53fd961935feff38b140b0568c5af7c63bda6bc13979065175a38fc53329ee48

Analysis

max time kernel
96s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 877KB
Sample260817-mfylaayvbv
SHA256 53fd961935feff38b140b0568c5af7c63bda6bc13979065175a38fc53329ee48
MD5 ec3540aca952efe40c3ecc88341704c9
SHA1 0b505d184c28c7d968a5173cc30b6bebb8010d19
SHA512 dcf1ff07fd9cce9cf6222a8e14dbeb6049b61be08b23ed29d6a33ba2b96fd633d8774a5410d28bdc7baf793b831f72629188ba930c590fe92a1b5daf1337f56b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqc:A3k03kB56ri
TLSH
T1AD156A17E6850FA4D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5724-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c585-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e5-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5724-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1140-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019840-216.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-410.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-477.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000018a52-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-593.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-715.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c585-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c2-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e5-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019840-216.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-410.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-477.dat	aspack_v212_v242
behavioral2/files/0x0014000000018a52-496.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-593.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-715.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1080.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1129.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1327.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1341.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1366.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1140	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files\DismountMount.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5724	2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1140	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_ec3540aca952efe40c3ecc88341704c9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5724

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 877KB
SHA256 53fd961935feff38b140b0568c5af7c63bda6bc13979065175a38fc53329ee48
MD5 ec3540aca952efe40c3ecc88341704c9
SHA1 0b505d184c28c7d968a5173cc30b6bebb8010d19
SHA512 dcf1ff07fd9cce9cf6222a8e14dbeb6049b61be08b23ed29d6a33ba2b96fd633d8774a5410d28bdc7baf793b831f72629188ba930c590fe92a1b5daf1337f56b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqc:A3k03kB56ri
TLSH
T1AD156A17E6850FA4D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 43aaea3e49773d2ba982846171a5efdc6f36c64ce2be913ba01717e9e0a5e7b6
MD5 8cf830fe0120f35f0b425b647cd17f98
SHA1 01fb37ab08182f0423cf0e248be2ba6824725600
SHA512 b81a5e6a3782e8a68023c4b949bc31b2d9d447afa6531e9e2cb42dd8049e6ac0ef38ce91f3458288959e0e4718731fd391b4b305b8e4144d4e6f24c1919f1431
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqk0Le5ji0hmxNrM:A3k03kB56riPji0Aj
TLSH
T12E654A16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 892KB
SHA256 d536a259d217cc9fc178f6c1fb6bbe8792aa00fd3b2e690b0d9cb14b6ea71da7
MD5 bb753adf62f67f36aaa446500b274fe2
SHA1 38a1549c525153a917d7a15fca9b20c655b03de9
SHA512 36634ab88ec556f4235913ff757cdb72cf507ae7c25b48b4ed07dcc5dc1e7fe0daf287abcfb0f58fb1209e2e7def68664c22a51f64dfe84f6f32d1b6b86390ec
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqOa:A3k03kB56r
TLSH
T1E6156B13E6850FA4D10F81749A968662EA737C025F2097DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 901KB
SHA256 c40b00c2404c9a02ddf6dc91270afc29f1d22fb6162d991bf5392fc0fb9945b2
MD5 9ca93a632e0f804ba82f64c087352b89
SHA1 60ad57783b7393764be57f5692b28b5f33d8b3b0
SHA512 55a370c1efa9a826d9bb94fc73d4160444f15619d2b7d96198de3ddcc85601537cbae466b55cb13d53c08d48e7ae2288a3aa32345d8865e377a0f02436bfac42
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqv6:A3k03kB56rM
TLSH
T17D156A13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 901KB
SHA256 a0c63423ae0b3bdf0a2eeaf4bb2f6022bc648ff54c0514d229d3a7c83aabfcae
MD5 399a6b0a470d2be29a0790b016c13b6f
SHA1 a019a096604f91c2a3b903e19d7d4a2f09e310fb
SHA512 49e4affa4b9e30004d37760ba05da079b1c625fe395200aa28c34cdbb44134ba3264cae916dee3258b111207e301de3cf624b6927553178ff498fec3d5ca413d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqxN:A3k03kB56rx
TLSH
T12A157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 901KB
SHA256 4f36e6b9905908a4097559c9249bfdbd0f1d306e922ffc5ba3743d07d90ef9f3
MD5 ba049070ad95c6fd23fb9d30bf714a8a
SHA1 34d0c37d7d78b06b229644d8fda80c7f2c089cee
SHA512 e81bd0763d7f25a1d10c63187d082935beda2dae172728b8e40048b2d9b123e90ce76b93fa9203be63061bba62722f64ea78c10053057f30b079ae275f9e8c1c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqnf:A3k03kB56rx
TLSH
T1D5157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 901KB
SHA256 3bd0f9982e2969e1c211def10bb33d590cc3de1e103472aa269dfbf14dbafa46
MD5 559433d36b75e3972f777f11a3d71a34
SHA1 8d1ce812c1549298cf986495facd1c1ab946f6e5
SHA512 983dea7dce102ee8e10fa15be35559da7ea6994ce73f373a70436df00b2030caef5086903ca0a1df9ec41e2e77093775800b7c7fe6a8dcf8a2fa2688d41c0cf9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqpo:A3k03kB56rE
TLSH
T15A157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 901KB
SHA256 2eb9066365ecb835c1509a4a7e7612b51532ac8b578b8f77c9b4ffbada2384a8
MD5 4f652b56e623fab654207e7d2d8d89e7
SHA1 f1b5f372962b0295cf5b273b19bdd5005a2ac729
SHA512 56fbe4d83eeb1c68bc4e8dc727730a07066e456e737fdc73764f41c9ccb190fc7e4b5471626c38c77b145f2ec1465d2f49a51bd50ca123efbb797390632d2a39
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqZu:A3k03kB56r2
TLSH
T1E2157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 901KB
SHA256 109ecb04057659234e3d2b13ecbd8463c888957e474b1b2e4e7bcc768537df28
MD5 6eb916d5e1dd1c57475f057152ab6dbb
SHA1 7dbe57adbf6c240afe6b58baaddc82256881ba72
SHA512 1f64fefcb86e457f207db7390c0421155488b0bdeffa29b8eb7b37618528f870c862a6b72715ef420a89481b1b9175287ad111d078f3c26820f2a86bed037a8e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJq/9:A3k03kB56rX
TLSH
T1BF156B13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 901KB
SHA256 ffb124ec0aa078477e248266da719ed2b3b5db634528d6dc667b4a5af21b43fc
MD5 4dafd6519ee0de85aab1357e04d7940e
SHA1 56c053ed728c6da016d6462f0beebd6c08856fa7
SHA512 fd2bc3f1597908c4adc8a0d8c1804056041b665ca5ab80685ec8a95fd319fbf51ade1d9f4a1ca742f0eee5ed2cb38b4a271685b7e4e1e2a3f81b862844612015
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqbc:A3k03kB56rm
TLSH
T1A3156B13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 901KB
SHA256 c88a99efef0a0aae10bda27587a2f5a7ef6d44819e79982874ef143b5fd16dca
MD5 97d3a0d39841659877deeb3d59ba725d
SHA1 d84aaa1e8a860a82c20f8720cd3e347facce6c8f
SHA512 672591ff1c937af40144e2764b2ba3fdf37552f2b4205c854d892dc6e662729b4b165e646a72dd0bb5edd16617584549c0ccade6eb6296b831dbfb661c804935
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqEp:A3k03kB56r0
TLSH
T15C156B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 901KB
SHA256 06c3dd75ea7c5b1309008a6d08ab2a8c3f4e1bf42ea4573c204c752aa8e6466e
MD5 1b4e30f7b95973e8ba13f9e4c83e4d4d
SHA1 471d0939730f47dce7aca8d5bd665f8c351c61a0
SHA512 8d3402541a2f0e4585e915f79d196c9c06ac6ece11d6d49d9738120af85f7aae63f93d10b7662660328cdc0da6edd9ce758490a3660d806429b8770833c8d2f9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqLN:A3k03kB56rD
TLSH
T147157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 901KB
SHA256 ae13a27bf22f8d7c228f5e6df87b94b42e2e3c6259d5de735b25bc8b4e1f3043
MD5 c6205f7f8c61193e34878b44471ea76b
SHA1 d0ab5c7f47c3ca20bbe4082f1c2314089ddb5063
SHA512 d2dcd4ea3a528f5052097354e9dc96bf387d006644d4bd27d6a3e9a74d71513fd760cb88a2e1c330d2d72af0c6add04b3c5bf8c7fadefb217c402be464acf760
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqZF:A3k03kB56rV
TLSH
T120156B13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 901KB
SHA256 149755c43f66eaa9bf5983971589f7df6e19b1374b6f6e2c7c69bab19404ba5d
MD5 af4376b889421f9819e90abbb49c45bf
SHA1 867d046808c60f417a86f2841c7ce74f737f81ca
SHA512 f8c33d486c48ea9cafb21e33d9f7bebc4a1f16ec19e216b1382f10dceea084743178f46de22886261d60c2faa8a748b2833f53806f78f17e27d042472e92a821
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqyC:A3k03kB56r5
TLSH
T15C156B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 901KB
SHA256 55b688607cc0e6fe061e634666859e96d50bf8fe5de4d88c78afc253a733b335
MD5 7318356e233ca0f5206121adddf5f3cc
SHA1 62a68e86b9a6669e2b8393e4ab82740c0deb5334
SHA512 f6f2fa7b013b661d1e8d4c300ca1614e8fa5fb06b6449bbd7b31a5349675efdadb8bd73d974a58c79fa5bc38d272dab04085288004ab292da83292c87e37cd97
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqtw:A3k03kB56rk
TLSH
T1C8156B13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 901KB
SHA256 2abef35a37ee23671d8efeaaf452cc84301cb981084ea3966249d019ff594da0
MD5 a8ac99af6cbd0da330ccd91024a23338
SHA1 3f9475eb081a972dff6287c8b5de134bc85ad872
SHA512 943d4b2036c91ee6c13b0e28a4d9fbdf63dd0ce8ad1b712fe42f97011c0d8397d2ab0729148d373a98dd153deffd74cc22d2e9fc9ee6f522d8bb0eae880aa681
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqcT:A3k03kB56rM
TLSH
T197156A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 901KB
SHA256 af375182fbc38a2b64d1e5a2703ff9908c118580d38830b8161c64b4b2edea5e
MD5 a7bde30808642556a1274e3a82e447b0
SHA1 6f73c89ca539f808deac33ceeaaedccc06fae00b
SHA512 9cd9bf605cedf98fba1dbb4f79096452fc28a856f98a50025b75ed71a9de3dc2225f1486ef5b2e12f3714a2a40f806475fe2e4eb87fc8c707d982d21b658cec3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqwu:A3k03kB56rr
TLSH
T168157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 901KB
SHA256 3997ca25664d546b032ca2f73a817ca68bd447554143ca3717ae6222d0785179
MD5 aad7c9e9ff33c34ba762bbcdc0f3db7b
SHA1 d911b92d5d4e91a08625ea5729c7bc944ddbc9cf
SHA512 4e230822be2ecb91c780d3b7f4ca5e66209a2b993c8649cb3d992f1170596278606c56267907094fbb73ce8b2cd529118172a3d41c505158fd864fe7af650cf5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqOb:A3k03kB56rC
TLSH
T193156A13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 901KB
SHA256 9ecc882781863d82f1fd50df6d692e2ce4938fbaed830b03ab7a52d387c62d7e
MD5 cbb3b35dbf00e0d0cbe57c4c434da615
SHA1 e638127b76d758905a1df8cfcd3f1d3a3b81a4da
SHA512 95acd9de3e2b08d8417545a22e6662ff369528b51003fbd80d155b1bd2fb07070ac9ed6152f81a82f84d526e4cf4d3d4c595d2441744b1d05907d14a6bb71412
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJq4f:A3k03kB56ri
TLSH
T1FA156A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 901KB
SHA256 0a892c99beedf2a676fe33167ea9a66fb896c6feb4559e0f980fee19d1d97e21
MD5 8b1e624035fb9e0b2d5191b3cb306dbc
SHA1 b3812765b9d58aed0fabd6472111c0555e8e059e
SHA512 1901911072259f98af4e2052f61b3956ba0c10c5406e146e708fc39f27678157b5aace482fbdc6cde2e955ed838ef60c0041dddb269894bd2fa8b7f1a0480b04
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJq1K:A3k03kB56rC
TLSH
T1F5156B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 901KB
SHA256 ae19b330f4c46cf840c84834dca5d634df2b2e97884869a9a27916f48dfc0ede
MD5 642c515daf80516fe7c8d5df8beb2f92
SHA1 6d0bfbec8beeb9932513393e9fcd9f047d006245
SHA512 d4df36d354157da5d1b7172f967c9a3dab06991837ceb7c81fed434feaeaf02624f695bf4d4d57bc8891282c5182fe3f70d898b20d16d44ee3b21885dc71830d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJq2k:A3k03kB56rX
TLSH
T19E157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 901KB
SHA256 490e02a31fc33080052a602c1b462ebd5fbc58aacfe1dc9233035c29fa9accdf
MD5 7bdd814ee403eba8f8b20045866f9588
SHA1 411ee21aebce762d6790adbc79364ea9036d7c7a
SHA512 80402210c3c35d0efa113fb19f3d04886dc17e95443cf0b5f5681ca5f43f374ae3d2df28f7322a7b88d4bb66a1dc7bfc1800d4b6fa495638ac5a2e031b58c2e5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqT0:A3k03kB56r2
TLSH
T1FE157A13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 901KB
SHA256 35d686456c22185a02a44100d41a12cd6f0757f113061dc5d643e3ffa57ab008
MD5 3f359af7b2f88873d105f35bb3e61c3e
SHA1 6d4e283426378223686d30aaa5ed075506ce678d
SHA512 0acc75ffef9601991e63b23be39cc62c1da13ac5841d1f522a40def96eccd7b0d8748b607bedd280b9f32e1fa0f9e7044bfc7ac76b09f6ae8cc1376581b3a849
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqig:A3k03kB56rP
TLSH
T1F6156A13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 901KB
SHA256 06708e51c5eb8de915fe387ff6d9f6245fdc2079b452309064aa19d32440dfa9
MD5 23062e9e462b977cff69935a78331213
SHA1 5dd906c8e05216a89a299c2bc5793194df5d758e
SHA512 506b794e418fee0e52224dae8a23a024ff7e5f696be0196767090fd623dd4462c28c8d4862c895028fba2fa3d67017946c7a3dc3d3697398a920c1d16354d4c0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqDr:A3k03kB56rp
TLSH
T1B5156B13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 901KB
SHA256 0c06b9f5c7a8c01e6c5bdeaa966b77ac23b3fb0aaf8f573e64791ddd01488f1c
MD5 72e71a2a8453d54c5d4a8aa0de6529e8
SHA1 5b60ebd622543e42d9ce42416a25a2a4f39af54d
SHA512 0687d76c5fe4987cb8039c5a6d151a102e9ba3a51afd1dc3ca0f764aefae2e760c8f9568931516354e9f909105cdf27057270f12cb92e40f8560f2841262c24b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqln:A3k03kB56rD
TLSH
T1F4157A13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 901KB
SHA256 f49fed4349cf5dcdbc323f705f9e99d3459ca29bc50581daa889827d204b0bf4
MD5 6c916806e0e070aa193dc913fa06db21
SHA1 b429abbd90c46f595c5cbc5ab33d8194ee78e83c
SHA512 d6edacec57f096ac501b8626fcfcee654eab7df2869d7a615b1d3f8329446da819357587ae697f7b9f1d1f84669a94f76bf6c618b55d9ac63b5f301a6035af76
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqRx:A3k03kB56rh
TLSH
T14E157B13E6850FA4D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 901KB
SHA256 90e43388d562ecdb2ba3520e903abe4e7a63c8160aa78a763ee2aad98754005b
MD5 fb6894bccc8c8d9eb1b099176217212a
SHA1 759a50958a9d6ea19ddf421d4ce34f0f212b469d
SHA512 894f3d9a52c685180f954d6deefe09d128efcbcb5c1ca3fb3846110d69e08d6c8e3c5f47e294588bc47924ef662e31100cc6f2a43764fb22133910de4eae3362
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJq/A:A3k03kB56rO
TLSH
T167156A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 901KB
SHA256 c124583948b75a51b9fff3137273cd067935ce547394f0fb5c6191b69c8714f2
MD5 7ff5100167f8a5da111bcf02a8c10753
SHA1 2342ea46ca4c5a51982b5dd47a20764c17310bae
SHA512 6210906979466144af3492f190bc65a91b31efb12a2a9ef2fe95529077cae0ed4c8fce3f6748ef66b8fed92d49ee42c3bc80dbe70c7128a747edd5684d34de53
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqQ9Q:A3k03kB56rT
TLSH
T17D156A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 901KB
SHA256 b1cc3e43a6f4551aaf28c196266536f1e4ccad2e8fe3c92f8a935d12617ec98e
MD5 ec30b012a62addb53fa6bf83cb0d140e
SHA1 e38ffc74933d087b2e7de4cf5afad77644249f6e
SHA512 2e21d625a1553fa0490c4a08128fc8edd61bd0ea05160c4bd9fc458b81e1daa965036e69e085c2e78fe2c3bc337e381d8bc6df3c8c452f05eac9be860b3e0112
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqx4:A3k03kB56rU
TLSH
T1E3156A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 901KB
SHA256 e3f85230d6274c0dfb9dc743d97e08360777a19067a1790fea139063b18b27f0
MD5 1317c761eea4ca9ef2adae752fb69c77
SHA1 06c683f44756bd2ab9ae33d20614ecaa0042695f
SHA512 409780248e29ed7e514734d07ba3f42ab275a3b4a65467920586951578a08cb7a1c28a8dbe7c0fda249a1133ec458b094833c78113d601fb6cd6879148f7859b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJq0u:A3k03kB56rF
TLSH
T15D156B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 901KB
SHA256 2ac12a684b942e4d3c57528693c73713631b3878ace1dda4d2790048c3536a0d
MD5 642aa71e99d9c0b0f6a2d890dc1f392c
SHA1 5e87fd47c5a15ca986ff1176ddf8c75df55279c9
SHA512 a0b67bc8589ab61b822be61bdb207140f6c6e6873e21dee012e9b14e9937c6ab1bbb07ef9e19eb84677df03f3a9e0121fc95969e4fbcf5692f31f0c43d99c0c3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqFj:A3k03kB56rH
TLSH
T181157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 901KB
SHA256 e80494f9c30c63c5c6a8fa72890c715d4727e900305fc15dfc39c8581301e7a2
MD5 e1abaf3560072917b37c15bfa7ce070e
SHA1 16c2734bc1444cb388f60a8742c96f5737102ccd
SHA512 2cf5071e2bdeb6b534b86b35aa09604d880c4354f651fae967e310ec2b91841d6d71b7ecdaf8d877332e59420ef4facc02a6d6c2dbaa4d90984eea33e2d403c3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqMg:A3k03kB56rv
TLSH
T10C156B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 901KB
SHA256 5daa60bc09f9303c041ed7acf96990665b9e1152fd020a5d3c7ed45a761ab063
MD5 2c9903f1de1f293a3ebe72bc867d921c
SHA1 87a7af59f677aa425631e840b36a9e0027397006
SHA512 e1714c5432cc8acadc61528b6296874309bdcdaa9497d3eeda740fe175f7d09062a9c6a99d74cc5c27354cd977d98827bb11bbf8970d0b459070a988addc0b3f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqTI:A3k03kB56r+
TLSH
T1FA157B13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 901KB
SHA256 f95e47c0d6703faa7f0f42beef783c37ea7ca9f887c21d5d19f1935be4f87d15
MD5 9142ba0bb5250106ea1ce336203584bb
SHA1 db0e7894dc5914c7fe11bb5a8bcb63174f8fa087
SHA512 eac9cb26e45a54573f00d3babf5e65856cab2033b9ad5f7191768a658189e093bfc14d64b6fe7a6a81d375a91fd01c29d0c0d9f658afb845a2c0da98f842a2ca
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqpo:A3k03kB56r8
TLSH
T1A1156B13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 901KB
SHA256 e6828f3340f9c9b9500e2df230b0666a5c3a593021857be3fc3e960c88694b88
MD5 55f29b541a69250e69be56e045360c34
SHA1 a7a6adc64a3aa176412c5823bdeaeb3898326f38
SHA512 ce26282e76bec917552741cb17234ff0dc56ce0f90e3aabbccd6b10869e098d199b0b4e8a939fc673636747f061e1e61e24430dd3009d7c6de921c1f8147374e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqa+:A3k03kB56rx
TLSH
T1D1157B13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 901KB
SHA256 f6f0cd8fc87ca9ffcbbda3f6225752ad01544fe17e683685ff061608755d0bcf
MD5 429b8eb3bf7bab5a558e8346d8610869
SHA1 df211151ba70d4b00eb86a3020c58b53d3520995
SHA512 fca3699438e3e434c3014faadce15ad54f56081371e0fd697271fc943adc23fc663b3dc4026849bca0aeda65172c8b2586b5cf761a359dcdd5c66fd4f15c22be
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqaQ:A3k03kB56rx
TLSH
T142156A13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 901KB
SHA256 eb9e04644c2ead716d4a7ca0b8eed728d089c4e79fc9f5f8c6dfdabcd42206f7
MD5 904179ea6028cb74ee3d356b5db7762c
SHA1 2a386365adf80a96698e9a3a5ad33a715cf2f6ad
SHA512 a182940a71be2d1b5b73a9d4a11c6bcbb9b279ef42a2c2c2d0fd6db6322619f7b309b1d94362e3748bfc46181d08e3e93ecb06052bca67cac2368423012c81ac
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqrX:A3k03kB56r9
TLSH
T1F0156B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 901KB
SHA256 92fa94e18668d8d3adf261b53a68c910e17e02a452a79e3ce0a54085833b1e05
MD5 19aab88724be7cc947949d48410a128b
SHA1 1e43c68aa9a8f45dce8fad834f7234e577fd5716
SHA512 227eda228d84fa35e28e353570317bb5b96e56e44f91efb46b9d04951dcd81ff44cae19f1d92f2473a074f5477f63e5125a070519304d3aa7ad426854e7c1fe5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJq5L:A3k03kB56r/
TLSH
T1A7157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 901KB
SHA256 1b4843934278da17b311e27dbaedb4eefe60a7746c33979deb58c5677a009727
MD5 746e9592ed84fc96d1726f188ede17b9
SHA1 099c445d6570e7567e91d4736e482bea388017e0
SHA512 be12ee97d9f0eefe202cb7fcde21bfb843374f0b166bde3d2138a84c955871b7908524088783fcd10bbe3bb226864b820b2ebff241481394ce7ad387457460ee
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqnM:A3k03kB56rK
TLSH
T1F9156A13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 901KB
SHA256 4c2e66c2bffb8bb4d36ad4b3f1c6f95579b56260bb66ba5aa04e3aca72c98b37
MD5 891ed370a650cfbd806688442b51fb20
SHA1 c87713d8513db05b735f7b3d2fcd713b265540c1
SHA512 29a83cf98f68dc2cecec7030994423ba1a049c0e3649276911dbc093589565a8f907ad37382dd7efe19f1df2ebf9b1a3e6e147dd1f2a09cec1f8b6a36bf3bd26
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCjcucJqQh:A3k03kB56rE
TLSH
T1A8157B13E6850FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1140-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5724-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5724-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads