eea9adc93578840e9b3440e50b51ca548365eecac44fddf3f5707e23071e481b

Analysis

max time kernel
112s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 11:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 924KB
Sample260821-njgbvas1gy
SHA256 eea9adc93578840e9b3440e50b51ca548365eecac44fddf3f5707e23071e481b
MD5 2679148175046720e04dcd77e53d3dbc
SHA1 49156aa12eada9c9c0d2edf8036f9762e269f7bf
SHA512 b78e8d2badcd19e5a2713ade1fe62bf42bbeda5d05864e93b20464e92aa928d818798412abe53bc71fa8faea702b1fd43bf3c647f4ca82b7f49553c051b4e611
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Yf:A3k03kHRJR
TLSH
T1BB15AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/2224-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5bb-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2cc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2224-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5792-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f6-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c84-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001ba8d-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-446.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000a000000018a55-580.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-672.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-789.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-827.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-858.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-955.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1011.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1054.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1085.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1186.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1308.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1333.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1358.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1406.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5bb-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2cc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f6-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c84-60.dat	aspack_v212_v242
behavioral2/files/0x000200000001ba8d-226.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-264.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-446.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-495.dat	aspack_v212_v242
behavioral2/files/0x000a000000018a55-580.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-623.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-672.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-789.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-827.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-858.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-877.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-955.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1011.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1054.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1085.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1140.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1186.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1308.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1333.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1358.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1384.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1403.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1404.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1405.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1406.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5792	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2224	2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5792	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_2679148175046720e04dcd77e53d3dbc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2224

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 924KB
SHA256 eea9adc93578840e9b3440e50b51ca548365eecac44fddf3f5707e23071e481b
MD5 2679148175046720e04dcd77e53d3dbc
SHA1 49156aa12eada9c9c0d2edf8036f9762e269f7bf
SHA512 b78e8d2badcd19e5a2713ade1fe62bf42bbeda5d05864e93b20464e92aa928d818798412abe53bc71fa8faea702b1fd43bf3c647f4ca82b7f49553c051b4e611
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Yf:A3k03kHRJR
TLSH
T1BB15AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 9340a8237ab2b49ca8de8f8a2f36a278013eb500bb8bea831eead1f162b6d3f7
MD5 10c3e85e22b9552306de5b1e14fbf9a4
SHA1 5bfd429f6df0f03f8c653b18ff2b4bea73c60ca3
SHA512 bce30fdbfb75594b5467d0f764d0edf266d6c5cd7902f00b88fd9cb96939597425fec018132c85880396290647ba7b74bccb23f7cb70d64f3c3ad193c400a261
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YL0Le5ji0hmxNrM:A3k03kHRJtPji0Aj
TLSH
T131658C17F6A402B5D027C0B9C6D6966AEE7138821B3086CF1359C7283F67BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 939KB
SHA256 295d5da289e94da73ecd7ce71222f6aa2dca1e708778a927b0135334c62560ed
MD5 715080a9b9261e90a78e75e9c9e257af
SHA1 59aca0e79ca38275539f755f73736061830d0c9e
SHA512 42cd58ac1e0ea76798e7dfc6971f8c998057ebbdeb311cabede11403c5a4ac96fb7a2c61f936b4d695a5739a427c8b0623080bd1d42aa8eb1e7683d9253157d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YNa:A3k03kHRJ
TLSH
T1B015AE13EB9500E9E10AC1749AD64A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 972KB
SHA256 9238171e19104dc74127402478a3a11586e30f6263c0cb4c81e6fb26c62ed0f3
MD5 dd7ae17d8f73bb288af44c07f3fac505
SHA1 67e8f0c2d9c9b25d73b2631403dd03a53aa12911
SHA512 04862a28fb81fafcd8f5ea391840243664549c8891274facd63fb1616f6f2a2b01ab0730b3d07ef30eb559d192c4f0b67e2eb83f8ba88790286921f4fabced2e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Yub:A3k03kHRJsb
TLSH
T13825AE13EB9500E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 948KB
SHA256 738c1f0346c0b7baeb1608dcbd4962e1da817aa6fc431326172f7d54a9a28dd2
MD5 e3a3d6c6deaedee92e28bcc881bcb913
SHA1 219920491f2e979c4022bc350461ab583a8cc256
SHA512 952356f06c96a504611a551eec768a20bdbba4a3fa066b2b2b0c50e7a02d2b222288287848fe6c96ca3638c4f50080219ec1eb3de36bd83a118af911cc924d5e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YE6:A3k03kHRJJ
TLSH
T1EE25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 948KB
SHA256 bc601deaa16ae20a2184ddccfe7f51f6684b233f580d902d7263db343536da79
MD5 18ffeebd634022e5ffe41be310e36d85
SHA1 fdb8bc6b53a2c382562522df09c71557f160928a
SHA512 865cdb312c8f786bda6410e56fc0837adcdd09e13be090048a5ecbe23a3b8ec7724d749468e2caad1354e37cd3157fb0065012faa0918ee56e8af0676ef9162b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YgN:A3k03kHRJw
TLSH
T1ED25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 948KB
SHA256 384e1a178ab66c0d434f8711633f9fd4def68349068619be845ec197093111d0
MD5 4fc7960c40f90257f0ae556043a1fb1e
SHA1 4ea5bfe3092deec63e1432a13a1f8bb8e2ac7706
SHA512 02ca496d3abced6a8a34abb6349773f128ef9467ef077211e82e89741b8b7fe608b8069250a97b0f07c029a4475cf549183cf972e3621f5c92d15f201071dd30
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YOf:A3k03kHRJo
TLSH
T16A25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 948KB
SHA256 27a775f74706c37ab759d3a85c08bd5e7e9eb1a1cde2f5dc05231c03b0647c6d
MD5 8f65831ac06afad45dcf1569b8963e9f
SHA1 f2385035523af9abb3f0ead915dd41a0ee113189
SHA512 d18a46b3cb482f455d9d5fe77310261359a2e688b06a713cf6dcbac6733e73b196d028d0e41885f78cf96fb05dbb80f3db6566fb557d0ceba27ae9158faf51e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Y4o:A3k03kHRJV
TLSH
T12925AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 948KB
SHA256 6a283d644c8d29daaa21fd604e1e648ceae2b697155379aa7a67a03056d4bb4e
MD5 1bc8f55356817f13e2b1cdecd4e71352
SHA1 e1eb05db50239ea5be78338d770829c9e62f1bc4
SHA512 f6bf1fbf8913e415dce76670ac127cf6e2d7ba36390792ba9405be79d2be4ca090c8ef6bd48eae44b9ce08ebefdeec6078d7f830f3e0bfbd1b29f05b184a08f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YIu:A3k03kHRJX
TLSH
T11825AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 948KB
SHA256 f4d1969c874247a8b24a9a0e827a864396a9b11c302ffdbdedc5406ae4f75221
MD5 1e9c8ed8843115e1db97d2469c850f66
SHA1 137913c5b5c0a55d4228a99f5501a4b5ade4329c
SHA512 6c75741f1bfa310003b1c47e475b3ca2101750f33fabb328996c4b99be91e9f3505972b04ea1a64888a337ada4586ec487df714a1db0fad9f10b61bfd2361789
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Yc9:A3k03kHRJ2
TLSH
T12A25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 948KB
SHA256 68e6af352a822266501f9509520c2aa4ac682a1bbc79273c6724562b16e8ece7
MD5 e3c3e8519c6bf0db4807ca6736b92711
SHA1 af6b8bcf1611d3c480b75755aaaea0423770d6e5
SHA512 da67b7d732273471894efc5f3a42be4467095a36376f50c050b9696b62db9cceeb31fd28c28c103047ead1a17391d9bd46a244cd68adbc009f5c3d5a2c5c8509
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YEc:A3k03kHRJb
TLSH
T1FE25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 948KB
SHA256 ba7beb6bcc78ee8f5df75b8ec2f2f45d53987bad38ba248c5aab7988362df308
MD5 128a1dcede5804a038311a3b4ad509ca
SHA1 aa4446fec056b61f8f68d859d4076af0a8dec3ee
SHA512 2ef40d1c325f90fdacba509060522eceabd4a2c353a7ca9a59cc3292c54337b1ec53bdec307a73c92bdd597cd2e3bce4fccf49ab624433477005c11510287cec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Ydp:A3k03kHRJZ
TLSH
T19E25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 948KB
SHA256 bcd784a15d739f0a5eaaa530a3cd8bef0b60eec95f87e6d91891ccd50161ad0c
MD5 82a84aadb6ac50af66f4f1957250fafa
SHA1 854dff660533baf75fc5b4fde1d9370663b52a03
SHA512 36b04d0603958fafb2cc817f999a091539827fd5919128dee8f55c72938e16a59b0980c0d22e6bfd7c9cc744097a023cb516251649675959aaf5728a3f413715
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YiN:A3k03kHRJC
TLSH
T10225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 948KB
SHA256 10fedd173c2cb69cf7f7e9cf7d27ccb82a0522eb339bbc1d0d540609587dc92d
MD5 6e376ea9bc2024b4ceddec483c823d65
SHA1 f3c6499e10f361bf29405eb8518fba99df4c1611
SHA512 01c3509cab846f6cac4529f705b568f9c456470e3d2bb67fe7e6b6b9eb5bc1c063d5e1190c8c16d6a98570f362e4e4a449d0d8da807e30d34ab54a3447f4a325
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YGF:A3k03kHRJo
TLSH
T11125AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 948KB
SHA256 a913fc483deb62fd3106225ac014d8af7a5a1c2dd6c42df2ea600683f2b617fa
MD5 ef95f42d5778c90a71e3488e6c8cdcf9
SHA1 001fd57b96be936a6364bfd09943863df1cc9f73
SHA512 6f3378d21f2ce51e1f439ddfe7da1659f8e719b6d57717852c019261708d3bf4d2fde912423764835492fd96057881af522f40083fc0df14ae93ec73af325d8c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YTC:A3k03kHRJ8
TLSH
T1C125AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 948KB
SHA256 f879fe96d7ab8b19b5bbc4da479b8a416a1b0b64e9ce28cc8280365f97cfe4f8
MD5 6d2f42384d97bd115b1aa863d3482422
SHA1 ec2a0aac1494227c93d3ea06c80d330d05213a6e
SHA512 9afe3b1e7b82d0fe7502a690977f9ab5056440786c637efdb9e9ca31b7c26ee89b1bdfe11f77b002419ed0ff7439a7774f5c37915450e9f91296488045eee7c3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Ycw:A3k03kHRJx
TLSH
T18225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 948KB
SHA256 caba9e59da6b6e08547fa609ccc13f261a48a4f6c6dc61183042812e78bff99f
MD5 e03859c4950e578c01ff0fe00ef85f2c
SHA1 da01ac64383c94e66e867c11b11fd2f32bdef687
SHA512 92fa65fdd9555d0bf7b20d2386faee9745deb36ce41c54977f14c731610785e97b7dcce0f0c6e48656aa5b27547205e937691c841e03b49501901313ab1690b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YTT:A3k03kHRJl
TLSH
T19C25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 948KB
SHA256 996cffdb1242fed26e9acb4ae3e9f94dcda1e2b8bb8767ae3c41419fe15226ad
MD5 9c2591042da4c15f49f91a48af99d67c
SHA1 db43d78c44c4d6794c435074fc4fe0f9d06010e0
SHA512 d5fedfa3244fae022fc180f90a41d172ec3e37f30175ac9494e7b02a474aab095f9fbd17e10db3f30338b6e15f191b8a214a70f1ddcac99ee1b4a29305e1aab3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Ylu:A3k03kHRJa
TLSH
T11F25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 948KB
SHA256 647186e5c494e0aa1bce1c177bfc13c4b9966ded77265066ad5f3340df28c710
MD5 cb5ee3d4114ae01bca468ac2181bd29d
SHA1 9411221d638de1a3a777e37a9bdb18bd6770bdaf
SHA512 311c65909cee5e59460dba252c15071b084d6a46bbcd911e001e41a965ec7e81256acec7c937ac73a390d86b2287d5ed4791f14f5061a27f85149759fd8821f3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Ytb:A3k03kHRJ7
TLSH
T1AD25AE13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 948KB
SHA256 6b30a355264f435194f809927b796d715c639b728e8c4014a74fbea1a9ec039f
MD5 0fdd03c1453b114ded83b5b29ff9b16d
SHA1 9122d55e5fe0ab78297b02fd440b98c3ae4f7365
SHA512 074e8c0d25300db92e363f8984a15fa75d17c081cecfd06f5d4151138cb206d8c210fd2fe6834b8531176d0d74e87d2851c55e42ae480ef69da3a7ffba227a74
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Ydf:A3k03kHRJD
TLSH
T18225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 948KB
SHA256 c4996175fb87e9f2bbdd4832ffdcee83df49a9d851fdf355f5a19ebf1af99b3b
MD5 b24490b1959c8aa513e79264c657ebc6
SHA1 71ca71e0798edfe5d0af16e68ab43bbe0a7f2ccc
SHA512 f1af6aa540266b6d48aea7eea0e8324cf9583b9e1fc6ef2bdd48a737a888fd363e5dd9aac2e7ce9b7b01f315b385416b77a16d8f1889f912f5a8eabad16d915a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YGK:A3k03kHRJz
TLSH
T14C25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 948KB
SHA256 51b543c88d581c951779e6ca25c31745ae8929408ed767bc4ea66e8f6fa4a362
MD5 93fbe4b2f0fd60e5e64d46e777bbe098
SHA1 ccd38b40eceebfeefcfce57047203c7330035d19
SHA512 baf90d98a5388d3698fe2f9b9327a24d364da418e9506bafdb37069791af0590f9f63a98010e7472855042d4c96d59620d938d0096cc478db68bcb50ccb08f5d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Yzk:A3k03kHRJe
TLSH
T14025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 948KB
SHA256 28c1fea40ff85df2b60c9f3cd5152007524ceff9f5b77344ee48a3a160672d1a
MD5 b230ff0519f2e503843ab9d7a896db7b
SHA1 70b91d149ef2833feb85d71189288747918b6f2a
SHA512 0c51cf2172279e394ccb3e9ff875b46dc17695e6870b8b2e1c2db144a7ab316b5b163bd8bc35caf9bfd707f035122f8dbb9e1f0b0b83cad786879125c7eed68c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YE0:A3k03kHRJD
TLSH
T19225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 948KB
SHA256 bf0d99ed904c95ddf37af31e1c9a1bc82fad552f0a498a014ca413b03dfb5cf3
MD5 30257992950f298cbcf7e9feacf39836
SHA1 4515f117894aff5006fd384330213c45b47b409f
SHA512 72c7136e930deed79f6a202e9e337c145550d6ad1169cee4a929e0b45c953003405d291f56153035e8834768071a6e72aef38ab5285173e54762e7d0354cac37
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Y/g:A3k03kHRJm
TLSH
T13425AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 948KB
SHA256 b030290ca59ac483f0252ba3d5abdbc164565ec752e0a2f0905e9c5e9ea51889
MD5 04b29fe2c86a807d20834f56b5989b8c
SHA1 a26cee58fb1d8f482ea40b44beb47b2ff5504bf8
SHA512 1e4b2eecb089c290bbd1578c4cedd6845af12ef877dfc00a4a570511902f42b19ad1431e2dfab86ae4166d326deb9f472f91b8259307a2a3cdec1cb38d37e231
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YSr:A3k03kHRJo
TLSH
T19225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 948KB
SHA256 ea97aab0b28db55232cb7aefbba37bfc52751f826bcae1c09a3eb3d7f4f569b9
MD5 73735c5ea8574360b87735f5c51c3b5a
SHA1 d6f8ccfc948da2cb973cc89383fae130e2da63fd
SHA512 dffd8a99da03994df6be5738f0fe8eb7ac5b67d725f7d3741df9e7e5bc62cacaabec40dbd67234cbda8da3e3192401db78ff53634179713df9047acd09a07f7c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Ywn:A3k03kHRJK
TLSH
T18D25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 948KB
SHA256 d7fb098b4325ae102f00348e1a4afb88217378e1a88130882e1a4f4caf9f95c6
MD5 6b9e09b50c725fc6e5312eef46a82d5a
SHA1 8b081f10b355a6ae19ff73830e87b6a9b5c44921
SHA512 d8656df152b7feaff7041f2409c41d0a5da9deb258f9b8c64fb7c6a74c9dfed194c9c5a9cb21985febc86967e574e71fa0cd8994f6c0eefe0d2f0e1c7871e5b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YOx:A3k03kHRJo
TLSH
T12725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 948KB
SHA256 bfc087622de8601ca63f2c92b2d035bb751dbbf116de2bd4a6eecd0ccfefbc47
MD5 a10c07795b46eaefa090e80effa190e2
SHA1 750a47de671e2dc3c6599a16d993df7a4b6d0792
SHA512 246247e37c76d5f34422c6916196885bf4495a8e4c271ae147f577c02650f6638228cd5f1b32009b551d178c680e472b13ab945f4c5b32e885567baf5b5fd425
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YoA:A3k03kHRJr
TLSH
T1E725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 948KB
SHA256 8f2d99d5c0bcfed42af3bfbcfe2fe50889e5c2c5e4eb213a01440580672dd46c
MD5 a81c37b76f683656d5c4d8b7cdfc7c27
SHA1 8466d82c264c22ec41ee854b63e4f747289fbb57
SHA512 2590bd29cf58ec3c34392d7d831a50390a632fd078cd03d62ad9be44217328facd46af62b5d6a23776b4a75c27c076f8c3ad575c55cda8a90556c6d3b72a64e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YB9Q:A3k03kHRJm
TLSH
T1BA25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 948KB
SHA256 1798dc39fc79e65fef3b4b150434ba28af3255d422c8170430eb672294bf7c1d
MD5 4cb003c46475a46e2ded37ceb2df4604
SHA1 c530067efb2870682b1f2751b8f807e0bac2fc9a
SHA512 931a28c117c2663db37236bd8cfc5b0029cbed1934368cac7be8f86ad598e7c2f5b79f2cc77510619cdbf28011d3b869162329fe610645c8da8e22b1f21392b3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Y04:A3k03kHRJ1
TLSH
T18A25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 948KB
SHA256 5574af1c3784b7d7e78ed5bdd804f96c3935e1e6d1ab11f9edf97bad31364c45
MD5 e519e4ba513ed323a17f816a1c9d38b4
SHA1 c0d59a6a6502465251fadcde8ff05c1769c3a7f8
SHA512 0051f812cf9eb5dc684146040d3753c964f63586abb22914f4a24ce378cf5921d452e57fc3208d395c28d97e674bf4f91ca37b579a1958c1a8d28e33ac28c571
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Yfu:A3k03kHRJg
TLSH
T1D225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 948KB
SHA256 df5bdabc266d7165ee63e4ec3bca612da7119810eb8489ffed062ca938fa4140
MD5 86904aea71aa009bd784ffc844cc52e3
SHA1 7663d4ad800e02066e4cbd1848ce4f8150fba9a8
SHA512 18e504b015969116f8e11ce2c1661f96b28323d169aef86001742692a5cc2e923f933c48ecbbe20f3e49b9ed16537b62f92d8dfa079e7dcef8f0452a0f0a16a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Y6j:A3k03kHRJ6
TLSH
T1B225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 948KB
SHA256 a15a1c9517aea75f8c1e29d2dea1ae50c0a9cc2720e0817c5bb741345647e0c0
MD5 3f8fe2291afe72b4565798669b8b09a6
SHA1 d8737ae26e47e6768c901698717b911a998985a1
SHA512 bfcc6f757b063fd8be74e02972b8465de45a3673b1fdc38bce4c78f6abc0eecd89335784468f6b217b041a9aec23c0f8ef1abf03f8c341ed10c4b006b530a496
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Yng:A3k03kHRJO
TLSH
T12625AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 948KB
SHA256 c489864d5d86713994294d03e0a1aef1a124327a1eb6c4c8042f7bd82edce56d
MD5 94a6bca65e50e743f68fb6d365c534fa
SHA1 12a2d9d0b3f6a51007d40ec96cd8e457e0738c61
SHA512 cbe7e0059df86ed1370d3054e050f078fdb03ab41334461008dd6f25acc67452cf69ed3916698d8a241d5c944c30842abf3a9bf01442386a37c16ddd5b6624b2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Y6I:A3k03kHRJH
TLSH
T18625AE13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 948KB
SHA256 2991e4139ccfdc2eacd4f08ed02948864771cb5eb47d5bf2c252f4da5c8e9c2e
MD5 1b8825ed30d38647abf4b29a81efbc28
SHA1 c03a6f8a4367ab15cbea5633146a0e981c117759
SHA512 e93012f7eb52e6910c58523f81fe8c0324582cf7a39d39d3b0c41c19458f633b06a2b1250fed4e8b85ffaa0b792028c3f30a8402a6b8060d6891bb9bbe2ed0cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Y4o:A3k03kHRJB
TLSH
T1F325AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 948KB
SHA256 e3994e135da86575a27a64d9495b3f1c2cf84a825feb0f5bc4e27b49ca3d0c65
MD5 4dfc55bbe62a7ec7fbadc8be98c8f966
SHA1 66f2376629a57fd88835f5eaa94bc2468b3d7c08
SHA512 7c75bd731024b36c25919ea99514005d3b6537f447e426cce8a3d60243f2ab530dc76a33201aca757c52f3390ac380f1d43ddab7f32f7ef6ad394b7cd911fc92
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YL+:A3k03kHRJE
TLSH
T19C25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 948KB
SHA256 cede1a598e35fe72b1f2a8323a56cd9b757ae6e3952df07728793ab56d943bab
MD5 736fa04ec02eeb37902947b63a29f7e6
SHA1 bc8adb1db6a515494d67bebfd281b26a575dfee3
SHA512 b40c58556a65201c023e4d23aa6758e234c184042aec3e11018242c02533b917473044f300ba6f43367b6634dfa8971b8fbbac2dc63c0811e2d7a6469ca7d173
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YBQ:A3k03kHRJM
TLSH
T13325AF13EB9504E9D10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 948KB
SHA256 a0300644b854f0fcb8f84bbb80d0dafaab80df2a51842fafd04cc65402b986d7
MD5 d9fadec254a653a3cd60b2c8187e27d8
SHA1 32e76fb2d52f568b5e63d16e864687cba3af567d
SHA512 c0bc7dc8d7eeea764d951bb77b66500a40f9938ce320c7ec8b38ca830e50f9ad7ae990e552683aeb4b66cbbf7e62fcee6ba95ea3fa0ab12d4aaa7dc647489566
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YGX:A3k03kHRJM
TLSH
T17A25AE13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 948KB
SHA256 314270d3040a43a2f120778e916b14f88a64e611db0d5b426d86775997072e55
MD5 805a1c6e00732cb7a33dfadb4e477e5b
SHA1 7c96546877349f92c5ce306577616ac16b68b584
SHA512 92cc4921b5c121a12f6550a3daef95d3217cfac5064db6e5b669b048d2d2172a6a0e4678f7144aa730303e4f31c5b54ed44ade00bc7e3ac5475217833cf29411
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YAL:A3k03kHRJ2
TLSH
T14B25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 948KB
SHA256 3a223c4047086830ea9ab49157ba0482bd75cc6428211a4e796cd8eeae4c4f2b
MD5 f528eae4daca8e0d02301fa82ff48790
SHA1 d07969a054c36f6344a11c82a99fd5f812585e5f
SHA512 650fae279b3892a68960edf09fab211dd331aa777e833c1881819bbcd04054a0ee1f5618d556cc3d5e96835e9940908e9d344b083b43741e33eed436f269290d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0YsM:A3k03kHRJz
TLSH
T1C725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 948KB
SHA256 4880621d54071c6b7271e94151da1752e68f22aac5db7e0c76e32a8b0fad73c9
MD5 6fd93bb97c5508ae5fdfffcb996daa60
SHA1 c9e774bd4b0372f6b8d9e176bd9cb7b058f16a4b
SHA512 96a5d6ee8caee753eeded442154ab646044c6eaaa59d8de1a9c980e07464c6e71c3b4be7d124c17a1cc1605d3e290e28b9340e1c83c8a7e8d537b507e5ff0a55
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JyasyH0Y1h:A3k03kHRJt
TLSH
T14A25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2224-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2224-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5792-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads