23e025a4324289497590cff5080674246ac7fe8006c75f4bf7b107a1390f80e0

Analysis

max time kernel
101s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 948KB
Sample260821-w3elcsvgpe
SHA256 23e025a4324289497590cff5080674246ac7fe8006c75f4bf7b107a1390f80e0
MD5 4a7f43d6aa312236d458cf9191ede731
SHA1 2ae67c66134e748f3ea1fa55c5c8646699269d35
SHA512 aeff6b152135f661f7ce91876f87b1914a58194ce48313ea348d5f31f74a0ea04f6f7d3dbae3bdfee2e5ce1a861c39eb4e841d7a674150ed6b8667d664c7bd64
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRb:A3k03kHRJIb
TLSH
T1A425AE13EB9400E9D10AC1749AE58A23EB75BD561770D3DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 42 IoCs

resource	yara_rule
behavioral2/memory/5428-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c511-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5428-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4952-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019840-223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-441.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000018a52-587.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-618.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-703.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1098.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1216.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1319.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 39 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c511-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c2-11.dat	aspack_v212_v242
behavioral2/files/0x0004000000019840-223.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-441.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-496.dat	aspack_v212_v242
behavioral2/files/0x0014000000018a52-587.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-618.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-703.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1098.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1166.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1216.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1319.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1338.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1378.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4952	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5428	2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4952	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_4a7f43d6aa312236d458cf9191ede731_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5428

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 23e025a4324289497590cff5080674246ac7fe8006c75f4bf7b107a1390f80e0
MD5 4a7f43d6aa312236d458cf9191ede731
SHA1 2ae67c66134e748f3ea1fa55c5c8646699269d35
SHA512 aeff6b152135f661f7ce91876f87b1914a58194ce48313ea348d5f31f74a0ea04f6f7d3dbae3bdfee2e5ce1a861c39eb4e841d7a674150ed6b8667d664c7bd64
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRb:A3k03kHRJIb
TLSH
T1A425AE13EB9400E9D10AC1749AE58A23EB75BD561770D3DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 44536f84d2234dfb331f8055963d093ab5ae3081fd483a37d8387d5079a02345
MD5 64fc64185cff4cf5d8a04b79caf30d37
SHA1 a2b8cadb0d3f33b88276c7f2e3f31d9e37555d23
SHA512 5b5470fa4e1680b19b2da2f02dd98c73bc3de869f0c213345d2985c0141c1121b0702482a011a3e2d50be9b5a6634e0c5b3d2a903e5a8469521c11729fcab853
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRH0Le5ji0hmxNrM:A3k03kHRJIHPji0Aj
TLSH
T17D658C17F6A402B5D067C1B8C5E6966AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 972KB
SHA256 19ed76892ae36b888d56ac973bead2ee9697d53c9f3c0ffacf79416d0d1f5ea0
MD5 f2f0505f4b47c885d02955f9259f4f00
SHA1 682e293f900fbe7dec46d2c139063d35f4eb9e9b
SHA512 70b30629f8f72d9e30a3f16aec63e29a4d5c1e29b0ffe0076b23c0e15941ebdb809fbb5dd5a9ed35dc037eb9df42e1b13da3e9808cefd26a225ce7a76d6ff453
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRQ6:A3k03kHRJIP
TLSH
T1BC25AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 972KB
SHA256 bb81f8bc609f24ce4205b0e301543e8aebc1c1d38511c9ce3e8661e988f9037d
MD5 2b2ec7853f2942577b2dfe4005511cbb
SHA1 3ed5723b04d974e71aee7ffb642659148e9eaf14
SHA512 0c3c77bf791573eefef40d237a9b58e14434fe643090b1a22466fe8670ab6a8c865fcf0876762912cef98b7fd4d7dda0ff41290a65dd6c59eeb556dad310c503
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRUN:A3k03kHRJIy
TLSH
T14625AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 972KB
SHA256 59ff3832190b91cb57596e646538a4424caa0a3cc613c3c91b446543fd3606e9
MD5 5390a6e3c09628be204ff3998611f42e
SHA1 20bb67af326ef5911f8fd2efc13fb2486f1d403d
SHA512 2e84e8fdfd7ee3b9eefe7496918cfedda650f2286e7414d2b7df7f95a6e453beba99ea9bce529ddc21fb0d6bca74f4e664728fefd200ae5f210c5dc279e9f9f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQR6f:A3k03kHRJIO
TLSH
T14225AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 972KB
SHA256 fae89600b99df2977ef3d200ca5031a9aa995cc9e5c22313015c7b12f9cea846
MD5 ed8b2533146cbefc716212fa27c2fa8e
SHA1 8dea5573c3c8400a8d619819971aee6c393aff90
SHA512 ebb8bbac188b11277f1717ca0c3fc0259d19b53478a23ba49393bb0a6d54b2f533649f93cd65e9419c914e403bb3aa65f26cab60fe1a8af9fdeb159e784dc2b5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQR0o:A3k03kHRJIv
TLSH
T11125AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 972KB
SHA256 a9500761c6b3080574f5ecd8f4a84f8fe2884fdba31c245701cfaaf95fffebbf
MD5 eab1d51b801f449616f82440fcff476d
SHA1 897534143029beb667d1d90c3f2a9689651a063f
SHA512 bf0d3d275fba264d8805e57b75f1095b15dca3108cb40f7a57f187e498e415e00822a8aee409f9e5367e44664d909cfd69287e7cc4f75bf1b448e5f609c66cc4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRUu:A3k03kHRJIh
TLSH
T16F25AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 972KB
SHA256 c1e0ab69d227de84fa16c62be580de79f6d6935a4729b7012d27e655ddb2380b
MD5 b6c44c61e91b0f64e3c2c5de6dd9170c
SHA1 a817853895c449a800bd969a921d1f60d6b39dff
SHA512 4ee498ad418c32550f477c3832cadd78b1f3b834f25f3728caf62dde23be30f57c1dc30956bea1463a709e7da5f194c5b238b26c114eaf905dc74c80a5dea582
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQR49:A3k03kHRJIc
TLSH
T10925AE13EB9500E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 972KB
SHA256 0c31182c6a4973011e6aab7cfcbf220d3dbe429b7dfb1b04b3703092e02cc9a5
MD5 fc24e359e8c07fb389f88868bcff1f42
SHA1 5d4b24930f3599f4ec83f962c1a4e58372c405fb
SHA512 b25f7086684b572327c42fa8750a9b9bec19409217c2b6a3c239097be92ec60043f79e66cf2b7a9480434fbd015125d24d4c4368107d6bb79c7db1951dd983a3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRgc:A3k03kHRJIV
TLSH
T17625AE13EB9400E9D10AC174AAE58623EB75BD561760D3DF2358C6152F62BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 972KB
SHA256 f80cba2a4bcba947dba7378c3884f5dbb83b07d4a1015e06beddd09c4c943d84
MD5 a91ded0b521615d2d436efb6758ee9ad
SHA1 fcfb3c2051216ada0172f83933de7ba4134061b0
SHA512 600c5a7b579fc04a01949c092524db3e768ad54d65bda5d83dee37135260a81cf13b8363bb270d86c41e9b04f23b882f01da5532fec00487a4475481a5393a22
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRJp:A3k03kHRJIb
TLSH
T13025AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 972KB
SHA256 27dfe89589403f755bbddea797dcd691ef30e07a2b8e6945c7ffcb841361409f
MD5 3b796796ad5a6132dae175b6aacb8de8
SHA1 7fa97d5332ebbc877502948fde87e7dddb731b11
SHA512 f3eb2156108d2a8f266257e4704d1b8bd8b81ba760d3ca4bc0831628d114d2eec6dd383b4d39094dabc38ab12fad0825c9ad182b929f25fc223fb1dbe7410148
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRON:A3k03kHRJIg
TLSH
T1CD25AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 972KB
SHA256 1b6c814ce3f057783a7517cb838f3ba924470e8196261f5b10b085e72155f541
MD5 ca8801e64a40cdaab60ce69e070a4f86
SHA1 2c9f090f4c836947905986f4c39ecd11b9bc171c
SHA512 2a218b6c1856eaba525336bd760ab7ddc7bcb5ab5f61b6b3e56c8953f4c576d73fee592a12abc57d2ed3a38f677c8d87a3d608a2d43c76b76aa6995a6d5c8649
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRyF:A3k03kHRJIW
TLSH
T13B25AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 972KB
SHA256 0abb7123e5d6e7f47b7ec3d87efc77edcea95ec147d97253e4b5b69f23aa355f
MD5 7eee281afe0d2d362146ed9d294192c5
SHA1 82c6ed4769d70188062b45cc129f7ad2fbba1a98
SHA512 bc63824dcd25a5bafdf1fe16002cad66eaa4ac6013350da93c3f7dfedacc55e4bb0b6a4f157cb5e893a71f339ae3393b8bd8cf3be22016ddf9146c418a54ca22
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQR3C:A3k03kHRJIS
TLSH
T10025AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 972KB
SHA256 3d17dc693a91ae81d047bbc0c6c7c0c2742433e805774d53bc6a20376ea3877f
MD5 4a0ad33a6ba0cf230f3e5a6f0b4dcd0f
SHA1 a2507b98e512c2b77749b777c3588d2ee0ef5a0a
SHA512 74b0f2738a2f8a9a003f104538010c5251db39df179cee701dda77f496f0dd88a7b18271ba6d2793f289168b66302b0b6e02740e192c7dde3b2ad762b03f3e45
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQR4w:A3k03kHRJIn
TLSH
T13325AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 972KB
SHA256 86973b1d746a2321231504d5274b92fa9bd7b0e35b6478d59ef1dc73a701a537
MD5 cf73bb0f0ce7da25ff3ee9093ca529c7
SHA1 99bd5ed601e50f1b2923c46a57d79dc49e7bd5bd
SHA512 8354d3c1aa863777013fc4901de6517ed490c4365a94a8b135b3e1ff9455bfb3621c8620505c49a4b91a8d357a6808a7559b54c89daed0e98452f1dadaaaaba8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRXT:A3k03kHRJIj
TLSH
T14125AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 972KB
SHA256 68de9c0c6536ad66c2f66928bee21ae57424579bba5ce251b7147c6abb4b9150
MD5 fe612ecab195e43a79dffebfcb3c3c06
SHA1 95fa6b388828ad1d3fe2355062f50031bc36394a
SHA512 7fbdcb6bcc2f61d191dcef7c59abb133597ae0e704514bc2494e47dce335871c024bbd44379a6117e2a007fab1e75806122a966a6249c96a9b31d6959ccf4f89
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRhu:A3k03kHRJIU
TLSH
T17B25AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 972KB
SHA256 d7b6698144217c89f16cb96f7825946aaa357c760759fd8cb7ea25eaa074c5e9
MD5 520b4fb818d78ed00acf94c3e6488e7f
SHA1 5aa3100c834924b36a992410e227382c7b67570e
SHA512 c3db580eeaf833e96185e5e00e7e52de9a757eff65716d2b8358c03629b1b56761e5380c9e1ab3c9c57eae01f424075d113c7e46a738cd5970d1d6c115450d6d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRJb:A3k03kHRJI9
TLSH
T1DE25AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 972KB
SHA256 8df05962edee6f14eafa5b5c89c3ee0d7caf49f4e1d5c9b575481ee2115701ac
MD5 1231bc7be579771a0d2bfbf252f00518
SHA1 57634b4ae24cb36da08a5b72b1d6ac4e07c4acb8
SHA512 8dfd80dab4ccacea1a6a6096151ec1377b22c1475548bd0232165f284086e37b0cf28f65f84cf4bf9175ed0cbed1f4bd4e3333101d6d0ea7fffc8c4e329f7847
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRxf:A3k03kHRJIt
TLSH
T10E25AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 972KB
SHA256 f93fb5801f0f87fb8d799cf39b117d8fabbe7a6521bd036e979a74ce88f7d48e
MD5 eda23b8f2445bc100f6cdcdba04979aa
SHA1 e500cf62696dbfdc18afdb0977f8a62fff5e944f
SHA512 688f5dd1962df92d20c6c257dc4a2554421882c89e077159ac71fb3a2266e05aa713b6ae0c340fa62dd8f56a510868b04cb207f82c6697cae6f0fce10b4f0b0d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRaK:A3k03kHRJIl
TLSH
T18725AE13EB9400E9D10AC174AAE58623EB75BD561760D3DF2358C6152F62BC0BF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 972KB
SHA256 7b982d0e156e42a438b06cca30cbc29f0d070716c161d0ec68b82fc054f768f4
MD5 dff399c8fd9acf05c9a99f29316b40bf
SHA1 5af11231a121d2d22608652363569b790a915497
SHA512 072ba8940f2ec0e97166e84e451a373d91877e8b1babd1478169fed38ab3ddbb8e3b194dd789b2ea17f32fec6060a82d8db7176f9900cbb6ca8595b425c642ed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRPk:A3k03kHRJIM
TLSH
T1F925AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C2152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 972KB
SHA256 c329ec8fc3bafb4d0abc2df54049174c2c7c3426592897d9acf18321d54ac9eb
MD5 d2fbf8190f46435ac458cc0b634bf584
SHA1 101b598298d3915d8718d5ebeaa26a9bc50e5f23
SHA512 7e7c7968f7055efbffbdbd6c8245ba255743bff5cf7555c5e460d443c9cca743ad67d61cc17980f12340fa9eff8b3b594976ba9739741457bece9dd7ab547830
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRI0:A3k03kHRJIl
TLSH
T1FD25AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 972KB
SHA256 baaaa076b2937556f60497465b75545ae400157f223a4e70e1de4256bde7b4c6
MD5 f3c6207e7563d736224cb43b8f9ceb38
SHA1 95c7aa38fdcf76516b8ebda7c4e02e39bb398496
SHA512 f7181f4e0aee323648dd964ed78870d76a16a235db4bbc8128fc3a4174eee9757465013ddfefd104a79cdaa37a9d832db0ec8f2c7e4171a5889b8d3eb12f2475
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRjg:A3k03kHRJIE
TLSH
T1DB25AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 972KB
SHA256 fea53584818788c35a5afd66333cca6ad7967ba4c37c05dd03816f3f47980246
MD5 b001e633049d88ab7ade71e792445c66
SHA1 c24783966b9011c27f9732010f481dd6c0157f5c
SHA512 32907f6e421a9efc31cb67e1cfc141ce648568e278136b120d5ef878b86d1afbfee95188e572b3e289e0cae6d542ea7ce90f9d7bbf365def0cbe2b5b3e9c15a2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRer:A3k03kHRJIW
TLSH
T13425AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 972KB
SHA256 952d0cc5d31e245b2f662583ed1b4100a558679c75dc517eeed194ecc43ca1ad
MD5 13d925a515b53e8a66d4b8a63b1ec258
SHA1 48973d37ba34467e7bb4e638941d660625825729
SHA512 92f305c5395f45111f34964bc2e8e47a9355650dbdddc8c4b2906b19b74c60290b96a93d3f45ebc90bc16b394c8fed1f68324ec7f75d3f4450f1298f9f2b8249
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQREn:A3k03kHRJIQ
TLSH
T10E25AE13EB9400E9D10AC174AAE58623EB75BD561760D3DF2358C6152F62BC0BF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 972KB
SHA256 cf04eac56276c64c42af8d7a596e10bea912a11692162f649894c93c3e878368
MD5 ece1c730d446a04afa29bbae749e8097
SHA1 0b1f626f1efe6035b4f20e1ee4e4e7414e07527b
SHA512 e2f7a3515ab66bdd3cf1a8a5051c8d0636700a0006ff09fa7ccf4312b70197e16d13283076372b0859a959e89dfea01d158591748ff5a643ff9ff7ae17cc623d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRSx:A3k03kHRJI2
TLSH
T10B25AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 972KB
SHA256 dbf5820bcb03c73a0a93fc284c892283895b6ac38b7f4e9e4cf96cac2716925b
MD5 d3ab07c52b06d9f2f15fa0ef743113ee
SHA1 7f3ae3fbfe33781d04ed8568e6c6406803aefe99
SHA512 ebeea6b7dea83031e39d2ec09bd521bc04b78b8b6bdd6a465a1d6f67c921fb295273aaabd2a421a4fb63d6ac312bb4667dc0bb2be5b2b2d6ee1b5fa6b1754105
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRkA:A3k03kHRJIt
TLSH
T17A25AE13EB9500E9D10AC174AAE58A23EB75BD561760D3DF2358C2152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 972KB
SHA256 c90bde16d9268a6c0d6fe9b8b5436b9c9a30410e7d4f991d92ace5b684f71676
MD5 2c12bf2988ec9412891db58d3c6bacc7
SHA1 8e3b8343b77f3591697ada14e3e23f7712b01ffc
SHA512 a750e92c679cac818dbf8a9e16ecce4971cc3f960d8e7f537ffc9691aa4b3d4d52ecf092a772b8aeb562e97a8765ce325226f9fa2aa9507d93e60a83bca0e5cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRN9Q:A3k03kHRJI8
TLSH
T11C25AF13EB9500E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 972KB
SHA256 b52ca6bcb4148f079630ce334c55584fe68d15790e6f169d829d9826c5143a25
MD5 0d0bb50e5a2471f61615af0d3ffda5b5
SHA1 0a78b0b4974dab7dff9c916b5b9a37a8088e166f
SHA512 b7e9297b2091ba2d89c9c0f910e1e097b588d06230b9a26add5f53c5adf048276cbb8e2849a82b96511466bdcbdc9775f976e79cf2918c4279a7cc1f02640a19
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRo4:A3k03kHRJIX
TLSH
T16A25AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 972KB
SHA256 05c927000bfd3fc425d463b03391efe9cd750b0134935add1dc8053ee94cfa05
MD5 f5dbf155175fbb6be35094d55c855a60
SHA1 a1dc9ab6fccfb3be7171f38caecc3f353dbae60e
SHA512 c76926cbcee80c994e388710f280f9c00bf265be1f281f6e5032a54ae5adb56968a177487321cd17ecc68eb515fc23306090f15c8701e607e202949d1ef0914e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQR7u:A3k03kHRJIa
TLSH
T1D525AE13EB9400E9D10AC174AAE58A23EB75BD561760D3DF2358C6152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 972KB
SHA256 47176ca981469d1635260fefc58882d30c2b94cfe0d30e31125ff409b04b82f7
MD5 0183026a50b649bf74ed5ad5e1c285b2
SHA1 d6b922c731d9a5d5cb81da419a7a962cae2261b7
SHA512 54076ae90d5c0477890b0ccd5935f2ed4ad67388e02f894b22412d11c7e2fbbdff466313ae4d39d2c8b096c6b14aaa156a88043c1d67ba1c22cc2854b1a74958
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQR2j:A3k03kHRJI0
TLSH
T14225AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 972KB
SHA256 cd888d4297ec7225e8314ffed04d7cae36c7bd7c452d62963ae72cab4ff76d58
MD5 189d73d75364da3fd3c34b8a10bffc9e
SHA1 727b5ffa04212e6ad37410c42cb401d75ff35243
SHA512 1547ca936b481f2843088ef3a466f1dfd3b77e056f7c030b99a7b972fc9e37f0049f301bfc4b6859d8880b162772a06fc8aae36c2ef9911ca93c6bd3b210251f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRjg:A3k03kHRJI8
TLSH
T11825AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 972KB
SHA256 8cc650abcc4563a33c76e71086a935f5f5259bae19e554d2b44bd4fa9c3c06c0
MD5 8382a10f9d1cab90c98767f6e53244fb
SHA1 09b5381a6e48b4def2d34df4b01fa9aa16f1dfe4
SHA512 e9fff0f69d5cddd1c2d59ef23974ecc24fd1df6241ccd304d843e7ce43471e2fd838663850c810c1401b9d0f1d99374de8a1a4b0c2a30e8fff72c0b4a3716fe9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQReI:A3k03kHRJIV
TLSH
T16F25AE13EB9400E9D10AC174AAE58623EB75BD561760D3DF2358C6152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 972KB
SHA256 0b0d388879a7bf88c338823f6b8f26a1e5e2cb0293ddb070b12bc175354b7221
MD5 90b5671a5d21dbb923e6d131d8f363cc
SHA1 0b9201fd07668a24c9f06c27d66b5886a9303521
SHA512 1915c12d20441bbd291ebb6ec317392dda7326a9080230380e59f9b004f68a50ac32eade9c9fcc78624bac1bb7edfdbf4bd8d86d9ecb37230b3fbc0b493e4c02
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRso:A3k03kHRJID
TLSH
T19025AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 972KB
SHA256 0d343936909bb780c145c69b193906aa33a44807b49bfb1f134dec308c50c211
MD5 2c4633218e5952d55def6be286e24576
SHA1 a5507e346871508fb33c49ecfc3a91e69501dd41
SHA512 a3b86729e7219bc48d052dfb781f9f614d8c888b1a4570dce277af5867b1843dd902cb9e973e2eb9df515e33a68da9d8718b66392b42e56bec772acd8542c423
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRv+:A3k03kHRJIG
TLSH
T1E125AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 972KB
SHA256 ec38b4a7de54cbb5feaf0390b469dec62dfbd431dab24db53565f43183b07e55
MD5 ed2864e6eda6c5184c61619cf6afaea0
SHA1 fe429a8441f8cef82664e79355e5801616a4bb39
SHA512 7781ae49751149b7dca5adc4b39f03f72fed37c80f9b5a1d9a82ff03ca389ad473e2a2f01d046176bbecb071d00065691cdb4c91280fcc0958adb6ef35afbeee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRFQ:A3k03kHRJIC
TLSH
T1FF25AE13EB9500E9D10AC174AAE58A23EB75BD561760D3DF2358C2152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 972KB
SHA256 247810108da5ddce30b44ac11b6394d01db25b536e56c01bbf58d34534ef3c3e
MD5 9dbcf6dcb231bf9aa52f6ccbccc20ec8
SHA1 4884f7e28fdc5e5bd11b71d4d1a64a635c713f94
SHA512 429635162360fbd58856a541678b31499426e236677018955ef06a2b884db09e0598dce77312be39f4431c44f2cc5df5ec50bf790a08fb325071ec906d73523f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRKX:A3k03kHRJIS
TLSH
T1D625AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 972KB
SHA256 14d380ed68faad592349b62ed0b5f9cd33037097fcc0929fabc61ca08fce7af1
MD5 24c04536726366414a718268f754bc0f
SHA1 39827355918afdfdcc4496d6500e04e7b2ed249f
SHA512 31f3d18a557cc93cb27d0154a00d5831886386bca0a58f628b442055fbf102e1059d41b21fbfeddf6c9972c1271d4534951bd32d31d15b2dee6dba90bc58075e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRsL:A3k03kHRJI8
TLSH
T17725AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 972KB
SHA256 244924458b399df06b629706bd29adb0d28bc4b2f720da6f04f036f340f005d1
MD5 db06aa440bb9a7a55c015c4c2b309e9a
SHA1 65b4dd04606122b01cbbfa1b0c221836fc282f9b
SHA512 d3b4e624c008c357c2d9523f97a06df169fb3bca1ecd2b74be3cfb469918064c786b6e29774c499585197baac86c695cc7b3958f2cef3cf8fc78fb5f245636f8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRoM:A3k03kHRJIN
TLSH
T1F325AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 972KB
SHA256 8aeb59e369ee61915a32284a6f103c82f912183071f12b93ed6666d51dd0d6da
MD5 8194ecdd5502bcc31ed766e23d54eb9f
SHA1 82effd4bae94e5a269ce630e04a442bac22d50b7
SHA512 b81b61e1d03b34670f7f8a75f33c21a7ce3f9bdb1f475f9792516b89a539153a6fa536c538905be3d70133deea6bf9bd3dc2b13f593e5ed92adc046c5d22f928
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvONaQRJh:A3k03kHRJIn
TLSH
T14C25AE13EB9400E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4952-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5428-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5428-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads