f381479cb90bdd63cbcdab9fc8e663272c9880b8f61827eb1874f87e8c48d093

Analysis

max time kernel
107s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 2.9MB
Sample260821-ppv8mabd92
SHA256 f381479cb90bdd63cbcdab9fc8e663272c9880b8f61827eb1874f87e8c48d093
MD5 f16ba09e4fec4ed9d1ab0532f8b35baf
SHA1 f71866d4fc23bf29cc3f219a27f9cf51b6289218
SHA512 b712e27c780f97ec325594ea67c116124c5f0b0da69129d72c6b0dfddd88a93ba0209f2764b7c94af10ea2514ab0c046e676d3619dd4c5a901d8ad5c6b85420e
SSDEEP 49152:A3k03kHRJoeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rX:A3k03kHR6fkZcNfkZcBrX
TLSH
T1BBE52916F5788722D0BBC075C6D66A59FA3338451F7086CB0289DB3C2F277E1963972A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 9 IoCs

resource	yara_rule
behavioral2/memory/2340-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c48c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c2-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2340-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4936-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4a0-524.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001aa87-961.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019c95-1282.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c48c-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c2-12.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-368.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4a0-524.dat	aspack_v212_v242
behavioral2/files/0x000300000001aa87-961.dat	aspack_v212_v242
behavioral2/files/0x0004000000019c95-1282.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4936	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2340	2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
4936	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_f16ba09e4fec4ed9d1ab0532f8b35baf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2340

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 2.9MB
SHA256 f381479cb90bdd63cbcdab9fc8e663272c9880b8f61827eb1874f87e8c48d093
MD5 f16ba09e4fec4ed9d1ab0532f8b35baf
SHA1 f71866d4fc23bf29cc3f219a27f9cf51b6289218
SHA512 b712e27c780f97ec325594ea67c116124c5f0b0da69129d72c6b0dfddd88a93ba0209f2764b7c94af10ea2514ab0c046e676d3619dd4c5a901d8ad5c6b85420e
SSDEEP 49152:A3k03kHRJoeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rX:A3k03kHR6fkZcNfkZcBrX
TLSH
T1BBE52916F5788722D0BBC075C6D66A59FA3338451F7086CB0289DB3C2F277E1963972A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 3.5MB
SHA256 30f8b6e3fbf01ff73da2d43377cb2c16e8a60f6502a258191e9f1f02edc0a1a8
MD5 f78b4d63d6e3aa34c6474bd2a07f9dc8
SHA1 e4dac6bc97984b6ff78985d4fdc54f8d231e79dc
SHA512 c9c39bdbbe541ccf6d52650fdd2ca85d2f1cb0aedee792c19653552b8e8fd2462190fbb7d33f3cd335c5489fdb25b23b8df39f9f84966659ea62694ef6d663ab
SSDEEP 49152:A3k03kHRJoeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rTPji0Aj:A3k03kHR6fkZcNfkZcBrLjo
TLSH
T131F52A16F5788722D07BC079C6D6AA59FA3338450B7086CB0289DB3C2F277E59639736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe$

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe$
Size 2.9MB
SHA256 7ddfc6504f1371a873b9e5978a4131f79968114b70682fe0111260b170ab70ed
MD5 45582a709cb043b0bb6848fee3a46fd6
SHA1 ecf981f7691028c522710f186ec1a57ae2a2c355
SHA512 7957887b40c1152a35cd5577454d819be4161149d2d05873462f862f05522703eefbb5bf99d824283c31c8588e8dc63d0ea657e12374b70b8d00d8bb0e334c3c
SSDEEP 49152:A3k03kHRJoeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rp:A3k03kHR6fkZcNfkZcBrp
TLSH
T154E52916F5788722D0BBC075C6D66A59FA3338451F7086CB0289DB3C2F277E1963972A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
Size 2.9MB
SHA256 1d1dc579acac05ac1e3d1ac2114552927a4c54a0123faba6cf8290b36f44f33d
MD5 a8cd3a2e88996093c6fab509eb5e100a
SHA1 35acb2514af8371a3f356c0227d35a2c394bd0cd
SHA512 02af23e9d61232d2ca7339a6fd3320e0eab6cc6b84cb86828e2f90343b98935b0dc21f596b3db40a960d98b52873f7fe9f681c5090024886de97e0757c8d590a
SSDEEP 49152:A3k03kHRJoeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rp:A3k03kHR6fkZcNfkZcBrp
TLSH
T1B1E52916F5788722D0BBC075C6D66A59FA3338451F7086CB0289DB3C2F277E1963972A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocolhandler.exe

Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
Size 3.7MB
SHA256 92084272506aeee779e403f86a0c3ee8ad80d26ff699275f2c590565cbd0e6e5
MD5 7864c05aa3ba63de35370f2fd1166d99
SHA1 591a8e0c99e36d3f97882ce0db03d2b4bcfec56d
SHA512 cbd80c7f719c96c7c378af31c4803f2af10f249ac80762a917eab0d2be4dfff30c7d3de906d5321016009a06e1569d1762c0ad5c9e435338796625f3e051b9eb
SSDEEP 49152:A3k03kHRJoeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56r2uygmUSbHDUnT:A3k03kHR6fkZcNfkZcBraUEW
TLSH
T173063A16F6B84762E0BBD075C6E69665FA3338460F3086CB0284D73D2F276D19A39736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe$

Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
Size 3.4MB
SHA256 e6a3073f89b2ff2d0b98766f9f9c4eb1e66b2e83b136e3b09b2a050f28b98446
MD5 a021a54b57c0c804a3315321606411ed
SHA1 a107a19d49f03fc1078897b84518824ea30eec7b
SHA512 e2d69daf4f0e293ba7f598fcc9f1f26b061ca3e15b7b138b89bbadfc3d92b7c0be23c8ee3dc4e4d2a751651845b4f970253c2d758cef00dace93a80791d944c4
SSDEEP 49152:A3k03kHRJoeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rZi6:A3k03kHR6fkZcNfkZcBrZi6
TLSH
T18CF50856F7688F32F06AC074C6966669F9333C090BE146C7028DEB2C2F366D595F9326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2340-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2340-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4936-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads