26e1504c97672e7af7eacab1d7756ec77d3f6468fe3f84dbe31d81395cdfc624

Analysis

max time kernel
97s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 949KB
Sample260817-mxvwqaah32
SHA256 26e1504c97672e7af7eacab1d7756ec77d3f6468fe3f84dbe31d81395cdfc624
MD5 8f91995c1cb20399f1a579a3d13d020e
SHA1 8845fec3177916b7670524512d4a8efceef89fb7
SHA512 1ce490c61c406c7afeb24ec10636dfd477c6885303e18d53f21dc11b5bebb9672e48eb66ef759052c18c9a5046c08b9b949727624e4bfe66f8fbcbc97a2c3bd2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3a:A3k03kHRJM
TLSH
T13F25AE13EB9500E5D10AC1749AE69A23FB75BC56176093DF2358C6152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4260-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5f0-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4260-40-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/260-71-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-557.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-644.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-748.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1091.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1165.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5f0-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fe-39.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-222.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-489.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-557.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-644.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-748.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-911.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1091.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1165.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1210.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1384.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
260	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4260	2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
260	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_8f91995c1cb20399f1a579a3d13d020e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4260

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 949KB
SHA256 26e1504c97672e7af7eacab1d7756ec77d3f6468fe3f84dbe31d81395cdfc624
MD5 8f91995c1cb20399f1a579a3d13d020e
SHA1 8845fec3177916b7670524512d4a8efceef89fb7
SHA512 1ce490c61c406c7afeb24ec10636dfd477c6885303e18d53f21dc11b5bebb9672e48eb66ef759052c18c9a5046c08b9b949727624e4bfe66f8fbcbc97a2c3bd2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3a:A3k03kHRJM
TLSH
T13F25AE13EB9500E5D10AC1749AE69A23FB75BC56176093DF2358C6152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 6b075845106ff91ff840dbf60dd91d7d557e047ab97c5d348314e05d1790e7f0
MD5 7e0f4876f2cfcc7e69b17c8e6b7aa6f6
SHA1 ad30152087329cc10e426436c78d1bbe838836c9
SHA512 35f6ce3ec11edd38bc79a929de5e30b4c645404e36b85973fe6113cfecc9dd9cb4acc989dbb4726123fd665358c393e646cbaa4b203b61d7b416c95ce48dca66
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aP0Le5ji0hmxNrM:A3k03kHRJM4Pji0Aj
TLSH
T1CA657C17F6A402B5D067C1B8C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 963KB
SHA256 15d04a45a654ebac30a5c8c92e3da48811ad997fb2cd51d1d4d1e90b20abf020
MD5 fb9d61aeaeaac5195efc8813eee7a1e2
SHA1 7af7ea3f752a50287659a90cfa8e86ecbefc9373
SHA512 43488c344c4faf9f2ec1b373da3a4a78a1506859a1ed956c5815dddd86721714c8eb5ea755cbb11da7eea17041dc90b7fe202a943eedb976f9cac3e67594a79a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aRa:A3k03kHRJM
TLSH
T1D625AE13EB9400E5D10AC1749AE69A23EB75BC56176093DF2358D6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 973KB
SHA256 f9deea258be76abeac1113a9a266b642605fbcfee20dc37682a3a969f5f49705
MD5 b206ba9b9d2cf7673e73f1d3ce60224f
SHA1 c0508b4de7486621169f350c7cc8ead356ab7759
SHA512 20aa7335cd59b553a37a482d95ef9804944a66f64def4c547d2700f6bafa35b5359f28edda760b5865927466de706d1bfe0a386d1225d683b51f9dbca7414806
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3ao6:A3k03kHRJMm
TLSH
T1CE25AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 973KB
SHA256 3dae86b57353895dc79d2420fdb9891795a7e6fce7080cb5f4a11274b12b4c80
MD5 ae60dcfec8605a5614be0fef6bd32452
SHA1 b01da2a135cd38daa053904870ee55d1eb54706a
SHA512 8054e18807fc5eb9c71b9ce58c03510d759b3a6ab3302c1a4fc165d51188f60d9db8f6cde25f29a7170c711f2b2e5eeab3ceb8af67515fcc1efda2944165f661
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3asN:A3k03kHRJM3
TLSH
T17425AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 973KB
SHA256 bdfe44dfb6f091e31cba95a9a6781b7ad10b557a2015f68937869a537fe39854
MD5 80534e35d493bdfcd507ca1a600b4ad2
SHA1 3cd5675ff8a9a23dfbb455284185da1ec8c2d5ca
SHA512 f5017a6d12bdc5c9d01f8dd25617efd8415f0dcd2f48b9047109691a99dec4c2aba1431daa3dab794df5fda07269cc3d678d7239c15913cf3d9ec6c9571f24d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aif:A3k03kHRJMz
TLSH
T1B725AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 973KB
SHA256 6ef82d2de0c6b7ef478ab243c4a22e77bdee59ad7724a4fed017741e1dd47129
MD5 303d3d0e1bb8514d3efba0d3745f4d6a
SHA1 e16308472feddaf03db1377abb8c0fb7053ba516
SHA512 f33d033c0ead123648ecd5e98a89b7f840c2c736afa68684f632efa192b4b3d69f1bbfd2379566d26e508e99542a3b2e4764e0715985c54af1909b9bb754fd7b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3a8o:A3k03kHRJMi
TLSH
T15D25AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 973KB
SHA256 6987b140747a53db8eef04f166ebd42033895c7d99460e38e7173ea1a04a83d6
MD5 067af55e0917b4774fe4f8da05fe3464
SHA1 14c255136337254a32e3f0e16ee9c74beb7b8124
SHA512 2745fa8a2a653f828b7f4823e04ae4a86584b501cbaf13a8bea88cce714b6776dc6f11bba0f8ba45b9429d0be9d7902fe1a7bfa4da2c642d814f57fa68cc9961
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3acu:A3k03kHRJMs
TLSH
T11C25AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 973KB
SHA256 e9598b546a92cc17d841d36a017225ed8bccd0e458906f5ced4e0fe6217c5d3e
MD5 a85736713e5bc5a5d1d30a22e85d52b9
SHA1 88dbc2b9be811d7bcd6094af2f40508d82a4a635
SHA512 a35fa14000f0a9b26a7b697cd0105f5c45e3bf393cc29d9d76b7a622e748bf880efd5e6cf1ba2c869ce7b2546019ad957c2df9a42fe7ce13522061b8878eeba4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3ag9:A3k03kHRJMx
TLSH
T19125AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 973KB
SHA256 cbfc6674c9d6b80e6f3c5d1bec20ad9e2bccd38c2afc65e89790c288465985f7
MD5 a0481ad95b0e3a0c7feda20ed424c18c
SHA1 79f5eb92189b46e7cc358f4dcb17cee7ec7cad8e
SHA512 057122aa4380eb2e2799007d1c0c3e043382d797e84a7d0fdd70c92384c4d338a919991c175487e396740c0e17fd401d7c9d16daf438b509f0fd513d66b59b0b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aoc:A3k03kHRJME
TLSH
T1F125AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 973KB
SHA256 0faf2fa85f6b84879ac0102fa46a291e383da14aad059e6063fd593b3ab66ac6
MD5 ee56bbf3be3fcc6c77cbf736d0f7c71a
SHA1 93e469416672d74b27472b1a5185efa945b8abd6
SHA512 a08d479906af4b7e08b67f9f6db4240856bc1ce206fab5dc6d518c040f5cafcc3cb88f66e2e617214512f459ffefecf4f8ce873a3b274bcb1f0becfcfeebcfb3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aBp:A3k03kHRJMS
TLSH
T1C925AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 973KB
SHA256 fb27979151a2f81b7e8bbf29dc13dc43c8fa83245fe8934cf2eb4e6530f000e3
MD5 27f0cb05660999227ee4b763aecdb1a2
SHA1 ed35d391b9380215553c44e2c4b5535be199d237
SHA512 80b8fcc3ee0f397270b4f313cc0f0fd6065a0f672bda39aad34fa5bd9e5048aa2a30cf90c36c76ce6a05b1b9a0079a3ad91975736f6fda66650d17dc16914ed6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aWN:A3k03kHRJMV
TLSH
T1B325AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 973KB
SHA256 baf40cbd2e2f36143bf48a9ee442236b0427c3386f4691a286a037a6dc034614
MD5 af292cfdffec2211a25a4478482a1cc2
SHA1 3df787fbfdd4ac4487c496285b74a0b98f67bf6f
SHA512 19c99c4e09ffae4ac4d5c83955c482c2a3604be14823e7b85950e0382cede232673ab000575e2d8553fb5ce5089478444715683cf0fe6c0d593d081eab4fcbda
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aaF:A3k03kHRJMf
TLSH
T12225AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 973KB
SHA256 daf346933358d1f0eeec404743568d5a76dd113c863919f703a7b30a5566c00c
MD5 6fdb77936baddf75646246ed82b7129c
SHA1 a740cafa966d2079e256394a69b40b7c53b32fcb
SHA512 82500f6006223966476f91ceeb076a62f5598de94c793ed1e1b2cbb2426d4b9b417fe13f20f73f0f495157d6e3103d600bed2bc92981b1750570e665eec5a97a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3avC:A3k03kHRJMT
TLSH
T12825AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 973KB
SHA256 40f69826c2ef5a453a59e3e3bc92ec62b5f010fa90a8688e46c4dab9aa976da0
MD5 69599304367c3deb2b7b2519f72fcd0c
SHA1 79ae9fbb6602c63b7353468e3095af2b5df2b005
SHA512 c432100d6f549991b60a871c2b5b728707f6b627418294517d9e7e801e4a910f88da7ecac0d4478223808abc75c0625f35b8166b492ca4c1c6c1b3133fc48ee5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aQw:A3k03kHRJMW
TLSH
T13025AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 973KB
SHA256 579cd153c840aee55eb25c37c210c299fe1a4fb10e2f7c6a9814b872d1274b98
MD5 b6f02b5d4fcd75a8270725a52666b944
SHA1 0eea1c163f30a29133654c1c7b516475aa4bf2eb
SHA512 914ebdc64ed0043cd7b74f45b8b6308686e1d3d950891e4e4adf87216308b13fc74704bb2f2cfcb7b349764ffd58b9ab9292c91d8e400167341cd66d0ad5e73a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3avT:A3k03kHRJMW
TLSH
T17525AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 973KB
SHA256 43f1d8c628ced264cc18dd85f43c4081c96d825e2298bc563a0f19209ea79268
MD5 ee67345608ddb54347751e555a0616ef
SHA1 82da2c183ddca867117f729633dcc332c1b4fbfd
SHA512 2942da1eaed92d87d38c92a284d145940f7a1843098ed16bb1693d2a71b2628ac03303c67d459dea7af70015be4d4249eba259d3aeed5f0baa240d7b8cf59754
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3apu:A3k03kHRJMx
TLSH
T11825AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 973KB
SHA256 e090ff2213d2ba8072c35148e944322129d30d4cdba7c890bdf960b509f61a89
MD5 f90bc154982fbf3555134bd586cad1a9
SHA1 9718c7ce6c291c9870e6c01c9fd7e276d37a9762
SHA512 1d579126b98bb14d67ef6a2a1316afc7748e3292d98e77d9db8e415e65e771cc0551e6e99a8636751343fdd735107249335b54c04bb54e4d72d55af148400e83
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3ahb:A3k03kHRJMQ
TLSH
T15825AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 973KB
SHA256 9402ba91d4e8b9121c38f296202f5b28aea10607c6819925c693377f639608e5
MD5 88045f3017725a23e9759aa95f0b0dac
SHA1 acd729bb884fed83ba99bd157eb46bbf9d4dd79c
SHA512 f989c9f33be61964c5952e63a877f9117032bc709003f08318f5c89a601d13451a4640637e3c49fdac5e2bae5daed0c939280e08431769031fb0f13876e94858
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3apf:A3k03kHRJMA
TLSH
T1D425AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 973KB
SHA256 5311975881452c0ec25e162ff3134071aa84339219924fb8d45e02767fb0c700
MD5 cc371dde761eac23b05f7fc0d16aa71d
SHA1 fb1e5f0e9b720e0c68d83367de6e1320dca873a8
SHA512 5a1736094f3eedee385dca22e9602e8f0dc7e51b367c202787bb5e6a9dd221e7b27d8fbec8304a2a2198828c922cffbe3a95f5faf0271eefc6c16ca75e6c43eb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aSK:A3k03kHRJMg
TLSH
T18F25AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 973KB
SHA256 d20ff176b4405551a584e1dc82e0aa42f6f46cefd47692e9cc262edda397766e
MD5 30ea4a7944c12f1f245c981739b78cf7
SHA1 eb5e885ae1df0bb1f842fd6ef3a54230cfad4c7b
SHA512 84cd03403b864d2d1d1887a5e9e0a63570d8b78ccaa62de4cc14525830ef27af1ad465cfe8e944998aab221ee60eb3a3ec055856874af279f232d0247a71efd7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3a3k:A3k03kHRJMJ
TLSH
T1A525AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 973KB
SHA256 e88a8a73b5e8256f3cf1782de790d0bb63218e621ee8a45ef875da71889541e7
MD5 701eab66647c84523976ebc3642beffe
SHA1 e00c4920d069307771e87936eb46a212ab181f58
SHA512 0c4fff6f25e214060f30bb7abb8dff607d188c5120af13c7021768986487209b9124f838b56e728fc8a690eefc659b6d48f8712b732fc0a8b802084cea6d87a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aA0:A3k03kHRJM8
TLSH
T14625AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 973KB
SHA256 940e9eff0c8df218d00a0b66489387491526bb3f95e92ef5a9285d8de2d4c96f
MD5 8711a0e0310abf2208a05fc99afbc3d9
SHA1 5cb7ce5b6ebcad8ead6f7187d18c3700125dd291
SHA512 0ca86b5fe82f66c7322830f5a37905a955ecc7fef3154dbc75a3f38efef8021b3cf83b82f3d87d93f6d1f2d312bf77ac680b16aafc3f56b918e05dc7346fe428
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3abg:A3k03kHRJMB
TLSH
T11825AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 973KB
SHA256 cb26f08079ab240aae7e6fd501dca87cf6a723425ce93742609b9a1c3628fba7
MD5 efd5d99ed68524326d2ac0f9c6561d86
SHA1 9620d643a0222cc3af0f50772cbf8c2f7fd58add
SHA512 c4c22dd32ba8036dc355b16d6185c481cfc37bd5359fd653e9711fc2dad70a56ed41259eac3bf9e597af563d7cdc77812caff557e483224ef61eb2b2cc5a2db3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aWr:A3k03kHRJMr
TLSH
T18625AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 973KB
SHA256 c514c7c04189533f8b5c1e90f56d68750d710b5acb897784dcd9631c55842dfd
MD5 137eea8950fa2a79a334abd5cd6b58ec
SHA1 97c5c1a8920ac4eee69fcf6fd9147e04e727fbc7
SHA512 e92c549192a7861879ec3bbd6fcb4e77b32a68d5944c460884468536dc02610e629b9c7fd2f6e189f9604fb463142c066738533419e73eddb990136340541dab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3a8n:A3k03kHRJMd
TLSH
T1CA25AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 973KB
SHA256 4a365d12ffae8f8145631f7eedf947bf3f0f9e08384f3e757b1bc62df0b83fab
MD5 49fb1d7fb6e713ab704619b1a03f70ee
SHA1 a8e68a237103ce2a3c5258bc95757b087859503b
SHA512 8be906cc7894ddcd5fb6631cbe83cd41e9297626421b805af6533cd709f2ab25b0afa4545bd775f76d1d2348834b5b7c70ed1fe38f17dd2d695c422632e3b785
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3a6x:A3k03kHRJMj
TLSH
T1A225AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 973KB
SHA256 ec4f08f77d68ca2f3025feb4a17ed1f16de9245e7cf32ca3e82f19023fcc6bf5
MD5 638e3c9935bff9d55a69af4b5ead5fb3
SHA1 4b3ea731d5d8a60ef9f795b2e4d37995019bffca
SHA512 1de0de6170ff704080f9f1532bbaff32d6c79e4aaea4d05dad43898f2c081e24fb5893bbe3febb1b93c27505aaf906014557bd245a59ff0936b60804fb740318
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3a8A:A3k03kHRJM8
TLSH
T12D25AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 973KB
SHA256 3c69620e6a081c0ae0d22b02ab671f3c6922f64d7966b3b3fc3c84ab76475ffe
MD5 38e5518706b83c2e6ea84b34c9e66737
SHA1 f3be23a2b793086cd3c16920b1343ae4b7397882
SHA512 ca4efa46b257478b264e42a38a0aa7093479fbd88f73c7ad7c8aee829db7d03525434f757d1a17458aaae8de723f11a7696973c107572560203a1fbf9e19b627
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3al9Q:A3k03kHRJM9
TLSH
T1FA25AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 973KB
SHA256 33470332cb28b526e040e308a5b7c74f35058d8060cd8ec14ebf501985774223
MD5 619aeb5b97c37680a85ed06612e450fc
SHA1 e9c0fd0d209a4b6ab0477a3ba9bccccf3f9fa0bb
SHA512 14ceca2803a85d832849e11c492a9ac5e727eb6caad290c27ca3e4ba06847cee323863b89175f11554cb957e6611b97b3a6197f8eb51779656441deb434170fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aQ4:A3k03kHRJMi
TLSH
T17025AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 973KB
SHA256 36c4874bc998d6a130ec2a6225486dacc907e04152982ae9e4cfb0ec147b0ef2
MD5 5ab01bbff7ebc0d514a45c9841d8419c
SHA1 bf6a4a89de9326e5533a55d7375b1d0b23a11796
SHA512 8a374727f4f9f53a90a85a522931b2a51fcf81bbb443b5628671a2fd73cd62cac626e714b44c7804790f65a6c56f9b879d7611dc159fd7e5cbe23be24dc36fd3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aTu:A3k03kHRJMT
TLSH
T17025AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 973KB
SHA256 b9d43c6fbb20c3de5b005e2342f42db48c3e987bee87a292651f00e65e60f478
MD5 e0157cd8f6fe5ac62800a8f339ffb227
SHA1 bea449a0ef6f6a28086bc56812f64e4d171ff2d1
SHA512 fb3d85881c80b0514829e1020bc0e2cb20a8ec595b3565fbb88c6e8e53e69f52877742abea5d8c72236b106decad56e9e48d4cc9f6d698e8310f0aac509eaff7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aOj:A3k03kHRJMd
TLSH
T12425AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 973KB
SHA256 00374442c3f66a841e6304d7566e7092d36f95349909b3cdf60672c67133fb16
MD5 7016d2cbff0f10fe03867915d64007a0
SHA1 27ca240c3b8c876965215fa0ea3481bd86387212
SHA512 32d93cf852d1adfc055f938375e47a56d54055ef2b76baf8f8e687f6bab003ee9c1dbf8a2ea77ad1f9e5a3444309877ab1ee93cf5f846cbc89838fae44e13dd2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3a7g:A3k03kHRJMh
TLSH
T1F325AF13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 973KB
SHA256 1fc89640276a5f481a5117cf958bf775fb7be896b11572c95d97c93356a26e1e
MD5 b0170b5b72b58b1e66a440f3c32f3d68
SHA1 33e5df88e9a68b5ec5315c4079f7867e89adff00
SHA512 04819833b5e1177537cd708df1adaf283e36b38dc62ca377f26175b38eeb86941fa35e24c67008939f0d8f8b2c76627413c61c1dd81a75e0e013c2a37f144da3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3amI:A3k03kHRJMw
TLSH
T1C825AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 973KB
SHA256 7abb15d957bcb6c02fe39af229b621f47af7070783c65fd1e28f4924831334fa
MD5 87297a9dd2b354c92aef7e99159401ad
SHA1 888696025c499319bfee351a718b23a7dff29e24
SHA512 e59a9b99f4a1b492003f145c5505056efd40ab9a9ae3299a68ff14844f947f33011312fd15096c6bc004be6d03dcd45216ea0201246edd92a54dbfd281856a40
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aUo:A3k03kHRJMS
TLSH
T12125AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 973KB
SHA256 f50acd98644a802957dd46ef684c4797b0ae971d2e751d01c0748964b3a8fd76
MD5 da868fbecd67b8ca6ccf93e9af8e2516
SHA1 b9cceba76a85cc749b4e3fcda91686e8efa433f1
SHA512 47c3dbb4f85f1bff917c302fdbd84660db1b5d26e84a4b1dfb2c2c42a66601796c794cb4f38114e1177dd843f5081e0930536cbdef02761f582b23ef5085d68a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3a3+:A3k03kHRJMX
TLSH
T1DB25AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 973KB
SHA256 a688f23a71bb2c7e74c036b8a9e30966bc7da364962c25f72fa17e80a2c75349
MD5 a632d65d51f188b4bf526ca3a8a6a461
SHA1 7f9a17de02ba1a2ba8f9cc0844b6233bf75a2d33
SHA512 0d27bcfbe8af94a95c419907541f6e09cdc4abcdc3c592781b34635b8cec672327ae39f4c4be2eff928ecd44e9d1483256916e20717effdc391d6e228a1dacfa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aNQ:A3k03kHRJMD
TLSH
T1C825AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 973KB
SHA256 006c73a8c66fd706dbd5eafc21c5acf5adbe76663199e11caf50657b299c6347
MD5 06a650084c3158daa2d69e489345d51a
SHA1 55795bdb518bf820a58ee0a172ef3dd0e956be98
SHA512 43a67d6eadaf78c03503b4dc4011a8f67b7b2cf421c5c55f77ea8d82d6404b276109b81c0173cbd20db8f4bddaf314491ab2700a34dcb222aa475ab2c684b34d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aCX:A3k03kHRJMX
TLSH
T18725AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 973KB
SHA256 b62929b645ca535f417e6bd0d860ee1f17267cd87cde8f8d3201e429ad872d36
MD5 1c5e5c8ff3393cf49c252aef9639e6eb
SHA1 44f31c84eac01af294414f508d9681145929f33a
SHA512 0301216a6a57d8c839a5bd13ec42ad1689cdd9551e42580c17d88ffdc6e0793304071ffce6026d622b5c9468f7c7665b3b7993b90ef8a07278f0ff08fd0f2ca9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3akL:A3k03kHRJM5
TLSH
T15625AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 973KB
SHA256 44ae485844dbd87512d87deb699051912bb20a8af7f1915cfefba817680bf3de
MD5 20d7e280e2400d13ada1ec2a25299edf
SHA1 98227eb4691f173829c59611712d1e9b43d065f9
SHA512 c1a0d278badae38d2f216a347ec4fc0da9a3b872ac4187993a984043516fec3132b1d269eaafb2cdc9e734a2454992a1626ac7b1a99585749e8347dd5b87b906
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3aAM:A3k03kHRJMA
TLSH
T11725AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 973KB
SHA256 ac0dd8342da57c459bd8c9e9e531a6d695f6aa43320589c76ff78126a2683441
MD5 c96f5f070e4ea40e6051bbf00b957d83
SHA1 422fc8a255cba9bf8fe203d729220092ea725971
SHA512 1c05465b37b3b1fcc07a896407e367fb1520aa9052cc81f11dc5f5829d8e1754f6ef7cbaa335fc02fa147d4f63c6514e64c0461671f6922914311e299b5aafd0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccUSuBv3ahh:A3k03kHRJMy
TLSH
T18025AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-71-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4260-40-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4260-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads