0c68ed3d8d80dc2650a1aeefcfc5e4b081f596d07b120befd8da28e72ad3da84

Analysis

max time kernel
111s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 912KB
Sample260909-htm99abd23
SHA256 0c68ed3d8d80dc2650a1aeefcfc5e4b081f596d07b120befd8da28e72ad3da84
MD5 10341cce8846fcb4b037a5cdbfcb7eea
SHA1 b0f4e46e3dd0b7fbfb63a204d3d4cc5f2a001989
SHA512 55de285e29558719f146f22567f480e84c11d1d40654505b6d24fd46ca32b2912ca9a21630e8550e80c1f44a51a4a8335a26801e55b974e267259f9dc1339d2b
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoUQfJChXsf3Aof:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwof
TLSH
T153154807E69400E8D00E8174D7968A22FA777C5617E092CB23D4E63D2F72AD06EFA757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/5920-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c56c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2bc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2de-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c7b-58.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5620-60-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5920-59-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001896e-202.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a48-210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-229.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-230.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-249.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-256.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a4a-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-307.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-409.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-488.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-519.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-616.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-641.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-732.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-757.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-801.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-839.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-870.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-908.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-915.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-966.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1021.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1064.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1102.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1152.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1190.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1198.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1336.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1387.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c56c-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2bc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2de-39.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c7b-58.dat	aspack_v212_v242
behavioral2/files/0x000400000001896e-202.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a48-210.dat	aspack_v212_v242
behavioral2/files/0x000400000001983a-229.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-230.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-249.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-256.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a4a-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-307.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-326.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-346.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-359.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-409.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-488.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-519.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-616.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-641.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-732.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-757.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-801.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-839.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-870.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-889.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-908.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-915.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-934.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-947.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-966.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1021.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1064.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1102.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1152.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1190.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1198.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1336.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1343.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1368.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1387.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5620	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5920	2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5620	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_10341cce8846fcb4b037a5cdbfcb7eea_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5920

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 912KB
SHA256 0c68ed3d8d80dc2650a1aeefcfc5e4b081f596d07b120befd8da28e72ad3da84
MD5 10341cce8846fcb4b037a5cdbfcb7eea
SHA1 b0f4e46e3dd0b7fbfb63a204d3d4cc5f2a001989
SHA512 55de285e29558719f146f22567f480e84c11d1d40654505b6d24fd46ca32b2912ca9a21630e8550e80c1f44a51a4a8335a26801e55b974e267259f9dc1339d2b
SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoUQfJChXsf3Aof:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwof
TLSH
T153154807E69400E8D00E8174D7968A22FA777C5617E092CB23D4E63D2F72AD06EFA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 627f4df6c7fe00ab294c061ae6c3fe6fc7cd396aaa35ff5f3922c9962d744bb5
MD5 ea5c74b1f8241eb565f804ac971c8054
SHA1 53173e9038b97e773eea4b3d7ae8862a1a8ff3d8
SHA512 2eaf3199dad7f61991d379608cc6407568e2d52ea0f215e4517831e47a101f96edc9a9d8103878c7c7e2043a9ad8ba17ff89bc3587a77680f8207a07db6ff163
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoL0Le5ji0hmxNrM:A3k03kHRJiPji0Aj
TLSH
T1FB655A16F6A402A5D02EC078C7D29656FA33384217F096CB13D4D63C2F67BD19ABA763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 926KB
SHA256 e99a21e48af3ed57a55c8e62b5fd5223b0121e5611d9c923ee4458c145989410
MD5 405598fc6ccb23cc1e88c973c77f7a69
SHA1 dc9e3a0b141f7a5a658a526af8efea9aae984db3
SHA512 d9d5d10f511f2427575e022adeb5cd6c07f4f5c8faf11d6ad8a4f54bd97938981d1c2dac702d0db3ec880041f762ef99a0fd68fa0bd01c28da1283546cf26786
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoNa:A3k03kHRJ
TLSH
T19C154807E69400E8D10E8174D7968A22FA777C5217E092CB13D4E63D2F72AD0AEFA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 960KB
SHA256 42c23d8361f211549ccaa57851350d3e37ee78fd05f87dcb18a3ac4bfb5d251a
MD5 39aab2b87414bced19b3e61e321f7267
SHA1 438a387f5c508f3f1d7cf147c0b36fcfaf0a1ad9
SHA512 ed6233feacce5775dc45249b3db5fe4c9f1689b84f7e616e1bd0ab3d2670b61b24f7535e7a606253e618563c0500b5c4933782de98f55ade6bbf947e85506475
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoub:A3k03kHRJHb
TLSH
T101255907E69400A8D00E8174DB958A22FA777C5617E092CB23D4E63D2F72BD06EFA757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 935KB
SHA256 dac19b03b0eecc902d1e62ec1de776ca1eb04ef5ee8d4661cf5f974316c3a4fd
MD5 c9174d8e631f94f8aa3a3ddd848ee823
SHA1 920fca8ea9acb028471685d2ff9bd5a77b597b2d
SHA512 ac118321bc5b727d27c1f3e19a423960ec495a9bc3133db082c8934d46d0f83482da66f5370a27f90ab78fde49c8186b7f1e9acc3af41b7a87cb19c47bf05923
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwotZ:A3k03kHRJQ
TLSH
T19B154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 935KB
SHA256 24614d1c495453cbc568dee210d3e2db23f7d51fec6f6eb3c4b9c32d1e63be1c
MD5 b7704c3023563fd497c4577627034b75
SHA1 4b01ead5ae9f826682d9b9397fbb8de160eb9dbb
SHA512 e2a8afe07b250bc06cbe4d6300951289d7ffc0a0bcb1148221e7ecce3da60212b73328819124a17064201829ed697f5a976d0b22096fe15443b11202648bea4e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoW1:A3k03kHRJn
TLSH
T117154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 935KB
SHA256 eb4d2ea7786c3491734377d4cdbea27e556e0d219dbb9c8ab14cd134ebd5683b
MD5 3052c89d6b848451b9cd2c03b8f81053
SHA1 e764ad0dca936080fe785ee906a2a2d2f254e084
SHA512 4e4d989ea388be1f3c1839f1834834e497730afb667912ea55e64e3be570391911e487be1e8458445e0ea469f1f20ee357863f7e9e67718200925159b0c2ce23
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoE6:A3k03kHRJM
TLSH
T1EB154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 935KB
SHA256 0f5cee43e06d11f1ae369e38b3547840c91cf22dea219b7d96773c3b34c254b9
MD5 c3737262709f0b21a1d60e8be7d2b616
SHA1 4d945d42a744313cec668a5ba28b2d57d17ac918
SHA512 a35687d5c00b1fbf3f575a7db9ca9664d7c641be27bc779a63605b747e781e16c37e56b127bff01fdcacde87872f5d3eeccd41f2f54436aedc9422f49ac57669
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwogN:A3k03kHRJx
TLSH
T1C5154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 935KB
SHA256 f0dffedcc1bc7faa3eee6a5a2fefb54b63489f648a8964de031edffa9ca598c7
MD5 639ed357a5c9a173a9edefb2180663c9
SHA1 ebd49a260198d3645702039e0c9f43f26b9e0949
SHA512 bb2695794512e6f1b197fd83706eb26c8ba8800f739197786de55f8d0d62f05a84ba3e62b049ce41a9f9ec37c1bcef656a98bad0cc23a4cbe7a4d3a8f61d3b78
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoOf:A3k03kHRJx
TLSH
T134154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 935KB
SHA256 e3a9d4c12b49733fd4cf7c21975fde066de879f539a1e63427074860e9976057
MD5 9b6d6288283ebb889752fc701fac2374
SHA1 c4b636d8dfba834c44f4d31ff5b4449f5e26c34b
SHA512 ff997d762211a12ae6939c52b145939bad0f31f3cab9a6ecf562838628d92a427301d5db6c58d4bce6b2cab41b8042f48d37263586af014c842de89a520e104c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwo4o:A3k03kHRJE
TLSH
T172154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 935KB
SHA256 8b33d884860e9e17c0f9308e0f56c13c72998b48e0e84b4a68163cce379a513d
MD5 ef52504040bd44c29add7cd3c775071c
SHA1 835a88519588317a404fc50d78ad823a06d4ce0f
SHA512 99f10304e42bf0fdc4a6ba6e97c6643fc073f3c58a33339936bffce0acd9ca36363a24e6286fb4729f997bb047dd2f60e3acb9f18b0e37fe2b1ba2cdb19da528
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoIu:A3k03kHRJ2
TLSH
T108154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 935KB
SHA256 1bf9e56d0b0b1ae26910d46e0e673a167860c515cdd8e86b0bc713ed93ed393b
MD5 0023586168b0cf0b1cf9820aedab08bc
SHA1 52e1eadc7f2fc9f538aeca87140246557f5be2d0
SHA512 bc81e451362d99d85ec67fd41de02dc1f14bc8f5449116c660a43f4058d26b46a3720d5d2606c830679d5afe13a47319efe2fcc07260df8d8dc9ca16d66ceff0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoc9:A3k03kHRJX
TLSH
T113154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 935KB
SHA256 dd536a36087a77adeffac5f1594e85441b4dab375e2b7d118d63bc570724d66c
MD5 5f9c2481e99e62529df7f5b9a582ce29
SHA1 497e8bd30417595e8b70bcb4a4e78f9ba519dfbc
SHA512 e6e641462c81dbc87722b3f585ea8125c65c2fef5f148d67d182ea274a86afadc23d0b4b4c558ec58701c6e20c22fe7d03c87ca33013282adc530ff2c6d43b2c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoEc:A3k03kHRJm
TLSH
T162154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 935KB
SHA256 6fb6cb07345e8d1ae378e3ea358d87c3ac8f0fcf77eb32eef969347d8abf4147
MD5 c8bf4af5979cd0bad3899ed8bf4d72e4
SHA1 32f6eb499989664faf1c53ec7f0c7970054de513
SHA512 c4f43d95fad9c6f68a8932257a7f1a98618433ba94d8aa6d565bce44e77e6262220a5ae568d3f636efd6474af0a64ddfb82a7bf4ae1c7f332c7c35e6b5c3cbb9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwodp:A3k03kHRJ0
TLSH
T14E154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 935KB
SHA256 748cc80b7560ec570f12d50f6f5dbd40b5cd7d662d4eb443127ce890ed1a1dae
MD5 57063b432373b04a15353bc7cbd0fb25
SHA1 9e90257ce0c5f314d31af162fa1f3daee565fac0
SHA512 8c950cd6e858a4e94a5731fdd1a73660799c5399c71c0e0d3293dd1b62ca4a715135076cc8149abc77f8068c5086a9e580527f3fcd8c9ba744ffc56de62aa7aa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoiN:A3k03kHRJD
TLSH
T149154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 935KB
SHA256 cb656e185b6bb07957364e8f47b5a9055112ebd72cd3709625a5e1e87cb4711b
MD5 1daee85e7658593da897c606b84b3383
SHA1 d6ab0ac537a1e73ce5071ccd5470bbb51124c5dc
SHA512 d401faee75e97bdf07bbe9fd13a8fbc59cc8ddfe24f61dd7f94abff94d12b1dd8a474491bfe4964c11bffcd6622d01873ea3bd1003b2272b7351933fd0d97307
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoGF:A3k03kHRJV
TLSH
T1A0154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 935KB
SHA256 39bb477d26dcbe8b14986a06632e426371628691adf32dda4df3cf80d206988b
MD5 3a7407df964cf9a380ae3f4df5c24d2e
SHA1 4ef3079eca43d60cf637c6f428e83ddb4b97a1d3
SHA512 f8b8a68968547035e24d3d06b95d9b57abf4499216bfef22c47a9abf3494b294fe2a706f3762af38a7692d9950f074c0449333eb5b5243991ddd7273cdac8e90
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoTC:A3k03kHRJ5
TLSH
T118154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 935KB
SHA256 267728ba33ab325d2679c3a6cba4bc24b6548edd66ec2528b336b3bf9e14cf1a
MD5 1f0cfbc106c6eb9813b504e91a8b6906
SHA1 6995fe6de7ad9fe92fde0b9a658d0fa08f633803
SHA512 4c04a223994c81d6861f128ae537bd05a90e18e4b7e9998bdf6c1fc59da5062e62e5a9bda5298c8443d6c28c242a1e1f4308f629d05c789c3f692584b5f5d708
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwocw:A3k03kHRJk
TLSH
T170154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 935KB
SHA256 63cbcb59d2022253df59e3f35c4faf044337513248e0add702e707cbe1da117f
MD5 c4053b17b5c5b7dadfc434317e6d616c
SHA1 42d4eb52d33e156d135f070e03c98e98c0248659
SHA512 9f43f9d56033976aaad7d8ca04b3313ea966c10354aacfb1a132a6fceff28ecd4f4587170981c450338cb92f4206d75282d54b5c5101d091330a045779b2a7e0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoTT:A3k03kHRJM
TLSH
T1D0154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 935KB
SHA256 520c8e44446914fa1cd8408fe058267188f206f7b41cd81c3eb3c06cb51493f7
MD5 1b3d6e9c790865e1f2402d0db21fa602
SHA1 591a699b6d9a93ffb3e333f34195768e0ab6f81b
SHA512 7862a3bfa953c73a8f6c43483d2fb7e02feaa3f3d6d617e435a0f8e74d8cb4bdafb912ddb5e180fcdc586047a016898f0a29bf9f609e41acd538b534bd7cbdbe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwolu:A3k03kHRJr
TLSH
T1FC154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 935KB
SHA256 188cd9e20732ec7be36d41660d6c250303983e2024ba92dcf689448a1c97d538
MD5 ec01330746b10ed309e0e242b940456a
SHA1 fd00fa0ade0ff203079308811c13b8061faa763e
SHA512 8bbef55eff4778c8e7a0102253ceaedac60b490df73e212e374eff8ae36e2c49c85672310957daf01c7e59a4b47046acfd8bea65d234e678e8a597b47b4aa993
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwotb:A3k03kHRJC
TLSH
T138154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 935KB
SHA256 5a9239eea3985ca3c52f68ff142d296446bda2cc0950690b63b68056c3d9a4ad
MD5 d743bc72f175b456f10c332f77d2e284
SHA1 1a1e00baff1f6e7e85920b3918cb8b64b6c8ac81
SHA512 b38e1def031f2c26dee7850e73efe0da63535cb0104f90d05f91e0588130ad8293f20b1ead0bc287ed641c018014b76bc5863e7e245fe246a9b54101c705b44f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwodf:A3k03kHRJi
TLSH
T1AC154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 935KB
SHA256 07898c6b76ea20c00035ad4d8f5623ee22b726dcb6bbd59261efdd6bec6ee04b
MD5 7a769f653bec467f6115d82e91e9cf32
SHA1 36282bfe0c0cc9969d196bf850d9263406d61561
SHA512 eec8dbd63eee52eab61817e437e249d2be436e6c0e74ef592503a7e9674c84a48338927d9e8ef6c25ac85d96fc3710aaf37bddf5f95bc7036e76eeb97c47beb9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoGK:A3k03kHRJC
TLSH
T1F3154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 935KB
SHA256 09f4b3b0d0685412e53308861364351b6e68d5c2db44c2f9be86642fa602ec12
MD5 1af71317b04c8ad1f8a115a1ae173a7b
SHA1 0f516efd09bdffc80e3453fc5c879dbbabea6d3f
SHA512 9a2f604ac4ecde94ac7a5aa32e08bb7ba0e0e1027a1259008bd56603c76c48b0fc3a038e15f63b03093f8caeefe6fc4a231863fee80a477d98e16165b597e137
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwozk:A3k03kHRJX
TLSH
T120154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 935KB
SHA256 ed30cbfbe8a7a6711353daa2b1bb1a3350ad1cdfe796f558fd6dca00c2cb10b5
MD5 21a9b1f3d6d7aee28529d0fa6efefce3
SHA1 0bc5787de3f1072b6e437d47ba1e65c0b7041ddb
SHA512 c82fd0a679ab2acd29257835eb7a3dd22d0c08c884c035f3e55c53f60111bb079f6fd36f16770eb05e70ec69138d8a563c18f963c7a19bfa88dc50042c648a03
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoE0:A3k03kHRJ2
TLSH
T15C154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 935KB
SHA256 6dd93345d1750ef17c61b772e180354846a6406144714bb0f0f7846184d14997
MD5 1d032945685da4e4a886acfb6ac4bc8d
SHA1 bb0f6424be1f96b1925e38200d13600baa98f05b
SHA512 cf349eb311e3d3bb5ceaa5629607539c107b3fb339b5749d551152420617a42dcb2ac8381a70145714f24574897871efe7164915f628db950c8bc9139c770086
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwo/g:A3k03kHRJP
TLSH
T1BA154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 935KB
SHA256 83650bebe993ce6bca2621796336630e875b40684711bd488eb38e157b77e99f
MD5 45ce3ae3a0102b0c880ebda01b6f8813
SHA1 1002107b12d38897fc26629484556f73c785addb
SHA512 60159fa325d5387e9d4d943c550bc2e8a470257d9811ccc9b7aae6929ecd846f85a0d66355a24c4f291513c950751f1fbc48d63e73557e0b89bae9e801a227d1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoSr:A3k03kHRJp
TLSH
T1C8154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 935KB
SHA256 6c8f1f5f4a6accb8ec9c8aa9f64ae53c726e9401c9ae22fc4a36df2d543a91db
MD5 a189472d73d27a8501b253b075e1ce9a
SHA1 6eae294c0225d86e945b85600e86e95337db0ea7
SHA512 73d0925822a014ee494006bf32dfffcc5390424a6c8ae70f8c18b91bed95f5ecd45cd441a8a641071f6e4178a705273a148054fccf6103afb60a6ee71fa8380a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwown:A3k03kHRJD
TLSH
T106154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 935KB
SHA256 369bcf9d31a17da464df0b03a5b2ea0948fa3e12ddf48cdd54b556d6de86e462
MD5 aa65566768284bb80f37a8f7173430e2
SHA1 20ef3131535b923668d388d7b24f81832b59a07a
SHA512 254ebc66f9ebe254104584ed9235c8102e0b4a26bb9af998a3857a19906edc0f9e06e244572939a0b921b3b164914a3c5df17b0302a2cf4bb34923cd63a264e5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoOx:A3k03kHRJh
TLSH
T194154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 935KB
SHA256 641a860b63ceabd0080cfa30e451b3359b5ca07f8117ef9a86bcbc8c839de88d
MD5 144ee55347599bbcdf99f67712d819ed
SHA1 24f9372c69df6dd1a7b80162cbfdaf1ec849bcdd
SHA512 f090bd3207573598c151540ea537827595e946a53c8030977f6c6fa180f9c69b79fc3f030459b99ed54acbedd1f17b7236901a69ddf895ffec415fb79eda0f27
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwooA:A3k03kHRJO
TLSH
T1B1154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 935KB
SHA256 3483a7374cdc0cf1c20f7827413cf37d88d559df5ce1575e1f3c5eb0e8cc1e22
MD5 67a02e16568022858018eee396ea7492
SHA1 e11a9e39dbb7909a96dc54437aa366002fcc5597
SHA512 aeafb6bd580482032cfe5676a692eb18c88bbc5a2581f809fcb662f34f192121dd126946647df76a448ce86da2d77f0b0edc25bfa90db5985257ef64d162f249
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoB9Q:A3k03kHRJT
TLSH
T1E2154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 935KB
SHA256 c426027c7d9c51c0ea959ebb6f19ad517aecc793d66b0e587a7a172bf7110f9d
MD5 88ae0b386dbfd78d2f04b0b2d2d9e894
SHA1 e790466e86f95e003af452c452454beed4c2c859
SHA512 0214dd7109470dfe46ad78999093493d05ee57be031e1e0fde08f30e1164d97db38016b11549538b4b789532249cc6b7189d8295c9a2c97c094fb61c0f118a0b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwo04:A3k03kHRJU
TLSH
T130154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 935KB
SHA256 a2f30a8f17ae9a7b6a6d38304cf8b7c46e1a68aa1631c7eaf8d1364bad23e10b
MD5 b4c15ecbe16265a9836e1f5f4a49fc47
SHA1 1ee03bf1cf55d98e900ae34404449ec15d33af78
SHA512 08ece36f23734401e9fe164da27db70b11961ca3435c605f9989d6f0a5605804fc762117490f75fae463da6a7acae7080da36d972e1436dda9530278d31ed341
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwofu:A3k03kHRJF
TLSH
T1BD154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 935KB
SHA256 06e4979ee277f74f64fbd2a24b60e1fd416ad19f18a3a282317c51f5fb49901e
MD5 3b5c8999e56692a6b156ddf4345b48a8
SHA1 00070a8d070187090faa209a7ac39fafcb6b410a
SHA512 c33b327a15a8de2b40ee653a5b530db766336d8dd1c2c3e5697ba54d814f813bd906f119c91d507dbf70ef3197dc9789c761423754fa34ad218eea925d198ac2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwo6j:A3k03kHRJH
TLSH
T15E154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 935KB
SHA256 38da6fd6bdf71cddbccdfa10d987c4a703a043116fb86aa4e14d88f61a48c96c
MD5 f2fee305977966202276927b4495e221
SHA1 a30e570f70ca228a161ef9a547d96b76e318ff39
SHA512 95373f4547adae7ef0a4306c2080f4b5fded428852e3c86e53b478494bfa89718eb69cd57c706175f86cd197ae632579ef3a1108f431b08ffb93259c1fbf4b48
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwong:A3k03kHRJv
TLSH
T1CF154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 935KB
SHA256 fdb3a676c826fde5091a6a21717694e9bf37216646d9fe03cdcd701dfed2a568
MD5 25bc2a3c5585ad37e8cf004cbe734d66
SHA1 3d0e6e03cb824979e788eaec7f2397bb6ca44420
SHA512 c993038afa781b122142c61a7b958365db6e3a73a2c6591ebf4066d8c126cf5161c413d3241a0b4b7965ecfc8fe87575ebfd01a35211cc72107c4f61c731048c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwo6I:A3k03kHRJ+
TLSH
T10D154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 935KB
SHA256 336218b2a293900af80e0235138696ae76579b7a775b26d74a20a991dcb36412
MD5 be220cd596302723f79524e0bb669dd6
SHA1 3229bfa66adf4c648c680399f8e3ea5095f5da6a
SHA512 9f8886392721b096d5d7f853a2f3f0e4d3023231e304366fc81acf4d80f660e0af164a2b9e4fa4f613ac1129a5887e746e7d460d2ee77cb5ab3057c9c215405f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwo4o:A3k03kHRJ8
TLSH
T1DB154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 935KB
SHA256 39a22fa724a6d7bb517726207c6fe6786330184b2029f4c877a44c721b0e8f77
MD5 701472af99a3ff3a3cc2d2b2d2e349a0
SHA1 a36c68478dc116087e25dc87945e87f2b8d99a61
SHA512 42f454879e6511df67b91dfd2cf7016d13f63aba86b3923e7af03ede7dde13f1b41917d7e46978e232a08cb87833b76eef51bfdb61d1291a6cb032c7b363562e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoL+:A3k03kHRJx
TLSH
T128154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 935KB
SHA256 da68a25e6b8bdcd61e1ba778828722b7e8cd31a9f1037da2ab2e4519430be8cc
MD5 5ecb54636c159b3e7f3f5004e7eea1c6
SHA1 0218702d739cb6fad080e8951dd13f1ef17c216d
SHA512 a68ffce5048393766aa457b4f74fee98f1a6d41c63894fbb5f3f173fe7b7e3e68ea00ca67b701c7d45c41f5f61dcce8dfece0f8b3680224599e4609dd76595d4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoBQ:A3k03kHRJx
TLSH
T1F7154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 935KB
SHA256 ee20c534b58d2dde7ecdc5381cf9cd4482b3a80ee1212382626736fa75dacbe4
MD5 ed583455628617fc64f79b31997f9d5a
SHA1 68f27ac52c06e939cdd478a4bd2a71c18b9fb4c8
SHA512 e542f5713172239684da6066d1d289259d5fe427e4d643c1e39c7474393f3cb6a50e2af8a2ec2e68d1775833b0c5070d8b5550e12dea681d05d2c577151b344d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoGX:A3k03kHRJ9
TLSH
T11D154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 935KB
SHA256 e2fe4997470e18689a0586fb6265b0292c981b479919d1fb47d43b59270aeb16
MD5 8cfc44d23608384d202cf201f3bd8697
SHA1 74b0a488d4f84afc94a519b4d5893b737fb9da84
SHA512 b5d312d209969f704fb8f3468954ea7477e984f1ceab32206857f01143276794f28cfa49158f68265f9ed4e7b521210361eccd5a60bb041cbc37d3770ef50207
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwoAL:A3k03kHRJ/
TLSH
T127154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 935KB
SHA256 72a92028a82d0e480b0124956b1583be612d3027dbe679292a6173d7d0d6a9ea
MD5 7e83c35bd87001c70efb080e86d6e6ce
SHA1 835fc9b2e16dc591590d067c396e81fdecaaaae7
SHA512 8bc58b46d955e1dac7fb92803dc45024b7e5a04ca3550c2f8e4417b7b82d180111ff5b14a34df59e871087c81f6ec33f9d693dcf27181a07baa243a042918f03
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwosM:A3k03kHRJK
TLSH
T1F4154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 935KB
SHA256 a0df2d84b8affce19b01e011bcf3dc7d42b73c1b76cd57bc9edf4e53299e95ac
MD5 08798d96303573ad5275ed7ddc40c610
SHA1 fb9e3ea39029878f10db3191fbf54ac8dd0ea997
SHA512 ef8984c2c5a19081dc47e41428490025fa2dd6fa02b5f298f74efb1a15f83b5cb1762b23bafab58e3bec451bd0a03106a472901d1b98e405c708aeb493c96f47
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJCkwo1h:A3k03kHRJE
TLSH
T16B154807E69400A8D00E8174D7958A22FA777C5617E092CB23D4E63D2F72BD06EFA797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5620-60-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5920-59-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5920-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads