a69bc39bee7d817c30f2093d2b6e529d9dd4d67eb29f75081ea55de1cb9f2bba

Analysis

max time kernel
112s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 901KB
Sample260819-rasv3awbme
SHA256 a69bc39bee7d817c30f2093d2b6e529d9dd4d67eb29f75081ea55de1cb9f2bba
MD5 0e3e366738b8bcc6d0625dd83c5453e6
SHA1 14b26892dbef27a35ed9c7496e0f2c56d5025a00
SHA512 4ff29eedc2e439ee0d83029c92af270fb63d54437d587c802656d6c50ac6ebcf7463deb69ec3cee7d79d75bb0361ef5c65eb802e3a53dca18bf96f978e96f223
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiN:A3k03kHRJE
TLSH
T11215AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/5088-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4f0-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5088-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1648-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c85-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-562.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-611.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-642.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-727.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-795.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-844.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-870.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-985.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1065.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1153.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c510-2141.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4f0-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c85-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-226.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-444.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-494.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a55-562.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-611.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-642.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-727.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-746.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-795.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-844.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-870.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-985.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1046.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1065.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1128.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1153.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1185.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1325.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1344.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1403.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1405.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c510-2141.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1648	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5088	2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1648	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_0e3e366738b8bcc6d0625dd83c5453e6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5088

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 901KB
SHA256 a69bc39bee7d817c30f2093d2b6e529d9dd4d67eb29f75081ea55de1cb9f2bba
MD5 0e3e366738b8bcc6d0625dd83c5453e6
SHA1 14b26892dbef27a35ed9c7496e0f2c56d5025a00
SHA512 4ff29eedc2e439ee0d83029c92af270fb63d54437d587c802656d6c50ac6ebcf7463deb69ec3cee7d79d75bb0361ef5c65eb802e3a53dca18bf96f978e96f223
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiN:A3k03kHRJE
TLSH
T11215AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 63c37e092e3867a889f20bb2a36180bb2a15b4c661bf7625aed2a1d4c972572d
MD5 1c03996582d26890c4a24d4f696ed60b
SHA1 0a425aa7b151c6b33710ab0ec95ff480b3daeb1c
SHA512 1f6e4a1c67b9773da6f9c33346110ec7b8589b047af21a2b2e9ab1b8c49bbce910bb9348c360b7970ef7c0797aef3d5e4c0a4af78c0f0b5dd532b991f7a270b6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiZ0Le5ji0hmxNrM:A3k03kHRJ8Pji0Aj
TLSH
T102658C17F6A402B5D027C0B9C6D6966AEE7138821B3086CF1359C7283F67BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 916KB
SHA256 46606eade11a0c6ece2204f1d8de4b557f310bca25f443d1337f3aa591cb75bb
MD5 7eb4966ba96501d0b98292faf7be74a3
SHA1 19316c8a5b1fe711c7072f5eef1bd4706d2f7adc
SHA512 ae4ad0aaeeb79722c21c01502f7fab04b172453e0f5bc8338c4279a1445aeb8d435eb991e186d596547da2f713d86f0fb8b7b522e912ccc4fa2c56f612eb0390
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiLa:A3k03kHRJ
TLSH
T1C015AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 949KB
SHA256 fb5d43593be0c9b89cf0277c0103897e1171d9014a6da7ee51bbfb30152784dc
MD5 c35c0e3de4630197f2fc33b6d8175c01
SHA1 cdb0a154922b5333470627718eaaee18af39e711
SHA512 5baed6e0e16c0637c7d4483461bfe0b1b9dc6df8bc546bc1a4af17cd1809da20f78980ef07466bff220c08f46c25dfc3897212755ae37d94a96996992f62384f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiIb:A3k03kHRJFb
TLSH
T1C925AF13EB9400E9D10AC1749AE58A23EB75BD561770D3DF2358C6152F62BC0AF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 925KB
SHA256 e7c50f6e0af2f27993c428cc8160e38c4f5bfe2b85f5941364987f331b921ef7
MD5 aea3284019070022a3fc6cadb9317fd6
SHA1 0bd1f3cc4417b07b5bf3714d49d7d378e6e91f0e
SHA512 4e3d27e83e1b8bdd102439aae770b48264b4ec00741444e699cf46fd677b9db5ecf5b7f7af8935803bad6e76de06fe3f8725f5d169f21fe2e0d3a5651fb570ef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiK6:A3k03kHRJq
TLSH
T14815AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 925KB
SHA256 56eb1309d3c3dd67a6f2af5426f75753d2e3bd0be249aeb3e2c3302d2553787b
MD5 a20cad08376fac02d077b9f5ce13ecc3
SHA1 f777276ab39f0e3a30161a97022647d749533fb0
SHA512 85f23671cfaf072d4b7fa63b9f27301f11e07d79d1cc2d1c1be4ff631672babe77e840cda4848d560d45b787e8644b7565b082103e5346d0e2646f2537d2c23c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiiN:A3k03kHRJj
TLSH
T1CF15AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 925KB
SHA256 dab25ff44251095443f6aabe872fbc13b1979d38ab061b9fa20f4d5595161330
MD5 6d7d0be731c294e7ba16cf8442d11628
SHA1 ab7f472cf4d148e10079aa5801de9a4f89c01ff4
SHA512 4b2f6ba15070798a06912bf4f7e62d59e55603e385ffe6a582fd0e0ee527dad37ebf60d5593448c6eccc02566d4439d2d049ab5775c4cf7b018c3c4885e63e72
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiYf:A3k03kHRJn
TLSH
T12715AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 925KB
SHA256 dce5e775ab217147806e70b10ed14852cca9313e918e2255a40042abee89c011
MD5 1bc4bcf86e5ba05b27fb76cfb8aa297e
SHA1 07c0fa4e74a43d98f35373b8db56ab83e14e0d0e
SHA512 732dfb721e9be1d13412d1851fa1df1609e0b9c05435b1abbf1b71363217555058b41866a502bddc459db79d0fc730d2302a9c76688ea287dcd6aac62a8ab902
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiyo:A3k03kHRJe
TLSH
T1E815AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 925KB
SHA256 b3e4f7990d300573077a5be2c0ced8386adfea7bcd329abeb9672ec0d6931918
MD5 b4335aa3f573017db45debde930aa059
SHA1 5c68e519a3213fb4cc9c57d485482618a9c11331
SHA512 c50bd3022e823c2faddbab53342e0ee48446ceb3bb5e637f1a89cace5d0775fc67f811bd2b05d74ea3db1169d8eb203610528a4ab256978ba989b2898ca4ed59
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsimu:A3k03kHRJY
TLSH
T17515AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 925KB
SHA256 163ea9f9305fb5c87c43c14dae311d5a82123da55660c20867dfeade5085cb2f
MD5 96292e350517c2bb73333e41aa3ede72
SHA1 718cff802b5e7cfcee23495d81efb52edcc84ed1
SHA512 18fa1a128ee7208649060177eaa2c9ea6a3dca93546606622f0758fcdc3b082aa8e8d8df293d9730b23db691bd2691453828436a4ddbf20778047e9939924d8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsia9:A3k03kHRJN
TLSH
T16F15AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 925KB
SHA256 aa108bee14a0c119bf64e2085d2a48f5f990d68220913971c3c7699ee6837c7c
MD5 ef6613c1de3bbe766b7b60bfc883306c
SHA1 cf091860e5ecfc0544db3b893cc25e603c0c738c
SHA512 bf5da752e8f3734535c6f578eb5d69503d31d1516851857af46098292cc79fb9fb47a295fd0f31988d54f789801ca4973aba024eb4f50a4acbf5a0ed73fc0ec8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiac:A3k03kHRJ4
TLSH
T16615AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 925KB
SHA256 5327f3510a369ce587a7fab97095753b38007d15dd421d3e0d1a54181ed6ca33
MD5 5e4306ab23794ba993c3e5ac16fed7b4
SHA1 0c688b5f4b2ff76e9e77faaf2746bceaade0adeb
SHA512 ba6eccf5abaf2cbe6c1ad41e8cf393b1309041b125669033b24dc3b9f14fb215e076852058f2daceee1b75fe39541917aa14d3b90f0cdfa94000b1a8d06d84bd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiTp:A3k03kHRJu
TLSH
T19215AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 925KB
SHA256 5e8b825d991c9afa7bb661d5a80f5ad9cb84c38570179411c8437420e7fddfdc
MD5 62c4870a8b9877a8e45d915a9b2bdebe
SHA1 a004e9cd89d48ce0e291c22b45e3bb0b6ea24479
SHA512 7e421e99aef2145e356de8d6b91ff1d87b4d2520f09d052fa64a940ed85f87d1a229976b3804577a8cb2f958f8ba7bb7c2a48223415246da12a880ca3de55a3f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsi0N:A3k03kHRJB
TLSH
T1C415AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 925KB
SHA256 8296fd80d627d22aa7edb6064dfb50a3460481a7535682f47a1d2494d96e1df3
MD5 ce4f198096f26e33e330be2d45c0bcaf
SHA1 c6504796020d0f3707692c291fa4e7548002cb03
SHA512 f82867489fc433ca70739febbda14427ffa213d2c40c22dd3dfae88535bda28946c2754b0905945194bef96b850a89a5ef6e5afb9cb2557eda32ad4d3398fe89
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsicF:A3k03kHRJT
TLSH
T18215AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 925KB
SHA256 51ae3c0b74704243265b532324d40cced02b2b55cf6dec29bd73521cd7e22ee5
MD5 0da83ec9a121e2f054de957248b53b02
SHA1 5ba524a2e80018f288a1d7db6cd900f80241a891
SHA512 ef76e7e9ff2cc3f3b8bca38e89673fe16bc76541d2f734b1984ca3e19a8465c1c0ca977cb1ff6d2824f4fea9ea1a48678e403f860a2d61a3f1e209f3fc08999b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiJC:A3k03kHRJP
TLSH
T1AA15AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 925KB
SHA256 d4e556ff88f196510d39e0b7b76e748127a70d94b72f27b4d58a1ab977beb29e
MD5 eaf09b6650706934b05961542d08d8d3
SHA1 46483ea6c9d8d31ebb754b8cf257e6c7f3451193
SHA512 31ddb6c459dcc2d9ab770d598d4fd1cb8da8f6a466c98461486518bb795b70d281232ea4da88b5e235dedc7d1980ed9b895f4b00dc0347512a796d3874cdfccd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiqw:A3k03kHRJq
TLSH
T19B15AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 925KB
SHA256 7910e2e6464040b1ea354f2b5dc43c413779897791d94c5b796e62d6310c79df
MD5 e4ac20698c3fd55653a2f80cfb38e604
SHA1 54f03529947bc5d7b429dba196d33bca155df97f
SHA512 6a328e34e84411f60301278b740a10da9196fbe8db3e9e100a7b4d56e8f3e97ae2920404546204fccb9f5aafabd05e82ab12b014dda33ea5bdffe0295e732995
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsixT:A3k03kHRJa
TLSH
T10E15AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 925KB
SHA256 bbb12788bf4d880949de90a12444ca620d20c84f643ef42f5a3d624ec76a0084
MD5 68d87bf93c885956dd0f8b8ff47aacb4
SHA1 10019ef7997ba8f668aa5489b996a60a24285d30
SHA512 7f9f536865265484f276511bc424ead7f12bd3df2ac0d74a548b263ab56523fd7056b8b1c7579bbf5ef74e9b4431611a4870c7f528e4dc0294f2fd22ebe4a897
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsifu:A3k03kHRJV
TLSH
T14515AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 925KB
SHA256 43cfb7b7169b9c1b6d0de143fa4ebe7f0636954106c15452af56e1de2f8049e4
MD5 11fbaf4fa1fe0bf326a007662ada590c
SHA1 88996f129ee660a899ec5e1657910e3bc086cd88
SHA512 c114f7868f32d4a0e38bce74ae123c5d9eb2e98b00b5139c08187f89ba77ae197340d77c198aa5b35c43814f728554bc68be464fe3e8e106557cac6d4c4382bc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiDb:A3k03kHRJ0
TLSH
T14515AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 925KB
SHA256 1d097b86d7efef8382910154f0bbd7574465f01878ffd46bcfbbc220e1808a51
MD5 92e59138d8b1ba37c42f1733833342a7
SHA1 37b281d01e8bdb3f5a8635aa35c2eacc3058c96b
SHA512 91713ff80f99a2496c33b75a978935fd4c506a5c9d939a6028fb891c48cbd49a736bf200fba87b15ac2afb99b1307b41621d312018d0f1100d66aa23667273ae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiXf:A3k03kHRJE
TLSH
T1BE15AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 925KB
SHA256 07df3d4ab2cc37d88b3d5d49142c639800b2e17eac1052da1ecf841cddad34f8
MD5 d932845085f741116f70a24fb283bed2
SHA1 869972482fe085a01e10e53afbac8a21846d26a9
SHA512 156b269361d01da37dbe2189a48b924ff43034bfabe5e4d9348083e96ec95a3fc0473867bb17ae41ffa09edd5a0b89399af7f9a741b5acdea799fe92231a26e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsigK:A3k03kHRJ0
TLSH
T10515AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 925KB
SHA256 7bdd43f33f8d402ac216a43b5470537fa471afc5647955e5af08628892537396
MD5 958910884c36b15aa7fcbce985da9dec
SHA1 001e447935be30dafed3a9278bba27d84e5706c4
SHA512 00dd430b57ff56ab07f53c917c440cf150861a28facff4ebba2d30a13e27bf3bf69d027e9feb31abb0ee1acd9b176d4f42a002fd651c2423a0d1dae92c6fb8d5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsidk:A3k03kHRJN
TLSH
T10F15AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 925KB
SHA256 0e13070df74ee55bbd750ce4529269b14ce6f23d220a282cc459a3ba3818dc88
MD5 86d152150dc9346c9cf99cd62228357d
SHA1 0ff916a0eddcdc12fda025825e28f9db0a2f7e54
SHA512 9a3f2beb1b55594e08987b5481014b47bc77642ea804e79fc8b8a23a91ccd18a23dc58f700efb747ebc94ae6b46044803f9b8aaaddccf071ae520ed20b1cd0fe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiC0:A3k03kHRJw
TLSH
T1A915AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 925KB
SHA256 6a4fcfe58dd4a118aebfeffc2f899d8ce0920f402667db2552ff0ff79272fa71
MD5 daae10106d7acefeb72d944a6b76e768
SHA1 18c763ff712a888b1741fd86bb10d11be4153c07
SHA512 2f7237988963ec8fa186a7460abe658d0d7f2da96b1a8fdfbb9c349dfedbc0b38987f4c57ba28af2c46f85defaebaaabc7985f8443f543e5ab16c1bf26e5b1d8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiRg:A3k03kHRJF
TLSH
T1B415AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 925KB
SHA256 d00ba2c02d8d1f7af8167786c606915484ee95ed5d8efe9a08feb64c844e50d5
MD5 f2422ffcde37be8790fd453a714fdcd2
SHA1 6cd4b6a6e8da335c061bb123fedab93ddc142f9c
SHA512 de66987aff27f1682a0d8604fe020d7b2d668f6db4282aacf834c0ee29f8aec72f64a5d3fbc69899f9e33b3e78fa6945d58d2e65cb2fd442fa3cb6210dee038d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsi4r:A3k03kHRJH
TLSH
T1B415AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 925KB
SHA256 90c4a6812b0500161bfe6913788582b7d04c222d86319a55c37a242faec4010b
MD5 52e14cf44dde33a5776f6e1ae04d37f7
SHA1 a8b7daf0053c7870bc6d72ff3389a017d50488d7
SHA512 2ac40624a505b6a27f8d3cdf65eea611b17e5035e3af108f29d498513dbccf025166c580ef3e13f8e25a5dd13399b2192af3ac06933803330778cb55fb3c6088
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiWn:A3k03kHRJx
TLSH
T17115AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 925KB
SHA256 4aaaef82f4a46d7d6cbef94e3edf83998f02355a9c927364bde5238110864b81
MD5 11c427b8a4abf9119a402fb2edfcd8ef
SHA1 544f94e8b31dc133fa3f845615f09155f55e871e
SHA512 0e73cf6bbab9681f4a3191040933d1f307e19332c0c60fd38308b59444b640d7ed341cdd9cc0977cdf54c16c5f9d6c7d55776040352972d69766a49caa3199df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsi8x:A3k03kHRJ/
TLSH
T17215AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 925KB
SHA256 2e88a884695c350c97c280ef2faa841ce2a549cb6b4474898a27625dfb82e897
MD5 9ea297c49b8d42f8187c9f60c541cb37
SHA1 82a8c1491eb594b79cb907c0d3e09baee49f5617
SHA512 8395759e08b959ba4ad725c284f9f60df55556351b1f68a7c2e39218285d2e24d17f63e4213d0893c9174ad72ee98d4efa06cecd8b2b9829a49bfc330b7b2d61
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsi2A:A3k03kHRJA
TLSH
T10515AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 925KB
SHA256 6f162112573a022aa7cd5f6dbc8cbcf637984c902334fa67306da4dbb081fbc7
MD5 a05c03f3a0bc0d2070732936affcfd26
SHA1 17f11706bb138e88aa67656491ae4274dfdeef96
SHA512 8fbac48358ee0d35c2ec556d5e34ef6810e267e7542049b39d502f59f5498f19db6ba161142567cacad160210532e55fe4a01606d51073f6d05aa7db021b2a26
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiv9Q:A3k03kHRJ5
TLSH
T18715AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 925KB
SHA256 cb31c5280160ec49066b9eb6609dea2c304cc8299eb745725f7f5be3f5757d92
MD5 da8914855c29aa59633131d9abe16c95
SHA1 aa25d624350ad2e66499ab76949fa2c0a5ee166f
SHA512 21802bac323a5be4d1f79d2c836a3513522592ac3493c1716c0599ac832e86c312ee14b9dd1bc96a3b9e46687d349cd959460fbe0b23916cfa43abedcc1bce75
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiG4:A3k03kHRJu
TLSH
T11715AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 925KB
SHA256 1dff24e242ad4410e78220654de08b3cfe937d01e809621894af8ef0e94f0812
MD5 04f4b5aa7a3232c972f01d7a19de35ff
SHA1 64ee0a6e1029cb0fb4f5547ee6d6130c99e1cd5f
SHA512 1458737fe8d4b1602e46ef40213862b0d728466e428f84f1e6f3a2f4daf9871281a0aaeb99d898eade6c7673dd34f367caa4829e67249cbaf4c9ce89cfce50d2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiVu:A3k03kHRJP
TLSH
T13915AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 925KB
SHA256 24c4367d63ca46aecff509cc4b2a1dc37e5d096a0dd65e7105849fcc8a0a5500
MD5 82702de5c1312279b869b7763a35e8ad
SHA1 1e710144c11e0fc612348ca048553a6f4febd0eb
SHA512 49cbd2d1fc84be73d4e724958f3348166c5cf5a268e03186c780dcdded4325faa17963f8ab67688b19a6694efb00ae96655e1a45f14a01dee8d9641bb2baad87
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiIj:A3k03kHRJR
TLSH
T16515AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 925KB
SHA256 99aa8ec21579a53d08d855416db9b4b327728f561f0a5db1c9574fcc786fccba
MD5 c0e4cf006b09fb6f4f12aec3f8c0fe78
SHA1 f74c0b02a171413af588d9da00a4a3c2c1ed153d
SHA512 d55f3c51b85a645e39908181fa673f8d4b2e5b719479e154b149bd83980de583863aa0578a45bc779c9554d58e2af70f3eda28fc7aa8c7f787f15f33bb1efbf8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsi5g:A3k03kHRJV
TLSH
T1AB15AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 925KB
SHA256 fedda4dd392084e6ec4d1a0fc0330b5a4d8b8436d0e63329f08284d399cad8c9
MD5 55e50cd6477901cfeea17cb1c97c8431
SHA1 24ae232494697e300303d1d1dd7f55b5a5e794ee
SHA512 cafb2969dc847c2792a52a00f53f6d5dda0a14ff74f00fbf44a2c44d107e7e7729525cb54f9994ff4c492c787f90114005faf80f164600c795775407fe480362
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsigI:A3k03kHRJc
TLSH
T1D115AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 925KB
SHA256 9ff4d38dc4dc0606dd546a7334b0a7b154a7af575b3d42d9c54eb0c713f3d10a
MD5 abb5780e5cdd89e53c85309347536629
SHA1 8249b4bb117cd36e2c2992e4cf7f3ccd8c67222f
SHA512 12e098cb2d4f244dfdff423b3313d7b903b2a0315eeae2e6ff20c1490bf7824c4cc650ce35f9a83f347c09aacc671a509a19f776588a598b98e2696d7612f57a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiio:A3k03kHRJe
TLSH
T13715AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 925KB
SHA256 8cee5b09abbd36aa1c4cf8244b5edf2eb2ad4f0a97d763f559cbeb84b6d5df01
MD5 666aecb2cfd014f226440742d08d648d
SHA1 10ef73440bbc2ded7a2e6238a1144827def6f09c
SHA512 56ec7db0bdc6b117898e58e6eac13cb2bf6f0bebb3c14a4e73c42c490f652eb19ec868ff975e360e57035428e9e23a8900f9e0651279d787f0450db6f30cd2c4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiZ+:A3k03kHRJL
TLSH
T10715AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 925KB
SHA256 ed4cc7583268315d25d7705fe0660fefa82ece7847b5a3948d891abcf7714b56
MD5 0a66aeeb7612ea2101b09e37e8ecc958
SHA1 ea9e940816561410976f28d34a1d7319eb883f69
SHA512 42a3dfec69fbdd20161d921ea3e76f1c24317d3f7d4ec04a23899dc37ecdae4cd7e0ae10a3bba4aa81cdcf5bf9587acaa3d23586d990d49f1e222ef48001c614
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiHQ:A3k03kHRJP
TLSH
T1F915AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 925KB
SHA256 05265aa0b2e14201e2354dfe9d135ac75b28716d27ba89da2baaa2236eadba42
MD5 1d33b2f6776955088b98cc203552705f
SHA1 6b573717a8815255fe9bff673f69435f29ee765e
SHA512 1bcfe6149d3ac9c3be3a473b0ce15c7bd0d85b7459c5edcd261e8397478c21d3182fbae1a520e109dab67858465672c692cf7021bba7a69ff17a7a1368dd1b47
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsicX:A3k03kHRJD
TLSH
T15C15AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 925KB
SHA256 9d5c71ab9f399578dd455ba66ffd752326e7416215675ca85c858f5e3e742a1a
MD5 6826c084a6ba1eecb0672b1cc9c4511f
SHA1 d3286d92f40a8c7a1eff3592c8be82d778cbfd1b
SHA512 11253e828982e440d70ab820a4de4637d62eb3c11ce8f8ceea58628b130d45b1b6e7d226e92bdfa99f956dac98af4fb6a6245946b52e2df29a3be6464b965add
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiaL:A3k03kHRJN
TLSH
T18A15AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 925KB
SHA256 b1d40d2806441bed24e3e7b67b718f4197e4b65551234fde431fad795ea9fa56
MD5 ef5dbe297b6374f5dad346fef22a1783
SHA1 1a0ffe2a76f291c4145a7f0992537300459eed1d
SHA512 951a65fbcf496c5dfc3f8ced58bc694c0f6824b1aedd832c6d1a97875385868836fc534f2631d5019a7b9124e7bf56f4731eda11900cd3a0420dfd15e78a852c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsi+M:A3k03kHRJ0
TLSH
T1AD15AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 925KB
SHA256 9738e5262e0bef232744c5f70a46d53068a99da194daa711a786c02b0dc8caec
MD5 d246634d72d6acb862874199a539601e
SHA1 89d3e7f74eb53cdcdadfa15276fcd2427cb00c8c
SHA512 80d59faafdd9cb23322fb5e70501664eec4cde37208bf6b1ed6164e122d46206f45902a9134e8d34e9fa7cb5e4e5977e2e2d77e4b8707a23f022b27cad1f1908
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsinh:A3k03kHRJu
TLSH
T1F515AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfsvc.exe

Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe
Size 906KB
SHA256 6a156d3954b3ec9f8ea3e7d44793ed303e058c3c1146d8614a76817caefef56b
MD5 9e7aac893497fdf853f1d9a6bffd81a2
SHA1 5fa2ba4bab2727c4376d46d06e0ffee9bf9ee5ce
SHA512 44e6751733a48fc13703b7f740d80676c124f5b356c59eba1ba42c45243f27b4b5ca9ad9d55bd29b4a847aef4fb173ae5fd91de01be8698a3fd023ee867e7ec6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xsiq+l:A3k03kHRJ
TLSH
T1BA15AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1648-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5088-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5088-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads