9ebe26f09192a7b203336b59366651a07089fe02a3fe2d75fc89ca9ff271fdec

Analysis

max time kernel
97s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 915KB
Sample260821-mljdjsah68
SHA256 9ebe26f09192a7b203336b59366651a07089fe02a3fe2d75fc89ca9ff271fdec
MD5 9541023ad0aefd57a7a66be1c5ae0a5d
SHA1 b82171ba80b3af56597e191d83b5a8dc567b4e0a
SHA512 27f46ac2d8d710daf3cce5b18eb311c0b1df340fabb66ce6dbeec4450bc2491ff2eb3d4c113ccf6f1f499812c152e5e2c0764be9e940bca34a4deded5058d047
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaai6:A3k03kHRJk
TLSH
T19215AE13EB9500E9D10AC1749ADA8A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/2440-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b815-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000016cbe-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2440-160-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5400-161-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-452.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-580.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb29-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198f4-708.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-734.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-778.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-815.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-941.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-972.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1034.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1073.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1122.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1141.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1319.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1390.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001b815-5.dat	aspack_v212_v242
behavioral2/files/0x0005000000016cbe-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-57.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-259.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-452.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-489.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-580.dat	aspack_v212_v242
behavioral2/files/0x000400000001bb29-617.dat	aspack_v212_v242
behavioral2/files/0x00040000000198f4-708.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-734.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-778.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-815.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-846.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-941.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-972.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1034.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1042.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1073.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1122.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1141.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1166.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1210.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1319.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1334.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1365.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1372.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1385.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1386.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1387.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1388.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1389.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1390.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5400	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2440	2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5400	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_9541023ad0aefd57a7a66be1c5ae0a5d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2440

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 915KB
SHA256 9ebe26f09192a7b203336b59366651a07089fe02a3fe2d75fc89ca9ff271fdec
MD5 9541023ad0aefd57a7a66be1c5ae0a5d
SHA1 b82171ba80b3af56597e191d83b5a8dc567b4e0a
SHA512 27f46ac2d8d710daf3cce5b18eb311c0b1df340fabb66ce6dbeec4450bc2491ff2eb3d4c113ccf6f1f499812c152e5e2c0764be9e940bca34a4deded5058d047
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaai6:A3k03kHRJk
TLSH
T19215AE13EB9500E9D10AC1749ADA8A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 8e0a12882fb34fa4d817104e4abfdfd560d52fc346470d2f143dd1b4fec9b580
MD5 1771dc1200700fddcd0d814ed07ac8a5
SHA1 277b2674d2da154b6e2d6be340f640ae3df116c5
SHA512 91d6bb596591a1b296870a7e930c51e3e787f32dbb6ed6c07e4b31f1314a0d956e279004892f44d260c13aa0abf28023732c4504e4c2edb0fc677b68bf3b058c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiK0Le5ji0hmxNrM:A3k03kHRJcPji0Aj
TLSH
T112658C17F6A402B5D027C0B9C5D6966AEE7138821B3086CF1359C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 930KB
SHA256 5ba76c172dfe9281fa7578a720f957ea84575bceb2c3880cb6eccaee494e6e1c
MD5 65628fd65d76ff2549f4328e3ca1099d
SHA1 fdfa4303f225c49dc4950683b78df66622519f94
SHA512 b768c695f134586a38a4914800866ae62d3cea3e35cb4d9a56e9348b902eb8b25167729c30ef340a0f525ef855b872ccada6855165ead2faa3d13df937285433
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiEa:A3k03kHRJ
TLSH
T18215AE13EB9400E9D10AC1749AEA5A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 939KB
SHA256 f1d7fcfaee346256353f56790514e05e741ee8b65c623cf790373f90d0b3343c
MD5 2277bc91301aad60d6185642e636c104
SHA1 8df91c233ef88666999d121f58d7a87fff879a85
SHA512 2712ff916870617bfb1c4f9fea52fb36925a3d4afb353f324d9394aaae13dae407c2503ca7dfee7a62a1da012eb4b11a0fcbf79340d6a28f8d9548023f57d92d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaai96:A3k03kHRJK
TLSH
T17315AE13EB9500E9D10AC1749AD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 939KB
SHA256 37ffe82318f1e97d57c6df4ce7b5c981b4a7a6b1db48b18ad4636df2bc5b3bb2
MD5 89e662095c9775767bad8dd025318258
SHA1 68ea2236cc1a22bf21993619e4550068c6769712
SHA512 ae2ba4500500b591e9789d1b197934a40775237c196b495e913db6186b3adc3abf31b4bb0f5e2a7244910d865431fa964ef8f7621537f2e2ce9176814a827a99
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiDo:A3k03kHRJ+
TLSH
T17F15AE13EB9500E9D10AC174AAD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 939KB
SHA256 736558ad644c4a25401ac4ae27c8c0d4f6673679d60d9f507431a90a7aaffd39
MD5 21a83d27f9e801df62cbb24e674e1018
SHA1 3c6dc82d68ea62d6725172c1740f5c7f905b6ad7
SHA512 3dbd1f5d43a545770333cbd42c8edd9b10edb1bf6b497c7e716746a8a0de842084263dcce4ab764ee68bbd82500f0b7d50a85f24a36567b7b2ea92215f751252
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaai3u:A3k03kHRJ4
TLSH
T1C215AE13EB9500E9D10AC174AAD65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 939KB
SHA256 965821e7ac2fb257ff551d870402b4f260338521d4cb14688ac39d49230b83f2
MD5 f0f635d89e3692f2f8d40cd2be7869d3
SHA1 13ee918b075fe8cc5e9873c4a297dcf259390ca5
SHA512 f6737eaa88ca5fc3d6ceb4079925ac73cad2ea4d8fb5512db18312484e6c0634c58ed9c6f287efb0d5aa46f2b41eca5c2589d422c465a6851883f5ea4329ab94
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiF9:A3k03kHRJt
TLSH
T1F315AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 939KB
SHA256 2d9eaa196be3466b2ac7ff217af965b8f84ac9fb5c3c5250e2431326ef105b88
MD5 a354faf9204eb4bce55c8d17673a833c
SHA1 846b51769d18fc0424a96f0ade6f2a80dd581afd
SHA512 3d4180b4e8b2423e9312516c467fe9acca66d89903fa90be6a2a64573b06f56bac561eaf9321e04dde67d0d3b0909eef60b666fe9f32080c2ffec1b12b0779a5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaihc:A3k03kHRJY
TLSH
T1E815AE13EB9500E9D10AC1749ADA8A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 939KB
SHA256 e7a5a082fec9b94209b555d4260fdd5a86bb8934e08c9444f1016e3639bfe871
MD5 2398245dbb73f2d52aa6e718339c3afe
SHA1 9d9846ade4c6f6734eb76ab4778f146480f3aee3
SHA512 717f4bcbed9a2ba4ead145086c27b4996aa452aaf218273d5cdf2657202fba32bcd2a2e4adb24530c38b5979315a7c5339e7a75274219e82e96c03d9f3f181f0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiKp:A3k03kHRJO
TLSH
T10415AE13EB9500E9D10AC1749ADA9A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 939KB
SHA256 db8b479be6636741e355af13d3713cdaca38edbc0e90839f1c3050bf5c265cf6
MD5 9c9798b5f28c8cee0695f1b5165e2ddc
SHA1 dbe52cb49ee0866ddecce18eab8af895dc6c6949
SHA512 6e9fe28c8511a873ba0267c48cab8b3d805947ca9399b3c32ee029774f9c5ac22301d028bfcdda3d15ddfa2863a61a0ae5202e423c4b9f5eb7ad7dc8876d6217
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaitN:A3k03kHRJh
TLSH
T12315AE13EB9500E9D10AC1749ADA9A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 939KB
SHA256 b97c5cb62e93b9bccf354a7e3407c384b089231616094e1a27874deb42035ef3
MD5 0ef2d47d32e53d8c37df54a42a3549ab
SHA1 af966987ee3695f6cc2dd455ce3d0bf9c805f546
SHA512 09c618af4a3aded64f798711990cc7ac7e28b6d21219f6630b0b522271aa75b77d981f4490180f7f2c22daf875d5d25ced161b41db39b3bb4bf5546a7898c1c9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaifF:A3k03kHRJz
TLSH
T11915AE13EB9500E9D10AC1749AD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 939KB
SHA256 828ff07f2dd03990bc16c77f60c8b7715d2ebe87e32e5a2120be8010917efb9e
MD5 5e80e5d715d66f0e5e41ee8732d3c4e7
SHA1 4dc8accccac03dd63a4b952c768c4784f336bac9
SHA512 feeecb5fa741cddaa5fa516312ae12f7a24c0ee01730ed567ff378597a862a07d6fac11d6b0721f71c50c1a8bc8eae65b6b6f2eac9ff073db26017f7df7740a2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiAC:A3k03kHRJv
TLSH
T14915AE13EB9500E9D10AC174AAD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 939KB
SHA256 48b8d39566eb31ab9fc008a26fe86b258488d7300e200b9b953018a023194b43
MD5 9409b8a9b2cc7a44cb9df11cd4b4772d
SHA1 73bd8e32ce632611c238693f835ae564db13b959
SHA512 3579c3d5597ac0c13606cfc8dc127b7695fd58ad7c2abc820d82b0b751e9b889bb5a447371a87bff69865cad57e757fda9740a83fa222d3e268a50e9f8377aff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiTw:A3k03kHRJK
TLSH
T16D15AE13EB9500E9D10AC174AAD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 939KB
SHA256 559e204f465f54fd85f75d7480ea8e2a46bd363473cc3b65c7fdb52f5d7c889e
MD5 6e8f222bdd0d50abd795e33742934c0c
SHA1 47aadb4639f100d490c0d1e18991ff2eb8a20d11
SHA512 e84ceea0cc321c048cdefd806db3a5bc0e76053a077ba5e53e295eed42861acbb0f0dc08363d567ecc274affd18c7b45ca1cf9a8d5ab43a216a344bc1abb598e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiaT:A3k03kHRJ6
TLSH
T1CA15AE13EB9500E9D10AC174AAD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 939KB
SHA256 820a55e013620243e8d368e037814df67d6bf403be033990e48a64c2614713bb
MD5 168ed785cea29718f4ec0acfe88aa407
SHA1 92d3809755bffeea7dff5fd0ee9148f747aa1b4e
SHA512 05f6fb76c584f3ee8e92530fe10cbeb6800ac4c3c1b5d6756140e4347faec8f3a06be884213f117e4c30394305a0540cbf8c7ed9923fe8af53ce098356cc138a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaai6u:A3k03kHRJ1
TLSH
T1AD15AE13EB9500E9D10AC174AAD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 939KB
SHA256 86b085b195933dbe8594446bc39750521ac3c64b41ff5efa12aa5c8516de1794
MD5 7e848674e90af644deaa8536a7d0c976
SHA1 543aae44e87f0b46613439e4dee20e16d35aff30
SHA512 2c4bf221312a592beec21942c8cc32e934ef989de459d65f92f497d8546e9474e0bcdb09c57d875d516e71c77e6268993de97dfd1b0c883f51b1fa52ac07f51d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiEb:A3k03kHRJU
TLSH
T12115AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 939KB
SHA256 7a804dabe050ab1fdfc69f84a861093f04a2de3b95ead1a61ff0c479dd3b4cc8
MD5 d896bc98aee0932b5c0a86d9a2f2c5a9
SHA1 cc30bdd1bed76142089f645a336b3ca16450e2e6
SHA512 dc8fc403fbc5cc1f645d0e0ffd68c7accd2ecc1c1eac9ad736ead248d694b8d5cc9a6f55b55de1eb5da0913ae9188e08dcce4515e2c45fe8490b5357715ce911
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiKf:A3k03kHRJk
TLSH
T1C115AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 939KB
SHA256 7f54d3e9be0c9491af2cece4b95c5ecf97eb510e7c370d985a0705e9196ccdfa
MD5 c4e2000ca13ff3cfa59a4b99850a6820
SHA1 aede618d408a20a462ecebbee7b56892f0aa8738
SHA512 e500d1f6414697848667fd4885c2b89313a20e1c1ddc61e631e2b794672749ac3952aab3c4b2f2277b636dcfb66df5401adc013695ea0c86e5ecd2c87df2f8f7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiXK:A3k03kHRJU
TLSH
T19A15AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 939KB
SHA256 df278750e7bbfe94a451faccf5315f6379ba288d2c0d20e4f56ff05f699c2255
MD5 de71b6ce9ba4101e60ffc433cb1a687e
SHA1 a74a1f4cfc04cd42541e21c5a55f5fe466ddd671
SHA512 66d5cdd949e373ce90da3900ba77ce3f0cce8a0f5ea2c938350d31ba736ffc0c22a31a31872329679e2510e534b41db997284fa9fdd2220e52e65764542a9c2c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaigk:A3k03kHRJt
TLSH
T13715AE13EB9500E9D10AC174AAD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 939KB
SHA256 bc6780dfad32d28c676162ff45fa21662bef3a811edc046027a4f6f15560d594
MD5 32d66248d4490eb6125c3a3fca129005
SHA1 6b4a3599d3069a772a63957d344c5376a1a68e87
SHA512 53ed2d91c9ab7e2a3b2b6cd4a4584d798a6e21c4d0dcd554be48d0aa8388907ee51e2b12d522a3cdc2e02c0d71cdc2b9b83f5fe381646971c42ccd8d21b60527
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiR0:A3k03kHRJQ
TLSH
T18B15AE13EB9500E9D10AC174AAD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 939KB
SHA256 e6472dd44cdbf9722041f41176aa51b43fe71bd8ef5d382b70d54a063e85c8dd
MD5 49aa43bae32e5b89c9f1a089bead2fe1
SHA1 35f56b56d3a7d90ef81a94a763d67a2f8060b18b
SHA512 926819509a9f34e6ada5a5a81593af86646eab16d2aeb6b8a71c4a1b8226aa70a2b44fdc2f5df07484fa40029092168e0a626b997a704e7d3cc84fc6b4e60be8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiEg:A3k03kHRJl
TLSH
T14B15AE13EB9500E9D10AC174AAD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 939KB
SHA256 52250caef7dbadf20800d4c4302c072885021726b77ff44fd3888766e3f97dda
MD5 3be4b2f470fdf6f40337cba2d8b82c7f
SHA1 82bd96eb1b349263e64e9f7ae85b250b3d3608d6
SHA512 174f9016d6fdcbc8bcd4833a17896a5251634ddbd4e4af6f696b7d6dc2e697f0f98a5a5dc18045f6155aaa31b4f2b3eee0c9c825f809762c7a87ce00f743cb51
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaihr:A3k03kHRJn
TLSH
T1CD15AE13EB9500E9D10AC1749AE69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 939KB
SHA256 8788d0ecb12532902d2e582fb41de720a8c22a95db0b80e99a76aefea3f2ed3a
MD5 44cdb2da02a1cb3634cfc52506914838
SHA1 4e49f4f32659f813befdd6b8eddfb627311b09d2
SHA512 f0fbbb995496feb441ab41831c0c754dd7e0ae1a5f4867641a48e49469aea40d013bd7af33fefc1e5b3c2e30a3f026f4b7cbeaf81999497ddb6c8d7a60b57184
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaijn:A3k03kHRJR
TLSH
T1C115AE13EB9500E9D10AC174AAD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 939KB
SHA256 6015270df4f1772d654fdb1614214019efcfa8d4f442807f6637e361caeae8dd
MD5 80fbb457e2cdda630a0ac2af3f5956fd
SHA1 a30de00b548536e4d546a2eb72eab91e04e1a587
SHA512 df94a94e529337d43308042464e95cec90d2b972dde305c29fe340879655b72351e4f774a20724932cc62ac3a031f2ac5ebab39f088511160fb4e6fe53e8d71f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaai/x:A3k03kHRJf
TLSH
T1A815AE13EB9500E9D10AC174AAD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 939KB
SHA256 c9e4efe0570fbb6628d080ff7e6a8bec2ab144c2a1c7bc20acaaf5fc62a81eac
MD5 f5df8cea5c61769137aab84a34757e6f
SHA1 5f926b9c900915230293adce34c4a34b32789971
SHA512 2bee70f22101c84d5ac133607a80795e998643b7446df19cbbdb7304262f092f314953ef556c4ec28979540e4c4fb5708b6e6e1551a559a8a817ebe5cf263265
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaailA:A3k03kHRJg
TLSH
T1C915AE13EB9500E9D10AC1749ADA9A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 939KB
SHA256 743cfc2900db3bb3e7c5cdde7434afcfda9457dc8765c53cc5c35bd60cbd41ad
MD5 370cb9bbe26bb297863ebe7d36c495da
SHA1 2d7581634aaf032e684f126c68d2626737fe913d
SHA512 b888a1200e40d6e03ecb057ee3f3895c43cbee4869c3bca661549ff7d77373bce88788256b122cfb2f7c837f1ae7d91f71e4828e7f96bceec93b5bd51b7edf10
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaie9Q:A3k03kHRJZ
TLSH
T1CB15AE13EB9504E9D10AC174AAD68A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 939KB
SHA256 d9393fcfb4465d0ac29533ff3a540ff00194002690b5620871b1649a536b5ec1
MD5 9c06ff30d44199643fa032793d33baf0
SHA1 f2d7f88cf6d5bb16ba455fc00f6ea0440718c45e
SHA512 dc3699e49a6dd3d1a81058bd05f148938a5873e1db552aae0c83dd7214097f9888df7e15dfcc6ba525e97dd37091bb914c28983566692786e242ad0ab7e074df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiL4:A3k03kHRJO
TLSH
T12B15AE13EB9500E9D10AC174AAD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 939KB
SHA256 148814274957715ab7d224f062eb1e6282ed608424ec269b34e4627a39b4f247
MD5 ac77b6095020ce6c915d4f10c748adce
SHA1 8450bc0a9efa231b652bc4e34fd91d4265a04221
SHA512 2d2b2e621a480fd153f63afae79a1324ee4f81724bee7380a100bc42b6fc186bd21f6ec5573fdc05621a8ca242eac1f8fd09f93bfa26ae1eaae632b26b5f9ef7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiCu:A3k03kHRJv
TLSH
T15615AE13EB9500E9D10AC1749AD69A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 939KB
SHA256 d00c5c7a5705d13bb1d86afba51bfd3d9fe973f760fc2ba386145b608bf4eb7f
MD5 dff840782d1f74ea382fb34c58713bc4
SHA1 96d60f8f29e6b71447b7190d1d4787b57511206b
SHA512 caa3d6a3af9ce18a5efd4c53022afaf99d3869dd596b29be429450e4796a0404cf361ab550f22a6db20ba222789baefeae65d17130af8c2285259f34858e8c5f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiTj:A3k03kHRJx
TLSH
T1E115AE13EB9500E9D10AC174AAD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 939KB
SHA256 d56e82e973f73ce34f69e003337d2b1215e4d262cb3101b537c976b671edd11c
MD5 928577ee0d072cf19e8b999c094f23e7
SHA1 938130e64e8133a5e1431ebb3de9be69809fe340
SHA512 273d58702be90c74936b1483fd52bb343e956ce4c1c8a71eb695871ba733dbf71059e7ebb2d959b6aaa757505ac6a0ab2681ba9147d1101e73e05f7a4d19e96d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaieg:A3k03kHRJ1
TLSH
T15715AE13EB9500E9D10AC174AAD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 939KB
SHA256 2890b06d51be385d736a3906ead74549b482f41813a88dc31afcc092eac1df79
MD5 20a89082537e04f99bd801fb99207681
SHA1 8d048c3d0b6ba3034809eca460c24ec6dfd6b9ce
SHA512 db21caa5f22c0031053975a3f52bd3b37378f94999616c690234df1837e7d63d3b35e7fcbe3a8f569e313c1754d3f1bc784bde8ace73cfa8ba056194d837f34c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiRI:A3k03kHRJ8
TLSH
T14915AE13EB9500E9E10AC1749AD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 939KB
SHA256 2c859ba6c9e11aa761986965f956bd6b58cc9fee019e50224abfff4d537fe4b8
MD5 3db3d2344b04151c1e1e1271930f430d
SHA1 eee3a7952f2eae5df74815032df9e175d535ca4a
SHA512 2e3c4de945671d4569b9379380f7d533d636cd48a0bf785a6a69a5ef413c43eae30a9b71352ac3c9c6d3a949352935f0f33454294a3ee93069e942ed9c625a88
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiTo:A3k03kHRJ+
TLSH
T1B415AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 939KB
SHA256 ecade6b6c5ccd0483a152cc65ce1c0e0b6284e77d4e973b256d2055313442be7
MD5 16ec5a4266a77b5d32b1b714bcba39d2
SHA1 4691fedcbcaf9c0482bdfd2bdf2bbf17c51fdce0
SHA512 9365cfa06625fcc61c9d6481bf954f8fd6dc2c8e8ab1b5a5a644bb2fd76ff810b019b575dd369ec3201d439687a8671bbaf14993b26596fd21916e5502f49ecb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiY+:A3k03kHRJr
TLSH
T1AA15AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 939KB
SHA256 8b4cf06af229adb84008b12747699932ec8fd4ed12f4a2f5d7ab3ead1807a8c0
MD5 4e8839cbc9d97882c7fc75260abc0aeb
SHA1 b7eb10d996608d8960e0509abac52e553a1e10c2
SHA512 201c00ebb4ed9b3bd0f7a4a35f813af24c73e46df0adbc479c8359f1609ec56fee84c7451af32aae6140af9d6f5381adba6aba323737707c0c5de90e105bc114
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiwQ:A3k03kHRJv
TLSH
T1EC15AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 939KB
SHA256 22a0df237b390c214701f47b049685e3879bb2c2e4de4be47462282995060871
MD5 a3427a859d46e326ee3906dea4c1bb38
SHA1 9dcb9fc3f83d32c951b189767dca570f94525690
SHA512 f299cd902f215bfb3c8ea45b1a8bd27d3ca0a4a5b9f5345f15d8d2d94f3f5196ad7f4bc9ed75678d53e81b3f39a656bc550d537aa6e74e42e761eeaf28c9e57c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiZX:A3k03kHRJj
TLSH
T13C15AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 939KB
SHA256 467c228540154147a80bc08f8617271b92b50703050625682dbee05fe6360467
MD5 9f45366d1b7aa88b709c55b6b2d3c37b
SHA1 9a3967e2605ddd94b5652898e611827b1fb25614
SHA512 f4cab57608458060242c007694ac394309f221b08beba3d4b0a877ba69843099ac1afefc5de680fe4fccf43f2af1c5663cf0b9962e5d0f0db8a25c71749f4769
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaizL:A3k03kHRJt
TLSH
T1E215AE13EB9500E9D10AC1749AE69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 939KB
SHA256 1fa43d142490f2eeb1b5eca0a7effa2ce92aa3e26b0ea91b8b6641365599b9ec
MD5 52bdaecf667b2c1bdd6f5a1cb2d513b0
SHA1 dab850051eac4872d25a1f22f0ecd89b7b1ea7b8
SHA512 9862f73c1afafe317845dd1b16cce3d6d0f3c7cf0163baa6b831deffbb5a5993986dcd55f73204226e48219a7cef687df7a5e790b71386161374c9632447af53
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiZM:A3k03kHRJU
TLSH
T17615AE13EB9500E9D10AC174AAD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 939KB
SHA256 d6d74cc01e52810e658a8573b0d8f155f6ce5971a1ac32cce4101f8aa6b998ee
MD5 fcfa3d9879ae1f34c76bf4982bbbfcee
SHA1 515468c180a799958fcc1487bf0e45c0e9d8a9ff
SHA512 115dd07b5e41c03a110a6bca244eefbe7d1ee4498f182940537a8da0976c8fc13f2596502c80d3334580c0f116582e3d69d2368c82be12e1f8b89f1397ca94f3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JDeaaDaaiih:A3k03kHRJO
TLSH
T10315AE13EB9500E9D10AC174AAD69A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2440-160-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2440-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5400-161-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads