643249b660595c88f6c1f947109b734f3360687e3fac9214c28f8c87e98928bf

Analysis

max time kernel
100s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 917KB
Sample260818-cl5lnstgnc
SHA256 643249b660595c88f6c1f947109b734f3360687e3fac9214c28f8c87e98928bf
MD5 6fd3050985f716cadee03fe8c5a1d516
SHA1 6647a997dabe42b194e04ef7a4afc00e31af8a75
SHA512 495718205991d6f925c774ac9998dbf8f55bc9fa91ea5a667e61b7992b7a39bf840e143e78527fa36d850c77f9cfb290023d833ade086c957b775ad339cb49c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcu:A3k03kHRJARJ1
TLSH
T129159C03F79900E8D14AC1789AA69A22FB757C561730A7DF2354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/864-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c574-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/864-33-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4184-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c87-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-443.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-559.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-614.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-639.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-730.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-756.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-793.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-843.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-913.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1086.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1137.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1168.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1194.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1353.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c574-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fe-40.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c87-60.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-225.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-443.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-492.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-559.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-614.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-639.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-730.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-756.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-793.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-843.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-868.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-887.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-913.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1086.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1137.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1168.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1175.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1194.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1334.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1353.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4184	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
864	2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4184	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_6fd3050985f716cadee03fe8c5a1d516_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:864

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 917KB
SHA256 643249b660595c88f6c1f947109b734f3360687e3fac9214c28f8c87e98928bf
MD5 6fd3050985f716cadee03fe8c5a1d516
SHA1 6647a997dabe42b194e04ef7a4afc00e31af8a75
SHA512 495718205991d6f925c774ac9998dbf8f55bc9fa91ea5a667e61b7992b7a39bf840e143e78527fa36d850c77f9cfb290023d833ade086c957b775ad339cb49c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcu:A3k03kHRJARJ1
TLSH
T129159C03F79900E8D14AC1789AA69A22FB757C561730A7DF2354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 ce269d701c8d6e5da55290bb1aa341c56a9175028feefce45d977f2f5144c4c1
MD5 dc4b4e0d9b66d1eefa69cd7721ebd788
SHA1 5fa73a5c1feaf8c9a2afc465909a743e515a07a1
SHA512 6afb4383530bcbbe1678581cdbd18af58986285b45aa24235e64ffa3af1ce5732dc2d2f22d5feb0429f91f4e76611a62e1717b6855205a6cfbe7268b9efd4e0f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jce0Le5ji0hmxNrM:A3k03kHRJARJxPji0Aj
TLSH
T1A1657C17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 931KB
SHA256 4b9deaebaa1c0ef10380b2d8427a059bdef15404234603a7d72218d4b1a9b50c
MD5 40be2ebe7e0683bc182ab30f6d763ea9
SHA1 f619145f467e1b360d0eb5572d9223a98f6b34ff
SHA512 ac585a83634d37e33a9272d3a7d4a2fadf3f4f3909b0b90461c327c7f7f900bc463898bf66612b6d9c2b14d2e7698421ca0c72755dfd255d8252b3c22778554d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcYa:A3k03kHRJARJ
TLSH
T114159C03F79900E8D15AC1789AA69A22EB757C561730A7CF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 965KB
SHA256 9a2e7f1e6b73b8159574ca9e1746e714934a3aaa4c49926970e357476eca15ff
MD5 26645e009aaa2f6302c708704f4d628a
SHA1 ff3afe990ec9b2719aac0c6a2a394d5a24a12aa2
SHA512 bcb6f15af87e408bc667c9224dca6519483449ef2fc2d2459188d7673d5a47fbba1fbcd7bb1c1da8fe796fd11e2740b725e02b6a3f9d2856b8c9ea947e4e8812
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcTb:A3k03kHRJARJAb
TLSH
T151259D03F79800E8D15AC2789AA69A22EB75BC56173097DF1358C6162F73BD0AF3E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 940KB
SHA256 932d1864f2afafa815239b80fb55741b03b6f908b33458198caa3ff2cf2d644b
MD5 b898b4113de2cd531b7b94f264cb613d
SHA1 84c81c488130cad923742de2be4cfc6c2ece9bd6
SHA512 4df81138ec50c5508ab221613925ad677a33af1321f98c1a936b94b9e5b1d155d1e2192de2f81ec9927640bfadb1844b9124765e0bc97fae41b481a393feaf81
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcx6:A3k03kHRJARJ9
TLSH
T169259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 940KB
SHA256 d8207f9a9a7303fe5ace234b5ecb869b82e8e4a1d68f7c8d1d7f2a84b8ecfa5d
MD5 f83b76a7f009ffe87861c1b3096b6cc2
SHA1 d5c75689dcc1a67fbf1cc4f100dbabe7d4fc69c0
SHA512 c0a76bd1b7d33aa8e9ab0f3f22cb6c74ece7ffd0e7aef3838ecb6a00ca5da692caceb16c8365741c9410a677265ba58fbcfdadc4dfcbb306cb0983c92835f470
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcvN:A3k03kHRJARJc
TLSH
T1CA259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 940KB
SHA256 7417af82bd59c996090b88ecd5884f6b1bc64f139df7a8e8fbf35aa792c68eb1
MD5 589c6defac2d7d83048d523482a1aaa0
SHA1 b4fd03b170d870097bf7d702d8cd3597924a3a92
SHA512 60f7ea7ba490fad420c27aed79b1c3a0c227d97ba3fd5c0672308fa8eb7e4a9615aea17e949c59ac4d636ec18865024c404802539d3f33d52d92dc7a40fbda42
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcVf:A3k03kHRJARJc
TLSH
T1BC259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 940KB
SHA256 849aeac9b16d935b8b460f27843dae32c4243458e33bd9b7a1d58c8a1b47c288
MD5 dd5eac54e412fd7504ac6f552aac6269
SHA1 b0614325c98ea9f543b12a97239d0ab432efff7e
SHA512 a9d46b28139de28b55c66dd6d781b99c2a445d527cd8e62d3ccd8b6440d129e4eb91b2b8a66fdca41b8a5c962b2e91d5bdfc68d13ffb2396b1b09528764bfd1a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcXo:A3k03kHRJARJR
TLSH
T1A1259D07F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 940KB
SHA256 ffe8b39ce23e7d189cab7ca8c3d717cef9d3f9c0aef9aa7019a309af6c922cfb
MD5 d22ce54de185593748eb064d8ac9f5c6
SHA1 3248855f709e0b8f37e7d71ec74ae710524e091f
SHA512 68bca8c12c841f84ba55c140f673c6a21112e53906b1d83358c6767d28eeacaded9b4efed019a37313adf39c93c4e94eed640e4d4bab7e8eb6378fb4bf565f75
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcbu:A3k03kHRJARJD
TLSH
T11E259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 940KB
SHA256 037cc31e4cdc86cc2de80e62cd6b42cfabadeb74d3db970f93878410e5922e3d
MD5 770d1e02f3acb958fd60518cf7bf103a
SHA1 82b9c03b52fcc8b101a7f5c255bc3773a5491dc7
SHA512 dc687acd61e017fa2bd5b4fe6361b79eb5b838e113c2abdbfa68bb94e08f0cbe5c771c11f22cc79456f62e5bee8077ea774a8918e0332008df02e0fb223eb279
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcJ9:A3k03kHRJARJi
TLSH
T12E259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 940KB
SHA256 b5ef1c04c73dbcbb8062d437142ba828c73a4824ac2398916aff0cdfaab6870d
MD5 5440dcac49aca92717143947b804b17e
SHA1 106e7ccda907e88da150757c39cc673a01e6ce2c
SHA512 cbde0e279383dae0cc5cf5ec397cff9dbc66a8e0347e8c7aad810dc6bad5418a98bf2057bd6487dd64b237fb880f152fa82fefa30d503fe0399c87f99388510d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jclc:A3k03kHRJARJP
TLSH
T10E259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 940KB
SHA256 4a41a0da0c0faba608c7297be9f2c443895bfc6182730c14ce75f81921951158
MD5 02276997bae6a35b9120bd762675c7e7
SHA1 482125f8b27870a6a7277d19ea85e61761a61490
SHA512 5026e29f8b829b592c6f79713ef4bb1c9489a84c644f989d07a34c37ac1cbeb8f2225beeea3722b0361f4c601b30fd2c50c5313ca95c243b65052f89f84f1ee2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcep:A3k03kHRJARJF
TLSH
T195259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 940KB
SHA256 67a74b6a423291e484221e746c1317b4ab0890c3e5853eae7c32ef3938afee6d
MD5 b6503a5ef2d9f22934ae43fc1e3990d7
SHA1 33660f9c6cbf60ae647b95abae467951ce33bee8
SHA512 5d199bada358f710b764afc31d068f778967693c9e2a04753ae36603f57e7c6cc8bfb5c7ebf953e44af45d9cd29b850362f0b921d165a067b822c4cef50d9d48
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcRN:A3k03kHRJARJ+
TLSH
T1A7259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 940KB
SHA256 aa4fc41e50840bef49b31c9d137c1a3322e65268a10b75e25c1dc107489a320e
MD5 e870bd319899a2d9aacf8b85ebc2a120
SHA1 9642ec23eb9ca2fff25ad89bc481babc01ebc066
SHA512 a3b498bb0440c47761a292d7166c425d185723f35eb0153de4cac1fb28f437e20369f70c753000cf0c90f62370b4e4379a869f02452508fb13aacb424485bb18
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jczF:A3k03kHRJARJ8
TLSH
T11C259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 940KB
SHA256 3af3217f5eac982017755435f4ffa9700ba3a083ccaf88af6b5b44a27c8c92b8
MD5 2eba4c9816102aca1cbf93ecb6b15eb6
SHA1 07673ad151fcb28a2349f7b56cdfd795a2b4f15d
SHA512 20380487e382e36cedce68f3373e07aeaa940d306faef5fdbfe14ec264c000babc2c130bbf9582b17ed8531fe889f578409a27081354b1cfbf46e8c7944e9bdc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jccC:A3k03kHRJARJI
TLSH
T1C2259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 940KB
SHA256 5efce7737cd1ab313f8c5ca2495ca483118e997046d1d2080c927f9b865aba67
MD5 9451e476cbe3672ecf53339a501b8e74
SHA1 cd98bcd593f4f7533bc0a474254087c0090bbac2
SHA512 a4b7f776cb2ad9ff7ca2c11db2b312df74fa45bee32ea34c09efc6556a0589bc9897c03e46a37950131eae8df6180401a1b23164a905369ef29d57a74d6447b1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jc3w:A3k03kHRJARJl
TLSH
T18E259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 940KB
SHA256 b6457aedb52a8058fc251041c8b18beb6c89de6b339c951d321ac266fca7095c
MD5 3a3d5d1745825feb3ff8d13e4a12935f
SHA1 ac9933aca6a318712ab1da3d03b419ebc5c75c55
SHA512 27afa90fcf76d38faf7fdd349c3284012debe86f0997c452ce13c427a71b2a09f2657f2a812007f6342e5269402a49130227ea38d17bc601b329685036828a28
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcmT:A3k03kHRJARJZ
TLSH
T19E259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 940KB
SHA256 cb495ed197b8338eca2ef4d06a6e53fe13c20741d60f13867d9b0635b54645d8
MD5 130bca77bde2f57d7bd2a35ac882cb5b
SHA1 8e5615c062ceec788cec819f5e09f721838b6f10
SHA512 c3f8b6bf7e56936e4d9a3991434b20b63418f22afcbed5bce268dbef1a3f48f630d37029da6575fe8e44f28040018ceb266ab772c8f2476900db00d307985be5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jceu:A3k03kHRJARJe
TLSH
T12F259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 940KB
SHA256 dc2ce911ec55fc7dcef4eeac8e2ae8b29cfd490ad035839f9fb9797954990c99
MD5 3947b1ce759fb604c50cd67a0510ce7a
SHA1 a369f7255081ba9ab0fa2ee3009f90c4ee506226
SHA512 6b8ce81c7b8b6f988c6d5fad1a1022a7b34559ccf4e01ab5a97ec8fe8b1980aaf70888f3b47e6f6a6f12915a7f2092a938ba029ad15486ced69bdd41124ffe64
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcYb:A3k03kHRJARJf
TLSH
T149259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 940KB
SHA256 a407d78fa3b87c7f37b167b8a3565423c9a0332f4ff19bdfa3bc6d8ccf6c8105
MD5 86d6cd23fccb4768b047117d4a36ab12
SHA1 2d1a03d539ac5259e1983d64cf2ef0933c16ef7e
SHA512 98592b326efd955ac93b47f5dcb83b7d58f2dd5e8cc102c19fba6a883570a77b47f9204d764589b243130afeb98f1faa0dc0c2fbf5efa8df5b37329274b958b4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcGf:A3k03kHRJARJX
TLSH
T1EF259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 940KB
SHA256 7a24903323cafb6d030dc2f5d7f70f19d335b48766a4269b1277bbcc0b4dc643
MD5 02177e2a07a7e528af2786fc616c0821
SHA1 e0be12dbf4d98ac22f05b840ca692845cc4ac6b2
SHA512 0d4fe908637623bbe47ab7f18f357e45097a42dd1fd756c16c92a93870d0b83d16de50f53ec42456611aa68601a970025e3a86b0751e1b85d682d5b7d8fab3b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcDK:A3k03kHRJARJX
TLSH
T1E4259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 940KB
SHA256 04265449b88e2fe5da271417fe49c509985bfa4ae52b2ee4b7e996ab114678df
MD5 8b4b1dbbccc0bd3d65b938f188320cc6
SHA1 4648ee369dbe97fb054ef30c252522750a9a2bd4
SHA512 50bcdc4fb300d1c64676c761b521b845274459eceb698a78cd153253448505a95540603d200c655dc8238d90c5dbe3c6da02e83a3bc660802f2a866b4340c2df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jckk:A3k03kHRJARJy
TLSH
T12E259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 940KB
SHA256 d7a883ecd88ab02f398feab0a13e1b6e6a1167993707d1ade8a2038173828fad
MD5 5136d91cf088ee51c2a5cc0080f530e9
SHA1 c0308ac83e5647f98d40388c66b2a35a94e42a55
SHA512 8e0ba482eb74697109a76deaf95d2bc422362ee03de794c7b131f43816743d0045b986ae8d465835faa4395c515870dfba4c6749398f3913bd04c0d77ffd9a4a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jct0:A3k03kHRJARJ3
TLSH
T119259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 940KB
SHA256 217ed8019ea711f1b65bdad47140c829cbe4ae70ade6c861bc65e76b22547a7c
MD5 bdf7393048fe138441da6fc1473ef595
SHA1 8aad20165848bb6a187eb4261184a23a703543b6
SHA512 8abfc9e3b80a1456c91a642c02c41399c1bb8c0a23ad85e2a3498d8d1954f2c8a97e80969c79681628624dfc4351a9c62420e93c9ead2eb5c27f3d0a23bccb02
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcwg:A3k03kHRJARJK
TLSH
T1FA259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 940KB
SHA256 be302ce2211a2d5bb9f6e7f6d4876d8c175289e2fed3816a413e56e1973aacff
MD5 4d8b1319195864021fbb0c84d8a23a48
SHA1 e67426822a43226518c3d99bfd67e236dc21a490
SHA512 ba4c5c8d8cd09dc3f97632747a0fb17f129b5389c109c72bf5703b1f5fdc169f8d4664e27d147d8ce6ae07603ed47b7cad685078f4e7219f557e21860ace5cdb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcFr:A3k03kHRJARJU
TLSH
T14B259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 940KB
SHA256 057296105d46d990fd1669027905ee91305502d303662af2a9f4e82637e99ccb
MD5 1c28167587fc8c643c7f59a5d01440f4
SHA1 399494d16f56c3d6d2220c22211b5f1708b662be
SHA512 c19cb6768f49d1f3564a76fd4523d76b9c043987e152f0f21048ac4569d53dcc35d4026743745c1efe1568dd87ed75eb27fb5685612a80d1588ce3fe83e4468c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcPn:A3k03kHRJARJO
TLSH
T16C259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 940KB
SHA256 3022111f048e212ee0c90e6f8a0d29216a33b94aae92d17274b29663a9d15ad7
MD5 d2861618c77ecd70bb6de7f6abd4ff7d
SHA1 30b2598658b01ff8825dee8949c95083325372bb
SHA512 baf3f18e9ac269676ed7721adb6b86602e430afdb40491f31b4af70cf715f4ba667329640ebba921be62f0e9968bd3458a41251818c689799efbd49e0628d857
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jc7x:A3k03kHRJARJU
TLSH
T1B8259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 940KB
SHA256 084eeec6d3690f6cde9006e1a81a9e1710a4ebedc58f099351ce16debac30b7b
MD5 5d68113c62edc86bf226916dedc04749
SHA1 2e0fb9c89f693eb7ae85840324a266e6ddaef52a
SHA512 ecc924bdc8ac0a78bb94c7dcecebed78618bc916cda6bb377afcec5c50c8cd98c51c26ef29ff85a53b753b0425d078f4099c8d8707f9e4b396fbb63f3788e47e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcpA:A3k03kHRJARJ/
TLSH
T1E8259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 940KB
SHA256 a9bfd28a3e30ab72cac35e38ebd827511ffb09d0db8bbce322baff55445248e9
MD5 dc4db1badd4a2eb233c3a55e454765a8
SHA1 66fef74d69468bc5bf0a11912c0ae610a93c5448
SHA512 55a9fd62bc305acb10f3b0aa1c868fbf0669c7f37a44da6700ae5e86c4cbaebccc51f60e66bbdda1daabb9904e1e75c253aa454a940d70bb6e684be592a9d53b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jci9Q:A3k03kHRJARJS
TLSH
T13E259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 940KB
SHA256 6cb9c1004867039be16f97a783ec7b65807d70b9f2a4ced1ea4372539d80cad1
MD5 8395c517a13cdf7c9013fcd99af38efa
SHA1 6d757dc7166940d013bbe746ebf43e724f7803f2
SHA512 dc50c639dbb9339c6d968695d7d145d960a71e85b8a0745b8103f70ff1c5025e5968fbb9ba92ab3a8530295ee4498215b2905258cdbeaa9e93d3f27036f6cc35
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcH4:A3k03kHRJARJh
TLSH
T178259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 940KB
SHA256 ea5191767ca4d35e75ea2a569b31236d89c237e58942e35fc011bbfbd5e93306
MD5 ed62cac98e4f7e9288cfba193eb482df
SHA1 0571448f2e292e627524d1cd609d9a462c0c4417
SHA512 153a4c4385e784c3ffd923d7ab18fcafa58615bc5cf4d7b1ca7273c305544b993ae0d275525be301b06201cb3534c35cf567e113f0e87d3fb6f6590960aea616
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcmu:A3k03kHRJARJ8
TLSH
T140259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 940KB
SHA256 91cfd89e5ba5e1d7ddc9c6e2a0207c376e741244786767a2e6126abe4b5c4d67
MD5 58bc4d1458a937df99a0d08200185586
SHA1 c4fa3cdbf68409d8db13c851d6610699ebc75d55
SHA512 b67ccb0e06303c5153f292db81e02fb2a3432078e5cf466642b0d8582825a8405215de3d2dfeda038454ab93f8c950bf7503963e917a9104632e1f1db939f1dd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcXj:A3k03kHRJARJe
TLSH
T107259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 940KB
SHA256 7500315f5b5806bf24dbb4228c851c95dbb4cc8b14661d3fb0a8877e637216a4
MD5 e2d2d60edfefac728d1de9ec76e1852b
SHA1 5423673f663f0f93b1f06d776574a8c021aba10b
SHA512 939a0f6acf93e37cdeb2a82f9e3dc591551b63eca1d7111caed3c3f636760d7eda419c1885eaef514e22c7d38ab1aa12cb44d60b0ae8e5b624e86eb0f6ff7284
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcCg:A3k03kHRJARJS
TLSH
T18E259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 940KB
SHA256 dbb9068af70e53ee777c59f9d371143d14b93627f3bc0a391ba626f2356d0519
MD5 749e5f8d7f73f88467981937f20f5485
SHA1 3f505d9b7b7b825175da13720116996de4a7dfe0
SHA512 c3d60aed04828860ab079d2e0ae8385badef0cd5bf3c67930cc00ef0b9ea7723be7ba63826c26e257d2914d1da0bf761580f71e6d0f301a1998f2bb599ca1510
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jc9I:A3k03kHRJARJj
TLSH
T132259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 940KB
SHA256 8dc72a6b6af890c99b6009544a8dee798f561fba80d06ed533f34a0d8b664b62
MD5 e92dc6dbd4b828c81cb103b833bf2bab
SHA1 15287baceb52eb8aa2deedeb52a72c885dc3ada9
SHA512 b2070883e24988da6b67c7ffbbde295c3e9d1bd81bbd6fe8b41fb3218c8b0e8b8e3c2784b7fd12810e6a4aa9dbfe5a2ce78a9b9d3ece1e9ebe7068ca8c902a01
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcvo:A3k03kHRJARJ9
TLSH
T19A259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 940KB
SHA256 03eafb2e70fae9da93382815256ce1eb0043c72b28f6a564739d808cb48e71e6
MD5 382871ac58b508f81c8a20eb18569f34
SHA1 699799b41b04db138d2232a9e722ff1a77989265
SHA512 fb0804f689a0404069f9f13b4c9dbc4da61919ae1de20b99b093e80b2e8693243b11409d9cf02933a3f907ba55ba15e8a3c64db7216fd3ac25165cfdab057557
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jc0+:A3k03kHRJARJ4
TLSH
T181259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 940KB
SHA256 1d55a65a0215770451c68551c09ca8f3e991e03b6e2f02eb532c25c6fa096a44
MD5 f45f0b0753d398f309a7609befddc26d
SHA1 29be3ab0e965d3fd6b421d35f488cb12ddb30ebe
SHA512 a1e9efe6fdad306d0eb15f86db057798fdef020767287f5aa646d173b95de0aff6e1ee3b6cf1d5ba93837e577c5d37449d2ae9b842902ac9a313781c5b90f02a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jc8Q:A3k03kHRJARJ4
TLSH
T131259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 940KB
SHA256 5e1bb8ca24102af96bc18382782d3b515dc7a9ecf6c9a7a2f95c34c5d9308aee
MD5 c76cf42d284086f5d10ea14973b1f9a5
SHA1 581f25cb7b15a4a95d4f9f2d59ac909126335cfe
SHA512 dc7d33705b17a2849edafbb777aff8d8f4ab16d0739eb937145c0a08caf5d0db92244d7f10a300533eb4a5baf2425531001a17881744cb0b45299b423ff71199
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jclX:A3k03kHRJARJI
TLSH
T178259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 940KB
SHA256 520f3a8754a907ff44ade74a353f22738cc48d6ce21e510e4038dd52b3d765c5
MD5 86d2fe9be9c045153f00c72879711de1
SHA1 60000cf13054867e229749290b7d01353edd621b
SHA512 f8d9085a4a3b05b4bd44acca848cdb376f8010fafc4bb12f02b2f806d5a05a300cc2291a8954ae4a01fa5bbcf7a4d64c574794e6a0faac5d990ca90501722af8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcHL:A3k03kHRJARJa
TLSH
T149259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 940KB
SHA256 507f78ac28b580723427692d1cc9abbc3e6c3c1dac7f49c8dac7fac1dd509614
MD5 0ef887ede5d5e3f0783ab9695a0c5a5d
SHA1 18094432bd7af626db8c01375837bc62149a8f97
SHA512 d01b8befea0dfff045a4dd30ce3419fcf7812c703cd5b3956f4caaf53ee270c9c0b212c1166404174e7201064b282f53bc704e0bd563796897590cbfcb54b492
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jc9M:A3k03kHRJARJ3
TLSH
T17C259D13F79900E8D14AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 940KB
SHA256 352ecd9493b5d18d292076d69e272b54e110694b79c60a3cc1b5a34ea9c904e4
MD5 1624dc1d02948ba14e02db402dbbc6eb
SHA1 b6f88d1c2027d679220960a1d089bc3c375d0693
SHA512 f66b17b17edf8963447ae675d4318cd76ff33dcd97b1d0f4277635b79c1c200a3572a99cd664866f255472ae7aa6c650369b0b64f13e304dccc364055c1f1426
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8o9jcuh:A3k03kHRJARJp
TLSH
T1A4259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/864-33-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/864-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4184-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads