59ca3a157c19773068d9129112228b84b3d5fc9e58be632cafe5e0616280e2db

Analysis

max time kernel
95s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 939KB
Sample260820-vyr58asbnd
SHA256 59ca3a157c19773068d9129112228b84b3d5fc9e58be632cafe5e0616280e2db
MD5 a3b1799f0439b0300d10ba9b2c3affd4
SHA1 534896c4693fc87eb82f1dc3eebdb2692ded73b7
SHA512 ab477ed769317a73eb14429900661bb2968c1663b5f98828650014efae7206a56b4c59c9c792096f76c5a2b2e394639360621feef25c9ba1926886d032a98f48
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayb:A3IqJtb2Iu56rJb
TLSH
T1CA251815F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3416-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b807-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3416-160-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2256-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-237.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-446.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb4b-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-580.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-703.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1097.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1165.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1209.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000300000001b807-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-237.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-446.dat	aspack_v212_v242
behavioral2/files/0x000400000001bb4b-495.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-580.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-703.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1097.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1165.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1209.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1318.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1338.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1384.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2256	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File opened for modification	C:\Program Files\InstallApprove.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{19C38D80-0C26-4176-9E53-8ABFFD293E4D}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3416	2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2256	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_a3b1799f0439b0300d10ba9b2c3affd4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3416

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 59ca3a157c19773068d9129112228b84b3d5fc9e58be632cafe5e0616280e2db
MD5 a3b1799f0439b0300d10ba9b2c3affd4
SHA1 534896c4693fc87eb82f1dc3eebdb2692ded73b7
SHA512 ab477ed769317a73eb14429900661bb2968c1663b5f98828650014efae7206a56b4c59c9c792096f76c5a2b2e394639360621feef25c9ba1926886d032a98f48
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayb:A3IqJtb2Iu56rJb
TLSH
T1CA251815F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 8f0b845e51c83bb232262987b90585e562146124788d2ec114f15a0885c75816
MD5 5b3d606e58e72e991671564be6edc55c
SHA1 e85ecf6b0a36efefe3481efedfb735afcef09b72
SHA512 5967d449eb905f5e29fe3d8dd6b80b231e4fe70f5b1eb9b68e2941853dc49d3fb14d49cd457a8ef17834d11c7c9aa6562affe05c0822f0522f9e9f664fcb190a
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayH0Le5ji0hmxNrM:A3IqJtb2Iu56rJHPji0Aj
TLSH
T16D650915F6648B65D07BC0B9C5D2969AEA333C425F308BCB0285EB6C3E276D68536733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 ce10e0fa4c2edd2e4fba1894ea5e3884ac988a0a390fee72a4d7c0a5280c4848
MD5 8562ccdb2268a960df8575e17e97967b
SHA1 2c86c5595c2c10925bfd3c9c2ab6e3d158ffe62d
SHA512 a494267edd0ffab2fd4969f7f174d5f354a960fdb9b5c46c3dffd6ca7291de94ded2a8ce2c846bc0668b1c1c626729b6a5e96ce7bc8179f1f187b0328e204d8b
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayZa:A3IqJtb2Iu56rJ
TLSH
T11C251815F6688B61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D5D936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 41ea38611501f2b252e962b3d03aaaf13ce93f76254dbe3893412b5a4638002a
MD5 676d3c74395d8318f30d87d2a6ca7d72
SHA1 26c0a8a76d42070b63229048dd557687696c527b
SHA512 8be7e4c79c9e573c8a305c52b9bb413a23a6c2ab16c9a88a74b7f385bec9c8f5a6a6c1b821a789ee51ee57e7192f08e139601168ffed5e91a0576cafd4832a70
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayQ6:A3IqJtb2Iu56rJP
TLSH
T17E251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 963KB
SHA256 22af335365951fed75234446fffcac93778404ec062fb81168e67e461e35a9a2
MD5 76ed52361562d3fcf315140fd1641b4b
SHA1 b0f60a63ba72c6bff94fd67863c241bed38bbc35
SHA512 aba24c9865479cc8bfc80c64eee4e02526dde77baf4da5d7e8d0a4d324d9f84675b316ed439a679bf8bd496d30c02edb41fe5a6f93665481c6a92bf06acaae1f
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayUN:A3IqJtb2Iu56rJy
TLSH
T1FB251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 963KB
SHA256 f262a0d32e1a425c0a482583a417e5f7fddd76d68e8b22452853a0c4d0b8db97
MD5 17e959c808ab09c56f883110db84c220
SHA1 423b51cb3192cb64c792bfe18061e9c51322e4fd
SHA512 b17a75e69b898910a29088f74fad0808a9bba381eab4598942c0e00670ac73927ce1635fa012dd61d0b976fa820df09d103e462f248f678fcb3c29b7a4acb050
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMay6f:A3IqJtb2Iu56rJO
TLSH
T18E251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 963KB
SHA256 bb3da437eb439152e9d406203f86715d2541d687e1487e16f639c9b969b2318d
MD5 065a85289211ef1dbe50a96680ff3832
SHA1 2967dfa1458e135d079e027e85b09a1fbd47666f
SHA512 4cfaa1f627ce5ff48b765767acb947de83b73416bf63c8ad82f88715269320eacaaff114513feafb1f09eab7850d22b7633f750a1709914f0a4431fd72588772
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMay0o:A3IqJtb2Iu56rJv
TLSH
T161251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 963KB
SHA256 136364f98bbe234dab5db952907a647b08cc3ef007e769d80af14c6ad10cc587
MD5 44b7699262b74bbb0e681a51d1bfadc9
SHA1 93b53492173b63f8edd1d524c5842fa743f234f1
SHA512 cc75be10fc5f7eade239ca2999e065b0b1d182df1acea43affc1f818dec3fbc603ed404214fa4177626bacdaaefc75ed7cda64febcb354af1255978e07926c7d
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayUu:A3IqJtb2Iu56rJh
TLSH
T16E251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 927ee514000adf342da24777e869b3bc4c3b74004d6a4a9bccce1ceec56093aa
MD5 2d808f76fc4e6a841d6b25d763e06968
SHA1 e13795d1f2d25d092b8f085e8c673315abf4bbcd
SHA512 43af7ce8fc65973eb410c58a8eb61bfef0222fd76240c9f2ee9aa4b42bf5292265529bd0cd0609637a0d66345ff471ef16df1318b051f46680480a130c9bb961
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMay49:A3IqJtb2Iu56rJc
TLSH
T14B251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 df20976ff0bce9167480d4ee6f0db5751c21d4e9a39043d2b4826442920673a2
MD5 ce28cc2f201b0a9b6713c24c65e0ba79
SHA1 311efa3e2954b3766111408850bc3ffbd8115f15
SHA512 5f0de600f30d4ba4f664e2323ee5b470262ad230a0a330391b300c773f358a3915fad3f101c4202000125dc5d427c96e59308e6a9541be3e7bf2283268056b1b
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMaygc:A3IqJtb2Iu56rJV
TLSH
T1AE251915F6688F65D07FC079C5D2969AEA333C425F308BCB0285AE683E376D19936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 d55807c5015ca9bc68075dc11240734e73d014dfef22c7c6ea3eea5bcb16e370
MD5 fa540a646691d19aba4de42534db88ba
SHA1 5442072b703f407799a2c9f32f4d7a63f8d7496d
SHA512 525123125b4ab6429605f65c3e91a0a362ac46e0e0afdd0027446ae8be499471bf69668a034f2de624ab457a7542263bf410f957d9b975088576e9e625c59b0c
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayJp:A3IqJtb2Iu56rJb
TLSH
T106251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 ba485885241d8cd6f0db9836b43b9dcf81116667438a8a22db5b76241c3d0266
MD5 9c35e0ba29e16d4d2bc83003956b197c
SHA1 fc9aa5d1648f06c36ef23980c6c75228a3669f14
SHA512 77222fc8a0da6672dd3dc3964034bf975b2271bc13d00ff9abadea3d0aa0d752a621e8042373782467d8977835e3ad0f1cf2300ab4e2c41e56208f7ec46bf57b
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayON:A3IqJtb2Iu56rJg
TLSH
T194251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 dc86b8f14dcb941f63d202291ada5409c05b07611901bb06f04e0076c705e8dc
MD5 fd2ce7f2371cbf7a19d17a97fe2e76a8
SHA1 d088507cc6c51f26c959bf0dfa1b88136de824d7
SHA512 5e01c4703e550c7032934a00041b2bc54671dfc3efac8e8311cd6853e4571227442832a93745d636e78ca3ba98dcfef195adbe33641ef00321e1660c4c1286bc
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayyF:A3IqJtb2Iu56rJW
TLSH
T1B0251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 363e6cdab1c21aafd936c09108aad40a376596394b0a43eb99cb9a5afabe0dbc
MD5 2a9446be98724cbccbc911b15fc958fb
SHA1 d91110624ea40fcea3ef060dd621965efb6e1eac
SHA512 02ce93297641cb8df8cd233a0909ea441900c467aadf1a513b2bd574b9ef9259191b7e5ba6c51b33fd11c234c284c2564440aef0710c00068fd68f49a08631fb
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMay3C:A3IqJtb2Iu56rJS
TLSH
T12A251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 b7c7e0d8de5be2a98b6c0154b58fb3105094451e80987e6fc437ec6541bc2688
MD5 26319ed316f9da4583626b3f9d58d747
SHA1 da67e1cc6847e9b16dceb3f850fdee50c34392b3
SHA512 e741f5c61070b0f601fc78a73a3801a792934a064e0942a8d0b565c7652b55a0d9a18a42727be3540bf784a960da950af4833cd4eb82968a0d02686314bf4c44
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMay4w:A3IqJtb2Iu56rJn
TLSH
T1B3251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 0a7b37ed675d6051c7c069103d4d3a4d3e8db0013bba5065a4cbe7c3c5691da8
MD5 34a3399a9bb147ef94e0550138fc4d19
SHA1 bce751964710a45222e6a61711dd9cb25f289915
SHA512 66d7255030fc31ef2e6c9121c2a61f0025176247379e5a67a703ab367c40963df0281728804c7d841d7d6a5839fd801f7909aca141cd3fff3c85652cab268119
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayXT:A3IqJtb2Iu56rJj
TLSH
T1AA251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 74ea7fa01b6a662d7e433afc7713b7baa173b67fa9b8b1b515d88472fbbceb32
MD5 10f5963411f94f99854e753cddf7dc87
SHA1 9f72d2c60f60ddb949d73f04058d0d30d413049c
SHA512 c067fb3d9cbc5446b2b4a3d7bcaf3149a5435b2d518cb1eeffc39f9691e2064776ff7f188caf3ebc480bdb5dbffb9247b16976253729bffa60e81aab1fe48976
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayhu:A3IqJtb2Iu56rJU
TLSH
T1F4251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 6984446c9f39449e635369900e9d8321eb15b8c2397c4956b74d0d362c04167d
MD5 708f6739e667e89b1d31b7b990e02cb5
SHA1 cb0970c80446bc5dc4dba770d023ad00309cfbe8
SHA512 487a7783a873653029417bda587dc261440e4b986e758b0b921ad9efd49018025b2c107ffe132946a597b75c087b6ebc7a0ade3775c4f29dbd7b4c92f1f37be5
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayJb:A3IqJtb2Iu56rJ9
TLSH
T101251915F6688F65D07FC079C5D2969AEA333C425F308BCB0285AE683E376D19936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 6b5fe11866c247c3ce035fb1246226a360a5496d4e4e118ce89551bd786b8bf6
MD5 d66c44f999f8b8562c3ed8961bc9c87e
SHA1 5fcb5493cd6bbdba5182b0d729f9945bee7c01f6
SHA512 944ff4193a936901be2db51a8efab37db601ba33391c52667e74824bfea30e12c0dc244b4c9ddae8984c32dcb2adc4fc3cab1d81f9ed98e6e390ff5dbeb05577
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayxf:A3IqJtb2Iu56rJt
TLSH
T152251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 8886acd6eab5bacedce2bd3955d5ee83012a66c52ed8971d589227fceddc5465
MD5 f4faa68dfbb27524bbf8625a9d238934
SHA1 e23b959c29c27c9df2aa5393cb9b5521087cf174
SHA512 455a01c476c34dd313e4980f9109ae15ac64f4ebf425e87e7da19fddadcd3954ccccb8d9051e8d731656ab33f8bd764d8d7e32cefdda592f40578cd56da18cd8
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayaK:A3IqJtb2Iu56rJl
TLSH
T12F251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 f33f74fdb1811f4a098bb9cb0f123757c41610bbdb8dba79a144e2d94f4671fd
MD5 ed855a476c909391d9936f49cc048755
SHA1 914201788005264c365ca3e5bf881e70c8da7542
SHA512 156a2beb534204d9ffd39e58ef36d8d8c6b45408f9bae1b671e29d8f6f463728f17b1d8dc4edc968b7b7e6047555443cd78bf0438c095c2dc508d9e2ab694ea4
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayPk:A3IqJtb2Iu56rJM
TLSH
T104251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 8ca1f710c21744784a321cfc84e22876689159ae622cfb2cf51beb3e59f524db
MD5 af4198cd6d6c0bb4c77252a786b05a48
SHA1 e5deb781213f900c6102b771f28dac32633c8e4e
SHA512 a8fcd3c28774f1d2fb2ecee003f4e97298fcc16a0eea52ab8859acde3c78dd446356fd77a33282921e33ad86d6a7879af8678b8b4f4bf8ec402b960826550285
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayI0:A3IqJtb2Iu56rJl
TLSH
T111251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 b74d61f3f2a0585d5a5757c9659bf706610fe9a638031684a4e53c96b2373d16
MD5 d4770a297df52e6dbb1ff3c13225ac48
SHA1 ce9cf572bd08e5ed8ef46cbe338252bf73926d4b
SHA512 e9eb63539fa0973b6a6e6caf2be519bf06ac839e3ce27ca293e738291565ecc2a19ea14e43c342715cb7388f212f022f7562421e8006a67f5ab18b3a52cb049f
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayjg:A3IqJtb2Iu56rJE
TLSH
T19F251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 14cf90305c0856b270ea1d320442906eb78b6c151d98b31ac58b562a4423d5dd
MD5 1ef9eb2209c4c754ee4d0a3889aaebeb
SHA1 f8f28bce8b913ce83d6aaf9c0c69fac3b1e2b101
SHA512 b0f3c28d5f3d718c3739eb94451bde9e8e30a8a398f165d185c3b3014acfd586eb02fb4655c1da88186f923dc75ba570a1fbf48f69d6922009f1134e87110153
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayer:A3IqJtb2Iu56rJW
TLSH
T1CC251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 8ebc54b47d7a6d573322a3e1034eea99e2ac45b23f59d96776c15870f4867711
MD5 53ee69c9cd29a2d4a1abf779dc55e9d1
SHA1 4c4b511bfad0a9d0c3595200a51aab59eec78f7f
SHA512 940a2411f6b7f3556748b3a91368957c937236de20484d1196707b15f3c110e51347c08b7b0fe918326bc6b07d5d95c9c46797253ad8601842e5f5a5b5ba69a6
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayEn:A3IqJtb2Iu56rJQ
TLSH
T1DA251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 f6eb2a56f9e4c5870e2f333aa83b7de3810783c23e56a28320af81fa4834504f
MD5 6b67ea83bf62e889226814aa904e87fe
SHA1 16f4513830f67d0d55d68bf6b7eede955e0acf35
SHA512 b91d7920c45e8250079ce016b0c397055bf831591962ce185735da92b2710ed2a3a609788954a4c545ea25f2d179cb6e307d2c5db9b7baef7fdb5f9e5a7aeaee
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMaySx:A3IqJtb2Iu56rJ2
TLSH
T106251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 f4f0d542d4c8a2b204ea3b940f6771d27de7719ea70dd2b6c0c86928160025f3
MD5 1ee43db5204dfb62a0474c482779ab4e
SHA1 5f809a2861c4e329cc37578858239977f9a7afd5
SHA512 b2b16a81241cb4649dbfae7115b0b08d4ad698ce64f8036b3d8f88dec42d5c87400bf4def26a400f59d0b4dfdd478b39e9dedc693e53786a05eea064abb806f5
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMaykA:A3IqJtb2Iu56rJt
TLSH
T143251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 5f9d33eec94c784f08d76a296d1169e946f441b774266eb83809ba77aa5121c6
MD5 f46d7538180c107d03daccb60862f9d4
SHA1 9873659c92a51871d7ba2cf7835091be77b2e31a
SHA512 9b2f42cab2c6052e27699b1fb08f13e91c978a1b9199bd16626df30051240842072fe1e33181946aca1aae569a0625444465b5b1172efe6ea1d321ffbeebf9e7
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayN9Q:A3IqJtb2Iu56rJ8
TLSH
T100251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 165859b1ddf42721f6252914826ea3c9b75d0086e6ea0d4482090790d1bab89a
MD5 5f6b5dbbe03cf591a26ed8c74b94331c
SHA1 1c55b0a7901ec2f14944623e0932f09cda2384f2
SHA512 9afb4c3901a1b125859e348b889b99d30b94069254a0a292e6ab0fcb73991ac1b5d73122029467cd3e6c887c2e5985b789623d901621786f8a2e1d7610719821
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayo4:A3IqJtb2Iu56rJX
TLSH
T17A251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 2a992a528cb55749e9511b8816c6c8433e11e9e617fd1c8fd6d118aa7a7a2e7c
MD5 849a5626c260612269cc219854056027
SHA1 570a9a6ff6fdf65a887e213e3151218102c932eb
SHA512 6b6e9e156b6ce58c5991a3724223b48d064bfa829a3103189dc3be65f8b1463422957fed1373a6fe6dac425260e8806f2790db763e1f465f38bc9d747971cd20
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMay7u:A3IqJtb2Iu56rJa
TLSH
T147251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 826a522ac670ecc24953b2090fa66fd0fd8515e7c91050eed378e18958fd097a
MD5 a755279ac6e65dcef2452d8568073c3f
SHA1 872873881b1d8c68ce2c483dc319bcb42191e398
SHA512 e4031c7981f4bd53f691f1a3081da911ddb2038921e1ed5ac48e41ecab3df0c4a5e1a7c66b3a1bf3064105613c483356266ebf0db33ad662dc8806e426034f0b
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMay2j:A3IqJtb2Iu56rJ0
TLSH
T19D251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 b97f4f7d980d8489e4b5f004df6ea1e3aff21846b85e5080daaaf7d18ae90f95
MD5 58cd7a7f86c9e577803b0986074e4b8c
SHA1 0eaffa7a0dfbe007d21f6eebb91679c556d0714e
SHA512 8cf03f5104f94a969b5b3f4606cac231b5533a25e8194384b8436b8d01cd1f5957c4f1b2935b0b44f0066df392559be2c265457884e0ae9e42cab0b907c0082d
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayjg:A3IqJtb2Iu56rJ8
TLSH
T144251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 670dd4b1d644fe2be4222c09d254e1a0a332666bf8f1ccfbcec6977e64121fea
MD5 0e0320c25e93546a96babff6540136e5
SHA1 0dbe845e9b9c140298f770fa4cbf8147d198babc
SHA512 b2fc865026a9de8d4c9864fc24cfe589552a2a0c4ee25fb8b7885c26cd7b77bfa004f2ae5cca007929f876a1548fcc65a657ba91dec90b544d9e2acd473ef10a
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayeI:A3IqJtb2Iu56rJV
TLSH
T1AE251915F6688F65D07FC079C5D2969AEA333C425F308BCB0285AE683E376D19936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 fe59471266508ad1f964ad9849309b6b7d81f93fb377700cd931bd0f9e79414d
MD5 404938faaeafb9fec760075f1ce412e7
SHA1 4c218e458cb5da27e695310e6b626493f8afcb99
SHA512 2ed450be1a1cbf996e1c1dcc5f4643aa176c0d14804de7f7b96c8e09800750213808796f898ba9e873b0ca244a18a5b2b49a45b5d3c24c5b9defda5f75f4a057
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayso:A3IqJtb2Iu56rJD
TLSH
T11C251915F6688F65D07FC079C5D2969AEA333C425F308BCB0285AE683E376D19936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 31acb12cbfb5f90558d8b1d46fab369d6caef46b37e5dbcaa71888fa93d96f16
MD5 08f5747f297fcf605234235e57cab934
SHA1 799f73c46071e529750246eb73b6d1b4cb46fe91
SHA512 9109fda8c9e5139fceb445abffec028000bff4e8380f741f03a781e7245db80a8473727a9aed67c541dae1b3eb25a10eba0e61703904e8fba6459206893911f3
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayv+:A3IqJtb2Iu56rJG
TLSH
T179251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 a1bee061fdbb692794e277a3db2330c48d269f559ac72c40c2c266cd2aadf232
MD5 11c4f1cd81e49562bf793f13c00f3157
SHA1 1aa8988d0e2ea221a4c99ca8467e669b28b1bcbb
SHA512 34d71aa94743eaebec5fc481cad9cc1b1ecc2b55a76760d48cb3bcf2d42606a1b28aeb3f1f3287f76f75b6fff6291318115b458100e19632531f6e33e07bac33
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayFQ:A3IqJtb2Iu56rJC
TLSH
T152251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 cdec86c9b19443301fa8715379551fc4f907bd40544c5da936e0deb6003267e4
MD5 7c32c6e5006ef6df20fcc15a9199200b
SHA1 4ae218579ab973c919a8e9105d0daec5c60da1bf
SHA512 3117a7fe42afe8614c55e810d3a419533c255fd23ac2bf2ea039438ec212e09d3988fd1c3526ac6899d62618b0226ec77e7c200d55cf2d527964648d2305156f
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayKX:A3IqJtb2Iu56rJS
TLSH
T197251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 f3f8eeb35d06ff40ad43740e62817e074933ca8b1ad43e800818bcc343d761ae
MD5 28ea070a41eb891b2de45092043eeb31
SHA1 d7d9e839ea70193766dd1910ca7328660d0686c5
SHA512 49fdbe32ce6ff2ddc47e75bb3e49821a9423c54ec95e405fd4ca3b001c228536df6c7696f2997b76f4645c3ced5d563888556d449691598ab2273f5f9bb310b9
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMaysL:A3IqJtb2Iu56rJ8
TLSH
T1C0251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 34c07f6b10e9020d3efdc9e63ca7c1d50102e87e92f08f47f0508fe4c893f073
MD5 2b749f3501e769543d0729e45c295253
SHA1 9147481d283dc8f8cdea7ad06af54d58fd720495
SHA512 2ac70592227cca0871932ae301065ce64c440c4474ab3993c8441aef7a8cdb8c5498447bc3e3b8d52f79063770b68b31abacaee12294bfef3695ac7e82d19cd0
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayoM:A3IqJtb2Iu56rJN
TLSH
T152251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 5e201521bf84e203412d5447e7ae3a59b8accce99fc6bf8d2ffecf66a60671d2
MD5 82186ef69e3710b6c4fb25d7b034f28c
SHA1 849ced4d8ae631bcd7f7fa68d8220db7cc34ff8d
SHA512 5ef8a77a7854bc84bedd068e6f7ece180bbc86c436f99118c5a4f8686856bf88e06e186db4cf7acd4dc9783f18b9b55e1b3963b3a92e3bad1ef94c9547c1dde0
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETeD5TvinrmMayJh:A3IqJtb2Iu56rJn
TLSH
T18F251915F6688F61D07FC079C5D2969AEA333C425F308BCB0285AE683E376D59936723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2256-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3416-160-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3416-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads