f644ccbb731957dcb447c252818826de75bcb021f995ba833fee1eedbb0650bd

Analysis

max time kernel
96s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 21:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 930KB
Sample260820-1ql7wsbk21
SHA256 f644ccbb731957dcb447c252818826de75bcb021f995ba833fee1eedbb0650bd
MD5 60917f56668b6d9c11902aa606f92715
SHA1 00e6c3c016fd541a60004bb56c2ceae575cdb8bd
SHA512 05640b1dad9fa06d411bcfa9afa73ea55b7cf465839aa7939a44b5c0aec2701653625b15c6c91963e9d781f23242352b9803269e629701c2ef572b5e617c1904
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35E:A3k03kHRJ+
TLSH
T17515AE03EB9500E9D10AC174AAD69A23FB757C56176093DF2358C2152F62BD0BF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4108-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0009000000019cc9-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4108-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2088-107-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-464.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-715.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-973.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1017.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1121.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0009000000019cc9-6.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-39.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-464.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-623.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-715.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-947.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-973.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1017.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1060.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1121.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1140.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1171.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1178.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1215.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1318.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1338.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1370.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1377.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1390.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2088	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File created	C:\Program Files\WriteConfirm.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe

Drops file in Windows directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4108	2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2088	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4108

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 930KB
SHA256 f644ccbb731957dcb447c252818826de75bcb021f995ba833fee1eedbb0650bd
MD5 60917f56668b6d9c11902aa606f92715
SHA1 00e6c3c016fd541a60004bb56c2ceae575cdb8bd
SHA512 05640b1dad9fa06d411bcfa9afa73ea55b7cf465839aa7939a44b5c0aec2701653625b15c6c91963e9d781f23242352b9803269e629701c2ef572b5e617c1904
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35E:A3k03kHRJ+
TLSH
T17515AE03EB9500E9D10AC174AAD69A23FB757C56176093DF2358C2152F62BD0BF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 fbf8cd34d39f9790f6311bad1c1be48972c18685c8f4caf9151a4b2d355b0c73
MD5 00e13d89776b332c74c19f71ffe47a10
SHA1 dad0058ace280ec9c6ad09eab6b4893349d70600
SHA512 984fcbdc488c7735746592892a4b95212e063dc17d98a29eb8fc59bcda56b08520b89d4772bdd5723564aa92667b32b9ca82ab875150e7ee9cecb3fc4db89c30
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35m0Le5ji0hmxNrM:A3k03kHRJkPji0Aj
TLSH
T1DA658C17FAA402B5D027C0B9C5D6966AFA7138821B3086CF1359C7283F67BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 945KB
SHA256 be3dbfc47a76decf33d944f66e19ee928668f58d1212382e95b4267b6d540a32
MD5 18deb9a57b169487be53a5b1b18782b7
SHA1 2a17332a56b439ffb813d6ff56d1b74247a1eb61
SHA512 325cd8d4acf02e29ed98d28774806af5ddd55ff7a94489e45b21096e43e267b1f180f4180f3c55fbd0e2c07a4be98c10774fae95ccee2c7c520b12c58731c2f8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35wa:A3k03kHRJ
TLSH
T1F225AE03EB9400E9E10AC174AAD65A23FB757C56176093DF2358C6152F72BD0AF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 954KB
SHA256 4dbf5c0e5356e27322c9c078091258fc1d7a79a70c08b9773eeb9d593e6ad705
MD5 48166f1e5fb58150377b8c54e759c21c
SHA1 9d492495930aff10dd36a0e725dea6b8c4989bdb
SHA512 af1ea920457a93685d186826b8fe78ea8100b2cca370d7b4c57da2e7c85c9d4bae3bf224b79871d61f788ead6a35196e40a7fa5bebc9c44573d9025b4b3e2f8f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35J6:A3k03kHRJS
TLSH
T18C25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 954KB
SHA256 012e89c05919cebd6552cbcc8a62b7ce4aaf7073d7575ac862e98da808499e0a
MD5 64374b9807bc1491dac706a55396aedf
SHA1 7a7ae4c0b22304fdfb20ad09529c9ce89a8fe6b5
SHA512 19fc339cb32600ce220385c8b8d676c9c06d1976c65ce07d38e115a1b5f4724b5904b0c20c2916d986b11b2830e711ef9340a730864d80a879fe091ae16d7326
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35nN:A3k03kHRJ7
TLSH
T11925AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 954KB
SHA256 3351c569bde80bd30dfbc55040e8171c54bb2264bad03f092f0f79d9cd709bae
MD5 de4393c5ecce0e5511e1b0cb9c22007f
SHA1 e5547c37dcfa74d09bb795c6e7154f0e9a013aba
SHA512 99cc9785242d3e809e565959924b108c1b960711ebea0061e3ab2469bb324cf81b6bc35655be99bb6a62e8a9f9fdbc997ec764e38a1f086d9505ae4cf6c95e89
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM359f:A3k03kHRJf
TLSH
T18725AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 954KB
SHA256 8ca09e765efe990dc5f07ff4a1195b7fd0ff902db03e1052593e1a3defd95ef8
MD5 ed012e7ea2805c1d9269eba916af06c9
SHA1 c155045b97d295735d2eb5979a12ab82f91274cb
SHA512 8d7d0d92ffb751f7d2c0fcfd6ea768fb80b9cabc87e6fff9810f3ee56fbe041c2979ea21c9875378443814f6138bdc523bc38ad480a1bab969e56a8132759870
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35/o:A3k03kHRJW
TLSH
T11625AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 954KB
SHA256 a02a4ca52be51b16dc833920af752b0e4d604f82ba278289a4b37d515e1bf245
MD5 b2d6a3fcbaddf28dc781c957fc680884
SHA1 2dba3e019e78da1856b5b2e1ad61098068601375
SHA512 51c7d968720ce6f7afb7c4702f51833d1e861b8d44b33389301eb58f2082a7bf3167eefb224b919a78f546d4a3583fcf3d9d50e6d2e3a8546a4ca3edfe948f58
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35ju:A3k03kHRJA
TLSH
T17C25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 954KB
SHA256 985c00b6c196a9a34cbef91264e223ab767aa6d9af96d5e6a68afd433b47633b
MD5 0f3ba5b5dce5d428693500c3f514b92a
SHA1 f10f57c23091ac57eaa844d40db328a40ca213b0
SHA512 80db5fef22b89184e6d433a5efda1a38494fc6331833411b39931acc0921aa033b52bbb4ed72b8caf2284cd38c1a27c93b885fa84dd925e331bfb7c5c514c415
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35R9:A3k03kHRJ1
TLSH
T10425AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 954KB
SHA256 378cc54a3d3640d07acfeeb1cde01deb3ed1a741deeda9e503773d344eb7ad7b
MD5 4844958ea970c1176e3d30c365332927
SHA1 5747cf074989b32d9e40d118f7f40a61a8fdeac1
SHA512 01bcc41db34b66ff6c45b027ac0bba75cd70c94bb25aaecf303553b24634cecf2aebeb25232305d0b107fc1d6e7bd6f59d4a1a62f341accdbbe69f01365b0d54
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35Nc:A3k03kHRJw
TLSH
T1A125AE13EB9500E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 954KB
SHA256 e16e8a97b5b2e4dfbc84c1ad6de51cab29451e2cb9d9104b6abb2feaf251c01e
MD5 1663a4e58cfea24447209b9065eb2053
SHA1 cfc33c09e4f035e2d541c4cb0c97c7ee94edf0be
SHA512 5cbaad90f110552f2b327ea3b95076926def0a6fe03d5b28056bd9baf2a2e43b7e474f8067c2bf1d626dc8180cad6fefd1a42850f820ffc44fbc53d2e88ef545
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35Wp:A3k03kHRJm
TLSH
T1C425AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 954KB
SHA256 fa67806980cdf3c21e8d1321b3300b10f1349923a7676e4477603373caa0e572
MD5 8d764dc2838eb9445dcfd2766d66c295
SHA1 9ce9752d58286584c7577a59b0f4077758782066
SHA512 20cde9cb657294148a852a14e743512563606f74e26aa71e7b619cc16eeb5666be45bf43fe15bec7ef8f3144a3bfb180e2727c8f5cebbb8cb7c01e683b599319
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM355N:A3k03kHRJJ
TLSH
T15F25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 954KB
SHA256 4aeff25ecae78cd25fa7a6674a4b1644159bcf2c2d61906af785eeb631e377a3
MD5 d0a794bea7db72d0e8f2e7d85def03cd
SHA1 fd9a25c1c613242186d7ce3fe02069e53214a16a
SHA512 b55bafa0993f91493a3b400165089911e31b570aff8b4c12a30e522df6f25ed6e7da2c082375ea1b069e8682d94cf3a73f7de5c598098e4ad5b08b5978f1d2a5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35bF:A3k03kHRJ7
TLSH
T17725AE13EB9500E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 954KB
SHA256 27affa39e77215bddfabbbc7fa343713f1de62099832449a6be67cc8c2c8ddb7
MD5 9479bc93ab89ede1a806f4d9656851bf
SHA1 519cc00cc68c36a8c561756942cfc5d3804b1cd6
SHA512 18816ee782e930dca2189a25e225a9b937f5a2e56b47c3b91c77ff8260b1852cece47e668916a9279a738b129253276dfd20ff79d83b92afebe1c5df3416bca7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35UC:A3k03kHRJX
TLSH
T1DC25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 954KB
SHA256 ef86f36e53c68524e1d1297974b671233cab3484a7cc1756cd7530ac950c31dc
MD5 73e7e10cb554ec781a3479acb55bf3d1
SHA1 46a9eacd6454bfab9d1ed9ca4fab2359aee55905
SHA512 57a2fe7fa0bff65cc63471344c91fae019c56153f8860ec2487d0e28122bcac7912333646401aa43d580da7cdf9e5b7868d2bf51ffe6709d13dd62faeac52e57
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35vw:A3k03kHRJy
TLSH
T1FE25AE03EB9500E9E10AC174AAD69A23FB757C56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 954KB
SHA256 a3967c43356d533a2514316c309a374326f76d93f43b5c42a97b56ecf459395d
MD5 ced1f4e81a2b616fe7bc63e286a63906
SHA1 d132b03c8c64e3beeefa89cd1a72995b3bf1d7b2
SHA512 aa71321e1d660b213b0146ece8cd756b7c2ac76a1fbd1ea9a8a331d49b1ee6d041b17501e87614e15e179111021c7806c30267f6b33a0f9cec2b4fca7aecd90a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35eT:A3k03kHRJi
TLSH
T11325AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 954KB
SHA256 d52f4f4aa346e5e628df250073e7df927d9c312bbaa0f116fe0b6507b5859f06
MD5 1d7fbf1ef83ac5f2a908993ebbffae1d
SHA1 4febf99975a57cd08e2e37544606bcdc44aa00ab
SHA512 e7779bbbdeb3d102bde12671b47a6f75cedf61fa783045bb00c591df03eb8a6aa896935ecb2bdd547f8b745ac4209cd7cda557f5c1f8615bf59db727eff1b22f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35mu:A3k03kHRJt
TLSH
T17425AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 954KB
SHA256 7c6ad1eb76516d3bee28954794911eeed266f3a12b16d60d306b5b97147bf6a1
MD5 79893405f122ce7a06d3c988f5e913e8
SHA1 117d326260b38e7c46542808c4edc2e51d82b136
SHA512 da585c483e20c8f924a39cbe5b8d82e11fbb3cfdbe81b0d92ff2769e80775802b8451a1e5a161460bfacee657f1ecde379e6355efb9cb45a5151c446d96b879d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35Qb:A3k03kHRJ8
TLSH
T1E025AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 954KB
SHA256 8f061ab15319f2caf14537c7db76958586153b0735645616a9ebf12b00b49676
MD5 ba2e4eae3d4b216498b37b1ef80b6c47
SHA1 76331ecd0587b2c64ff06bcbc1fb1595da9542fb
SHA512 989fb97c165cf665fbe640a82d7cdc78e46f6f12f8a9fb9421174b5aa8e0aaf92a43ce3049eb826d5e14aa3a84a7a4ac4513fcbd25e62a56c5a6d61451ec39ac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35+f:A3k03kHRJ8
TLSH
T14D25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 954KB
SHA256 fe005f3cfc024c508869d225791e02dc368c11ad8ac68520dd1ab5034b84e991
MD5 d26085c0e687948a66b08e08cb8f3957
SHA1 41e83722956245bbfc616dfca7c7e3912c138b12
SHA512 eb91a5ac7560af8324f409ec5e2227253e0e200df4aed578cff0bd34bbca10a7aab8430e80bcc2090835ea2f29a8c4f4208d7f5508d85aa374de922ff432f028
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35bK:A3k03kHRJs
TLSH
T13F25AE13EB9500E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 954KB
SHA256 0a61a38ce1b09317b60bfc3608833a9015fa30565f8ccbf1f9ed01d45cb63b36
MD5 137068c88f2399e9ef857908fc12662a
SHA1 f3e76f5da6efd1805e34594e2ef9a1eef815381b
SHA512 681b775861554a80e8e3d13229fbf074521cee141586e98f08f13c9d8d540ce567187c036340ca553a135f8002b2e2181c2b19fa1ee42ae5c0421bd5c54b41d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35sk:A3k03kHRJ1
TLSH
T1B225AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 954KB
SHA256 d8eda58407e0580c17b7470f9b12262528be4c8da47c76a91d70d63e9367e545
MD5 4b4600355ae9ebc1dd7880f2c9fdd93f
SHA1 1b6136a2207361e05abe4de21a52242deaaa6e15
SHA512 0196ed825b9355c0ff2c5bfe0658cf07fbeedb1e951b40a1061152d76845b3aa8df7fd588ccf21ad9408e7a733f81b05268f981f59683ac99349affcfe4c4046
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35l0:A3k03kHRJI
TLSH
T1AD25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 954KB
SHA256 32ec90cfcdbe9526ca2bde1ee9078810160c9dbebfdc24088f18a5a4f9986fcf
MD5 428edd4892f57fbc284eedbce5184a69
SHA1 41213a550564f894a92a031b94f7b7b4b9638c73
SHA512 f419840fd2e06c4ed1ae4abd1e6e2a419fc3e40e0f12324ce7472ce07084df3459e0189fc7312fbe57ef21184709effe30b7e24d0bc4d0e5d1d8a404fbbfc14c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35og:A3k03kHRJN
TLSH
T18F25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 954KB
SHA256 fe08bc951338c5ac5c6a3a5e806fc4e0ceb58def835f68c6363a0279cf7602e7
MD5 91ae90ecc5a80c880323d58053d4dba4
SHA1 d411c739f085693ad32531e45e0526e91b91ed2c
SHA512 eb63409274958a2d3d646507a5ccfacfa3a7d71f64285f9c2ae1518d26b59d5bba83952f96bc49c6a3b87c8228cba7a3b3fc296c36ae91e86927ef5143370863
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35dr:A3k03kHRJP
TLSH
T1A425AE03EB9500E9E10AC174AAD69A23FB757C56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 954KB
SHA256 94930849228d1355cb4d805ebf2e6b7ed846db254dd5b5053a8cf980cfccc5ea
MD5 a7665767a9ef83efeeeab94cdfd64cff
SHA1 7bb395770f365f169acc498b22835e508045cc01
SHA512 2658b7ed6455872c39fd21d0866420fe86374b3212b47371a3606cd7b99ae0a1eed3b8bd63f0e643c3fee447449ce8d179e8f0c4b35e190ae0e8c76b1f70f571
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35nn:A3k03kHRJp
TLSH
T10A25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 954KB
SHA256 9c3b626ef0b5ff5e99a8225add24b06b028ebe95947c8495436ec8994823299b
MD5 ebd0768fc165ec44f0556224ac2fca83
SHA1 fcd881ede7b9b8da52de2c822b827199ea26368c
SHA512 d9a4521008c5de4d5de5dc2b16d67b9a9bbb727ed3418bfbfd6cda1d6a8bfcb25badae19063401cb72d552cf0c5dc87ab077665e9856ee9fce363df69f87617b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35Dx:A3k03kHRJn
TLSH
T1FF25AE03EB9500E9E10AC174AAD69A23FB757C56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 954KB
SHA256 56f835283910a8d92c855e3c7f022ed73a68bcdef22dccb6bda560a3b2c0af09
MD5 6663d64663c5f00d198001ec77b40537
SHA1 453b9699966e81ecfb94dd45e57ebb7b07493dfb
SHA512 7be1098430c740398cd5ae2b3b176f4b6cdb983c0f3daa4659d5c86d3b2ce72ebb9da40c51c65ee72f360b3164b81cbde68ada4d8218ea6ac6f12d71ca85bb9e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35BA:A3k03kHRJo
TLSH
T14F25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 954KB
SHA256 6501878459e2380b6d8f044a46d52cbf28283a7068af17b0bd45937b49c1331a
MD5 9e0741ea54b8c98616a461b2f29d475f
SHA1 3c53e2fef8d5f98cef9503e40355e871ffc323a4
SHA512 6333dd709fb1e15f9352b274c13eab41f0288e5ac096e1c1c40b6754a6aa8cd3a7b72a97dec6dd8a2ca2ad8e65cbcc9a641f6491c073780ff8716bcc3d71b615
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35a9Q:A3k03kHRJx
TLSH
T18A25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 954KB
SHA256 800d604b735b42bd5145e59a1ecc7caf1f21c068247b1d8e19f025764d142168
MD5 58b23f5eb9e79e138fe6d5c43a1023cd
SHA1 60ea3a93ed5740138acb0f28ee5b5b66c500f683
SHA512 64078ed851e06cf02e4c0afb6a02180138e2b6daf9db98401b66f6392984938024cbe1d8ef9c1efbd8c3f8f055d26403733845d2d4f21e1b90ac88c67f304555
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35P4:A3k03kHRJ2
TLSH
T10C25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 954KB
SHA256 1f3de92e7b3c321a8502be01fb78dab71199b46c226173c5f9bb37a84df2dd11
MD5 538905658c73e2f1193189b4c095cfcf
SHA1 1e6af88864f55703bb4b7337510973d8cc2b0f6d
SHA512 c8de255d7af83a2ccad88bb3bed1d4cb4b405f241c5eb3a7f7d41fe94c24f73b31dbea7dde8b7983652c2ed8cb59a1ded62ede44185d9237f6d1d2eb403f9ef5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35eu:A3k03kHRJH
TLSH
T17C25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 954KB
SHA256 7520c14476288938292088ad14f2197c4b550c3d455d67677f0af67f372bf9f6
MD5 5fb9cc8d68cee2c9db2476e28a0124f8
SHA1 90f3f98d03fa5fcbf9908298cfd79d4b1d8d69a7
SHA512 b77e2e7a58b835193e0c266d5c36c5475ea1e020dc700a8552bc848f5f09a1e29ab6ba3806d73cce10f7a7b4b2389312e571a381cb1adccae9721fd36b405581
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35vj:A3k03kHRJp
TLSH
T1D225AE03EB9500E9E10AC174AAD69A23FB757C56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 954KB
SHA256 0c02674c8a6c8bf82a13e432e5ed51c80da4a1450356712446d88eef34304dfe
MD5 2a5b8c86e63febf8f4f6f6b3db2e3612
SHA1 149a7c66ba5f730bc9214a75457fe7c75dcb2d3e
SHA512 d26fcb5a9577cbae05bebf4776ab9953a8f0a39221b0b1151310810c262b5123b7b5f51d0c1127e0e22ce82a684d31539e6acd35d3ecbb2a78f2dc830dd8fea0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM356g:A3k03kHRJ9
TLSH
T1DD25AE03EB9500E9E10AC174AAD69A23FB757C56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 954KB
SHA256 5d092e85d852eb9fb46b52191055c5c5e3d54f2d54ca4e347b79e47d03c54cf8
MD5 e8e2dcc9c38aad321a24e1c20c03bfd8
SHA1 6f63cf289ea854d83f068a2ad24e903f5949f263
SHA512 409a0d6f3415243402d92dbea491c943bcf46fb2c9ee9d4ea6aa18a259a4eb88835927a353d38c64af44351e093818b742939e6ff2b3f83b0707bb2d2a3eb926
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35lI:A3k03kHRJU
TLSH
T1D725AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 954KB
SHA256 62f9d72f17ee75727698f1874477ff3f1af75d1aae22315fc124c136cb47c572
MD5 4fa41915c8cb66d2b4c537be44577118
SHA1 30e9cc8b7935c5c85846867f6bb931a05bf98777
SHA512 3f08578216a26ef3b55fe757fe576115fe8bf261be547372f92a9e8306ea527ac8e1ffa464c1663968219bb5c1622927b55b367e907d29733f876bbda19bc800
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35Xo:A3k03kHRJG
TLSH
T10025AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 954KB
SHA256 0e36909315335b1143432d7c298d37199ae3bc803b286a993e39347abc5b48d6
MD5 62094e575a4a9f91e194ae7edcb87b49
SHA1 1439dee5cb876cf03b917df1a2277e43ca9f94ca
SHA512 c51a9e66827513abea1e5cf12c4fe9a13342ca2b1dd46481f42ada4365ca1f0c0da2f5939777bd256c0527a562b346a4ecb8b665632e2cf9c74ee9d64b616caa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM358+:A3k03kHRJT
TLSH
T18325AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 954KB
SHA256 61a2f572c8dfced31c9e02ab52271328bc0c7d21f54dfbda74649d3df7e20761
MD5 7807f1b6ed926fa0ce72899a93579258
SHA1 172dbe58d158255fb36a86384e39175a847fa37c
SHA512 9387d6dcb56e3f13fedd3031f7602b02a983cef3a7ecb92da445efe42b02f200434a464ce00f249e99b782d1e83b7e0a61923be0fb1d86d77051a820be66dd6f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35EQ:A3k03kHRJn
TLSH
T1EB25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 954KB
SHA256 3ff84911bbb12eca1909dd368e9dbe7a2f59d7a1ecdf1f35adad6e7c2f475828
MD5 f4cedf24e5052b162deed82faebf05a7
SHA1 8243a6e029e2819f7f9e44b292aad0c641ee5839
SHA512 349e698b390af11b264128b1ccc48e029ef1fa6283419383b553f04d0e021912f25aa9c9a2d411d61168a592b7745825c0874784bd0c5c71450c6845b91e5683
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM359X:A3k03kHRJ7
TLSH
T1C025AE13EB9500E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 954KB
SHA256 c4453f751b9aa0621d50023715efd4003a6ab3a57c0e1d4db4dd6a5aecaf5c5c
MD5 31e0934c11f3887f28c5cfa23c07f877
SHA1 47991717eb46ae70bb7ccaa0c684fa327cbf61ae
SHA512 770db8c0a41d7decdd178d90b2d01e66ae56297c4ff0e006f2264ee75f694afd2c9e4293c690273f58322d33fdc84d6256b3d539b0de538c094e794f2def5e73
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35/L:A3k03kHRJ1
TLSH
T1CA25AE03EB9500E9E10AC174AAD69A23FB757C56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 954KB
SHA256 f9c852165d4ce3d930adc9da93c3ac811fe5b05722b2d7f77f89a0cd2ccba3f5
MD5 957ec9b0cfe3c1a2d1933f0c33ebc334
SHA1 6084e0f86f5eed0cef0c00e9d58028d5c14510be
SHA512 9e42149e3caa2aa2db59f137a9d1d0d1138ecabb8fa1d262c96c7e7168eb30da41859143bdb39bfbf455dc5426de198d60632bca5bd1d078935df3d0c43ce1c0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM351M:A3k03kHRJM
TLSH
T11025AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 954KB
SHA256 b6f9b4b28bbc64b162a0b20960449d467b457ee9327f1bfaf38dc7f46d9eeeb3
MD5 1648f4143e0a201b0171aa1ad31492c0
SHA1 c12468c5eb4a6fd528bcc8413d6ccf5f821cb57f
SHA512 8987bb9a32c159fca95f56a5c74a33048880f1d8cacede020359cf125b4236902327ed775ebfbd32dac869421c477fa230765bd55d9385d1adc1a8e91e11e11f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35Gh:A3k03kHRJG
TLSH
T14125AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2088-107-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4108-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4108-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads