f3166e6ca8178a88dff28b8b7e3cd109d568fe31bbecb0eff4f47d0a479881ad

Analysis

max time kernel
105s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 939KB
Sample260820-211cyazzbw
SHA256 f3166e6ca8178a88dff28b8b7e3cd109d568fe31bbecb0eff4f47d0a479881ad
MD5 f67d89d05e7adfab090ca3f38279247a
SHA1 2b77ef919a59bd7b2ff52fd9310984f61d5de86c
SHA512 821ecf46c5f840b1bcf5f93984ab41aab18db6088b66a0d8a3ddb47cf2fa26afd86278dc850fddaa4cb0cd43006faa42af3fb982763b3c274fe77c3521b00973
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacu:A3k03kHRJF
TLSH
T18A25AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5820-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5b5-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000000436-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5820-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4636-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2de-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000018a4b-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-425.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a4a-548.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-615.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-640.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-731.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-762.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-799.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-855.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1094.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1213.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c5b5-5.dat	aspack_v212_v242
behavioral2/files/0x0003000000000436-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2de-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001983a-218.dat	aspack_v212_v242
behavioral2/files/0x0006000000018a4b-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-425.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-493.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a4a-548.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-615.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-640.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-731.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-762.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-799.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-855.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-875.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-901.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-920.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1094.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1138.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1169.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1213.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1322.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1341.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1366.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1386.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4636	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5820	2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4636	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_f67d89d05e7adfab090ca3f38279247a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5820

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 f3166e6ca8178a88dff28b8b7e3cd109d568fe31bbecb0eff4f47d0a479881ad
MD5 f67d89d05e7adfab090ca3f38279247a
SHA1 2b77ef919a59bd7b2ff52fd9310984f61d5de86c
SHA512 821ecf46c5f840b1bcf5f93984ab41aab18db6088b66a0d8a3ddb47cf2fa26afd86278dc850fddaa4cb0cd43006faa42af3fb982763b3c274fe77c3521b00973
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacu:A3k03kHRJF
TLSH
T18A25AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 13854c67533dbf9255728cd9b6aa966c9fc966b432e6ed2083f3bafbe16f8264
MD5 6fcdeb6c3f8c94997a2b77c1d7f8ea82
SHA1 28636bd95b9c9febf66c80a5cf51ffb2e5145e28
SHA512 3306e15d7861c96a63fd792b81a6abe0497fadf0481fcd56504dc859e223992f3634e579992f8b17d1008b62b228ea3139be08e360a89fedcd28df405eda81dd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLace0Le5ji0hmxNrM:A3k03kHRJBPji0Aj
TLSH
T158658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 07c2bd01e8e2f223876990977f5c15356c90a21d415496022dcca916ba529b75
MD5 1237fdb63a27d0e167a75cf6a6aefbfc
SHA1 90385a3447d9aba4c1601dca53f4f20bd8241a75
SHA512 4fc8bcf276fd9c41e7a055b4b101a00f3ac8bb597df8dab3aaffef4e0953993f8bbd45b9841407f4c5e493dd50920d18ed34a8b0e96a6fe0f920b1776fce1a96
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacYa:A3k03kHRJ
TLSH
T17125AF13EB9500E5E10AC1749AE65A23EB75BC56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 f97406fbbe85c0cda70c38fae6565190a394974331c97dca29184b2294fdcb05
MD5 c1f61db1357d459f5168875325ab36b4
SHA1 eaafd41bfe6a1a0aeaea3661228ddbc991a58c5f
SHA512 2b733c10a8ecc37df16a4e8db67fb79827fce0ab1b9bf440d8642583e35aa3d9b7a7662048a4289f17af293196e04d8f5dd768802c0dc894e18fb0561c6407e7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacx6:A3k03kHRJN
TLSH
T1F625AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 963KB
SHA256 6d9ecf17b71a6d8a4457847923e69a1ce9de6c9565e3542a3c7cfa8aec30b93e
MD5 a591a85d73eace0b24ef26276d8aca47
SHA1 66667212514c788f8fe8e1a30b8a16b87f87368b
SHA512 07e4eba31e49cba087dc7d64aa4c9e44521cd324790e35f959bdcb8c495058e4d1094c210c2762efbdc0de8337de7afb937e99b28128cd6bad259a97feee3c74
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacvN:A3k03kHRJs
TLSH
T17025AF13EB9504E9E10AC174AAD65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 963KB
SHA256 a867ed8d3a89badc3ff327024175eefb55ac0f5de6499440fda94764d6cc915f
MD5 fcf2425f5dbc73df3796d074e46dde00
SHA1 a7f078ac012f3e2423a1f0de66a52f8638ee30f3
SHA512 740ef081ab357d5efac0ed47d5ce19752e1eab1fd21ced86c840699202e8d4d21ddff705f380eb5e695bd05163e50cd1be9afe3990fd88390b4295dc40223895
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacVf:A3k03kHRJM
TLSH
T18D25AF13EB9504E9E10AC1749AD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 963KB
SHA256 e26e1197909425c29128bd56339d63ae04abc38bf9d3f00ffc28c999e68d6b4b
MD5 f32abe20289c0c00e12a8a8abecddf22
SHA1 f69e5589188c3dd6b6f091eba866fcdd1175c001
SHA512 af224ebe52d8fe1cd5d34dee6becfd3c3263f750aa2b80ebdb3d574878b80af2df05d97b46a683eb38711adeb9f1dd904e1c4c55aed663d72bb95cd474bbda56
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacXo:A3k03kHRJB
TLSH
T16E25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 963KB
SHA256 6e6c3bf53024ada31efaf3403c13290d522bc519b6ab470dfc1f42f0f70b4786
MD5 30a13243a8f0511cfd182e180707d492
SHA1 549757700b905b948d9cefed3ace4badffcce435
SHA512 4ac8b81db87ca1a9bb5aca090ee9495040c2f986bca701b71bfe5b547b6194b8447364e9ac539a19f0d33fbae22b5adc2b64ab8590af90c08a1e49cfd716e291
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacbu:A3k03kHRJT
TLSH
T11F25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 d0da07fb577176728ddc08971583f9352b1000d8439db92e63a190a564ba73e4
MD5 4c0da10c31745a24e8e9ab6f2a359395
SHA1 c1948d945459e364246a528f28d70d5a8f2572c4
SHA512 4f90ffbd3787abbc175a0c9a9a86f24b1d24e2da250558b51794697ec703cfd8a8f7d55059590feaa3c1e6e69d870dfc679071645a692571a56f85c9cd3df47b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacJ9:A3k03kHRJS
TLSH
T16025AF13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 8da6033064e6fa275ea10b93a3e6ef60e2c9e1f0cc51f6a303ff5ff4d2253416
MD5 e81f612c57e3686abf82b5629703f80a
SHA1 ed785ad8d34ac0b1f9c1533cc01b0fc8fd3f0b70
SHA512 4cd93f3d6390f454f9219f816a62225bc071663b99da51eb675cf0a366c3087235fe81602eb8714c8cf435b91e35f010f2de3317a230a1398c0374f5887f424a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLaclc:A3k03kHRJ/
TLSH
T1A925AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 b896a65cf7cd76843f13e50133e3d6145789ec292c20524d56968f5a65201713
MD5 8fbee96d1b1f1656dffe2e27d603ef59
SHA1 0a0dd4282cafce14804ac27b3b492aaf86ffa39b
SHA512 6a265ae5eaddc13042b9cc54c65aad0681d83782bd6b95ca691353e15f2b4a2d369015cc82d33b550ff2744ee2777724655f77003818125713a88c64b72c8c8f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacep:A3k03kHRJV
TLSH
T16D25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 0d56637ce912b8841c48685c374da5049c2b12d3184a54c4484bd82a73288583
MD5 1bc4668f33f94e8bacec0df43350a87b
SHA1 a09f23a0ee55f0ba87fd0afb830c9dbda3ee6786
SHA512 3fbe992c96807e753bd13c7c5f266dd1cb67f58335bf07357b3b3a5f1881c161f5bc0827311b264a1d92005bd06a985cbe00037a9b2ba09aab7cd7fe06ef0771
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacRN:A3k03kHRJu
TLSH
T17925AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 aa78700fcb0fc8866336c961297c65289935ec9b8ebce4b37e3ed1460078c6c6
MD5 f7484cd5aa3ba85ed627e12dc43bc83b
SHA1 2f364427f68d287039678e50fbcbe997dcc5a766
SHA512 7672d99e338d28c7d05a03c33d5de3d848f02d9d98652864aa8cad68ed7cfc7386e499db9326f595cc96ab71a285a8f2366db6bdc9956ecb9899f5df3a431b2e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLaczF:A3k03kHRJs
TLSH
T18125AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 e2fa0d2afebac0b8eb8ef44d00105aeed7f940e3f935020fdca3c232b3cd6b0e
MD5 c52dc189af2211cd76a27cce2ecbb847
SHA1 9d01c0dc6f28d53b248e0b54b1469ecf1c4bde4e
SHA512 887e1da7fb3d9a801ad407d5bb45e273ac2a6a681dbb964f004cc989354061aa6ea606e11e367a34be7b67bb5526582d520ef2793ddf676003be3765e9db36d8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLaccC:A3k03kHRJ4
TLSH
T12725AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 6e8a60c8453a897e7226eb21c23899d74d3255c46509601c23d9a84766bf6461
MD5 5ecd3fc763f3b3ebd88b8f28ed232b91
SHA1 2a11f669333b3293e4208e9652d5dc48ef558124
SHA512 89e89501f6345e83ee77c26defd60eb810c575af96d8ff0d80e328c882108e67ecdac6243731f0be91c44be5aea8be7c7bdb0f4d377d6c45475edd6271af256a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLac3w:A3k03kHRJV
TLSH
T12C25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 654006b89362b11b2776add3ddabaecd0c6d98964870be226e02b0ad02baa284
MD5 b01471acd15f153fb370dbb76888ef7f
SHA1 4861bbfcf65c93c4c70262d3b3cabc16d70890e8
SHA512 f2d7887c71c462e321df7a183408bb182cb284c41c06cfa1fbdce4266b0d4a2fe1447ee5940fe03dde4c5083f4b405e2664bfd47621064bbfca841e0f5d20c70
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacmT:A3k03kHRJJ
TLSH
T1A925AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 b0ba6591af86a7013d04fc07be131fde2211960ecc6f884894f9ef110266f543
MD5 a0d48916ef37823e53f0dca3233324c0
SHA1 310d61f2968e0f007ac7322a02a95e1a0361a368
SHA512 5e75fbc41ec7ee7e180cec689c0240141cb565bea1250212a609c28dc2d4797572dd78796e171c7285c264feaf84f89ee8d5cc73ca2b6b6cf3aafe95ed10896e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLaceu:A3k03kHRJO
TLSH
T19E25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 e97e96ef0fef5a24349d1550d846c00dc3b9e93bc825bbb2cf8291027e5fc983
MD5 ebf33b8b7a2233955840610ba77afb2f
SHA1 a977306aebd99aa4f0daa13a7a783c475cc853bf
SHA512 4eafaeca8854fe79567f0a7f01b6f886f40db76adbeb4e78d29856e2a9ce2aaf45e02c01e95971c040d97837c20f7ef18c8ae7356d5e8642e495345cbb92b490
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacYb:A3k03kHRJP
TLSH
T1AF25AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 a05d3f85c25eb23e57f93f415cba368747d7448436127922228a6831777323e9
MD5 80ce8a42051085a832f0cd69229aa891
SHA1 f31a5279e2fc5be7d4623d22c86f64366a14d29b
SHA512 20220ca972c326a3f10cbb3959b3ec5c3747c083c02cd0d20254b31fb27d8fc9a5da3f9b3306aa414d007cbeb3c8320ef922c861f276842fe79a2fc1466e065f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacGf:A3k03kHRJH
TLSH
T14325AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 47214b1fc1f5cdc60e8c57e91c293a8e15956bb70c650898b7db7499c8e14101
MD5 7a11e227e4dfdd76e54a582eea29167b
SHA1 d488e5b77daf5f1a47d4417fcc70cc7368a317d2
SHA512 ef7db88f0ed2c802c4bd7e2e6ceaff679ddcd71955d7ecbc0ce428381191ab9e6c4000c4fe6e7d83283a60577b348265ca975b108c5c37edee2e8850525c711d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacDK:A3k03kHRJH
TLSH
T13125AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 06ab19aea82517f55353f175ec41b5a99765d363c73b39f4efbdd05f87f22eac
MD5 296b126df9807ac279399d3243f7ae81
SHA1 5d88c13c9ae8b353539fc5400133927cc79cdbeb
SHA512 22c87f74a0e80eb0ec9d252d13bb676de69d72cffe51b1102a813e0ffe925d72148a3e969bd1f67ab0977d0503ac0c7eafc4d4943ba3eda6862642f20b6e6ccf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLackk:A3k03kHRJi
TLSH
T1C825AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 af6b9a537c8cbc703545416aa9d9ce67ca3a3785e26ba0d250fef9bfd1242654
MD5 1058b08b3cee8a2055b20476918a3600
SHA1 02a947fc8831bcc81f254f03fb919517d567f38a
SHA512 81f558370b44f86ba2ee6d0cbbc8e9ca7c37c96257336f7d937c53a58d0746f25748fe501bdfba748584974a7ff205ae2d6c7fb02079e2cc0966e16ca864763e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLact0:A3k03kHRJH
TLSH
T1C225AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 8198733d585f9107e15a8ec08bbddd6df93db2fb9407d85690b373760dcc0c3e
MD5 c87aea0c4c8cb2a6313dc649ec0fe4c6
SHA1 07fe56b601366c89a87b3b9ed2f229797c2fe744
SHA512 9e050076e84b0b3d6fb561e9d130c69b2d154420d60a09d7637417c9a4d3d4b651a09b08f16ba1ce8936de17f2a065792c1c0fb143aa2012d0bbfac790d7f2d2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacwg:A3k03kHRJ6
TLSH
T18D25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 ee9be6cd66e19bc865347bf7966f92de6206a90ee2318c1b2dc7fd6690b8b114
MD5 51854900bd6cebc45d7ae99951fc6b22
SHA1 6945a6035cba4d1d806b04197aa04366ea44e2c6
SHA512 ba505774f6d1de3ea0e283d0a90c30836041522395fdbd29b17c6e499efaeec00966922d192ef2ebae47075ad8e35879f4ce2cf000ddb8ede0e6b5ff7527ed4f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacFr:A3k03kHRJE
TLSH
T10625AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 d6b33ad7d0d226ea26f6be0d7ff7029f3ec43cf2e2c8e395dcf1a30902b2047d
MD5 0bf159c453a1fdde1bb76ba9dac96bdc
SHA1 f9e4f54e78163cfa05f97104e39f944277d86e64
SHA512 3920cfaefd1ae02af1a5830a1b6cc22fcd5e31420b3ab5614d550086f8e7f134878ca463dd579b1a0a2692684897dbfd5a332d2344aeceb9bc6109f7f1862541
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacPn:A3k03kHRJe
TLSH
T15425AE13EB9504E9E10AC174AAD65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 4c318b979d3200ea41da3727e7af88002cc7add68e35869800802c6af9886672
MD5 272a83e6ab2f8abc817c71f46e6ab642
SHA1 c4e2ac54561fb93728e97ed69bef0d3e507ecc4e
SHA512 aab555d5803cf80940c27704d9e95690bba16ba43b8c008969e7a01c830fefeda88cf183b86d51e820be34339d5467a7ee51c41efaa95d10db03d61a36e1fea6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLac7x:A3k03kHRJE
TLSH
T1E825AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 b66f73ea628a7b01216a1a626517069f2fd36f7f218ff4d6e4c7c0f8ae57bf26
MD5 4ac049ceb659f99472e7c983ef5a8b4b
SHA1 50407e8c68b6acfdadaab3c6dba4bffbc9d2e46f
SHA512 90bea2b8d4e6aa3a56767c6cc64ee7b7da848e8d266d74eccdab182c8be913e74ecef49bf51b6e801355c4b9f91cadcd4326fc6e8179e330007ea57e010ce305
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacpA:A3k03kHRJv
TLSH
T14025AE13EB9504E9E10AC174AAD65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 20f66ce3be1c8f7feac193d86d78e207ae8543c1d3ef8a2423fbf370a12b31e8
MD5 161f5a1733a9a19ae3f4a44ad254a8bb
SHA1 85388036a16681c6ce38868d3ca0787138e6f6da
SHA512 d9e4aec1c63c687c5bea47375171eba8e16b1ad290f35287af46983c3d47b06455fb7975771fa45c14be79a7d80750160dc0dd597989dc6c3ac30545495f615c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLaci9Q:A3k03kHRJi
TLSH
T17A25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 9f16ebdbc1e933b3f4caafc06f1f931d1c72aaad1d9714291cf492ce165fb210
MD5 bd0af94540d72c4af79a892bf361692d
SHA1 018a745c986cf993502325dee5d0ea8278908043
SHA512 fc7e0d8a3a7b59a54ffc30cccb8b9cffe4008987662ea3d872b81ae5fd51ed5d375ba2c5e653c12b2cce4f0843279a8d91f3e1a8c7290d1de2162eab9014248f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacH4:A3k03kHRJR
TLSH
T17625AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 8a639eef5af703d54607a526e3015713100153f7b9c468236cd4bd412ca1dcf2
MD5 0ea6ffd886a039926386614396e6332f
SHA1 0555314929807d923cc756a9c444fec088e5baf9
SHA512 5fd8d2a29cc30e57ea3b4114e2f7d6a1a9a6404f47955c2275d0383e3aca333e52860fdb14cbe5986c207230a34f06733fecb998622aa802172544ec9f8989a5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacmu:A3k03kHRJs
TLSH
T1AD25AE13EB9504E9E10AC174AAD65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 25959c827b3c2210d61001f4aa41011c38bdaaafc5731dd6936dee28cccb7265
MD5 cd894d92a788a3969b1b9288766064a8
SHA1 7c85c3ee459e212506584753bfd88212c81edf0f
SHA512 7b5023549f502e5b3d786f520657a26f3700ba30f77fb549b49d519ed744ab86980b04866eeefa2c6d911d2a61d1c06a31228f3657d68df1baa920b1b8d9b28b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacXj:A3k03kHRJu
TLSH
T12525AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 5ab5342d8977b21c2d83ef65093655d068227f180d84d39e370edfd05d9ffffd
MD5 5c357c0d9f255ab6dc1dfa76cde80946
SHA1 6c68a03aeb8bf247089da9f34d6b473ef48c166e
SHA512 b0ab567b3c523f21a7f95f197687b027a56c637e0cb12c5bf4a9fb4731e15f117b621f6bf5611f5a4d15d2a4cb1c937e13e0a4cb45b5cb641a4b501001114d5a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacCg:A3k03kHRJi
TLSH
T1A725AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 75eba75fca34bf3e1f5bf414835cdea72b75168289aacf07d2a8cb7fc260cdcb
MD5 af272828c16d46ff73277680a339d460
SHA1 07777c1974e5102c82d003d515cec795af1faa2e
SHA512 dfa8cf3f3a440d2d64c7c6dc6d771816e3adfb3862c2101254e8ac80239ed35fd8f61193c7fbd6ffba5c7f84a4df4e6c68103fb25276ce555290e9a1c9cd4017
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLac9I:A3k03kHRJT
TLSH
T12B25AE13EB9504E9E10AC174AAD65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 4501ead21038f9a43cdf6370c9fc313411cc09b6133aefa0f5d5b79433732d70
MD5 548139c3085268b671a91f92fdaacb8c
SHA1 f5c7d00224b61eb48a26b8e0d33ee027b9cddc0f
SHA512 fd182a36f896ef3ff387a5a5668e588b070d851a62a6cae51d34b3a867aca3e11dd373979aa32bf1977467872c58b17544cf0819896f931d368cf7a4d1c4e635
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacvo:A3k03kHRJt
TLSH
T1D325AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 579ca50a9636ceb333757a95fa8ce2aacb361d0149ac1b4dbd005fbc1abbda2a
MD5 67580e4361a2293dca88239385258ff8
SHA1 d5f63056985ee378d2234e1d846d7cedc8fbf43c
SHA512 306b28d9491c86dba66fc34c1d34808564f9b9d6f066228a85492bf00d083dc5f056763bc998db6c257faff7cc326990e686ff918152b4493500ad43e070b37a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLac0+:A3k03kHRJI
TLSH
T17B25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 fa61d84076bc018f394c135e8b138914ba358b22cbd4fb96afc54622a018c2d0
MD5 8e653dbaab1a84efd66486de763a44f1
SHA1 7436c71bef66a8c40a96b8bc39cbd1ae4c1b3591
SHA512 ce388ead37aa16b3df87664a512088653a5ce1dbc9e2a95a83b080e4148573c69625a0b389cd84a058b586d3b275527e8f4ca7614496a4e8b9bdb66fcdf5606f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLac8Q:A3k03kHRJI
TLSH
T13C25AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 124fb6364d09c3621de0fe2afc46942a3207ce1bc774c9f9f4d4aa5ad56149e4
MD5 244ddfea03558eff5aad929b04c36669
SHA1 284e0a3019349ef0110e1f14a227d9cf83a6dff7
SHA512 02769f0c01ae34124ea9b189901cd67aff4a4f3a4e9fb1de1a0a4eaaaacf90f170f044841238846a7662b57bffea848cb188e323cd16dfbdad6770c9071d4a59
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLaclX:A3k03kHRJ4
TLSH
T1BD25AF13EB9504E9E10AC1749AD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 046982c48e1254eb1581ff0227e1bac57635cdc22f118b5eb500d197c5991857
MD5 f6f0a7366da88f619d1d5aa4104d7b2d
SHA1 0ca51f67a69f4b85be93a72b183036adc8a2629e
SHA512 3becb4ce577d7717e51c63a89460848923295089100e49c19b96eb29e43d194f648fed99fd4bdc880765508eeba9593b28f66460755bc5ac35a933e2a19fe25d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacHL:A3k03kHRJK
TLSH
T14725AF13EB9504E9E10AC174AAD65A23EB757C56176093DF2358C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 069791768b73fc5b77ed8187601356df353c9293e6f0be6ea0a01698949463c4
MD5 64060dea3db66b02eff660cb8a52ac27
SHA1 e3a119ad34dfdf0dae8a3cfa8264a33c5b6e315f
SHA512 3a3e2fbeffd2e360b2c10686101c26da365364261996270c4f6900ab5e5d2938fca5aaef8bca109cb3175469805c8f249c0d4e414923d87b716e446a75839f9c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLac9M:A3k03kHRJH
TLSH
T1E125AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 115d8902f9a39f3277138d2a0be981b97be976a64f6f6d158a5bcb04364594b1
MD5 12e0e48e28f8453a5933e6dd0ff638df
SHA1 76d72bbc0ad3ab6007b7ecd16bd43d4182fe6926
SHA512 6843f18a4f76b14a853176ec849875f574d6ba27d880bcd642205b1bf273cbaaa6cb9193a52bce127c48115d8455ceb055083083b436819ab43ccbe6e0426bf9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCC5gyLacuh:A3k03kHRJ5
TLSH
T19E25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4636-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5820-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5820-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads