db48841ad1a8ea7bd5ae53931
MD5 40873a70a723f072d84d5a23fcd180df
SHA1 0fb7e37e61c47857ab1305aa3bb551d650823b20
SHA512 e8ac0b2a03bce47bed7148cf5d5f0f643e7b7273b5a91f0f7eeb68d03a9d9874abfdb54ff68a0698d4013de7ec1b47151f311fe69e7a734aa9cc3df0536674dd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapbg:A3k03kB56rd
TLSH
T1F6257B13E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 953KB
SHA256 724eec305c0c8825db8d507061cd0cfa056d993374fea2a54a764da0c30aea89
MD5 da076d9e2a290239ff9e4d9ea1380dd8
SHA1 639d83e86eec538c8a348f0e69e8a03769725977
SHA512 4ed536574fa6930902f1bda9a49c5fcaadb4dad6dca7cdf04f615dd85e1e7e022764876cf8a2e50a260bbca450d509036255075158d88a8b722f6151a0a06750
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapWr:A3k03kB56rf
TLSH
T1B5257B03E6940FA5D10F81749A964662EA737C025F6097DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 953KB
SHA256 f39a1f55d62c2c139bc56ca0e53c2a7e296025a59d0f56fe86ab59378627bf5c
MD5 75622bf8c9f5b84a8eaf19d82b13796e
SHA1 274982b56a3996f1b415f2e40de438297c3a9a59
SHA512 64a43f7c6e9bb712fec7f0c3358255d398aabf117b84979276cec1d8b8c4a09924005ae73329b0f76dabf7f03bf427d0a9f4d78b93cc8403350f6cf922e44586
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaap8n:A3k03kB56rZ
TLSH
T1F4257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 953KB
SHA256 694ede38898a89e964757c4506c03cd88a9277139ce5ea0782290569ca41c0cd
MD5 2ec5f346c516bb943f2e8f7d36b8b9f9
SHA1 164373af4f39efb4ea8d7e26954e94d667087049
SHA512 89e31eed825fa28486baa48e534e51c237db57daaf44ffa42f3aa4c4c4528a9a9adca69c24a3360b0bd866c8a2afe4211da429ad7f85d6917908d41b9f53ea12
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaap6x:A3k03kB56r3
TLSH
T14E257B03E6940FA5D10F81749A964662EA737C025F6097DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 953KB
SHA256 76ce78382e98b807e05ecc8a6284f342891ac5d76987832352cbe407b8feafe3
MD5 1e550fdb1e5489db259c80db9b66bf92
SHA1 425de53b903c6fc78078cdfb28311bb380a70497
SHA512 2937c2e287a4279b84ef1e23edc20bc7992f1d7338385de4ede3d198bc0fd5ee643783dcaae98d8201e87fe313f5c77e66554e73b0631b887da3558b02f7d352
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaap8A:A3k03kB56r4
TLSH
T167257B03E6940FA5D10F81749A964662EA777C025F2097DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 953KB
SHA256 28dbbd74ddb1a4527e3585a1c1f1a03cec3058c2528c0b2ac52acb4de8a51846
MD5 4dac85296bc3756b42390fc888e919ae
SHA1 68cc1c7da73773c7d775f8db461a63a8e13b2514
SHA512 d54779595a555d0d7ef786b4179ef2d92eea9e5ee22ae82c0fefa14586d2b56d4a18e33714c80cbe078b82f952a2877d10ae18c3b480c54add432fb6aa6b37b1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapl9Q:A3k03kB56rh
TLSH
T17D257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 953KB
SHA256 6f9e176d298ba155eb283988a92c51e14b3eb11f42ad378a8fff4b2f621c4aae
MD5 8d621bb8c0f0c335cc193f979284f7c4
SHA1 fbd46fa4218dc38bde95b8cfba54799c8066b2e9
SHA512 059f5ca316cee764ec1bd85de3b727d998a231a41ee0561aae74aa6d4ad499a7e917fea5952352a6bcdb7c5700c6f929b2d5cdb43ca406db41a0528fdeb68a5a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapQ4:A3k03kB56rG
TLSH
T1E3257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 953KB
SHA256 90b8d62b139aac01d8b6d587a77b4437b52be5992655f84dfd3a1d2f37e4e4d8
MD5 4aea26b2a939b213a3378431a8ef62e9
SHA1 d168f1ae97d65e0132b7dad2b3c861d3fff4059c
SHA512 1228b3138e02d31ef74c2f974572efb01fbc6f8d65615a8705533f9d911c033c13514e62184c1a1775a9569d74aa87c21ece92c01a0b6b767109ee46f73fe39d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapTu:A3k03kB56rX
TLSH
T15D257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 953KB
SHA256 f367a0286a68c9625ec102845e7e8cca3e6e8ddc28a21686542b5da013405753
MD5 0903801670fcb95861fb0b7e78e2b060
SHA1 9333942f516a3ae34d3d1dd6017124b15001ea54
SHA512 d87d7188004268eefe948f6aad8386daf3894773929fdd018069842a00080c928b810e1dbb8f138ca6af327b9ba36590636b15359d082dd7e19388a81845bee5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapOj:A3k03kB56rZ
TLSH
T181257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 953KB
SHA256 67110c226e63b9c052b4e53bf84ef58b71cbb07a740a33d97cd251b94eb73c6e
MD5 1b605fe0d2217c5051a1e278e287891e
SHA1 9f145549bf4f0c60339228f92a174d77556d73d4
SHA512 d45114fa91b813a790fc7f43b46c8cd9721ae820c421b3b4ddd68a949c943981058d3480ef22badfa421ac40fc60270a811671d3e829633499b9361436c41444
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaap7g:A3k03kB56rt
TLSH
T10C257B03E6940FA5D10F81749A964662EA777C025F2097DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 953KB
SHA256 f57e6638d013ab99a1020e1e2d8b7085a34d09b4d935b1258b5e401c94e715a3
MD5 e1715878a17cad0153b5fabebfb64b93
SHA1 12d36b5265c115287fe7b0367cbfc5b595c4b5ae
SHA512 0998f68839bd76c78d5e57690c531e875b42f54550e6ae77dab4651aca1c45a45ac09b4d979c040f12f65b120c38e552e48f8bb4962bef8e487e9e0973e558a6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapmI:A3k03kB56rk
TLSH
T1FA257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 953KB
SHA256 065279424f112ab134590159a1daaf5fa23ab17f04cf2bbd6640ce63cfd7c460
MD5 6560a281a9dbcaf5c1c070e738455a67
SHA1 ae96b13e5d8a72100fdabb4109444f24168e30d1
SHA512 fbb686828b67f937c85ec293fbfc4e830a6fc58a00fc6575afa118be7d3a1c78ca9e6b06df118edf762bc9dd2945915126ca54afaeec45f7eac380c2853d313a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapUo:A3k03kB56rW
TLSH
T1A1257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 953KB
SHA256 2989d39c6d995445a4f78c4b3eb6df058b8158bb6b7aba2a8659d3265a45a771
MD5 b79d581cb8ca3b223377409fc7545c3b
SHA1 51316c1bc0f1f13cb025ccfd0e2756fa5253a40d
SHA512 91df014e5596791edf2ddee85aab9ba195937021a1a07039a2e5532e6e2398a8c529fe1d8ad9c91b762e283276813cb59f6e44f7c85a1ed447c6062af93ce31d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaap3+:A3k03kB56rD
TLSH
T1D1257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 953KB
SHA256 155c1e54ae26e18ba2fa19f629f76860f94863c44205843bd31df80723b5daae
MD5 82d246da44e45469f0b41dab2050dae9
SHA1 a5974bc969eed6c19ea97e4364146ee19e205ed7
SHA512 8875e6766b4749dde14c193c360c80591198e158347cb83b62bbe1afbb44150f4b425114285b951e589c735397ff0d32b8621373bd7d900602dd7163bc72be44
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapNQ:A3k03kB56rX
TLSH
T142257B03E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 953KB
SHA256 7fa7ef8015c73319e71ad6b795f0fc54540e9bb98213f812f75e607663119e50
MD5 a5b1007779486c7400541fbbd5211df5
SHA1 607ef38c1052cd85469dbc97906b2572f182a826
SHA512 629d99d4a114788d1bed5497c09034a5c22364c97e2997202132a87bb603f9820529e39c35cbf9fecb46e64f3ce9e38ee493003695d1bb60abdc70d530f95f65
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapCX:A3k03kB56rL
TLSH
T1F0257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 953KB
SHA256 6f17ee47148e87511fe8a63b5d967f81650d5a42f39faa054827c762dcd05176
MD5 049cb94295e704aa92be61b9ff6fa8c9
SHA1 c63cd8f987e281d0f9ae6c8455ada0872d07eade
SHA512 7f9fb692e97c377f47e574ffce96cd63cec03a2579a85db19154e6aa86048943a917ffdaedd5f226e01c86b7f4935d15e1a3d50eb4546cd57a69cbde8074f342
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapkL:A3k03kB56rF
TLSH
T1A7257B03E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 953KB
SHA256 d67e4f639722fea078d3f35dbb57637784027b1f6cd368b811dc7dcae767c60d
MD5 ceeb60d11ee388907bd9ccbe3d335c29
SHA1 6a1bfc6dcb83f3386103f15c636d5a0d191b37f6
SHA512 cf7bee350dfa5af80df3d887738f82416fd38c107bbb1e1394c27e6b9b37f62cbda8d6e81b6b27680cb431e3134c33440c42b93ff73530c08242ce86bebe9cd3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaapAM:A3k03kB56r8
TLSH
T1F9257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 953KB
SHA256 89f22e13b3f4e325982025e630c91c9ab1a50d184e2a11955fbf26a63395566f
MD5 c7501771bf3417a131e66f2424c499a9
SHA1 99e4d36f83a12c02437a8f74181b3008aa35c575
SHA512 e28272ad641d5953d973097c2f1bd1abaeb24ffd5b8625833c93bd929dd39ce6ad9baa9cb942657e497f32439947c1a442cf70eac23001bfd1cdb817b311e009
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLLaaphh:A3k03kB56r2
TLSH
T1A8257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1692-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1692-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4772-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads