fe9285a904a9ff7be8f7a5b7a12458cc7d91e539cb5d6c77530952408486fed8

Analysis

max time kernel
98s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 945KB
Sample260819-ee7tkadk4v
SHA256 fe9285a904a9ff7be8f7a5b7a12458cc7d91e539cb5d6c77530952408486fed8
MD5 f102af69d64a7af570bb5aefdb347332
SHA1 f9219e1e005a7332c3c057824255e536238c8a4e
SHA512 fd1d82b2da1bae9af50b6fd71a8f0d1f262dcbd28c01d1265caa2a58950c4d512bde069728afc9d9200ad17fe200e15b808a548735315752100acc8346213f69
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEE:A3k03kHRJ
TLSH
T1FB25AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/6000-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5ac-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6000-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4948-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-448.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-588.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-716.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1047.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1079.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1351.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5ac-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-224.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-261.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-448.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-588.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-625.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-716.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-741.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-785.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-823.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-854.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-885.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-892.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-905.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-930.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-949.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1004.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1047.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1079.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1129.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1148.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1173.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1180.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1217.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1326.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1351.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1370.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4948	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6000	2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4948	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f102af69d64a7af570bb5aefdb347332_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6000

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 945KB
SHA256 fe9285a904a9ff7be8f7a5b7a12458cc7d91e539cb5d6c77530952408486fed8
MD5 f102af69d64a7af570bb5aefdb347332
SHA1 f9219e1e005a7332c3c057824255e536238c8a4e
SHA512 fd1d82b2da1bae9af50b6fd71a8f0d1f262dcbd28c01d1265caa2a58950c4d512bde069728afc9d9200ad17fe200e15b808a548735315752100acc8346213f69
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEE:A3k03kHRJ
TLSH
T1FB25AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 c21d90e2d08a7db1148225aef7d18adfa8a82bbe66d02ce09e2d2c5f0302fad0
MD5 5bf38fc5574bec116c4a73ccb45c6cd6
SHA1 bc33a546a512567305a5894210ad8438f2d146eb
SHA512 7c6dc258f9ffd3b1fab85720e5c5ddbb134d89330b8f00d1ef8f702524121ab7cda2cdac8069a034b2e8dd5cabc4da2710f58467fdc3d568f40e7f1867e8b308
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEP0Le5ji0hmxNrM:A3k03kHRJjPji0Aj
TLSH
T13F658C17F6A402B5D067C1B9C9E69A5AEA7138421B30C6CF1358C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 960KB
SHA256 e2f9ad7e4f909bb8688a207d5fc400f1f84c42f822ff773aa89c227a14598ff7
MD5 700272b5a0cc18d8a3ea19c375be90cb
SHA1 9da99453bde2ca48e11abf15d3eda25cabfd9b51
SHA512 0dbbc766e6addf3fe6434b95ee303ad2ce1d2d81b1eb870973fda489fd5c534176308509cbc2549c5faae55699c1cf2c1d46059fa6852f91e8587dfa1b59152a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEERa:A3k03kHRJ
TLSH
T1DD25AF03EB9400E4E10AC1749AE65A23EB75BC56176097DF2368D6152F72BC0BF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 969KB
SHA256 4ab8fb45b699839bfba0c83a3bb7c997263475d91f2d743987b68431e2647060
MD5 8a3f227c49aa6421de611d627e65306d
SHA1 2ed89de879c2fe42b1f605bc835bd66305e5035b
SHA512 840a353b8e82ad31d5edf45344749a3f51b4378a7d320585bee4f1dc882a271a44403708c38bf52961bc8b13383f31252aebe897004ed06a404958ac5874b55d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEo6:A3k03kHRJL
TLSH
T1B525AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 969KB
SHA256 7f87839aef51e6551a00408e14c28987f02d00f20bea2d3221c800c4002ebd8b
MD5 ae0d9f4dfed6d94ec2994d589d009f53
SHA1 aeded3a04a1e8994b6a2fd9b95decf9942cd090b
SHA512 8a3b72ab7ec510b4fbfb3643c2db11c2ab0843154019b74445de74a3fb7bddd053ba66f1d4a67bca0cbe8f70e75a95b67a8b9919d359d01b9b79086f0b7f6e44
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEsN:A3k03kHRJ2
TLSH
T1FF25AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 969KB
SHA256 265974021d93c6b5e03d824c6045c40f9891117a53a0ebe3599021c8aa692a72
MD5 1dbbad8896952eaa4c487dbec1d85bbd
SHA1 49edf9e22bd69cdcc703719604243e597a26f297
SHA512 aa3fa0c4587f7895858a7214a6102fe8661bd19e2359a9b3780574d83a92773323eb6c32b0e37568e3b35fb5a2451fcd9cc47ce9d7c2b311902fae231b5b7eef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEif:A3k03kHRJK
TLSH
T18925AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 969KB
SHA256 0f47d222c3123c993e491b5409e5461dae2f5e1a58dc5bfc9b44cd3cac8f0ef3
MD5 720eb894d05834fc979f7b26af99c313
SHA1 ce1e821828166e4a8d53c93d784323fc663a8add
SHA512 d58d49aa6a7dcf73115a0ebad4a4d5885e3e512ce8b34fe07f6c8783cd63622e79505ca443158fe3ee600b8d1261314442985b41fd4a0aa877fd8e97429f94e7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEE8o:A3k03kHRJT
TLSH
T14925AF03EB9400E5E10AC174AAE65A23EB757C56176097DF2358C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 969KB
SHA256 01386a4aaea6c6d6d71efe08fdf566f1758461d5651d4b0839b8951dab81af72
MD5 1898291dd38ff0037b370983b7ee7bf2
SHA1 0b8ed6066cbd58fb29e532651018c32e45437b77
SHA512 b273c8b73612a3b112cbbf9f39f337a8866d28175e23472022c4f587a4b22141adf67bab22ed3566e089f57d7ec2fd21f0e1229f102d2fb9ac538d6b919b8470
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEcu:A3k03kHRJF
TLSH
T1A525AF03EB9400E5E10AC174AAE65A23EB757C56176097DF2358C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 969KB
SHA256 4fbe3e25410aecf5c4abff52282b5d6b0e944629f07b3dba7de27f20eb922afa
MD5 bae7dcd1e2ea98305a58165f08e17aa7
SHA1 245ca102255e23f5bbc9e77003d6917dceb17ec4
SHA512 e949eaf3b81b8464ab2a3df82266ff9f3c2af904886f90205ccdb8c1cfed6715ca60c4c8130477b722e7ab9637d657f41869366db2552a22872c687c41a43bb2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEg9:A3k03kHRJw
TLSH
T17725AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 969KB
SHA256 d3c80a37973d273938ae5f32daeb791623034c4df9d57e209007f5dfbe3c9fa5
MD5 28b04cd8ea4936f487f778cd66417a88
SHA1 53cecec2250bcf8959c48ee26330b1b45d42c818
SHA512 c8690bf56f06de73608f5dbe940974c1dad8adb78a0f5146f9fca7b064e2e819eb18c2c8b1d5f8a4fe6f91b4a63586a361d3aca7d042a5cacf55c304fe6ae799
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEoc:A3k03kHRJh
TLSH
T17925AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 969KB
SHA256 e61744b039036112aa242e7267ab8e6e5594f99d2dd967dabc8927af1fc6fa2c
MD5 602b25a3001702c1f943b8ead66f71bb
SHA1 754673fd982d8bff714d7f89c623e9cdf8c94775
SHA512 1b648e89685a9d71d403f2dee93d423d1775e5477beee732a1f76b5740d27897a56c098f1f322a0506377373b67b04b029522b18718aaf6c4215434fa218e71c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEBp:A3k03kHRJf
TLSH
T1A425AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 969KB
SHA256 8f65f05d4db33f9c79d7ab1a89ba75037710bd7f2c4d79af3a25266e3fe342a7
MD5 807b83023137bb9dc112ee4379e509fb
SHA1 41547dd5cf96e78bd2f8d3a611c7fced854e9cb2
SHA512 455ce53afb6ae26e3e3256714c98e71021a19825281b33f42b052644fcf1138c56c4d00aa537019209bb078fffaab2008f09abd2aee07f9b7c82afe0c0a52f3f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEWN:A3k03kHRJ0
TLSH
T13325AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 969KB
SHA256 30de25ee72d082dfd5f33e0e70ed29a5670b5c72b1fd7e680ce45bd039e6aa49
MD5 91a54b736998d944508fc596a189be1b
SHA1 52508007c444b20719e34797350dc96e71d7fa0b
SHA512 99d6a301ea7607695fa1ad9032f03e312a242069404d23995cc132aa2588e0ad363d100af3d43851eead7e56b16b44c5eb01d5b2e67ca936bc7d32316326276e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEaF:A3k03kHRJi
TLSH
T13725AF03EB9400E5E10AC174AAE65A23EB757C56176097DF2358C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 969KB
SHA256 4de017b51f2dbebe071c732fa6c53e010581c9606f4417ded712a375dd23f06e
MD5 425b0cf9f2924daa537cb14aee5311e7
SHA1 1dab88de3574cc41d89a7fe888f4be026aa2f4a5
SHA512 97b13f2f8e64f410023ffade84c4fc106faf42063c74f6e6f79fc1b421f13f3d502231d3eba337314b1207f7ee272a85e46c16f778f2ed6a59d80359b4381dd2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEvC:A3k03kHRJ2
TLSH
T1E025AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 969KB
SHA256 b07791ed84ee2a5cd556783143dbdcbc0a699d0dddc1616a5c23b27ae455952b
MD5 235b1dfc03f9ad1f174d2184f2de7e25
SHA1 aef771870d935caf3c3549914cc624a8868c268e
SHA512 f3947528d75431c54c65d63d20b4fe1d723011b62522ce514e73c98c4222187f2df5e2f69ff584c12291e24628f3c5be2058966a3bc18a0f7ae09f4a60ae0c2b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEQw:A3k03kHRJj
TLSH
T1E325AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 969KB
SHA256 0bb57a73eacafb9524b97b6eed06bdad68da31983daba1de81e44c7f45dababc
MD5 4ce68babffe80b1183eb62f0a74bdc1e
SHA1 37fcdc747b25fb33d4ac8d8cd31a217798b58103
SHA512 38b6355ffd40aca76366d1bc0f75d4a5bdd5dcec970976e6e98b55eabe8d1355243c8ff31d98f4c91adcc728755e05c36e8a7ac43e2d3865203aa52e025bbd01
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEvT:A3k03kHRJv
TLSH
T10125AF13EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 969KB
SHA256 13e2c0d4303da58053576e66209c713292c2380e52413d52f067a27c5fbdf19b
MD5 01d8dadcfec7dc920e440d06a97481e1
SHA1 16dd1b76a652789bcc4ce1ca17bae82a5abc7a8c
SHA512 dd13324f32c3d4423223811115e92ebfe9c227eb6a2256ac0cfb7fa925ad3335e5be829b70063486b8ae1cd7c9419c6bae9cce046a13c271070de6fa8fd7542f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEpu:A3k03kHRJA
TLSH
T1D425AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 969KB
SHA256 afb1290c302e30dacab22a83f75b731fba5489e9315d276c169103b78f748c5f
MD5 1a25d3b83d5ce93631f363523aa325b3
SHA1 0c0bfb5c40d2c75d2fd1d2bb939fa6adc2016238
SHA512 1270675046dc8a50c16db8f9f1ec05b61299da54e818b2719ae615aedfc1f62841d11e582c569bc04ee8f726c01b43b5f25246a93eb6f5f167bc0ada8234839a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEhb:A3k03kHRJ5
TLSH
T11025AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 969KB
SHA256 2fef1ad447d1bcddc885834e823506dab6e89b087196cce11e20c33a6e506c7f
MD5 e083d1d65902fe7a56372afb062c9a39
SHA1 e494dd916237e52396db44fc80ec07badca5c655
SHA512 b69bd41433178c8293ce74de77ce8a2cccb9feae39664e79cc0084e6f2b699d7dfda49febb8008543b325de83173f4fb77ff41a49bc17c0c3a7315cb83306c25
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEpf:A3k03kHRJJ
TLSH
T17525AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 969KB
SHA256 0ef89354f1b3a93aad26adfb5fde8d09310d4278c0403e3635597f949ff84829
MD5 5df02e198878d5b378695188a516d4a9
SHA1 359c8ed83eaf5e29699469593fd9196b2fe06d1c
SHA512 037ac79e0e719ec7398474af1b020d621efdf6c2abac5c366ffdeb89743bf5658e1b557f91fb50347b93436b36ddd5ab818c3c9e71b3bc3c34bd47bd08c3edac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEESK:A3k03kHRJh
TLSH
T1C625AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 969KB
SHA256 59b3be51d577cf49f353acde0d7b8e8ee2c81c579f72a8b9998124efe32ccb17
MD5 24ea2b75499888eeaacb5a5e98a6b1ff
SHA1 b425daaecbdce36fb332b030a517812e7eccb838
SHA512 7d49ab27030996641854a11b8efbc6d6c80e33eaee3fd3e73bfd81eacae65b80be84a267a1f5224063e30825c3fa325f642cf0ffd5bc0d2f3acaf3e256a34850
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEE3k:A3k03kHRJI
TLSH
T18125AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 969KB
SHA256 89f4fa7bde9d4bbaf8d3a4b1f3b7b76c07f3c63846b5e94fc7407fdceecc9ce1
MD5 486d1272862db103180ed77554357a6a
SHA1 6624d85f8f638f5bc2791929d681345bd7befd17
SHA512 3345338459197e5e7c089409a58e4ae9563b8ebb306cdcf8dccc5b47b1fca9f919dfbcd531736c73002e2e7d89bac36fddd8c81cc64cf093fa6be107738a69e6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEA0:A3k03kHRJh
TLSH
T1C725AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 969KB
SHA256 c42428c7209a21164343e075ee2042f5e2c7d976fc0759a9c1bd895ab41de93d
MD5 77cd52702258762fae10e036f21d91b2
SHA1 17d9d5c1dfe9acdd257213fa6ea87a97b423432b
SHA512 b110b731ab9b213764252ab556638a24ba033237ca9e9e0a978f62a9a3c531b8b20185ce0ef6d6ead658e896711eda9fbad4f7c0d1ba006eb18341d8edf052aa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEbg:A3k03kHRJg
TLSH
T18B25AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 969KB
SHA256 a42849e190f467f2c470c490263406be616e4ba7cc7cc985481cc54ad4ee9761
MD5 5e35386111c8b3836a8401a7eacaadc3
SHA1 18e0f3c5b20493d6a5e0791ee924842e0e914f4a
SHA512 dcc2a2b2a82840270b6f5e10f229135ec7cb7d8c9d1333e5b025ff56a60a262391b12254e782b551d5756db615e096272d2090ea0284ea353728a606e2149ee6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEWr:A3k03kHRJq
TLSH
T17425AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 969KB
SHA256 de6994300870b3205e915f381fb0b9ff48040a44adcbe014355512d01f987c06
MD5 439b0d1aefbc435ff6d4db253049b68f
SHA1 77b23dee5bdfa0fe0de5070f938771d1ee2842a9
SHA512 790af87151c766e9e7aec298899ceb67170714499896af3c9bfcef4b62e83e9aacec69b9800ffc467ba48de5c96714e6b4a3d893fa81c69c2685ab64105e4cb3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEE8n:A3k03kHRJs
TLSH
T1D125AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 969KB
SHA256 a94e0f447439e5f05980ad898c508375249f3cf6fe0909744b03c5e471f4e065
MD5 e8d72d525f0be97e08c7f742c61f5798
SHA1 8e6d19a1a4e5ce6f3c09642bfe5a98489562ed94
SHA512 01dc91ff61ea156702930f0490d4994e103a8655fe283e28bc3df670f0f125bdb385a1aee3c42c57e409ca118e133ca6020f8fb74c977e320040a8aca5e253fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEE6x:A3k03kHRJ6
TLSH
T10C25AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 969KB
SHA256 a61ea130ed7c0239bdb8fe84ba9a189fc17e77ee9a32a8deefb006ca21d7e9cc
MD5 6356ba11cba086739e9fd4895bab387f
SHA1 ff9a65bed4fee2cc00736683e543633f0df00d18
SHA512 86acb303fc8c845d60aacff31580247c6d164966ce3571f59ae40967d8bda3d93478fa14c0e136d2064b4f06ba04ad959bb81f4998b35c794fe9bfe00ee0de5d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEE8A:A3k03kHRJ5
TLSH
T10C25AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 969KB
SHA256 d069be6159d464d7d3063eca2c3dd016533db24ce5ce82185d6cceeb1c459d66
MD5 a80a3a3d4054c9f5bc9310948a224e9b
SHA1 453660eb15010a9315991138422e1338c19872c6
SHA512 e53a7d97bcf488277c400f718a05e76da61a6eb74118a1d48071e42057300865ef6a48b321e5fc566de432f21794ea61ef66e3e6619aeee4ff70e48ea4e16b92
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEl9Q:A3k03kHRJg
TLSH
T17525AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 969KB
SHA256 cf5226a23dfbe1ed3144774765fd1dbbe206c440339909ac6ddfa573b06c354b
MD5 4c3b64d455c506d4d707fdae9a8fcd7c
SHA1 a14d1133e2246aedb6b023e214a229e4b2297859
SHA512 4a1ae4a22a382aa82028f469548e8ca260a8fcb59875bea73ae5595fa402c07247ec107de82726734076fc6d78b2fcb0fd32c1565a90de02b0190281b7f45857
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEQ4:A3k03kHRJ7
TLSH
T1E525AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 969KB
SHA256 1897bf0157344a1fd0fed4f249cd7a70fd4b2304db32dd3405e4f58a2576a0ef
MD5 ae5acd38f970e1e041d508969ee4189a
SHA1 8baecd64d1c0e2389dfca920afc64aad7b580bf5
SHA512 676626b2a8227fa73c3470d45b54697104e5f90f1a5dd1302d764e7e05b730585cb81b82fe99504034e5bda7980015a75a2fd9a1de19d4fadd3bcd6acec82684
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEETu:A3k03kHRJu
TLSH
T12425AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 969KB
SHA256 a10e94f279455cf8b949a42f63bb0e52b40d016a4b7872b1c0a368a2c92626ee
MD5 6af14d7b1e819fe5b2a6262fb51acaab
SHA1 32eb1b4ae00a9c1e3a8d1b762f9e9826ee047c62
SHA512 079c4216bb26bac83247b9d0f19ed68ba6bdb01fae318a1a453517ec4abf134955955fd2ba7db0fac2a87a8090511774c37932492456d818351f8531be6c85ef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEOj:A3k03kHRJA
TLSH
T13125AF03EB9400E5E10AC174AAE65A23EB757C56176097DF2358C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 969KB
SHA256 3b188d7eb2cba2a00bb1a22d95c465e381b1bd6ef3023d8db4afd06c0ca8411f
MD5 e01bf4199f50f76e621d862f4dad3f54
SHA1 2c1d0af2eec21732938a8d9798c1d3823475c9cd
SHA512 29540e7606d666d8f2e6240bcf695bb586b41d45c3a822c1eb8befb7fdf46d4d85729ec30047496c5ea1b88349edd85a2c9f86eee382bebe66216464614a802e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEE7g:A3k03kHRJY
TLSH
T19325AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 969KB
SHA256 18c93a34a6bb1622ffcaecf1fa56d6d63e5a6b0a0c12e0a3f59dbb4a7de9165d
MD5 06308558b210920d9619953289a8081b
SHA1 11280b6cec0ceab37e227350ba4e240906efa303
SHA512 3b853318312fc6600255e73566ecc8bbc58ff01ec54f12617870db913d50432fef4e7dcacc04d41e954eef7bafef58374af3f09f1d343d22509f109fdc63cb21
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEmI:A3k03kHRJp
TLSH
T1A625AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 969KB
SHA256 d4253e611d825db7d2b44ee359b0faa75fd00258f0ca0923317ef7d49fbd62dc
MD5 01180cad52023b05bad6c078757ce2a1
SHA1 30fbda39d63fb247883a5216af4b5e3672f418c6
SHA512 3b37306bbb004dad111840763d3fae0edd3656d51b2bdf0295ef01580422ff79e8e6be1f2f3f39f8b9a86d6202d39abf2e69fac10c1fdac4fa7bfd1355578371
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEUo:A3k03kHRJX
TLSH
T1E225AF03EB9400E5E10AC174AAE55A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 969KB
SHA256 6c9f9c759864f76eb0d23ceb87dddf90e1f7460669f1228207308d3e8a448873
MD5 2c93a2f0457104cbdfb2dc9bf9408b34
SHA1 f66866213a179a8205e8a9e68688c54b6efcb370
SHA512 4198ddc1299a6350cff546c1d89e0bc4cf62bf888f7a9a13a1b6b6ebd2759492512cbd327885ef0902747fd26950881f9753d1df92c09e6a6df0d0f746cab7d9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEE3+:A3k03kHRJi
TLSH
T1FC25AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 969KB
SHA256 f0c2176a2ce1f8a52638ba6aab9bcaacf1ccd12c5b3c2cae6c6d538a353953d7
MD5 42b9796ef3a9e16629fceccc178f2a9d
SHA1 3a27166604f90c829a3429752d444ec866407c87
SHA512 64bdde3ec750163a3f022da6ad4fb5e314d71a41891e8b7febcf6f866c27d44c69e42d958cd119dd3ba2e7df458c8202e2a94911f2049458169ffdf5fbcc7593
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEENQ:A3k03kHRJW
TLSH
T1DC25AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 969KB
SHA256 a1790afc1ed9815eccaad85f35c83898d8286e2a23782f6bb7ce025524a22292
MD5 986b4d48399627abe09e2625b23ce042
SHA1 84c0731b42e95c3e9e0c191d9c1f26cba0c58e12
SHA512 df4b202d486dcc11b1d7b670d2ce228d84016ee0ae4025adcba7b8e7bf08c70fe77b307077ade846265d14404352dd1d0b792e738223f47f87fa4966c08ccd20
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEECX:A3k03kHRJW
TLSH
T16525AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 969KB
SHA256 d9e564f8e5153dcc1cfc8dcbbd460d44459248a10349a7b362563a9c6cb717eb
MD5 6d87140eeaf7976ff84aeb3ee6e88111
SHA1 5dfca11001b414ff55afaccba7c920f7428e4aad
SHA512 ed86dfaf201e78c714368cec35a66b9c832a31ab02bbecf6ff8dde6ee72d2b5b20f2d120547065cdd8def1e5631b87fdeeacfd106db24932e7081df93bca64b5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEkL:A3k03kHRJY
TLSH
T14A25AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 969KB
SHA256 148d583acbd4f88d7119a004c556713b058d66afef41f86822fb344966dc970c
MD5 f443a70c879a48aadc4265a0c07c43f4
SHA1 68390a43ec45451387a1ea8e1489ac9bb8953e73
SHA512 cbb34f4b2a1a8643c1892fdb1701807bb6143bc05c5db2fd317a75665df597141be22215acbdec73736595bcdf8e088ae0f732a42dc6da7aea199dec59a14a1c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEAM:A3k03kHRJ5
TLSH
T1D725AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 969KB
SHA256 abfbd952154537ddb60b6c489bf4acfcd477da8e70d048968b64e808d9a2bd34
MD5 246240c8cf439da41c418975e15772e5
SHA1 9e204ada6a85d42f7868477cb6ad893d6dfa885a
SHA512 81b2cce774d4237d96cc3a7e34678f4407a1229f3464a77b718cb4447946d77d1d6101f0b61811265637b8b655ecfda0a590f37f70cc5a599d04ab12c8df3673
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi0La3ScDaEEhh:A3k03kHRJr
TLSH
T12225AF03EB9400E5E10AC1749AE65A23EB757C56176097DF2368C6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4948-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6000-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6000-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads