f60b56b4d49ae811cb4da065cb4b7566def5d0719c71eaa5cd1ad64492a822c7

Analysis

max time kernel
87s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 844KB
Sample260817-1vmzzsdh87
SHA256 f60b56b4d49ae811cb4da065cb4b7566def5d0719c71eaa5cd1ad64492a822c7
MD5 795c8583693e4cb0f849038bda69b0c5
SHA1 29c6af7aa2aa00fcc32e85b8ac965a673e0baddd
SHA512 02b4514f422d3a5018c0dc3fb89485705eaf65dc32d94add9ac4dd772abbb09e8596f186833046f6f6e637b0bec4381928a8542810f4568b0b972aecb5010a66
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasK6:A3k03kB56rp
TLSH
T1F7056A07E6840FA4D10F81749A968672EA737C125F2097DF1354AE253F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4128-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c53a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4128-88-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/680-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-532.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-982.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1037.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1099.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1211.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c53a-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-489.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-532.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-625.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-982.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1037.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1099.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1136.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1167.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1211.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1366.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
680	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{19C38D80-0C26-4176-9E53-8ABFFD293E4D}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4128	2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
680	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_795c8583693e4cb0f849038bda69b0c5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4128

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 844KB
SHA256 f60b56b4d49ae811cb4da065cb4b7566def5d0719c71eaa5cd1ad64492a822c7
MD5 795c8583693e4cb0f849038bda69b0c5
SHA1 29c6af7aa2aa00fcc32e85b8ac965a673e0baddd
SHA512 02b4514f422d3a5018c0dc3fb89485705eaf65dc32d94add9ac4dd772abbb09e8596f186833046f6f6e637b0bec4381928a8542810f4568b0b972aecb5010a66
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasK6:A3k03kB56rp
TLSH
T1F7056A07E6840FA4D10F81749A968672EA737C125F2097DF1354AE253F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 7806d2a989354eb55aaf06cd52861ebe16c1dadc0d6c0f787aa3772ae7f01620
MD5 a4115c2adfe99d0aa2cd23360f4f1986
SHA1 59801dc08664de2b6eee41540138fc3f6e75836f
SHA512 b45550220bc643e73af0cf28a6b5f68672cd0628cb3879142e7949437447f5c78cb588bfa9ea2de43195093b2d21abd6e14c3ac17824d3877463443d3cc63f9e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKK0Le5ji0hmxNrM:A3k03kB56rVPji0Aj
TLSH
T153654A16F6A44B65D02BC078C5D29666EA733C421F3087CB1354EE283F67BD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 859KB
SHA256 d1f420679d01e5001364950230c165c0678278db55f64cfd40e8207228038ea7
MD5 660caa3c57e78f4b934ef025bb34b613
SHA1 4e2a61c83fcc9da737c4d6a78d4b027322dac35b
SHA512 5bbda690e3332451ded6a60d321a03f249d15160d83513f620163fa5dd1e346f106e65df1c69f011d84cdd654919d41060f3e85ab031230c1385d075068be65e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKEa:A3k03kB56r
TLSH
T177156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 868KB
SHA256 f0cad243a20ac410bebb10d17ba774abaa8145b36d8831acd3d00d57f819f680
MD5 a197d118a7797771dd97519d833289d3
SHA1 ee025cd980461a5b252e2d35f104143f40354ebb
SHA512 9f0ea9123d89e939729aa9c2440ff1da28035fdb3e2c702507942b910f87c97969890ae2f556a5ef2c93e926ed248b12dabb27cb93e36daf9f5ff011252beab0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasK96:A3k03kB56rR
TLSH
T176156A17E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 868KB
SHA256 a136b1377e52449fc4f142f7e2f9f1f1cdc6a0ef63bff798ca73aca71128fdb3
MD5 0008cd1f9a58527d581dde2d4ab96f23
SHA1 1f092ef635ca9b013a5b16ef812e2e8e41fd945c
SHA512 32ced0ca201a9e52cdc161489ad79aedd5e96c266abd045ae227b8ea2e9ba617c4f1c0cd1268280ed9a30e1cc086e21076b6cc5e36da2e025b047adce25c919b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKTN:A3k03kB56ro
TLSH
T188156A07E6840FA4D10F81749A968672EA777C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 868KB
SHA256 17c6d0430abb7d3c60f2cc2d2e76ee9c40b80a7d7198f57d05299a7c70dd3069
MD5 02b1d63e9d671e25b9e6bde9cf1f1e83
SHA1 15dff00f26f83e7e314a7edf378cd88d7093457f
SHA512 a86a4041592692ff3384af492e5e100403a02b6af4954bd2defd28c5b31925b27e6ca414ba585d0f4b292e786beb046107c25ae940c9c894527d92053c169801
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKhf:A3k03kB56rA
TLSH
T16C156A17E6840FA4D10F81749A968672EA737C025F2093DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 868KB
SHA256 e08b66805be588fbba7863745949242b337ae5f18a2234f5cfce49e12ba0c272
MD5 c95d3d301ff2df8c014489ad1378a0b5
SHA1 0a3df7f60485ea04736c90073eee5cc6eb369b88
SHA512 c97502420c2a3ead2e543da55c3a6a11540ca356bdb718fc37143aeeabc08bcf7ebb3d57825d15300edadf6c243e8acffa518f60b2e148234d462d4c00aa3fd1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKDo:A3k03kB56rN
TLSH
T1A9156A17E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 868KB
SHA256 a9c4ce931a1554fb833e0257091a831fd5561ce251832ff336055abecd0d8e67
MD5 5b11a9c3bff9df087da91c80945079a0
SHA1 860399a041097150d898e15cfeb48d46170ab8d0
SHA512 bb851af6325b3328635ce5268c41b8d1ecdcb96a9b5f997ba7a884f95e417d8f86280cdb932612d95c6208502fcb7c3f655044289aac6158396a757301d3188a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasK3u:A3k03kB56r/
TLSH
T174156A17E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 868KB
SHA256 81dc0546297cfbe8d6f2613d80d53929ba7e241664462846a0a4393c1ad2a3e3
MD5 aeb1ef5d633530e7a2fc019870c2eeaa
SHA1 ad47f9c12026c3ed6135e1b9b2215ab79a3a4304
SHA512 2727b57f5fc9eee52fe5a17dbf78b54115dea0610d8a4d17029d2c5027405bcac78f070c83c25508d04261639722b64dcb0bc66e14d7cebcb95ecd86783e3f4e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKF9:A3k03kB56r+
TLSH
T180156A03E6850FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 868KB
SHA256 661eb85eb227b1cdbfb2a4edf40cd35157ec080b5f5681ec71809e74706829d0
MD5 c64f3e59e82055fb46f1b8bb7800afa0
SHA1 b2e37b2f94457b9229c79dc2eee73995f7f916a9
SHA512 522c9b2f213e02687580647e68f27d3b715672cdca61fd74ad715cf0cba7656d971d7d1595169ca913a6913ceee215f82faf6e570caff5adb0da9bf7dc07a24e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKhc:A3k03kB56rT
TLSH
T1B1156B17E6840FA4D10FC1749A968662EA737C025F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 868KB
SHA256 f66696d8d68a7e4e2d9ab58214ae6c5b97ce07a6a52ac37ea2e09a71fcad8828
MD5 378b26ace1d9d05c709d08c868ac783e
SHA1 8346270399dd8d610318005609522fe91a2ff27e
SHA512 94414cd982cfd3882671a6a5d72af21f9d85e3776250278c62470addc850cac7c95ee942e50ac026f0f3eaf5cc03515cd26a8f1aeef705fbcf554df7beb7338f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKKp:A3k03kB56rx
TLSH
T185156A17E6840FA4D10F81749A968672EA737C025F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 868KB
SHA256 d459189459819d9fd605dfb8f941434fed539430866fe50b961c445b0f614916
MD5 9f6b1a9449fd826eeedb413a44a8caa7
SHA1 d98fb43085c3eeeb34cc4dbde2c65b7ed2ca5bd1
SHA512 ba2503456c452cea7d15659ba2b7c2d571d8562088efdd920d245299b1f0a5485d1cdbd30970b1994b46513f155f360e52b354d1d2c050f18434c9dec8e8efe6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKtN:A3k03kB56rq
TLSH
T166156A17E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 868KB
SHA256 b730e28d7936758d809cc07dc28a26597c9e81bac8e1e982a83f62941e10625c
MD5 2334974705a7f77b089d32ade844ab82
SHA1 df00fdd98f1b05bd13b3a4a4d4dadb2ae09087c3
SHA512 0d1771c283b53e3078714d057d4c2fb9c1ebf8a00f7197a7147170cf60c6f89f812b2cda91cc52b42d59ee5cc06f9d2e5fd831e0929e57e60f8005b3f80eedb5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKfF:A3k03kB56rw
TLSH
T1E7156A17E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 868KB
SHA256 6099021287c0bfd8724e4b69cb7b756aa1026821519f45d247b41f1a51b6bd8d
MD5 be75b9afa47750831899776850ee311f
SHA1 61e89eb6a2053f8055468ab42ad54bbbcfc5ec0d
SHA512 443ae98a9b13cb4d10a0ac1032d9d43283daf5e6d689003dbce8b82ec75dbd9da8ca723ad6556f93e42f63f07faf40b837931b37dfc8cbfc187b885d0f20eea6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKAC:A3k03kB56rE
TLSH
T184156A07E6840FA4D10F81749A968672EA777C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 868KB
SHA256 1411d64e64f2585f3e892a3475b3f88da10488399a488ecb8624a6c03a489096
MD5 56e842d486972071a11d5c3216161d02
SHA1 7b385801b5c7b8acc26ab2cc9b9676522b17effe
SHA512 5d82bebe6bb2e7136d91ddebfc93c73fe2116e0c26ef65002c4b6c417abd802893b82a4b9e549aec0bdbc8449b51019767839649a4801d8871e86063da54245b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKTw:A3k03kB56rZ
TLSH
T1E4156A17E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 868KB
SHA256 b62ab9f10ac5425aee9f39c3f4ee64a96e08cfc610a28c8c2bcddd44ce9173bc
MD5 1416c91ff8393d5c8e1d9627b578760f
SHA1 bd373c79ab7b60862c13d5e2761faf2bea0f1c62
SHA512 4da9b6a5840b08fc855ad87cecae95d0b45ff9e73ae26d91f3e4f0e340441d49256ae7a35cd76430611dcb3df0f0a78f311b9cfa2cd50a9b26230e911a2b4242
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKaT:A3k03kB56rN
TLSH
T1EF156A13E6840FA4D10F81749A968672EA777C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 868KB
SHA256 c2772b1665fa3fd3b02625404c2314396ebb2ad7cb14633483797e7e2c1cae6d
MD5 e596fb1472828152ad571c9dd0fc79f3
SHA1 2adb2151417efac86e8f0b22919c2f2704792548
SHA512 8229b41f3abf741ea5cc41f2eecab2a535b099fbe1c0f02003d1e3c03394314218389e6690d5c136baec653e4ba56ec2626d43a26cddd611061c8370aea81636
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasK6u:A3k03kB56rS
TLSH
T1EF156A17E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 868KB
SHA256 2f2aa7896634ff51a6e4ad1692b8116323c19f60bd5eb88725845cdced8db749
MD5 89a752f7cb2b1b3415da837be956526e
SHA1 2e1be8fd8290f162fd16b52e95d5c89a3fbe8fb1
SHA512 c5aa18dc6dd116805c2862a674a480719fc966ed24fb2a6c34be80fc60376c56de31c13b4beda999e9f2c2a16b05c99e00e32179ffe5f0bd8aa8eef3019c7a15
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKEb:A3k03kB56rD
TLSH
T103156A17E6840FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 868KB
SHA256 f48597985a443e39dc7146bd421bec9f812d70776f285cb5fb342b881bef7adc
MD5 908872509c0ea00f34a1f13e3fe07ed0
SHA1 d2af7fba94bd33ec20dff4fa33fdd56368ddcb0b
SHA512 782277f1eb452e5be7a07c555b0c8ec099e616b7cdfdfe662e88a6894466ff91658ae473ba081b7e4097b869e1c02d7b9647f5c704c8693ca7bf8c26c1e305b0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKKf:A3k03kB56r7
TLSH
T148156A17E6840FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 868KB
SHA256 b8c355df78ba69523c964421118fd2774718cf666244b59ffca396c2e30561ca
MD5 fc4158ae4ab7c2e0dd1cefff962a2216
SHA1 200aa04e42404763d262993e475a332006bbc30c
SHA512 58a97c4111b49efa5340430e246fa31ec89b92f5edc3f22ca4a7556672ffbcbc48207c1cf20956f3ad20862bdad8dc44df86b8604f96d427c0f1ede8ee0863fa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKXK:A3k03kB56rr
TLSH
T1BA156A17E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 868KB
SHA256 5a75f05a4a73c6a1ab412bc98d76f2b75f51051ee90d8152467658d4cb95790c
MD5 b2bf6815d724db8239d036ed1d5747b8
SHA1 74274c0df57526d1dbbdfe9d9a73e378aa1859ec
SHA512 589518ee12f1e0a61ffd1460da4866f9d1aba29f87abdd39c833fb256d427b6e80f069c19e6d25b66c30ba1e271b05a18ad81588a69cb1100dce7390f1bfdff4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKgk:A3k03kB56rm
TLSH
T1E9156A13E6850FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 868KB
SHA256 6a3a5e98e530875957f2438653b6afb9288c7385041be78a66e310cb174e0c11
MD5 0143a205ba7c0b2c2bae0f95f102809d
SHA1 53c0c2398dc16b1ba1ffd9d6a52bb8c47c9edfcc
SHA512 55781307cbe5473434bc9dea28337c2f7584654e76f789c20a6b8a50789000aad6c26a792ec56729d3d960265b225a269b08f251372148bada751f231ee8fa58
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKR0:A3k03kB56rb
TLSH
T10C156A17E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 868KB
SHA256 32c4a01fcf068a54c1fc1066e4b398ab00aed7ee45fc71a3e318f6d42199fe07
MD5 e2dcc1b5b2ef9d47dea380db97d2666e
SHA1 129179277e97dcd23a0fac91c848cbb856deb060
SHA512 3efcbc796519cdf4eb1467e0f93a67186a8dc745f41a7420eb411797cede3563d776620e5b57f720a7d4eb22f76ea5ee4f0914fc637f6a38ce95762a52eb3d50
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKEg:A3k03kB56ru
TLSH
T1E7156A17E6840FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 868KB
SHA256 876f3451bb13e0e341577c315f362f2cc2db50d21473b509f0f939e5a43ecd2b
MD5 eeab1dbea89d5f6237b1f0fe7959d9c8
SHA1 58750c882eca9660ffb44e5ea47f10c57ea6f361
SHA512 1075c3542c49ffeff98ad4e16ca6cbc2e7bf38f11ff88bc34f954dee49b3dfb69e444b39d7faab4cb1e6e7e81667c4c09e4ebd42cfe45e1177f9222ae6e4df44
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKhr:A3k03kB56rw
TLSH
T11A156A07E6850FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 868KB
SHA256 574cb9a33beef6e35d54f7daca7f75a87d385babcb37afb79bb3fd49e79edbff
MD5 6c83c543b880679fa70448cd304248ad
SHA1 fbfcdd1698c22b7edc02f1e727781af5f11016f4
SHA512 4eaeb8a5978578e2346dc558b21fb6a6e91b49083b66360955cc8123174c855e3ac6c594ba8078a83c6b597cc7d59ba8f2e682ad9c5d2ee90cb4a0c323133739
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKjn:A3k03kB56ri
TLSH
T127156A13E6850FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 868KB
SHA256 789da8b2f9a2844242ce016cd84506217964cbb5c936e0ccf46e69014b40ace3
MD5 d4b3d63d125edf80f4a9263db393ec30
SHA1 601f32b1b4275061e317a2fbe405d5a9e7b06db2
SHA512 46099e73e6576f5822bf7975641c533902331baa4a4b1fdd5ea92801b1e32e5a481a90875dbf38adbe06d510dbbef0c5c7f75c283237f90fe728f72b1560f001
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasK/x:A3k03kB56rQ
TLSH
T147156A13E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 868KB
SHA256 eec8f246e880cd910103e60f8a18f5c5083d5a003f73977fb6b65c1e78b388e0
MD5 cdf271bb99f682e23edd001c85290d6f
SHA1 f31c2abef3d88430db517e1b480278b57ae582d8
SHA512 466411b3c3aa0761102b404346f92f7f23c4397abebb8501a8c719066488b060dc8f445432cd43a45e8752daf1048fa91c5d62a40abd43ff85ffab0e1ca5abf1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKlA:A3k03kB56rz
TLSH
T1F6156A17E6840FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 868KB
SHA256 313af16b755fe2c4175bf2982e7d6319de09abaeb86e7fdba575d6a988406f5d
MD5 a25ee35ac9598f8c1ece29f41cd98abd
SHA1 d56a6f2e68aa2c38253a76dd482d5e80348e5918
SHA512 574868bd811c6b8c39cabe543c5dad33b7277d5a27ea03e7895faab64624979bc56dc85a55b762d1228656a786b16e32e977a602c24086b7b4df480d90bcd74c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKe9Q:A3k03kB56re
TLSH
T16A156A13E6840FA4D10FC1749A968662EA777C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 868KB
SHA256 a088f530184ef9407d67ea86cc34de21b4c65f79c38bb55d1355da2fa899fd0b
MD5 ab8deda57d9a0ef8c70253f9b4200e53
SHA1 7754a50d1d2b5342dd30a9cca4edd382c5deb8d8
SHA512 fee8d8af56a1378b18568515a1d55479bef9059be2f2ad81943a7d07508583d9ef113f77191a379d45964736583d1c1e85979ca297b16addb952400359004445
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKL4:A3k03kB56rd
TLSH
T137156A17E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 868KB
SHA256 84ce0128c9c124eb95c6a9ac4868f9c0b079d7254205958d0778e295cb623843
MD5 03267739a40052f88dc3246c0dca5273
SHA1 45839d8d92a4975b42be29eec08351de7a6c1eb3
SHA512 42f02578a168d422c10ad9ef2558ad0f6fc396e00af799db2ff64a6089beab334d6c497f98584dee3c972677fff3af67eac795d39834b07dc511ebf95df131a6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKCu:A3k03kB56r4
TLSH
T112156A03E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 868KB
SHA256 8ad01e984c48c43338eed2733e79dcccdfee45a410f09643e6657482e9858492
MD5 5ff5c496a2c4c7eb1260d4f48b003981
SHA1 60a7dbdb8f5cae8624aa516cfb9d0a41e0ebce6e
SHA512 09e892bad484ba607b6107e6daccd1b26e232baba66ecfcd3c4bde9f669b4796cf5d7a8388127ca096fae91a98382699c12447c35ce1916b2c86c63a10c7f72f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKTj:A3k03kB56rS
TLSH
T168156A07E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 868KB
SHA256 204891ee4073f34b90c78e1caa38922ab5f2140a9bdbba5f75075368705d1e36
MD5 733549d42c90474ea532b87379f0f7dd
SHA1 5377fd8827bfc4517382434ef63749e4703d0517
SHA512 bd515fe4d7f0ec4763d6a4d105beb9982a9dded2c78a5bd02e7e188c06c146c541f6e58f07321e743fed7d08db128ad4f24f59c82a3d4676b563d51a98467179
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKeg:A3k03kB56rW
TLSH
T1A4156A17E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 868KB
SHA256 073107d9a1b99fd790c87810d3f6087b9ac01245cb047e01eadb8e1f4312afc2
MD5 465833956f60527dd8d321d8c5ec0d73
SHA1 693a8b43362ef926527b2a2d1fadf3ef78ec362c
SHA512 858ab9696a22c3cfd17227b4f980ce415087695ecbca27c484dc8763fb6c35953cf5276fe76b38afbf6da86c03418cce259d35811d4b43daa8f10d9ac61e5d21
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKRI:A3k03kB56r/
TLSH
T1E2156A17E6840FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 868KB
SHA256 baaa5377b9ccd5893822172ca99c57f5186ca11384d15b09fa43ac6d6051ee32
MD5 a65a0ba10c541dd721863b8e00b20316
SHA1 3d8c247b2a53cf89f89cf92e2603eed853f2433d
SHA512 8866ef62b82e5c5807e1e572c6db620e4248c0c33b3a5d5ecbd38bfdaf29237071858b21d0f0e0f6f3422a7c304e87b96f06a4cab2530c504ff609ecf6320ffb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKTo:A3k03kB56rp
TLSH
T1DC156A17E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 868KB
SHA256 a8eae978b5112f2b9d63ff658d7477e734a77e6897b0c961dfd1ee647c76cd66
MD5 c96955ac60cfbaef5f57793ab998d4f6
SHA1 6839755d0fe2b9a86b1b0dcab9149bd0b4b8c628
SHA512 70760a5daac45e5086bea8ade7ab93c5fc4afca170ed61e0feb1413a09b40589111365592c9d4d7fa92fc40262aae817de8a24c3f7a1d69bf8e5f8990d0c5590
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKY+:A3k03kB56rM
TLSH
T157156A17E6840FA4D10F81749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 868KB
SHA256 f4c45cb6f57f6803565a3a9d053cc14eb92491a80f6ca354a1faabf19ee859d5
MD5 dcabcc89b293dd2e8e1012f57b246e03
SHA1 9575e0e88c03136ec3e47b510559eea1bc098be4
SHA512 50347cbff314335921744feac5b8340730a42b28ddfc259d7683b30d30141d922a2f2bc21f8440c8ee43bec2f3f1658514e314e31020a8e975a233759839d59f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKwQ:A3k03kB56rk
TLSH
T172156A07E6850FA4D10FC1749A968662EA737C025F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 868KB
SHA256 fc9585daaad48f7c104b416baecc2cefee2ab9a053d224b6c8766ec8d96e5199
MD5 9486cf8f32092fed007e84e552f65d34
SHA1 6d73a48022e30133fa79a6e657c1d708db295fca
SHA512 c1941c15b914a2a1ac596c9727a95f86a9addd9579a20f60ceb9fe8590fe688f2e662a24e01c6c8dd8f688b88d3944ef7c974a66ee2081ad818014e53f0ab878
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKZX:A3k03kB56rE
TLSH
T1DC156A17E6840FA4D10FC1749A968662EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 868KB
SHA256 4794655767c8002b684bf18d9a434843a0a54f01de9400c57599a021ded5e53b
MD5 09ddd0a0b5f155feede1fdd62ff765b7
SHA1 336cba9860945cce47d15049feeb582afbee759c
SHA512 791976e9a1914347879e51ecadf244f120be1be1b906f112b59177d9258759af3fca205e95e0be3fd36d420168f912361dc430a928f30d145f8df9fee968e094
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKzL:A3k03kB56re
TLSH
T1FA156A17E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 868KB
SHA256 1c15f36564dd7a8f903f17e14d3a870cd69d0d7c9bce945830deb57cc962cf10
MD5 5cae3fa58de06376662e497452ce2d9c
SHA1 5ca316a6bb0db9bea66564756882c7dcd6abe0bf
SHA512 303e562d41ba3b5f1b58175071262efde8f5b5b142deeb1f8e25ebdf577044423644fec8cd46035f8dc7a28995ee5b07dcd77b7906a14837dc185a26f4908a2a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKZM:A3k03kB56rr
TLSH
T1AF156A17E6840FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 868KB
SHA256 a8202354954f0d0417f85cf496dab652c84a82559b15df0d33916d73fffec681
MD5 857e41961467a73caf8336dedb62b7e0
SHA1 47a452ad92b92312fe1fe0e294b22b14192c3e96
SHA512 7fd31483e47c201ec5a9a72bf536fcf6bf67203bfd14dde4658b0e3f8f3f563a62f184487976b9596df73796019db24ae2b7cd034a6bf6aad9385709a979d875
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasKih:A3k03kB56rl
TLSH
T1EF156A13E6850FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/680-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-88-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads