de1e84c37f6f6782c9d715e037123f83ea97f34370d18582bfee3606e80d036c

Analysis

max time kernel
98s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 13:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 915KB
Sample260815-qbf28axapd
SHA256 de1e84c37f6f6782c9d715e037123f83ea97f34370d18582bfee3606e80d036c
MD5 c76e550ec1f12ea4a2f42ea4abe3a072
SHA1 d96aadb54257ddcd7015d5acefca4d3041135216
SHA512 26d107ee7b368f43cda18ae8f9edafc1d223bdbc8bf94246db0170698d8b7df9cfa61715b8e85369eb80df70adf8ccfa7b85e6e6e59a3ba7e2d4aa90e837dcda
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLag9:A3k03kHRJy
TLSH
T14615AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2440-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b815-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000016cbe-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2440-160-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5420-161-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a6c-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-253.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-434.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-568.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-611.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-660.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-766.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-815.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-923.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-942.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-998.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1000.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1160.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1198.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1314.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1394.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001b815-5.dat	aspack_v212_v242
behavioral2/files/0x0005000000016cbe-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a6c-228.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-253.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-434.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-568.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-611.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-660.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-766.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-815.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-846.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-923.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-942.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-998.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1000.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1043.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1080.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1129.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1160.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1198.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1314.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1334.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1359.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1366.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1373.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1386.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1387.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1388.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1389.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1394.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5420	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2440	2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5420	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_c76e550ec1f12ea4a2f42ea4abe3a072_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2440

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 915KB
SHA256 de1e84c37f6f6782c9d715e037123f83ea97f34370d18582bfee3606e80d036c
MD5 c76e550ec1f12ea4a2f42ea4abe3a072
SHA1 d96aadb54257ddcd7015d5acefca4d3041135216
SHA512 26d107ee7b368f43cda18ae8f9edafc1d223bdbc8bf94246db0170698d8b7df9cfa61715b8e85369eb80df70adf8ccfa7b85e6e6e59a3ba7e2d4aa90e837dcda
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLag9:A3k03kHRJy
TLSH
T14615AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 f14368745bdca841701ec508553f37015d25529edf5a979622907221c268043a
MD5 4173a16007b6b50dfa8619fb63660753
SHA1 eb4c90a5b10766b0dde6b55c41e7ece663d3a756
SHA512 f41d449d739df2896a9e8e3cbe4afd2b12b8a732fa9a069ad4b5291f4e25cdee5a435cc5ea5761af95deae1a5d33de96d0b3d67a371d24a796fc9f1194f96664
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagJ0Le5ji0hmxNrM:A3k03kHRJyPji0Aj
TLSH
T154658C17F6A402B5D027C0B9C5D6966AEE7138821B3086CF1359C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 930KB
SHA256 1fef54c01f3d782c91b697ce82860987f6042fb1d81d5bc646d0b1ba10549dd0
MD5 520661d8b0750d16858747f71da98c26
SHA1 1e5038162f1a5d99216e748c87cd24599db0f237
SHA512 46886306800abb8d45398d4c858d048dc2fda81a1f88105d90558e7594c27e0b5cbc4ce9ace8330992da057924e7dbdab891fdfd6b010d2e4f1fef126b4fe529
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagba:A3k03kHRJ
TLSH
T19215AE03EB9500E9D10AC1749AE65A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 939KB
SHA256 59fa6f633f7a4db9ed0f947ebbc5c0df3a9eef7809137c8a3eceaa7723ec00cd
MD5 d0fd51ac2ec539ca3874962696e30c89
SHA1 6619b36d100851cbd313740ccc00c444c056f6a3
SHA512 1546697ad402b00e410da563c9d718546f7a803f174909e7e78d5c929e9859e5cfbb7fd7d1d44e81610a0d6b4e34d07c22bee59222508903f8565240b5d6c5fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLag66:A3k03kHRJc
TLSH
T13915AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 939KB
SHA256 4cf3d68d8ed98a09d8c82dc1f1d5801d8d305dc7b75e948c3eaa75f8bf26ad9c
MD5 cc28744e7dc3d8829e58b8a80cf3d8fc
SHA1 b71a3fc40ebb68bda79f45d4db867319d7ce4019
SHA512 4d0bf2a50178e69bc86d45e0a76483dfd775c85dcfb74d5d4e66fd88a82a524b44700cb4c90b110ffefb2f5295d8159df46df5e9314d146fed15daa93f8b8064
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagyN:A3k03kHRJB
TLSH
T13215AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 939KB
SHA256 5c6f940e3bf095b28b39d8fa1b97e8346d7af167b9ec11df52f58e4d2f7f2607
MD5 2e213671a2db044c403484045a471d92
SHA1 bc2d2e281ac84324b9bd41d40bc12984d921d99b
SHA512 699b6e6c07995affef33bc725dae93761846cdc9cd57656a53e26cf72d818fcf61d052e86575899afb77ecf07e625d1c447aee3939abb59da63c706cc75d4646
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagof:A3k03kHRJh
TLSH
T1FD15AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 939KB
SHA256 6bf99361a0d5bff697524121e068f2e7da5c0fbc99e65a097b8868da58eeb2a3
MD5 db640a36339b4c441512e848523de9d9
SHA1 d68cb6c9bb839abb3a1090f1a46fff594f9a48f7
SHA512 959f5d87c55cd3d466da187671b022054155b2d984268c1b0d3bca7e9073f9b658eec1bdc0e94134b919abbbbd52740bb0560c1fbfb90bb749a5e559a076ea9b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagCo:A3k03kHRJ0
TLSH
T1C515AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 939KB
SHA256 5c49b8b6bee7a49b2c11454aca9aa36a2a4367d9cfcd801b851ea4b3016b30fa
MD5 a26f9cc93a33d0f71b4a220e66fdc1e2
SHA1 d31aa15cf5aa63fa467b09048b1a855d11f1da8e
SHA512 e73df7d2a05be30e5faa4e294a580c31e06f9a1b9587d834d9c10e2644c21775cdb6236b79f6ca1c572cfb0348991c1a25e09e2a0e49242259b9fe549f67591d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLag2u:A3k03kHRJG
TLSH
T14815AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 939KB
SHA256 6a6ce8092ecc8bdb831e703995ef3b5b1bc460e91e3345d4a143dde4e6d74d94
MD5 6b52f2f865456e72217814cff7ee5159
SHA1 ab372839b825692518770c9cb8c0038613350063
SHA512 56d3818d4497409637b87d8af07e636553db70ec4420220f58f9627009cbea5b0d84cbc7ee265332406467922fe4ecdfe62775ba1cf50efb3551f1d8f2a922ef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagq9:A3k03kHRJH
TLSH
T1E015AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 939KB
SHA256 092ce9de8a061060a6db2ce22871134061419bcb1f31a174504933156ee3231f
MD5 81e5df3a4f71cdd77f155206510c077f
SHA1 bdd0b2df0f57a36cfcdce23c043ab26a1b13f842
SHA512 90d58d79d57a2f9f3305c56b0f4ff4932e3f7599b1032c721e5f86614f339a8ccf063decd731d36ac111ee9ae2419b6c5f31bc3a955005fdc0985933f3469e44
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagqc:A3k03kHRJW
TLSH
T1A515AE13EB9500E9E10AC1749AE64A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 939KB
SHA256 20d9c08011dd1b77302d591f6a62228e9cbfed02b25f7c87e08540a73037e038
MD5 062afd2647c729acff55236db44da86a
SHA1 2afcd2c44b0f1e86da73bd296356f32d012d698e
SHA512 0f0d4343356c6edf1fd9e6f0aa37dfa5c830e39d1e8a7aa442e316cb45632f878d9f7438af214b119a8064e30be1b74451ce58e7bddc6af50907df20d3f78ff4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagjp:A3k03kHRJE
TLSH
T1A315AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 939KB
SHA256 62d115b2690af25024b572f68c188d8d34c47ad15acc6186367403186c627b7e
MD5 81e0043958903ad4028ea5c0aeceba8c
SHA1 e61fa649c39cd844ab15cb4a00b6ca5a8d0de0fa
SHA512 291f9c012a3ba5a89f839cbd3c03d674d2585b2b7a21ea5440d38fff650dc0503fa676f70dde413f4ab6a85d88d0b5d7612441f3d46045cceb52e7d2a7a1918d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagEN:A3k03kHRJz
TLSH
T19E15AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 939KB
SHA256 45f7d504626caea91b173c2555fc01432e81d1b319c8aa327349d2b20a4466bc
MD5 ba75617b0bca564d9aff78b5432432df
SHA1 6391287b8952344b7310c22b50c0c95b5cd9d440
SHA512 f1a895d63644cc6a454041c04202eb392561bc8e561693e70e09dda8c33e4e30c7e59a55c78a8281a85379655b2008c02757c10e16a18f305e4e00bfdfa94f83
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagsF:A3k03kHRJF
TLSH
T12C15AE13EB9504E9D10AC1749AD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 939KB
SHA256 585e66fd03d45c60e0cd4f56336d87585ed6f5cfdbd19259d8ab812197c4d0e4
MD5 920ca168a7db8eefadb782cc26552797
SHA1 d1f832cae384046de49d08faff57b1134438c4b3
SHA512 76cbb8332dd8b8d2ec84deefc99f5342a45f32fb4e21b00881e4ffdc1d59ecd9cd8ffbaced30b21fe50c3ac876d6d6422c6262e0b4464b9389d78d548c7935d5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagZC:A3k03kHRJp
TLSH
T1B215AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 939KB
SHA256 442be0fdb10033f1447554f689ff2e7e27e7dad42b41c1803ff5ef03c40847a7
MD5 14fc12b72abba8fe002f3f77c8c268e3
SHA1 2f46e4ed9ea84540ae66d464907898baa404346b
SHA512 adec520482f83a73ee9fe57c93d464cc507c362322227fc025294dab6ebac577c83ad4936caf28096d7a6261ee34fe0183adf9257d13f4a5c1da7e7d957d1300
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagaw:A3k03kHRJU
TLSH
T13B15AE13EB9500E9D10AC1749AE65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 939KB
SHA256 e960e0348aae1fa80b562e9306769d100a89bb14d8f15f96b6916fffd21855e5
MD5 80b1e3b468fdb19478ab1eff294f524e
SHA1 9029bd9f0e53aca5bd2cfc94dc50a9532d2ce813
SHA512 f7c2f3ea14ed7eac0205dee26ca2e8554636184c207229377c9fb309edf39a6cadea24dbada7240df9245811ddc0391419208b287eef3331ab06687403ede0cc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLaghT:A3k03kHRJ8
TLSH
T15815AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 939KB
SHA256 ab5f4f56605b34e45e602d73bbbb6db0909db7b16d8d4b22046cb6bd18f7edfa
MD5 021138d41bc83b488526472981d46385
SHA1 2b9b62dd4000c45ed4de67edb444ac7613b53555
SHA512 fe88ca000f07f994adb06e5d745b03e94ecc85a71b31fea9714691866b61c38c1ac57a265a0c33c41e089c93d63e1c59628ef80a47ea5532d24346044cec6f42
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagPu:A3k03kHRJb
TLSH
T12515AE13EB9504E9D10AC1749AD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 939KB
SHA256 ba9ad64c58fd9ff11c6e48f5f230fc6dc6d1596fca6818114d81f9849c639cf1
MD5 d5997eef9bbfb72bbb362fdf9410102f
SHA1 9b0efbf9fad3d4de8ebf948552c78ec740f8d3c2
SHA512 6fc883f1f935a1d9078108e678d6b74d48d608bbd5b859200800533738434044be7cf08bcdb1cffa44ac3260d44121ce9e7d5903dc45ff98523deb27fefd3573
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagzb:A3k03kHRJy
TLSH
T11D15AE13EB9500E9E10AC1749AD65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 939KB
SHA256 0e448ef515ef31e8bb031554a5a131a59b18c29877c8db6744240560b4d8301d
MD5 04fe15067905dea5c07aa39b439ad51c
SHA1 d309775f91cd19d4892813a0949a9bfe168872ab
SHA512 52b4d7a55d6d13b2ed42a1b75a7ef11fa54d72a620307cb4ec3135002d3a1da0a52cfec91e37729758c0b0915332101eb3eddd712f2fb4486c6912ec20e2fb10
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagHf:A3k03kHRJS
TLSH
T14215AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 939KB
SHA256 6d4e6ce0a6872d070131255be19e6cf9e959e3a15e6f2ce176010c608e719145
MD5 a8e85e49b7d7c70caa7d01382c1d3189
SHA1 660da4e1488b0bbbee2169e3b23dbe3efd9b9a84
SHA512 834ae9b2fe416b475ab4f6fc6fecbb48e848b5a9c57e9eb4ead4368c5bd4c5bf2a6750dcf3d3dab3e2ca635ab44c0b0fd70f3bd11391e57f6a92fedcdd755afb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagwK:A3k03kHRJy
TLSH
T1EA15AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 939KB
SHA256 d929c60b78ffae71cccf9f96fe1e37190f55add03736f02266a7cebccfa4c7cf
MD5 61a1607efc6ab43eb172ce6d981b752f
SHA1 deb96f40621bbbac06a192b25eca8e5020232d1d
SHA512 33bcb32095161b05ff00a8b3e4aaf94648c7d47308d1922e914f492e802e1cdba07c71b4587594387307814157673ba0ea11d70a7cc73cd08c5f0081a7b88081
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagtk:A3k03kHRJH
TLSH
T12715AE13EB9500E9D10AC1749AD65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 939KB
SHA256 815db41ea1052ad8ea67c8cf5af1c5601aa64a25d32606bbacc50a6d0f112c09
MD5 08968e85e2356fb34bd9312958b33d08
SHA1 9262d502155b15b6f15614c19fd9742ab82c9487
SHA512 6dce43676a3b9c73489368183dd4adf6db3eb21d146b403e9ecb9e9000b1e6c0a84e96df41f2dd36b89b361e38e21e4d522f869a1ee7640db92120f76dedf45a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagy0:A3k03kHRJG
TLSH
T18D15AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 939KB
SHA256 ec3143e3dd42f1ed3f5a59dbeeb96bc0634699706b7c52a80fe778088248ff4a
MD5 1663daaec10170be7cce7bac01983ffd
SHA1 21e4cea8cebe05dd17f27beaa49292ea1d1bae3d
SHA512 c06da2abcafa2f152a77c1c7ec53daa833fb049444d16f47788c5fa09f2b40d934dbefb9a7e73d950b00ef0191715c17d0d661bd39cf6093af7b552570fc7354
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagBg:A3k03kHRJ/
TLSH
T14815AE13EB9500E9D10AC1749AD65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 939KB
SHA256 ec09dc46f9ee94aa71a3923f03ea30ef41d7da8ecfc8c7a5a5671bd4bacf331e
MD5 ffb139e964df875f7364a551e00e9733
SHA1 bf9a500743d372b3809199c42d503f027b19d0d4
SHA512 94cdefe40deb6d62610c9607fc87ea1b36fd02427dee76c245499e83fd7defc2f0c240c400432d9a81a109860b0b6d8f14578ed9bb9b5ce5d86095e92625ac27
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagor:A3k03kHRJZ
TLSH
T11115AE13EB9500E9D10AC1749AE65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 939KB
SHA256 e293e3b643f6ee05539f98f0214ca2b21a4b8c82549bd32e2f85ce528bbb1898
MD5 000f664ab21c4303ecd83d580eae6368
SHA1 3cb75dc2ce0d1c90b229c501b5629d643498dd7f
SHA512 c5b0cac42fcf0d4d2538946664a500d25ba843446b5d902e984e1fe8cef77ec2dbfdd9b952a805314a3a654fbb720c186c0afa7412eec5682f3b3894bb69b4ae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagGn:A3k03kHRJT
TLSH
T14015AE13EB9500E9D10AC1749AE65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 939KB
SHA256 5d52fde0b72b8781caacc86d0c9d96a3e1b53aa2a2cbbe41addffe9a16314c2e
MD5 f319dcb9a92d714923c93c60a81a80c3
SHA1 52da59d4616cf4332bc4c09e6c24e8c40927b068
SHA512 076ff8d205161e9d0a4d9336b45eaff52b668e3078fe37c6cdf6c16e3d20632f5db2dedac56d9a4555940dd85127537e41af8866ee75c47ee53e87394c769833
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagMx:A3k03kHRJR
TLSH
T19B15AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 939KB
SHA256 d3dab86c01598a062c829c663434886c3ce65d64bc9c58529c068363bf6d65b0
MD5 b35812c65427c334f486c2495d2b10d2
SHA1 3e5f1c3a3e0ff9fcdedf102124d795ee4f060c9e
SHA512 2898bacc6b590933413659b122156a23dcecbabb9aa0e18c8ff27a77b7b0a3fe514b136ba9ebd9a553a1eb0383a73ec7c109d0a700dd7ed7fa086b7983205472
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagGA:A3k03kHRJ+
TLSH
T1F215AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 939KB
SHA256 77dd06f179dbff661f59a3505dc68eb3f88949f40dc2cffddeb96be7608311ff
MD5 67d266213d78858df002d5daf625a75e
SHA1 6ef6cf657382853e8a5afca8c5607a79cfb39c9f
SHA512 e9eb5d346088ec1c6bc8ca750c51fed7256587db1f26bd2e15ef631ae264e42ace1222cc445495974305c3a60700a08941bb23b9a211579f781d2c9fbb2e5c27
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagf9Q:A3k03kHRJj
TLSH
T1BB15AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 939KB
SHA256 c2ba6b471e9782630b4d02f4300f83a88def15be97215e67d321e5da490cc3e3
MD5 7f61fdee989e74378d301f86123b804a
SHA1 711394b81b438b2587cf48a0e2182688ca47f678
SHA512 b47233e7fa694fb0b3786d20f5f80854fb28a8abd0e649593a994d44c3db3a05c35574102524b2a16f77930e78e6407058328c3296c2714ebd550045ce91aa05
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagW4:A3k03kHRJE
TLSH
T13D15AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 939KB
SHA256 ccbfa2f61cadf2ba971264f11eaff27f46c7ab85e53d038d23d512010a44ac0f
MD5 17863fa2f236d2ec7ce27c551c01ba79
SHA1 b764bef9fdcfe19f7f825159acc99521acde47b9
SHA512 1ffc22eb0a74576c0f0a2b4774e1492389e8ae7ca6d06081f0ea2145a942620d122ba1c5523ea8ed291f709ac40d8de747e2e1bbf10fd77da4a1856d1a76f147
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagFu:A3k03kHRJ1
TLSH
T16F15AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 939KB
SHA256 f32a93ac1a370d083084fbec3500fbe206b665f22afff4025255028ef3f81d96
MD5 cfb9243940f862c257adac22bde7002f
SHA1 3714f82b7894f85483d4e276a81f3d6e415c38a8
SHA512 416d6da72bb47bfaa3b18f4ae2281771d50b37828a3ab7ddd486297adb81c41d7aca79f49647ddae267bee9877799f02ea614d0f2fa3eb4a07c2cf4fd9d3e446
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagYj:A3k03kHRJX
TLSH
T19E15AE13EB9500E9D10AC1749AE65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 939KB
SHA256 40c83c7e205238f52732c7083e5250766d5cc571a643f7ecf491cb33393f0ffb
MD5 6bcc7ac0f506357acd40ec3aca49fbc0
SHA1 13fb4ca0deb7f569091421b56bac21b0b2b0a9d9
SHA512 338b5c08fca5ce5d12189d3497f7911a6e67e30b9cac06b5ba6a887395fc142bfb3bcc4ab7fcda175c1099c8e5bbb98a70094d84cc3d200b128d18459e1c0fbd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagpg:A3k03kHRJ/
TLSH
T1E615AE13EB9500E9E10AC1749AD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 939KB
SHA256 d8c78e89baa905c81171e080363367f7eb3d42ef86225341f0c042313a1fc0c0
MD5 e7241795cecb8435f6b0c887daa1f4fa
SHA1 def601f5d8f21fafe786cdd9d6bf5b059c8b81d0
SHA512 41036179237bcdf07710886b8ce9b3bfb484cadc0f382c8ffbc57a6d21fb9f64d55b8ecef9c549db2a83378984f3accabab0bf0d7f383afafc8fdcf178412109
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagwI:A3k03kHRJu
TLSH
T1A815AE13EB9500E9E10AC1749AD65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 939KB
SHA256 4292f0fef0186062d42b705b9509947f30bd92d48b22305aa020bfee95d3b14a
MD5 b418d76298ab99a46e7e2124b5931754
SHA1 4c1872f637b3a5a1e3b92f93dd24d9383683edb9
SHA512 205ca73cd155ae4b3819c4e42983273cd1c59cca63783e481bbc6a5619f85732cba3420bf899d6de0eb8b10122886a35ac253b22db5287f83c919c0e225b07b1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagyo:A3k03kHRJs
TLSH
T18F15AE13EB9500E9D10AC1749AE65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 939KB
SHA256 7f1f0b67082e6c904f6edf767ec8c84e341f5f68151b53a7a3e83f0c4f2148d6
MD5 7cd3ad7b48baf1d4bb6c1da6766285d1
SHA1 7cd670ad594c25b6068402b05920b3a9fb5934e7
SHA512 e184004091496f381c18e5b39445430c41e7d50b499ea35d64e797c28f00e6795afb3ed499425e44bcbe22d265c0b7d39bb1587caf308eadcf0e5d4d57dd3bd1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagp+:A3k03kHRJB
TLSH
T13D15AE13EB9500E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 939KB
SHA256 367bb3177ece29c8d68e6d37dab47db50b182d6b083673df280a0295e976799f
MD5 c72c4a831329a65ef552392acace9c3c
SHA1 0352acedf17ab04f3aab24e843564e04b0e9efd3
SHA512 acfb9c9d6f15c353ad0d444e14b1b3a1eb9518e11f9649d35db7e820277576aab246ade906d1fc14ec1ca8884bdbf4860d52b74072e159bfd109851288659a7b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagXQ:A3k03kHRJB
TLSH
T1E315AE13EB9504E9D10AC1749AD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 939KB
SHA256 1580b4377d43c6018cbc2d57f714813493a516c9454473f4c3e3aa1a8607a47b
MD5 d589a4cef7ff924b7227ad2450a0e1f5
SHA1 1fa2a485971248a0df25063ecd38e17ab7dce844
SHA512 74203c5b4719d799fde2a2137173296a5ba5199aca9579448109cab31d508d64566b4988684202879993aa23aa78f398003669de946f5f04c359c97a9c4872b4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagsX:A3k03kHRJt
TLSH
T15A15AE13EB9504E9E10AC1749AD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 939KB
SHA256 2e50b0488cbfe7f3fbc15b1a6ff49cbb4b259cdae00cf2b5e685b24543392850
MD5 3190f610b7c7fb90c8d12598ddc443be
SHA1 313bb99309d3b92e8a912b61de39521b53bdeae9
SHA512 26cac9537830b120b953265491601d77628f9cfbd0b6a21dacbb43c173364f8427ea69b8658b36f53055bcd23e86be806bc935efd456771b6b5d920161b27221
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLagKL:A3k03kHRJv
TLSH
T1DF15AE13EB9500E9D10AC1749AE65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 939KB
SHA256 cd0ab8789698a067e23866dc6a2cbc0519fd5fce424b856f3880c4deace2655e
MD5 7f5103c2fd61d1b56c8c68b85d0a78f0
SHA1 6fa78889b252785352016f49956c841b19b33d79
SHA512 55de018f9a3419a6af594f0ab5040c9eb0319a7295465e08dacf05f0dbe158ddd9ee7f085fa07a1bf7792e46aab80d190de64a23339fca6793d29276af9c8648
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLaguM:A3k03kHRJa
TLSH
T1EC15AE13EB9500E9D10AC1749AE65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 939KB
SHA256 443884d1359601b28eaa71a2af12ad58944b9977bdf4bb61a3b52b567d6798cc
MD5 b9eb4eaaac47d521e759c73986b5e557
SHA1 e1e4f86327b730ee077341a7296d6bfce435cda7
SHA512 56d05356bfa3a732bc7682794d9a56d71dc09aa2ed378e82cf63031e553ffbebed08de19bbad1bf19529234b169154d6af943860b38c4e99197768ad1f1cbcd6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaBQLag3h:A3k03kHRJU
TLSH
T1D815AE13EB9500E9D10AC1749AE65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2440-160-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2440-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5420-161-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads