9dde1ff955eb3ce7f90a8f5a93bdb8cd92cc9af73fcc513aeb39d74189e346d3

Analysis

max time kernel
109s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 860KB
Sample260909-awvs4sam3x
SHA256 9dde1ff955eb3ce7f90a8f5a93bdb8cd92cc9af73fcc513aeb39d74189e346d3
MD5 6004c4717f96bc89d707a9fa646f4bb5
SHA1 d70a1818ef44b7ce57847e86f96c8b25a3a59be3
SHA512 70866b93177724215093d4787f602daad91f2798f57d108cee2ebf5c77e2137ea112e944dfb13a15d43270a6d2649181a07bd6cd2f40be6d4d454aa9b17ae0ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aH:A3k03kHRJARJf
TLSH
T1C3159C07F79900E8D15AC2789A969A22FB75BC560730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/5564-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c54d-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000000405-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5564-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4964-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb6-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-227.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-258.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-361.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-476.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-502.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-593.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-631.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-710.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-778.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-803.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-956.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-987.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1055.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1098.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1141.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1186.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1248.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1347.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c54d-5.dat	aspack_v212_v242
behavioral2/files/0x0006000000000405-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb6-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-227.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-258.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-361.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-476.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-502.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-593.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-631.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-710.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-741.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-778.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-803.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-852.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-871.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-890.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-897.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-911.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-931.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-956.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-987.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1042.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1055.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1098.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1141.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1172.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1179.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1186.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1248.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1334.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1347.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1386.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4964	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5564	2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4964	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_6004c4717f96bc89d707a9fa646f4bb5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5564

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 860KB
SHA256 9dde1ff955eb3ce7f90a8f5a93bdb8cd92cc9af73fcc513aeb39d74189e346d3
MD5 6004c4717f96bc89d707a9fa646f4bb5
SHA1 d70a1818ef44b7ce57847e86f96c8b25a3a59be3
SHA512 70866b93177724215093d4787f602daad91f2798f57d108cee2ebf5c77e2137ea112e944dfb13a15d43270a6d2649181a07bd6cd2f40be6d4d454aa9b17ae0ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aH:A3k03kHRJARJf
TLSH
T1C3159C07F79900E8D15AC2789A969A22FB75BC560730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 a847ebdfce4bb4c58f453f32b902d15dffd54919b2e4e9c8c74333ce78ec0ea8
MD5 4d3e40987c6cf8edeae457a0e4bb2959
SHA1 0af95d05c7bf00d8d1d735e38248b6d68101cb09
SHA512 e39e72afbe1526c875304fe71906632cc905326e3fa0c4f6c2753f1c77d64045724d33d15976305b2bac9981a0093f87150cc06754c46fd3736d0bd868d783cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aI0Le5ji0hmxNrM:A3k03kHRJARJwPji0Aj
TLSH
T19B657C17F6A802B5D067C1B9C5D29A5AFA723842073087CF1355C7293F67BE19E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 875KB
SHA256 78312159ff54310e32c78391a78cbd6084c236158a6768723e8cedeae1311d37
MD5 3a0ec9e06f003ff22977bae586c7ca85
SHA1 9dd351e5c3ba8d2dd21912c0c80c66d1068fe4ef
SHA512 543663a38e802ad31b5f66909ec6786b1df9e94ad1c023a623362ea8943b0388572c9b43bfdb4b1efc71d411479e1d09e5e9a5d39e51a39ac05ca88a5f4a684c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aya:A3k03kHRJARJ
TLSH
T181158C07F79900E8D15AC1789AA69A22FB76BC560730A7CF1354C6162F63BD0AF3E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 908KB
SHA256 e8ed2443546d4a96e0b9ff034415a9e38b25ddb72247bdbb94539800483989bf
MD5 5df8be9082fbfe167386c782efd861fb
SHA1 a4f7909e9b5718d96681b94d71cdfe226bcb534d
SHA512 4f942294c8cf70467645d575a2c7e564be797080d10dd5580389137ee481a8b5837b5f492b22be1379d533aed2edbd79c974872766d495585ba2246dce83b20d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aRb:A3k03kHRJARJZb
TLSH
T188159C03F79900E8D15AC2789AA68A22FB75BC561730A7CF1354C6162F63BD0AF3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 884KB
SHA256 a491c837449562cfb5d3e3b2f7e662725878d2008c12be7af840dadc6d3cd006
MD5 0c6b990791be589a685d456ff4ac2bae
SHA1 c8a274a880d2878fb014e67f2cc279f160a9740a
SHA512 238351d51805a42917b65d9bd81756fdadaa918a0e2c0a5f63f61602272bd722c1378aa135e0982493bd1c4044e7352dd6fcb8a4189d045eab739c7da6a7c444
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aD6:A3k03kHRJARJ+
TLSH
T163159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 884KB
SHA256 5c9b4738610f8393895c5fa3141358f2412d526ef584e75700cc7310d2c575b5
MD5 9d0aff944704d7479be987edbf9b9ac9
SHA1 50c4f1d9257fc99731eef0fd976a4efb185c9c5c
SHA512 1671cc19d2bac1e5e2cb3c6bd1fda52f699380e8fc8b0ae9710998aee1f5b73130fa3b9681796e745c9c4642f972bc2e3038896281ba040708f2f704cf4d8daf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8atN:A3k03kHRJARJ/
TLSH
T11A159C17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 884KB
SHA256 005f386f5104a0204356ea8410aa1f35e83dd212a1ac6c58d1870300a5f806be
MD5 52f410784f40531ef07d7dd207392707
SHA1 a7caded310c6afc5e8b0adb09d82600bcb5863af
SHA512 b7bcfdb381cea0773c5da7dec37f590584a60197494dd53b1e14b7f033edb63ec577a967f0b0a13addf6fd1575c894f6c3772d8dd096b5b03c5255453bc8dd7a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8abf:A3k03kHRJARJb
TLSH
T135159C17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 884KB
SHA256 6afa94fe36e5ef681d4771ed03ca52438d6b9d2bfe17245c8bd310f710b3ec11
MD5 963a33a44e1d14dc2ccd8b33aff898dd
SHA1 1defeea734993b66e05ad01ad0cd508a4e0ff4c6
SHA512 1c21e7ccf6bb6447ec7d392309cf58c7ff85c48e7b3dc319ebf5cdc4d296f11fa65125ab178e2a7e44699145246088272a882aedb22837a4f5e6f03395b7eb57
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aNo:A3k03kHRJARJq
TLSH
T181159C17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 884KB
SHA256 11d8638463febf5a6a8b45693cc82a20f11eae28c971c8b718f6ab91d8060f0e
MD5 24f38ea038324b2c3bd6bdb213444a34
SHA1 921c30516c173d98657ba540be738ab1a197732a
SHA512 5621d5349d0784258d9c005ea27057cac14d00eb86702f75ed82bdb7568f6c1e79f6bf7d191496c6ba0ccde9657022b72b381ce0ccd6377666c42781da29aa65
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aNu:A3k03kHRJARJk
TLSH
T187159C17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 884KB
SHA256 61c84a6c359906a562bdfaed4e08b276bb59c44dd64e06e0bcc5fa1e38aead8d
MD5 d567bfea69a9bb017e03e9093e436007
SHA1 cc66fc6a5d5f9a58e23b1d7dfe05bcfafa092628
SHA512 a31f37e50ecfecc2692dc6a809251fd86f4703ea203c6def302b890c05839b987c74db7c45260daecd4d4d85fd93490e476dca41e113226e49e26029762cd4b1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aj9:A3k03kHRJARJp
TLSH
T131159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 884KB
SHA256 5d7b5d690201ed4adeb8227f0d6c70c07b1786c689262622cdd857c945297756
MD5 ccfda78b94b15f8316256c3d2d6e3d1c
SHA1 56fb2de4c4d1a376b60e6de2ecb8b06865b76cc2
SHA512 71396b28ef5b50e8472b43272340c432a8dbc284f3f8a3402cf7f9dc4f4d00e78bfbd8691a64633738a4f4026c85d6924914f5c2965a4f17a27e15f616a8fa27
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aPc:A3k03kHRJARJs
TLSH
T12C159C17F79900E8D11AC2789A968A22FB757C561730A3CF2354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 884KB
SHA256 1aee4aabce51b656e20a311a19d1260cf94d84602c9910096a5f45b3a9c718bf
MD5 575da193f3e7671e12ea1d4b7960ef77
SHA1 eb53d110e176e942dd7457e21bca89f29b1d5357
SHA512 9f797eb5b851e5b20ff73e4dce6316073c8a9a94592b093da5912948e7dd8b42da1b9527abeb804e596dac9467984c3e2f3063326e56214ebcf6f44f1b895652
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aIp:A3k03kHRJARJa
TLSH
T129159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 884KB
SHA256 d6375bca45e8a0822179189f757b01e277a81d1c1a8e07bccdb9c668c84bd0b1
MD5 4b0aa37a695522b2004d62f171c1e545
SHA1 a6a9891f0a5ee3a19c07cb9a61c78f2e51b25e1c
SHA512 8bbd842e1a63e6070b2f1dd9ef638d9cdfafab678853157c675d5d29b0247af1354e08ffcfc85c2ab68eda434ea4e7b8a3fa95a82a2cc38874612ca87fdd35c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8afN:A3k03kHRJARJt
TLSH
T10C159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 884KB
SHA256 ca9beba2623db4d0cd9819f69be2a184dd0d3807c9e60f88f3e97e615b280e1b
MD5 6b1b7ac17edd137cb01790b799061640
SHA1 f5751f48c66f71838e937d5b77d51508fb329b39
SHA512 c7771e9c5ae4f128a2362ae93e893072a65e6515eb3d85ba9ddf05964cbfcf4e574aac1e737cf64dd70591b4a86ada800db82c39092e1c4a9a6a411ce0fb8006
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8adF:A3k03kHRJARJX
TLSH
T15C159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 884KB
SHA256 bc51a43d3a44be3dee8dbd4bb191d55dd16267c4303e98c5be58e4d283067449
MD5 70ed70f23422b88d80e7897da63537b3
SHA1 f35b793166952c158fd654da826b5e4ca949f742
SHA512 47c77fcc878a876d2bec131c11002638ff74ba1a1cfd31a4112a32cc11a3fda31b483a418ce1592d5170254ec649ce23b7ace77bc5e12fc65a7ba9484abc5475
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8auC:A3k03kHRJARJL
TLSH
T171159C17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 884KB
SHA256 3874100bfe3e18eb619601cde603653c9f9698a906883aad624cc41455642cba
MD5 e4128ff8c52263385e6c5e91cfe0c72f
SHA1 eb42c210607c61d1c974c7559ae9ce8e5b711fcf
SHA512 f8fd8e701c7431e6b04e75d3573e822f07ba123cc55dae4643ce0f20c2d50eef4dfbd0517f137ef8c6340d73c5d73d168340441b638b988a736b558d818321bc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8axw:A3k03kHRJARJO
TLSH
T10F159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 884KB
SHA256 a1e64f14e8297793bb4f05a1ca18baecd7bee0a7839c81f1d9ad29371ece9bf1
MD5 618f2ce76eeaa0cfc540c757b9fcb928
SHA1 92d10c0295f213016873fffbfffa889df44729a4
SHA512 3a8be33ecf0e56b601c64001ec7b061f76e65f8f991045a351dd3bea2b4000846007ee9ad05529890c644e488b1f12496ec606b3d2683d79ad4dfe2638712aa9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aYT:A3k03kHRJARJu
TLSH
T103159C17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 884KB
SHA256 8e86120657ed16b4ce5a78d78fea0672c3f30d138c657f92d8c7ee6a95ad27da
MD5 72e2c6bf2ecb8e9153621f38d1f85d6b
SHA1 e0e81d1c9e473b4420b21507617b8cbc969da233
SHA512 6927bbeaa6d952c5b2a6f1adaf25f34cc4e4a7b26bd0d0347cc014aa06724ccde8dff0e4abb67827baedbada4a53b20f26bb49d0ff387835f17e09d0a2f6cf2e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8a0u:A3k03kHRJARJZ
TLSH
T16E159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 884KB
SHA256 e6e174e33beebeadce5b9c29d961becceeabc305047c52f4417fc91fd4bdf7ac
MD5 92d9698123405721c56b4021b9d78e0d
SHA1 c1a5f18afa4fd408d025a7f696927ae61b0e3e54
SHA512 12bcedae95c86245a653c9d2748d4b42e37e8db47728304330f25d99ad7303e07d980b8c73a1dfe128e3f8935d86bebb29640d1c26b36c6bfc850eb16795ff6e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aib:A3k03kHRJARJI
TLSH
T169159C17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 884KB
SHA256 bf606e81bc3d7950974b328898fcfbcb3c8c6aff8721af80469b76663ed0777d
MD5 75e6db49490bb73357434603ae3e2b8f
SHA1 7fca666461ad87d752ba399b195c2836dd79b77c
SHA512 0f940e85d77a83c6326afa2dfe1ab96952978b38c8faef46dc329c8e3bdd38f7c7c0827815dfa6782027148988aaea562ac9343afc32b704bae2089176a68dac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8akf:A3k03kHRJARJI
TLSH
T1B4159C17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 884KB
SHA256 4ec55bede0a229517f8e1f7236205c5d6d5c38a7b50c84d194303a0be0844f19
MD5 d0769e36947f11105c4699dc46266c4d
SHA1 e23453f0ce961a3ae426eeb79bba338948c0e005
SHA512 63dbdd7d1589e610ea2f633e1ebec25d7ff7824082663365c78aeaed7ed6d008b67366fc1092387a9e80d0a3f3e220b75b1304031dc09870da1eda7ac5cffa6d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aBK:A3k03kHRJARJI
TLSH
T13C159C17F79900E8D11AC2789A968A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 884KB
SHA256 01d5f68f9dc153565cde42e341b4ce2a3317ae1a946232355b1e838eb604b273
MD5 eaa7af241bac38caf4101c821bdac2aa
SHA1 35a13cd1fc77cde923354e848989a5e4cf0a9484
SHA512 744d262ea20f1ce791624ff237af72771a9d2e5319d704640d631ebbea875e92e31550023b3392176caafcb90a6b817da289059691d1014735b596c8a8657bb7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8a6k:A3k03kHRJARJh
TLSH
T1F1159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 884KB
SHA256 003265f9d25a2fe8dbdc2a78cef045077ced972e14762ece05375df49b0c6e6f
MD5 124e386f9382d72c738fa30794174bc9
SHA1 f2e3dd145a45a401a25fd74fc6e108c0b49c248f
SHA512 721a1b51de4683318f1ee0c6dc4d63e61145489cc6ba9e4dfc9b0dabb54f414d5b60638fd603122605a7c18b98981c0a37400e3699536f1c4def60228134044f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8af0:A3k03kHRJARJE
TLSH
T11B159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 884KB
SHA256 44844c40b704e92175a671a9faa08bbaaa119bc1a6b7b8b504704eef9b9ee079
MD5 1d2e4790eed1e0812ca7d0c6c7904a85
SHA1 72a806b7d1d780398970be92d5fd2cf198069622
SHA512 c00a26ec0bbecf7cb7b0987a4cec9135c020895ae29cb2c0519dfc23b04854a6876319a69d6cf245df6183f6db7e69eff55da3af2ceb99724b120055e16f644a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aug:A3k03kHRJARJ5
TLSH
T1D7159C17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 884KB
SHA256 39a0e0e7d4c8a54fd3ad86eddecd4b22bccea277684bed88cae2cbd4c1c78be3
MD5 471f3538609851e346de818dd32044aa
SHA1 1112dc958d7c1e04bce0afa45756d32da173777c
SHA512 2dac94d2e1282b6d67c23150b2fd252497de0f4b62243bb0fc9c11e3945fa4370cd1efeff5a698c6e82928644204171e6719b1fcf5d4b8ea7a4ecd2f2ae11d79
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8a3r:A3k03kHRJARJj
TLSH
T1F3159D17F79900E8D10AC2789A969A22FB757C561730A3CF2354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 884KB
SHA256 201e839362576ce21291a6143aea248c3cd0a8935694392e710f8fa0cf2f2584
MD5 4cfe3ad7d06a74a5d262f38866db89bb
SHA1 69e13f6966dc1daba8162b7bf79fcc58475bbbac
SHA512 8af01720a3d57d98716f4c1814672a560d383b6d6d56250605dd57b1e1736483f444981beba6b138f6c62251d46fb196dd280f38e0fee5b7f4ab74aa25d9d4a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aBn:A3k03kHRJARJF
TLSH
T10D159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 884KB
SHA256 d3f7a09a197a0001148ae495574ffb3ab7bb5acaa86e7b130ebeb5f74997661b
MD5 1300acd335645d942d92c17349654ca0
SHA1 5a448a8ec5d33e7133add41528806ee7f22c4fbb
SHA512 c8bf133d91b16ba9f0b761687bf325aaed20883152f838fbcc371f527f7d09670111a7df4ee02b045dc199b0e05d50b0ad1928a140a5eb3fdcfe1bdfada890fa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8atx:A3k03kHRJARJ7
TLSH
T1DD159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 884KB
SHA256 5c0353170ffc3f8c00262e7839bf0d79a48b2580f687dc49dfeec459a8f4d025
MD5 2103f0b02c0a3ab87067e2728cacf9f2
SHA1 a55398e3bcfcd91fcf13bed9c10e8b39adacc01e
SHA512 9170ff26dc531e4160a19fa8ffe2503f2496985c1f335d55cafefa7312d6d8c9474d23a269f75a8b9bdc26cf67d3c77514d47098b043f4527898054bfef23065
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8azA:A3k03kHRJARJU
TLSH
T132159C17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 884KB
SHA256 6581aea6055db4a291e0b2c82845c0617e92f0572250ae7b66707dc405c9c693
MD5 489b612a73d1f6156fd83297a2de0696
SHA1 a592113e23dbb27376aa5280b627c0ecbeb9c774
SHA512 b726f7ee32d2919ce4f09152f3c32f5fe90493cb00557f3f14cb67b6db25c53c0502e4685ddf8df7f9f4343dfd241c636c750339d1fc3ad8e71d1746adaec7c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aE9Q:A3k03kHRJARJl
TLSH
T16B159C17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 884KB
SHA256 526d0d2f3d178e729ccca32705342b597248aa75378db07c677f2dd23f98846d
MD5 5ca3f1d7938cce3d21d39f7efc95b6c1
SHA1 ad848efe5c74243f18a72a120967f2a92c653fef
SHA512 ed43b2e079107db50614db7b988bf00294b7e70d99ce1fd0b2c0802f868369af3b57a30023fadec254f17f44224834e031bd6c6c6f77654d5c886bb32351dbe3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8ad4:A3k03kHRJARJa
TLSH
T139159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 884KB
SHA256 d8cd225c558f18263cacc849fb04c263e4a529423ad0721cbaf091d14498f9bc
MD5 b2e9edcf3b665f16c40f4e7b5a1fcfb1
SHA1 5f9bfb143d00ee804dd94103f1986c4ae5a46243
SHA512 83595f5702fb079110d3afa2f0f06ce6a9565ec3ea3a09c087558364428762261d3454c8beb6f6ce64c5d6221c2c2d666e0fcbfce02798bcd2e2e7688362a8da
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8a4u:A3k03kHRJARJb
TLSH
T180159C17F79900E8D10AC2789A969A22FB757C561730A3CF2354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 884KB
SHA256 24fffb92e2fc2d074747c6c71126680203de4b3027818863ee22e6fc0d84b8f2
MD5 20f542ffce8449a581ed701b69ee75a1
SHA1 a5f3a05925df209cfe7faaaf2ac9969e6251ce93
SHA512 75dd56df1e80e53d337dec852c3444bd46a0288c43ab24a0f4e90b2769cde03631c6cb20c19c0f08f621e400e393734f24fc8c3a96b50fa8a887870a633f1510
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aZj:A3k03kHRJARJF
TLSH
T1BE159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 884KB
SHA256 413a3453d03e6cb7e7a6144e8dcf9e39562d98efa98a201442ea0a5a75b7e78c
MD5 e7e82465d5d10e3ae46ff43b86a05b8c
SHA1 8561cf8e75fd326feee4dc7bbf5a28a7d7544b83
SHA512 a6fd51780d110a0300b84d1e6e5412dfcd37ac767bcc71a6035e57e12a005cf7fafb86a2cbb5dc31d5fcdd24bc78893c2195304fa42b57eb428f040817d7e9e5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aAg:A3k03kHRJARJ5
TLSH
T1F7159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 884KB
SHA256 4794824348268673ee8c059c7c46e7d7c0636171e0ea3af85ec2659029f18e9d
MD5 7cc6c2e976b4ce2fec7672cc07f25170
SHA1 d078d698df065d9946c53642b6e941aebd586cd9
SHA512 df522ba66fa43b3152ba4a431608dfe57925012a93c0a5e30b8a73bafc688e09c4ccfd372515606a858e9ce35162a66e6dd06396d627a0683f330342c8054a05
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8avI:A3k03kHRJARJ4
TLSH
T172159C07F79900E8D14AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 884KB
SHA256 7261a10ce39cc9805d0750e5a263f7a4542931a074944c2a7eb8796d40e8f356
MD5 71ed7c234db5d69ca72834de07855ca7
SHA1 d4f24d74294bcaf3c5f421fa3622397118ee9b7a
SHA512 ce00e72260bdc49b0f3bef960c74e5952060ecd2368962efe14802c9f30adc125d427910302c0562e89883a799e7e8ef616931c969842c8c6a133a308f31c4d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aVo:A3k03kHRJARJq
TLSH
T1A3159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 884KB
SHA256 a82f5ad03dc5220ad3cfd2e6399aa363a5785ca36bbc52774495a0769f1b1946
MD5 f83750cbe9eb262c765eabe5191ba7e8
SHA1 6950f908bed37021fdd2f6995d0fa46be92b4eb7
SHA512 c031b0df9a5afa26ca274858d8d566ed5638e5547ddd26ec09f511d28fa6b4947281cff18720065dfa45761abadeec27853a64b15203f33c64a501b569c138a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aG+:A3k03kHRJARJv
TLSH
T176159C17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 884KB
SHA256 0f1ecc4d9cef286a740e5728942ccda835ebfb68fd429b254ba9894b3993ff28
MD5 fb299c7e539381046de5d9c91d214aa9
SHA1 83bea23f65f78d45d9c2cbca12224e67b6cbd942
SHA512 f26fdebdcc794513c16a7de33c5e09c62a4a7d17efddbe020c8be18e3b586cb84f628b0ee6adc67b4bc904a76b149525fda49c7cf489c379ef49a683be354067
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aGQ:A3k03kHRJARJL
TLSH
T16B159C17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 884KB
SHA256 0719b6e3eaac462d25b40c984af0a4116fe5781a751aa269fd49dcf4770c9e86
MD5 ef75229cd30752e6d9bc291d14d4318d
SHA1 a4e92dfc39f66304e62b6128bedf7b5efcca121e
SHA512 d0c83f6b1bc59d8974c854acd297ca4877bfe0c44fa06c2d95bb65798e57710b6f57063f5da602fa82eaff9eb2b6d8841bbe31d46fb2c4c123c3d1c5b75e6648
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aXX:A3k03kHRJARJ/
TLSH
T142159D17F79900E8D11AC2789A968A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 884KB
SHA256 a889f7c5b3087693be66f21b262b9a8bdd5a91f35f5599da4f8ed2fbd51ec4a6
MD5 40b88522369a527dba06e6d764307cc7
SHA1 c3f5af00ffae6890c24c6d6bd73748916a2f2bc5
SHA512 5926b9f39cb4973d1ad904ee4c679aaf9814179dc9845a13af0b1cba0bf744b980445d03f92303cf8931c4cafb7e0c69e6bc3617da1d1a10af274b1ea1854711
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aNL:A3k03kHRJARJR
TLSH
T19E159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 884KB
SHA256 3069dd82a1d70f3293a37a803488250a0250a11fcdbdc153c29d1d3b4f4c5c95
MD5 ef9eb49cc82415843e9c48c8d85b3b60
SHA1 9aca3fe7e8e8989b20fb1cae97063973fb0540fc
SHA512 f58c5b458df02e38f71a0ff58cb9dd8c86b44e80f295b2e1da3b04467375b8185c2ef3000ff9046cda2ddd1d964d6910facab4d9bcdb255e14ee52e3791d04c6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aLM:A3k03kHRJARJI
TLSH
T1BB159D17F79900E8D10AC2789A969A22FB757C561730A3CF2354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 884KB
SHA256 f6066f58bd8676011e4bcdc763e10c892680d45798e6f843a25bc5d0dd3332f1
MD5 a73283706e69bd73c5afd95a1a7d4279
SHA1 d68a2a6f20d0a551413cbdebd0ae56aaf5c23c1d
SHA512 d78745131327827f32d51f71937048234ec952faa9f082195b3f7d29b5eb29763b31e3f5f33b3b6b41b2d6da505dcc3c42af0f2e57e6857800b0873c44dbbbd8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8aMh:A3k03kHRJARJ6
TLSH
T16E159D17F79900E8D10AC2789A969A22FB75BC561730A3CF1354C6162F63BD0AF3E794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4964-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5564-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5564-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads