fd45cf1db0ff647aa639df39770559905fe6d8aec060442136e96f24b8aecffe

Analysis

max time kernel
100s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_641303ec47e5632d33a537e3ed03425a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 948KB
Sample260907-ynqfesvcqa
SHA256 fd45cf1db0ff647aa639df39770559905fe6d8aec060442136e96f24b8aecffe
MD5 641303ec47e5632d33a537e3ed03425a
SHA1 269958d9523656d248c2c9c4466038c9ffedf107
SHA512 cc578e5dd02df63d182fb0d75f6f75963a1331675bc9dea85559a2f1e1acf32af9f7959107c85b41bc0089f305faa5b559ddaa6f00c613ec7c569c022c07e27f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvO:A3k03kHRJARJR
TLSH
T1A5259D17F79900E8D10AC1789AA69A22FB757C561730A7CF2354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 42 IoCs

resource	yara_rule
behavioral2/memory/4920-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c55a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b301-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1300-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4920-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a65-223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a66-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-441.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018989-587.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-618.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-685.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-923.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-973.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1029.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1122.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1216.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1325.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 39 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c55a-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b301-11.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a65-223.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a66-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-441.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-496.dat	aspack_v212_v242
behavioral2/files/0x0004000000018989-587.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-618.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-685.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-923.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-973.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1029.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1060.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1122.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1147.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1216.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1325.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1338.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1377.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1300	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-09-05_641303ec47e5632d33a537e3ed03425a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-09-05_641303ec47e5632d33a537e3ed03425a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	2026-09-05_641303ec47e5632d33a537e3ed03425a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-05_641303ec47e5632d33a537e3ed03425a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-05_641303ec47e5632d33a537e3ed03425a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	2026-09-05_641303ec47e5632d33a537e3ed03425a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-05_641303ec47e5632d33a537e3ed03425a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-09-05_641303ec47e5632d33a537e3ed03425a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_641303ec47e5632d33a537e3ed03425a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-09-05_641303ec47e5632d33a537e3ed03425a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4920	2026-09-05_641303ec47e5632d33a537e3ed03425a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1300	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-05_641303ec47e5632d33a537e3ed03425a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_641303ec47e5632d33a537e3ed03425a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4920

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 fd45cf1db0ff647aa639df39770559905fe6d8aec060442136e96f24b8aecffe
MD5 641303ec47e5632d33a537e3ed03425a
SHA1 269958d9523656d248c2c9c4466038c9ffedf107
SHA512 cc578e5dd02df63d182fb0d75f6f75963a1331675bc9dea85559a2f1e1acf32af9f7959107c85b41bc0089f305faa5b559ddaa6f00c613ec7c569c022c07e27f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvO:A3k03kHRJARJR
TLSH
T1A5259D17F79900E8D10AC1789AA69A22FB757C561730A7CF2354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 1d8ffd121e264ce078bbd8db3b674cc9a5745014e221f1d86f0a47f83bb57ded
MD5 a9c1a2dc42e802beccacbbc0db50113b
SHA1 24f4a337f7549a85e22e879e0ec97c9880346497
SHA512 2f3610fc4f144eda2681e62e546d51618b1bbee0b9facff704d33d0aff162d77a8d777d19a0a45d39f1fa9656db56bea1635ea8528e7847bf531166bfe9cf84d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvh0Le5ji0hmxNrM:A3k03kHRJARJKPji0Aj
TLSH
T199657C17F6A802B5D067C0B8C9D29A5AEA713842173097CF1395C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 972KB
SHA256 577e652b8f58df6f1cb1ea0960f4819cfd3b45734dba36902719c645ac3f3e68
MD5 e514a1ce40172cfdb98835d4d5c349c6
SHA1 00b4b35dbff691c38fb855211f2edc34a40dbdd6
SHA512 95a4e3cbc37c68039995dc407ebaf424f3b26a8f768a0f0176e53a2c435731ac2e9b0f301153f6cc23fcc0197411f6c6342acd71ca736f93cb5fd7b5ed2f9b33
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvC6:A3k03kHRJARJU
TLSH
T19A259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 972KB
SHA256 5838c2522f0e3ddf7af712df5e73b44873d4f02b80c67b8e739d67cb1c30449c
MD5 ef279ce1d3a98730a3af191b9aafc2a8
SHA1 e07fcf35b0c38411893aa70fd54491dc87f095f6
SHA512 f4f5927ab2973cca54d1cf62deb6469506e50f68612fe82ec957f7ddc2a635dc60895b17d39743d881ab7a5f6e88d4577b79ee2d107144a7f971ed0c406aba85
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvaN:A3k03kHRJARJp
TLSH
T166259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 972KB
SHA256 e698cc304ab3ee860d8ca407eafd4c55bb12244c66ec21f3f5bc70b86cd5d705
MD5 72a5fab2f5c01e9e0776fe040d3f49d0
SHA1 a69c0ba36692f464e4202a9eae6357d7de9ecd83
SHA512 866f28d92f1f86dcbd4f48495c2a45dced1fa186aae7a530caaf114ef2fb0f29b7bedca8c0ab35ef547e7c4e97f222e03a00287891175ad4ea2d768a9ee68fd4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvAf:A3k03kHRJARJp
TLSH
T133259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 972KB
SHA256 2d71ef8a0a306a2ce8c82b8618268838591f6ae9a2813e63854a1fec397aa259
MD5 95d942e726b7c656a0eb421daef7f9f2
SHA1 bd82d0a126b3005df2b5ea323fb78c0e4fd61858
SHA512 1ba5525a49732c4cfdea9b3bdfc9d2e66ae4f85e03abbbebb2ecda69ce1ab394c2293e9efd596c93dd154b6c5a1c79bc5c894cebf595c7f770c45626bd72b5f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvao:A3k03kHRJARJc
TLSH
T1AC259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 972KB
SHA256 27df688ab2c6899ae268446ac3089a8d72d56dc0031dd927bc4ea1d0734b9356
MD5 11cb96730ad978dd8c01c65cc53116ca
SHA1 433d5f171ab6431030b4aebd61a78023438ee065
SHA512 cba5d162dc5aae72a303377fb5a09e10e96acaa2be4876773e24d679e01bf883c4d36f650c0ce0b2acd120ec2eb8f6caf11a0127a38d04c0a5bd45f064a1d5c4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvuu:A3k03kHRJARJe
TLSH
T1B1259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 972KB
SHA256 f5ecd43a2908e691c876852b9bea73f5e92c6bcf10492782f0190b05932cebc6
MD5 58764fdf84febd7d9c2325abdc9de064
SHA1 fb2e631808e9cadd95379d2769c771e7123330b7
SHA512 16971544d3edea6f4ed41520fa9869a2b7e0ac0b3de3137cda353b0545cdf50baef367b73a3982046463573885ee7ce978a344e326b96d93dc325485488fa7c3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvi9:A3k03kHRJARJf
TLSH
T10E259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 972KB
SHA256 f248ec5465017b641a935e443ce326d7a2e3a122c9301c3665482a2483da07dd
MD5 f22e71f05ca25c37bd1754f4757f314a
SHA1 76423d210548c555afa361a4b1b562569251ec0f
SHA512 ef387f2d02718c3c1ca945ce595b212436063e044a4ae4ae97caf2f892ed3a5d4f5f69a85ccd3d377170f2089a63f2df06c170ed034a637db359f31fc44c5fbf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvic:A3k03kHRJARJe
TLSH
T116259D17F79900E8D10AC1789AA69A22FB757C56173097CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 972KB
SHA256 bb8e10df1667c506d672f038d403bebf03a0709f21f4a92335492a4efa1c757d
MD5 bdc7a0030827104d264e26f5b1c282dc
SHA1 848261dbb5f6251d2e53cddf5262adb0a8226d7c
SHA512 c65b4fb12402c9280fe189df47449e22ac4550d04ca983d6c7f5b7b247e3edc570f603db0ab54edceb236b22b10bbd3a2c04414a68fd8c480553597af620fb24
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvrp:A3k03kHRJARJs
TLSH
T10C259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 972KB
SHA256 5d7b1be1f2c72c3b63038ac788de3c7cf9be88e2859c7029a4cce06a6d428681
MD5 c4eda70e2c5987be3681219623551512
SHA1 a9e952575c68d08e50c256fa69bc93e1c9f3d3d2
SHA512 3bfb3a98f5e1bfa30dd3fd9e0cec93b0eafb07a0ab246ec4271dd6621db00ee2b2dd68227c28ee1a1555c24df2c41309b9b827f954e205ae8c02fe187c0094db
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhv8N:A3k03kHRJARJr
TLSH
T18A259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 972KB
SHA256 a996792bf95b1324fae942e70a3347bf6cc72539456f62d986f4c31e7d0bd995
MD5 5d1d0e24db44531c0f45ad8f43deab74
SHA1 88b68e4058aedb8081d0e9142549456b8aa82d83
SHA512 10efb87bdc1deb301334870fa5afca9dc8c73b43e4315249142729b10b4d8d4583da1192768a11aa831bddcb460545afa4371a48b067098db5f32b228d1decc4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvkF:A3k03kHRJARJd
TLSH
T16A259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 972KB
SHA256 2a364a15461843932d192ed04d5ae0e70668d1721b25f2828f547b60167ba1bb
MD5 48b66718803358deade343b0b2e1a239
SHA1 28e57b226a45d45d3c5da23a8ab7edc8487e633a
SHA512 3a043906be1d6a2aa81687087320a747173c8977bf26e5631e9a5ace83f79ef42accaa83607a0c6bb77df5632bafe0ad9a0f4368307075678cc9420792f0cfea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvBC:A3k03kHRJARJB
TLSH
T12D259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 972KB
SHA256 77a1a8a1adfcd6ada4156cfa52a17d650a6edae31974fe53d31021ad5741c1d1
MD5 69a4d83ec2ca99b0dfc35efe1b8c3f92
SHA1 0b5c8ab370a76905f6416254d6007870b9205e51
SHA512 0776b6f8e83683f0e03717dc395a0279a752248363330078e2c509f84e70cc07917b1bb41747fc8b4a40d4ad267a555ec27e1f5f367b76358ecef583afe6bdc2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvCw:A3k03kHRJARJM
TLSH
T11A259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 972KB
SHA256 7870d8bcaffaa558cb17066ca8809ea39af6f469d5c09d3b2920d19475ccd1cc
MD5 a15f1e4cf6599c90b82291ec1ef9116c
SHA1 1af950c7ca50a9f1a6ef22bd71037fce2e64b2ac
SHA512 95c1b5794c945b4b137a6397baf26e9fec85e6b85f455173277cb4c2e1df0c761446aff3b89376fc97bde022328c20373f27c1bdee24b39b6dac9126364fe99b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvJT:A3k03kHRJARJ0
TLSH
T19F259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 972KB
SHA256 b2751d49404be6e329c1e3280d272008f828586d2de3bf981858729aad486fc2
MD5 cfe88a29a9de3ef8327d9301a143f9ce
SHA1 fc7ce8485b2e66f420f33f1ada656852c5c14a95
SHA512 5414bdcc57cf2900b3f5794ac8626472daee6d397b7dca6235ef94293780bb62d0fc534df2bc07a4a987de0bd4443515d9d37039a50bfdaf0a8b8f78485b34f7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvnu:A3k03kHRJARJj
TLSH
T1A3259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 972KB
SHA256 17d57966a0cfce9ddf7964dbae8986bf970c65b3e730926a01b2cc3edba4db43
MD5 3a9395557d9b7c906146666f66a88321
SHA1 ffc75543879c2145673688eea8b4568751151cf3
SHA512 7c017cf3f283af0acf952ae2d2ece45e7989698c80af95b523d82bb18c6a194dbb844fe78e93ca637130d963dd89ba07e77e9e82ceaef5946027c5fc586cb91a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhv7b:A3k03kHRJARJq
TLSH
T181259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 972KB
SHA256 91987e1ae92450225b70e43129fba7c1b96816fdbca8dd777621f79827c28c8a
MD5 b5ab55f6e6e5c5f697149d3ac806edf3
SHA1 dcd927ffe89a2ba848b74fd82267c3b811683588
SHA512 a77a0a656f95e1d27bb32f3fef9c1da77888f469c8482b45f530931e6013b0270ad48782d0d43e92adc3ef958be6be4f76e7b86567772243e0f0f149ec013f5e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvPf:A3k03kHRJARJ6
TLSH
T117259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 972KB
SHA256 ef5383a30ea12d41780bfe53ea2ae5fe942da4c15692eb59cf019273961d17b8
MD5 00c6aeb2516596a61cbc6a433a57d39e
SHA1 ddf35d7e2dc9923edd1dca37d5711b804ac8f119
SHA512 3e8dbc580b19e83b3fe5934923fa816d81e4833519682ec25462024d026e127f2193f02cad8b51bb6cfb92282d865585bb07627707f2bc6c7cdf06cad78df995
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvYK:A3k03kHRJARJ6
TLSH
T1C7259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 972KB
SHA256 74fd41b1753c0d8191ae1d53bc698f93eb1b9ea25eec551a50cd3692628f9613
MD5 bda5818012addd164c74ab90577536bb
SHA1 1fe1f37a9178d7ce925620d862f1abac742df213
SHA512 24830124df7abc7098db3dce5fb5b983b6c284d8b8b5b1d9e7d88fe1acd173b15829a066b44681c29d7f9edfa2985bfd2412bc8cf992ace9bf4080b648a09ff3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvFk:A3k03kHRJARJf
TLSH
T14E259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 972KB
SHA256 a2c69b7de8ae167c56eb4bfdd1079a588f8768ebf4df66f95d9675d7233da8cb
MD5 5d3860192ffd53e94f4c7d6577c5701d
SHA1 544d4cf15a2bfe867d1b081e082579129d955f50
SHA512 c255918527fbf8dbf3466ad6d1e7030636ccf90540480b962f5949ccf7c9ff84430ecb6d7dc239773ee1ab728e7b0edd0b0b89f3c73d7b7c9a0eb496919f7d0e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhva0:A3k03kHRJARJu
TLSH
T195259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 972KB
SHA256 69264ec258210d2168c59a25eb2214d7ccd5a91d2686f0ab55772872a037d2e2
MD5 cf31c277bd3d620c49782638f8cbead5
SHA1 246ec287d04af9d45b9d20c1c8e3f067cd65692a
SHA512 72485117bb1f7c0b77a439db3e2ab0565fbd14638bf77b6ae0cedd44669e04541bb1c2b6b7c8c10e2790c526c3d279630441fcd996e55e7b1818a7659e92beba
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvJg:A3k03kHRJARJ3
TLSH
T12E259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 972KB
SHA256 06d618fd622f74ed88d865cb47f1b27c1cf9fbde2780191376ee3f8b91f83046
MD5 396596339a3ae644b5b2592ffac9a859
SHA1 b606f0b6d428bbf794de22d0c29063c19fb527c5
SHA512 902bb440a65bafdf5583fd82263eca47d6bf5c60635300d56dde3a2cc13d6c2c5fbbabe810cbe5ae27397bd3308ab56dfce76d9236ed5baf1bf2fc297ca690bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvwr:A3k03kHRJARJR
TLSH
T163259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 972KB
SHA256 3a44f49c462539c35530dcea5dd96f8b117be18a7f3d0170556e03e9573b84d5
MD5 a7dd90756a1c267456cf88dde6bc0dc9
SHA1 823f8014658f63531276b8dd06794110d3429256
SHA512 49f73ac81e8af1a87eb6dbef652f31e46fe55c242cfe7a64791b197ce00b6e02ae71096a304a29a09e3f853c843f9e903fe420e120e18ce8c01ac2f41b5b2f82
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvun:A3k03kHRJARJb
TLSH
T1C7259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 972KB
SHA256 1eec6de4cb1761d51f2ee1f4feea1d2eb3348fd104a4d840fbd164e440517e4c
MD5 bd299764509e193bca0bb722ebc9e484
SHA1 c50a7c23f3a0aec00d288f28c357c8296b6fcf68
SHA512 b7400d325cafbbb7f4159caa8850698005e458e12312aafef3e0ba16dc8dfd54ba3d16c4adbf846755421adcf729d50206b2d318a8aeeb6d5fa7a79dd04a9f8d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvkx:A3k03kHRJARJJ
TLSH
T1F0259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 972KB
SHA256 2100808155c85cce440f9ed4c990e5c8a8b0a24a7d25bf0d0c2c84314d71deb3
MD5 2737f0090763fd54039f4cfa43e6a27a
SHA1 795cf2e5d7e733cbcedf17391f016c00531a6124
SHA512 2bab377b1eec327e1c949fd6965ce282203c559eed7938df72ecc1e7dfc265c9effa9ba76862495b2d7ad3a26417922306c4cb906a67834f37b8d8dc61b21019
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvuA:A3k03kHRJARJW
TLSH
T1A0259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 972KB
SHA256 05d92e5bb3d449e1bd834863d5d8b5cb459c5564ac4efdb2ef78240ef8462040
MD5 c7d0e0afbb5e31f698e99adbd843b2a4
SHA1 f84e94c686b1ea3c40cd8a764389b14720b9ea62
SHA512 e8df845552b32e255987c7a5fc7eff8ff905281c115c6584601c98e0bf4d7e630695f6b5d6e55be6a8ff5edfcbed0bc5ea8fd9014540ee4cd4af5b64b55c2db5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvn9Q:A3k03kHRJARJL
TLSH
T1AB259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 972KB
SHA256 cacbc3fd62e5e4dde0b80b7eda86dbf89b6a8a71cc51a46ed32aef807b1d4696
MD5 65dd573852e3276b1364f542bcbbddae
SHA1 cc612604a728ba59b8123a3c2ea1cc987391d745
SHA512 e78fdf43c0cf2086796e2ea622607f7d28cf424e19ef20bf46fa25e6f88e591c6794f318e7f3fbc865a7e688cf4b354418c7df6ec049b267dbb04e4fca4060e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvu4:A3k03kHRJARJc
TLSH
T142259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 972KB
SHA256 8b5c86df0b078c3803a171b2bd623b2121aacccaef7b857fe73a7f8697735ca7
MD5 f2ad632151d3e5cfca08ad88427fb445
SHA1 1ce7c540d4e76b74c5dcf0588cb99db2e7481b15
SHA512 0da41f253172fa5ad41728ad5211534608b6372b27b50bb2c7b70a8679735f35a40e7deda3836e1fb09725d41c8671458fb8e91c2bf3f05dc6edd1398dbf9526
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvNu:A3k03kHRJARJd
TLSH
T1B0259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 972KB
SHA256 b746a6b5a7c88d949e587a6455620711ab4b720edcdc0a74be522a4359e37dfd
MD5 0760f56ae8b93934bbed1a90dd5a2b5c
SHA1 0447e92692b8b2004d8b66e91adcea335f7d2a53
SHA512 a0b205086cbdd6121a71db0ef87b1dcb30b76dec77078bb2780ccc2bf116729074b0639f56b51fce2dea4d94e674112f2f72294de54c2be9c27a47e92d2eb2d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvAj:A3k03kHRJARJf
TLSH
T1E0259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 972KB
SHA256 3b13f9c3947c0203655f19a82a82f8bd437dc21a6ae1e1c0b1973f2d88632bb1
MD5 00aaac31a9400723394f4b0ab3ddd469
SHA1 058e7d79f762b5b3991498bd99c82a2f6d9e6bf0
SHA512 ea5f411c8a3420bd01d35ea40c63c87968ef843bf27e60fa033701e31b5ccf562dfbfdd8b4fdcf232710bd694745fc5b8aeb8d768414f09d30f1ed2377d0d5c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvxg:A3k03kHRJARJX
TLSH
T1E1259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 972KB
SHA256 387cf803dd8cfbf99ab9a998e1d036c9490d7fc25ca0a54d68a65f944a1f4a7f
MD5 3bf7c109f9d5279a40a4dbe6ef54df9e
SHA1 3a2f99249eba49a1998d4a205f2be91270426f1d
SHA512 c44972a2ba85cc82f6f87ec7c938d0ec93f59a472fbd230fdd4618a826de40831efb4ac309d50c68a11e083bde969fdec7e7d24bd38df4f0003e9176415c01ea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvoI:A3k03kHRJARJW
TLSH
T1AC259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 972KB
SHA256 83e0d37a1e28d207d3f23fced1875479f846b9a603e401517c8c239811f3ff63
MD5 e15b1d3535fb68b209f135c7c5bfbd52
SHA1 d1a23bb147768a50b1abe8fab3bd599a7600372d
SHA512 723d9427d0fbd4f0f56e45ce573b297c51b50747672f8390fd052a959797b1feb3df4265c9d7f5bbacc69a7615f73ada5c23a3b1b731823a8cf4fd9d342d571b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvKo:A3k03kHRJARJk
TLSH
T1CE259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 972KB
SHA256 65aa403b4d82d700d072e994a756be6ec00adabd6a3e5d6b662f21aa8239c6b7
MD5 206bb5ea33f21f5b907c7d851b91c266
SHA1 a59d4277b9560ae9f327dc235324482a816d3b0a
SHA512 fce1d3c945c252f05d7755cd4214bb10322277857071025626096e363d8c89b560ef42df19d9a6b4da3fed7e1fa622ac5109b86a6f9acdf3f836d4281af04cec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvh+:A3k03kHRJARJ5
TLSH
T118259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 972KB
SHA256 dc7261171a46e2322325c13cbdfcf44e7ec411496de16197d136c3a2ea442166
MD5 46aed7253bebf9eb2a84d009f40ec094
SHA1 000c3ee6b041437fcc235b008414b7ee2984f8f9
SHA512 3f65576d7e75e0a5452d06b5cb60eda8241952b4374658d997858eb8f396855109f85aad6a89e9e9f82c6c62c2203a81d97387b136d14fad9e8f2dacd916311c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvvQ:A3k03kHRJARJJ
TLSH
T199259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 972KB
SHA256 ef2cb04e724dc67dab0de4d825d3555c2ae8174e4c1984827d43390ab8d5d02e
MD5 a2208d6fde40d152d5efb077b94b3f06
SHA1 3434a0ef2746a6987644679da279e35b9ea4f885
SHA512 eb8b33eaaad66e71dd070f8fa9b3c3e5b155d81417bd9acc6f0c580d4f4597ca9c0df11b9b6996ae8285692009d7ce2388cfbf8c03135d4c28d52d70eccb4cbf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhv0X:A3k03kHRJARJV
TLSH
T1FB259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 972KB
SHA256 f23c58449cd9919ce6bf788e1c6634143bd6c07a5bd7122aeb8e60501e36ac35
MD5 0d8b022029f99d22f2783e7c16b846a4
SHA1 20ecd5549a45036d8561c6cafb23b0979e388385
SHA512 54b8c0f5a61d71bdc6fad7cd653f6bb093cf5593c2b43555c43a08f395e258f0d851949b18f524cfe3586921eee01303dea515e8c93bdd49d4979f419329dfe5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhvSL:A3k03kHRJARJH
TLSH
T130259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 972KB
SHA256 ccaf2f9ae63c3a26b391ccaf1bc32515e5287f48de2ab9a267a203a8aebd71b6
MD5 ad25e4b01c717a56ac3264f0dd6d7769
SHA1 a6597bba3733f33aea683e69fcd9941f2eb02782
SHA512 5db4cce635be87f62ff292269091223f15650feab6919149af02e8a4a3b20fddd66ce75672b556c1ecf50f3a614593f1d58b36521415b28c888c960666018971
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhv2M:A3k03kHRJARJC
TLSH
T1CC259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 972KB
SHA256 e952801f3bcab98600c8d8df6ff330d2a3bffeb7f5ec9f8d5a8eda71bd644ecc
MD5 ca4cf5faa1046b74ac7373643449a63c
SHA1 c268adc29fcce8c744a44b1aa9a9a80365ea513f
SHA512 505e8362449042194288f9788723929df49d50299f6bd954051c50a7629316d22d4e576601841e9f82c26d371bb4a35c28bb4db1fd0260b828d11dc63b605556
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhLQhv/h:A3k03kHRJARJ8
TLSH
T12A259D17F79900E8D10AC1789A969A22FB757C561730A7CF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1300-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4920-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4920-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads