57ff6696495cf7bbb1de8f11b49bd998e107f8b4083d4dbca75e775c598599d3

Analysis

max time kernel
100s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 900KB
Sample260831-vtxj5sdp21
SHA256 57ff6696495cf7bbb1de8f11b49bd998e107f8b4083d4dbca75e775c598599d3
MD5 8e48ac090353c1cdbb7a66d1bf12d950
SHA1 62edba40207c3a58717535a199a5f4d54e3ad49c
SHA512 234753809eb862d66f3a8394764df7a2f52f87e2327a2803df3f1756bdb95679c0faeeacbd04e5d84c4ea68d6ab1fdc812e39cc2ddf720ee054d14eaddf2023c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+E:A3k03kHRJARJ6
TLSH
T131159C13F79800E8D15AC2789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4696-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5e3-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4696-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3268-59-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-490.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-564.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-607.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-638.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-866.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-981.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1061.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1117.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1143.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5e3-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-40.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-490.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-564.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-607.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-638.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-866.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-981.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1042.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1061.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1117.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1143.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1174.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1181.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1218.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1321.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1340.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1365.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1372.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1380.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3268	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4696	2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3268	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4696

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 900KB
SHA256 57ff6696495cf7bbb1de8f11b49bd998e107f8b4083d4dbca75e775c598599d3
MD5 8e48ac090353c1cdbb7a66d1bf12d950
SHA1 62edba40207c3a58717535a199a5f4d54e3ad49c
SHA512 234753809eb862d66f3a8394764df7a2f52f87e2327a2803df3f1756bdb95679c0faeeacbd04e5d84c4ea68d6ab1fdc812e39cc2ddf720ee054d14eaddf2023c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+E:A3k03kHRJARJ6
TLSH
T131159C13F79800E8D15AC2789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 829a1294a47172735855c54ab487050bd0ea3a531323d79235aff9dc4451ea8a
MD5 982f89e4bc01d792091415e4671bf210
SHA1 1ef9c0dd15d9fac72cd2a98b524a93f66f87ae85
SHA512 fe05f9f75519f693f2fd84ade74ab39b0eca016ecd68a135ad19ebcca414ac16cf8a76a7eef640bf8069a78a9ac33f5a86860186c3b0f6f48c2e6de80a9673a4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+P0Le5ji0hmxNrM:A3k03kHRJARJ5Pji0Aj
TLSH
T143657C17F6A802B5D067C179C5D29A5AFA72384217309BCF1394C7292F67BE19F3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 915KB
SHA256 e1fce005877332d498bb50bf03a49aad8fbdc785fc89b3c6d59a71cd59ebc236
MD5 9f4a3e0642755911881a6000673bdee9
SHA1 8b7df60432f347ffab68ef6cab2559cb94b7b5b3
SHA512 0663410baa7b84aadead63cd87510a7a13431c38d1eea9d02ade0e3d2be380b7b4341f8718a8c26059c6707bf6ab9e67711d148c0998e551250afedd077306e1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+Ra:A3k03kHRJARJ
TLSH
T133158C13F79800E8D15AC2789AA69A23EB75BC161730A7CF1354D6162F63BD0AF3E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 924KB
SHA256 4a40bc90768ba45ef00ac99daf8b90b0566f6606a599fd7a151bcfd3a7b4eeb7
MD5 99ee6649c91eac6c81546c35542191c0
SHA1 784251c8accbc8860a7a62f9c749b6ce0e05bd02
SHA512 889c6449d1159546fc7cd5fb42666df099a9ea300ee4984a7e606a2424072e2958955f17240db46240cf9e7fe869a9f385b1fa6a69064bc468872cc79e49a1a6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+o6:A3k03kHRJARJF
TLSH
T124159D13F79800E8D15AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 924KB
SHA256 89d6a2df7d6938a615b076b684343a34d9874fa21ce66a7747a2621711ebc9e2
MD5 7cca52d4ea7b071ae645e34e4df11ea5
SHA1 e1743e495af0fd0e8a7c8bb43621d7056064bc9d
SHA512 fca25dc10179f821921a7bd4ea3f85d766e5bf140e1788cc0bb8f589de77e7b90990d25b29c0ece84562f59217307bcf2f8345f59a5b45f76a1310bd747a225c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+sN:A3k03kHRJARJU
TLSH
T152159D13F79800E8D15AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 924KB
SHA256 ba0466cea96d12722310dd86a3974307166d0073ff89853d3adec91829ec97ff
MD5 cc173abc3d5d086aa2200b79eeab50f9
SHA1 66ad59e0a33db65be2b1b94aead5bd65fb55dc22
SHA512 72b1a61901d88b3c8dc737a97a275226985b937456692bb6809aeb42809202b160edc2c5b3ab7ddd188432af1d10a0eebb831a225a270645704b2993c6859dc4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+if:A3k03kHRJARJ0
TLSH
T168159D13F79800E8D15AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 924KB
SHA256 a37ae904f683d102acf3aa2e3cb6d644300b8930a69055cd46222961b8f8743b
MD5 dc499ec35f4d142797bb1a293bc10131
SHA1 4f7de84a73de19e5b31db387b3aa7c677a43d6ca
SHA512 d3a8adb7651404279f36c200d734a9cfe45c325d6274feea2cdc3478608425054792962a1e1dd992dc1afd974403058081f08ab550ed0106a81d77b851d8509d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+8o:A3k03kHRJARJJ
TLSH
T128159D13F79800E8D15AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 924KB
SHA256 0031cd35486926f2098e7c9f14edd38b4383899e49ca9cf4eb4493b7d8ee0790
MD5 edb4a5c9fe1bccf186612cd45bd5035d
SHA1 c693b9a7209669b5af15963cb949c400971357c2
SHA512 8516e0ad76dd11671c1e7e563fd777b1c91dede0d2c389a2ffc64183ca33bafdfbc2344810fd5f551073cfaffd93b1be7a20652218466390c8a71da091a83c47
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+cu:A3k03kHRJARJr
TLSH
T12D159D13F79800E8D15AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 924KB
SHA256 f5f975a7a4e7b6730f8dad9a7dd0802220428d2d7e471f83717fca163beb9366
MD5 40152de445d60f7a95159aa8e51ed610
SHA1 a65bb6e07a6bb0a35051bf4eb4a632f0dea6582d
SHA512 c97ceb01cf823a45e7704a9be4d28dbfd29ae00eb5b0ec11d209c0733dca81e5d9826a4b261eb774386105654d8528bef5bbbba9918481f0f1e94fa452913069
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+g9:A3k03kHRJARJK
TLSH
T1FA159D13F79900E8D14AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 924KB
SHA256 28e160c0aabcd0791669fe1a519206182d2ec32f366ed7205d7f61510c595b89
MD5 8ccaf22a1fb1c53d00fc078d8bebddf9
SHA1 aaa2c710586c4e1ded0970539c9f5deee1faf7d6
SHA512 a7ead2b2f21f7d3d2acaddd94d356879a02e0b8ff6e34b030639f32a0836ea210e859678ef12d2b011e11912130803a556c88fe1d3371b52dbf6d6a3893878b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+oc:A3k03kHRJARJn
TLSH
T1B2159D13F79800E8D15AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 924KB
SHA256 74b7f81165c6b4e83c218831d30cab810f9d72348955dca6a80a91b97264a138
MD5 a35b859d28be98b1816345252888290b
SHA1 a5d6523424f1bb8d990c24e5b16630b533f4573b
SHA512 ed1b7cb12a4ae42ccdf813d41c0df990e92aa2dc9e955bebdc0bb88a03abb779f52203dc2f73dd4ec0f34d088b8f36e74a75242471b69cc443f04bf9b0455ca5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+Bp:A3k03kHRJARJ9
TLSH
T198159D13F79800E8D15AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 924KB
SHA256 b6883cbc0897c5f87b23a716d541d7a9a65ca25a103e070b976966b1d22e6409
MD5 cb17167973d795aac9637e09290cbcf2
SHA1 fb62be83328cdf8510165ff381e256ed243a5449
SHA512 bdd88d5a9b83f896615660f92d1319ad673f42942f51d9047124f4da6e85e370f72302f32fa99e4e570d9a25fb5cecceccc9de570c6b177aa04623eba7269728
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+WN:A3k03kHRJARJG
TLSH
T10B159D13F79800E8D15AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 924KB
SHA256 46bffda44f9ffd07574d26ea75c2cf2bd4fd4b83a8c573822059c14e4fea08d5
MD5 9bf101147cdc0b455a5e51bd0f2a963c
SHA1 becb0599fc52b4ddef45b4213bee46d50761af65
SHA512 f0c15b63ba570cce418688939644f190ba2b48f4ecf47aceddc43d3e008ea5e450277821e62adbab3caafed0c0405d6fec4b0a52de0e92c379292106caad4310
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+aF:A3k03kHRJARJk
TLSH
T1D0159D13F79900E8D14AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 924KB
SHA256 7291d53a7967ddd7e2914d0d90f610c5e6f47981ee3f479e38b6686e907587d7
MD5 9568b8d91905f6881faf9b17ec7047b2
SHA1 9d688f7425e59e554710daf3e69d79ce9af49dab
SHA512 c9ed1308f8a9e7fc0aefbf2e815f456c8846704393dbfcb5f393406502faba1a100b7bb107d2fe3e9e113d560e4f0b02273436a0b53db613af08c3f592b8afe6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+vC:A3k03kHRJARJQ
TLSH
T14B159D13F79900E8D14AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 924KB
SHA256 8580f1b7b8f4f85fa76f50b7ef8976ca16d57796d1990b6cfd62df7273c9d7e6
MD5 d2d3a17b1cd04228dbe5a4a9094b8b2b
SHA1 90a8567d371f97aacff43916314b9f160a5c834a
SHA512 661c8aded33d7438c32a54ff1a4f6dd5a67e2c0148023921a5688675559c326f200441c00dc051e9b2915637f0ec1a7ba4db2082c8541f44c73739065da599a6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+Qw:A3k03kHRJARJt
TLSH
T193159D13F79800E8D15AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 924KB
SHA256 24e199d70d447bdbfd2b4c884ece6ed78014f906fcb10884d0ba0344d97dc128
MD5 2c8b60eb017efd789d6f2965bff8157e
SHA1 a2f922d07a3e6be349b8e7080da29cda49d49745
SHA512 3f58063a1da900a8fed3a7d466db75de0e9b52ce41154193b3c565bd75cf94319d09363c3016ca92a1b0881cffd35add478e0f7db7c1e5a54011192bafb118db
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+vT:A3k03kHRJARJh
TLSH
T196159D13F79800E8D15AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 924KB
SHA256 f23efcfeef18423e753eacea01d38d967b46bb5a38659718f4da1068cab98ff0
MD5 11239cc951f5e4a9c8ba3894b10d14c8
SHA1 5fb498f6cfe2f05f0f470c53ed86119bce6f4b17
SHA512 f4864b9fec8553ef654ab7d449cda979f91bea46c2911bc7df80968c3cd6b6ba65abddf1c30fd0ae5d042efa06567d6adba0f9f36a687e370faae18786c11d9a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+pu:A3k03kHRJARJW
TLSH
T198159D13F79900E8D14AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 924KB
SHA256 3225a754c7c5f7ce7098b5c2433b6df9be2fca4d6954ff0a1009ed3e0ab6fdb9
MD5 fa3a6ed7063c78cb7127b8dbf200dfde
SHA1 b65a2eecd3ea79a2a5ab9df4fba541f4813132a4
SHA512 9ff5dca839611c93b3bff90fc4a5c88f21fe48a3dab8cc18ed3e88860865226b33eef14bb491a4c10459097159a9cec969d1556f6939b267a77808e30de653a9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+hb:A3k03kHRJARJn
TLSH
T182159D13F79800E8D14AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 924KB
SHA256 1d1aa5784d86e9ca1b3823210b265d6ed1c8b993e4a71c8f18c99e90c5fd927f
MD5 043b31e0e8dc1c2e2e0297b0e3e92869
SHA1 6a41fed00a59e5e9ac89f599d3256208cff0f069
SHA512 d99d939a3e42b041fb8f30e4cac7b25c7f1cf6f7a2dfa50d3a890c4063b11cf5fd5da75e033f8a6009d52d0183f9586f2b94f926ff014f52b7e7ef8f64042603
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+pf:A3k03kHRJARJP
TLSH
T1E2159D13F79800E8D15AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 924KB
SHA256 442ce344e434843c278514cba8147832c2784dcf7afd8076259a538096974a37
MD5 811ee4e4a963bd59613d8979747066d5
SHA1 2d43013dd72f96e1b3c9074520605aadfeec64f2
SHA512 d36f10eb8e7db8c05667780c0f121dc42faad416aab7a25c6bac4acb3eca20fa4dc3dcb1073483fc897762f8bffba45e5bee8b8a8e79ea20d58f33b6ed5bdcc2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+SK:A3k03kHRJARJv
TLSH
T198159D13F79800E8D15AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 924KB
SHA256 c1e62956c3107f788927e7e065a986418feb4b6ab71ac381497c61eae512fe90
MD5 7a7d3e068cb79ae0633401b8882fda30
SHA1 c31f9d57692f513cc6535bda777fc4781d309f7f
SHA512 e4839e8be6848ddd865f4dd5a1b22187b0e2c605a5f9cf07145df758cf428353d72ef5d1a31c0c89d36e723fac9673274ea2c39ba8c176fadfe031cf0ea5f3e4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+3k:A3k03kHRJARJ6
TLSH
T173159D13F79900E8D14AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 924KB
SHA256 2cbca340bf9a231042119e3bc8e946d1781950df4143845a1894d1975df2069e
MD5 9365777bb48bc3f3d29079d394e8a6f3
SHA1 2315d0674c5ace517f9fca7766d90fd80f3997b3
SHA512 bdeb1664d8cd214fbc9ceb8516ca65a206b7e893c684c218af105626c89702a45eddb0ec3e70d1f90f0f9e509233aa73bffe4ff19fc0ba02e0c3d5efe0aa12ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+A0:A3k03kHRJARJP
TLSH
T161159D13F79800E8D15AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 924KB
SHA256 f8830c1c85fd1e34e9795b119507fbf1371e534aeb79a89ab06a3900517ae603
MD5 d80026235023eb34e2177d39aca7d953
SHA1 faa9744a94f52f23dda28fac51124b440e64c9db
SHA512 93f24b426208ddab5464da7e5bad01df170dae6152e5b9e776b0a0a752aaf1c23bae9df7cbe46e5d765ff901c395ee031dd13532246d4da3ef51b6c4f3e5569f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+bg:A3k03kHRJARJS
TLSH
T10B159D13F79800E8D14AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 924KB
SHA256 f0c89a572b7c6d22f84257e6a471e77cd27d188dad6b046da7716ac8b4819834
MD5 c4d06be6751149accf25e4f4fdae45d1
SHA1 8020bfad7297be8c8a05171d2ed30007cca561c0
SHA512 9fc4ff411c0d487fcd87d90a66a9ad85a81aa13af63395f22188e56c99e232e43d67d72b36b12a5068f26cb78bcf7ffe09d128a32bb4ff278c4027fe44b3d459
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+Wr:A3k03kHRJARJc
TLSH
T1FC159D13F79800E8D14AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 924KB
SHA256 3220fc8f283835d2630ce8a6d1373c4d4bfe6e3d4e4375c90db22818aa41fd73
MD5 1a3a74af8d46f2daaa01a6a2990d81e7
SHA1 ee138254b8f5ff6f597335d0796d7825316c8275
SHA512 161203c0066556cebe8e520039be5dc472df1e7e69212cf5d5c3543eee8d5b119e3f02fce48e1d7e923a7ebaa2ec599eb7e08fe16343c282fbbce3ec10bfd4c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+8n:A3k03kHRJARJm
TLSH
T125159D13F79900E8D14AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 924KB
SHA256 4ab14eaaafdc2090237d44213914e837a989573832983109730ef47ada0ffdbc
MD5 4788549f480dde7bb703877b587030fc
SHA1 18e86e7ae41605369c8fabe6c7d7965df90d671c
SHA512 69c359f174b365e50ce8188d577d8ddbbf8e4fcac58c67347b2abde410f3501d03370a8c6b09a136d2df308a4620c0bdc85493483f0d4afef1410644243915e7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+6x:A3k03kHRJARJ8
TLSH
T129159D13F79900E8D14AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 924KB
SHA256 aee60ccd873744f7ee176c1b20a3a18ba5cec7593051dda6ecb4252d60d68ea0
MD5 6a36d8c2b0ba5985e221df7104f5cb8f
SHA1 d3a3ceb529a18ac3a018addf5fd0aa1ed6e8f89d
SHA512 1a3b6669dc967f851ca3f96877cc6f040ce13ab9439712a5b5db530ebf44ee560cee017b3b1df628b0f741740589eade74980de8bfd793186f15121ee567fa47
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+8A:A3k03kHRJARJH
TLSH
T150159D13F79800E8D14AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 924KB
SHA256 d50264969063ada4b2a3c0056128bcd2d5254f3e5f7c2f4e2f7cb6716f43dd9c
MD5 8143b1b28842b17a0d9c9627d25e4009
SHA1 b6582fdb967ea54f05a6cb5fea42590dc3af5d72
SHA512 a598319152a8b6095679840484ec622d0d96f17a0ae80c05fb9e5b2c3f04a96589574ef231b209137a39137455f8910ab35ab181893eb24ab8c7b36df789e460
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+l9Q:A3k03kHRJARJq
TLSH
T13B159D13F79900E8D14AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 924KB
SHA256 e02fee9bd49dfafa4ccdb57aa6e52f9c95a07fd6031d8a5f932681109e6ddcb7
MD5 31674554473c29edaec48f2f1f2d2740
SHA1 5e270b97d7fcdf7b2b57c42d3a2961dfe54fc938
SHA512 26230472856071094a2e650403439d5040023f27ef588975d0291145bec8123c38ea3569280c4186807c5ba8c33bb9b3ee84c72e9ea78ccf18d0fcf2f83b65f7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+Q4:A3k03kHRJARJp
TLSH
T1E8159D13F79800E8D15AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 924KB
SHA256 c15c3b360719b01fe032d7c3c5ef3dec3e6285b42f246b8dae5b8aef8c6d465d
MD5 73fececb13d3203d658757bec6137f2f
SHA1 1ee407073ac913757c229d3e694718e7343dec91
SHA512 66525b7a6d9a35460f1df6000e0af7747444afb3365599c593f280c2f0605dc6f38362ba6483092683d9e669ceec3cbf5be7bf08a671c429cd26e871b43b4799
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+Tu:A3k03kHRJARJ0
TLSH
T1C5159D13F79800E8D15AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 924KB
SHA256 0e0c515c9de842577fb924f72f4f03e47be933f39cb3d0cb4fab65345f97ba8f
MD5 e9bc82d3f09d48002ef571ca294cd59e
SHA1 e54f159d62ce0684bcdb73e7c053c089cd1010ed
SHA512 cdcba3f7985ba47c9425e21e618aacaef5dcb5e3e28711e50111a5ab0d5332fd2db42f21ac57b29c062637ceb817ef8092fdd64c18efa6b9fcaec5a778baf2bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+Oj:A3k03kHRJARJW
TLSH
T13C159D13F79900E8D14AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 924KB
SHA256 e4e2b216b43f9c8042ce0b7115665364b80729e74fa06037d079bfcd592da707
MD5 c585d2ee9e71558cbce6826c61b1d5e7
SHA1 87a5e8405e6df79f45f052ffbd87a92203856c54
SHA512 f6262f20e6939e694bb000e531788979c6a31f5fa89c2aa9460287ce7f0a423ceda2e2ee2c7ef1b29c30f0ac57c11ff901d57cd1bc2203270f47f75aef4e9ae8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+7g:A3k03kHRJARJ6
TLSH
T1B8159D13F79800E8D15AC1789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 924KB
SHA256 2b6d9a565d165d2736b2aaaf6cdf8d59d51d3cf1d70ec638d9706adc7932b26e
MD5 729ab01818f30b41550e69d4364f03e6
SHA1 acb34aa8523e0b1181b8a69da8b5029a06972936
SHA512 542e203757a62f7af467d3ce6fad162ac6c685cbbace64339a79569890d9912bc7fbe81d7655c19b3851ad3c6cc511778676715710bcceb2c188447b21cce404
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+mI:A3k03kHRJARJ7
TLSH
T108159D13F79900E8D14AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 924KB
SHA256 578a36a3998638180b6c4b5f0f431d325e8b4e234469acd609e90f8cf4bd5ae8
MD5 cbdecbf42b192c16ca3765ce5c1e1fea
SHA1 5f305852476998fb4b8fbc8d62e5fbe667eb1060
SHA512 cef368de3d1225b22e0ee93f5291463866fdc450a82cff2698665f782772d5f54a12cf9550cb9e55f9ea562a99044de9737189862575b37d52b204ff9eeda056
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+Uo:A3k03kHRJARJF
TLSH
T191159D13F79800E8D15AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 924KB
SHA256 bf3aced2a3b81eebb1f0d06c863d4ffff0ca6519d2e3e75eea7d61bfd9757dc6
MD5 4698ec0a4f6e745e07f99bab328bbb90
SHA1 7b1e0447e9d65d0b15c9f87ee2a47a88506f82c9
SHA512 c0cd22866a2938d2e0ef855055df2ab36f9788d484e8ee00ee746e0ad6030b5534c90d2708e919a1325f253c1d4838c496368f5070abc31ab55b6b5584ee8845
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+3+:A3k03kHRJARJA
TLSH
T1B4159D13F79800E8D15AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 924KB
SHA256 449851b230ab364d6afc51eab2303dde28d013f6c4f744f94188b5fcaac17cd6
MD5 be19839805a407704a7f82104407a73f
SHA1 b13e0a0b48be36687523eb703c6bfcc29a060104
SHA512 a9256f7a106b8e459068b972d255cc299007323b321cf68f34549cb0ec7cded8b2421c4e0c998abed9a3b07d68d02491653afb95d4d0e2552894fefe1d63baee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+NQ:A3k03kHRJARJQ
TLSH
T10A159D13F79900E8D14AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 924KB
SHA256 06a21707b29fae60a1e93239abcbf8b58a4f3543b8653e898e5e1b64ad87fb13
MD5 12ba9174813d59e6ba542c07158aebfd
SHA1 892dcc21102b6629dba6c459bca4fedde5dbbd0f
SHA512 e4ecbd6b573b6fc4a57a350004e539d14045a70d5db71378df3057a5cd9f26500a80e2cb56bbc061b16b1eb0d4624e4a4dd555037a0b22f90eb70d51d090d460
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+CX:A3k03kHRJARJg
TLSH
T17C159D13F79800E8D15AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 924KB
SHA256 4a46a374642ecc35de938a913f66e9d8ad472d56ada3c16cc3e32e3331b07740
MD5 7771f4a6e984d42c4d476c54cc125296
SHA1 e2f3ed61f25f5502cae29f83db78239763a1bed5
SHA512 ae2df624cad6e051e8fd0110a2f6e24a78b345abc9a917094c8e7c99fb662f937828585ff6c40481d20e42a3182e6b9d5c085e4e62a6ad9d8cd2c4e80b93f88e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+kL:A3k03kHRJARJC
TLSH
T120159D13F79900E8D14AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 924KB
SHA256 16353b825f50c3e7ccbfccfdbd4e68c6ce19461acfa5f1f3f59d3be68cdff2ba
MD5 7cf6598d07eec5c9bb844d56f9ee5753
SHA1 45dfdfbaae2eae71c438c310641ee9bfa35fbb7b
SHA512 63a6b51005d9ffe157d0d78f7a25fa217da8fbed37cfccd8b1a5a8e052b68fc2bfb1ad8aac7aaf93d4fc4b8068867a5d950cec6db55740ae390c1c26725832d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+AM:A3k03kHRJARJP
TLSH
T1D1159D13F79800E8D15AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 924KB
SHA256 740b72b852791d9892f663c2f38f867b5aaed92161fb41d2b70d7c3722e8e54f
MD5 5c4a22f5e67351102c72439c1608dabc
SHA1 df9c57aacab051a1238c3c443a180bc96c4bfe12
SHA512 3ce361aa7692480570bb4bfe4238c4c5f5f570ad5b0d88402388f5f492c129998cf5fe8caf899c48f161c1306276c2435151c2080f0ed0a267792ce147c7464a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+hh:A3k03kHRJARJB
TLSH
T117159D13F79900E8D14AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3268-59-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4696-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4696-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads