e1fc8af332442d3cfdd08149507f2f9f0aa951f638ad55c5ec481b32ac1df655

Analysis

max time kernel
121s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_7655d76df1ee7278ec989b1d9d7709d9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Size 4.4MB
Sample260415-s8hnesey7t
SHA256 e1fc8af332442d3cfdd08149507f2f9f0aa951f638ad55c5ec481b32ac1df655
MD5 7655d76df1ee7278ec989b1d9d7709d9
SHA1 1def53d0d678cdd1e5744e969a4cecaa33923ab3
SHA512 674eb409d829280a890d73c3a516bb0854f58d75b3570a59ea9a0cbeb01a461347f880d2093ede3d7e40437f1ffbedf8bff29af761a690822e142d6ad46c8be5
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GWF12WTgADeW4Ska:TID41qM5ram6m517hDfkZc
TLSH
T149265A56B7A88762D0778175C4979696FE7278110F2087CF1384EB2C2F337D1AA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
2836	patcher.exe
3884	305.#.exe
4384	934.#.exe
5044	276.#.exe
4804	172.#.exe
4228	337.#.exe
1600	601.#.exe
2556	594.#.exe
2656	541.#.exe
4040	75.#.exe
2260	44.#.exe
2312	953.#.exe
436	175.#.exe
4108	195.#.exe
4512	301.#.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	305.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	337.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	594.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	75.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-04-15_7655d76df1ee7278ec989b1d9d7709d9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	541.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	301.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	44.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	175.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	934.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	276.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	172.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	601.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	953.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	195.#.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	541.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	44.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	175.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	301.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	patcher.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	934.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	172.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	601.#.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\	305.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\	934.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	305.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\	541.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\	541.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\cmm\	172.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\gl-ES\	44.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\et-EE\	305.#.exe
File opened for modification	C:\Program Files\Common Files\System\	934.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\	2026-04-15_7655d76df1ee7278ec989b1d9d7709d9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-GB\	337.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	2026-04-15_7655d76df1ee7278ec989b1d9d7709d9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\	541.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\	601.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	934.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\	305.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\	276.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\	276.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	337.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-04-15_7655d76df1ee7278ec989b1d9d7709d9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\	541.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\	337.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\	594.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\	305.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-04-15_7655d76df1ee7278ec989b1d9d7709d9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	337.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\loc\	172.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\amd64\	594.#.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\	305.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\	2026-04-15_7655d76df1ee7278ec989b1d9d7709d9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\	276.#.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\	276.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	276.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	541.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\	172.#.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	305.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\	172.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\	172.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\	594.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\	541.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jfr\	305.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\	305.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-MX\	305.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\	2026-04-15_7655d76df1ee7278ec989b1d9d7709d9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\	305.#.exe
File opened for modification	C:\Program Files\dotnet\host\	276.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\	276.#.exe
File opened for modification	C:\Program Files\dotnet\shared\	276.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	305.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\	541.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\plugin2\	2026-04-15_7655d76df1ee7278ec989b1d9d7709d9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\	601.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\	594.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	337.#.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\	337.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\	934.#.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	172.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\	541.#.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	934.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	541.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	337.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	305.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	594.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	175.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	195.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	953.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_7655d76df1ee7278ec989b1d9d7709d9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	276.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	172.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	601.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	301.#.exe

NTFS ADS 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	594.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	75.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	953.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	195.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	2026-04-15_7655d76df1ee7278ec989b1d9d7709d9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	305.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	276.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	337.#.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1176	2026-04-15_7655d76df1ee7278ec989b1d9d7709d9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
2836	patcher.exe
3884	305.#.exe
4384	934.#.exe
5044	276.#.exe
4804	172.#.exe
4228	337.#.exe
1600	601.#.exe
2556	594.#.exe
2656	541.#.exe
4040	75.#.exe
2260	44.#.exe
2312	953.#.exe
436	175.#.exe
4108	195.#.exe
4512	301.#.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 3884	1176	2026-04-15_7655d76df1ee7278ec989b1d9d7709d9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe	81
PID 2836 wrote to memory of 4384	2836	patcher.exe	82
PID 3884 wrote to memory of 5044	3884	305.#.exe	83
PID 4384 wrote to memory of 4804	4384	934.#.exe	84
PID 5044 wrote to memory of 4228	5044	276.#.exe	85
PID 4804 wrote to memory of 1600	4804	172.#.exe	86
PID 4228 wrote to memory of 2556	4228	337.#.exe	87
PID 1600 wrote to memory of 2656	1600	601.#.exe	88
PID 2556 wrote to memory of 4040	2556	594.#.exe	89
PID 2656 wrote to memory of 2260	2656	541.#.exe	90
PID 4040 wrote to memory of 2312	4040	75.#.exe	91
PID 2260 wrote to memory of 436	2260	44.#.exe	92
PID 2312 wrote to memory of 4108	2312	953.#.exe	93
PID 436 wrote to memory of 4512	436	175.#.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-04-15_7655d76df1ee7278ec989b1d9d7709d9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_7655d76df1ee7278ec989b1d9d7709d9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Local\Temp\305.#.exe
  C:\Users\Admin\AppData\Local\Temp\305.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Users\Admin\AppData\Local\Temp\276.#.exe
    C:\Users\Admin\AppData\Local\Temp\276.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\337.#.exe
      C:\Users\Admin\AppData\Local\Temp\337.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\594.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\594.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\75.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\75.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\953.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\953.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\195.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\195.#.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\828.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\828.#.exe
        9⤵
        
        PID:1104

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
- C:\905c0769f9a06c95a24ddf945\934.#.exe
  C:\905c0769f9a06c95a24ddf945\934.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\905c0769f9a06c95a24ddf945\172.#.exe
    C:\905c0769f9a06c95a24ddf945\172.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\905c0769f9a06c95a24ddf945\601.#.exe
      C:\905c0769f9a06c95a24ddf945\601.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1600
    - - C:\905c0769f9a06c95a24ddf945\541.#.exe
        
        C:\905c0769f9a06c95a24ddf945\541.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2656
      - C:\905c0769f9a06c95a24ddf945\44.#.exe
        
        C:\905c0769f9a06c95a24ddf945\44.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\905c0769f9a06c95a24ddf945\175.#.exe
        
        C:\905c0769f9a06c95a24ddf945\175.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\905c0769f9a06c95a24ddf945\301.#.exe
        
        C:\905c0769f9a06c95a24ddf945\301.#.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4512
        
        C:\905c0769f9a06c95a24ddf945\489.#.exe
        
        C:\905c0769f9a06c95a24ddf945\489.#.exe
        9⤵
        
        PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 4.4MB
SHA256 e1fc8af332442d3cfdd08149507f2f9f0aa951f638ad55c5ec481b32ac1df655
MD5 7655d76df1ee7278ec989b1d9d7709d9
SHA1 1def53d0d678cdd1e5744e969a4cecaa33923ab3
SHA512 674eb409d829280a890d73c3a516bb0854f58d75b3570a59ea9a0cbeb01a461347f880d2093ede3d7e40437f1ffbedf8bff29af761a690822e142d6ad46c8be5
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GWF12WTgADeW4Ska:TID41qM5ram6m517hDfkZc
TLSH
T149265A56B7A88762D0778175C4979696FE7278110F2087CF1384EB2C2F337D1AA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe$

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$
Size 4.4MB
SHA256 6dc9f1e3a3e2596d3038e534f656edc3c8b6f5d1a65ddacbfd7ec9b8d7ccd1eb
MD5 c035665c791f418d4ce21a7da74e48a5
SHA1 18f7ecb4469b59143f742df73d588f2d5a011502
SHA512 b5b33d4ea88c5f6797b9b11473e78802e42f8b8e64db5b5bd22e3dc577734df8eb5ba009ae2859aed215950b280581937cb364ee75355080c7d4a35dc135e508
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GWF12WTgADeW4Skw:TID41qM5ram6m517hDfkZc7
TLSH
T120265A56B7A88762D0778175C4979696FE7278110F2087CF1384EB2C2F337D1AA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe$

Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe$
Size 4.5MB
SHA256 9d7fe017597585b3931126f15bc2e5d2ecf34673f0d2c19fd275de478719ae32
MD5 76834a8cdd1125b45d8d7f1b634f23c5
SHA1 ede603626b14fc5bd9d2e83751877288d898cffa
SHA512 2257d69fbc5e1f006357f54975cef86a1012f695fe8231cb6e6e6b8d7135b359b121c54ddb0f84f7105561d17c6e9c18c1c303772cb0a6b96f862ffdb9de26a6
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GWF12WTgADeW4SkJ:TID41qM5ram6m517hDfkZci
TLSH
T1BA265A56B7A88762D0778175C8979696FE7278110F2087CF1384E72C2F337D1AA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msoev.exe$

Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe$
Size 4.4MB
SHA256 58e716c6740826bd024694a8fbe20f321814ebaeb55f474cc0bc293c48811909
MD5 38356126f084b07ba99ac25dc1a5b0b8
SHA1 f2e58f7598210e6b3bd6622227e0f18916af4554
SHA512 743af2bd71e4f58322e98aadfe3e45bce4a32bc053d02134dae8c0208336433d401abcc0d4a3400fafeb39a417a4a50668c9727284c0d3cba937bb2b1b6f2676
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GWF12WTgADeW4Skc:TID41qM5ram6m517hDfkZcj
TLSH
T1E9266A56B7A88762D0778175C4979296FE7278110F2087CF1394EB2C2F337D1AA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msotd.exe$

Path C:\Program Files\Microsoft Office\root\Office16\msotd.exe$
Size 4.4MB
SHA256 b57d4daea37ff2f932b236cf895f4f1fa5d8137c3a1fde3f85473f2152aaa10c
MD5 a58aaf597b3a7fef05439f8b27a8efbe
SHA1 b75b3489e1512d3e754f2016c8caf9373f5d5ff9
SHA512 89652135cad0daaafaee3641cb2179238cde8c816c98fc723d0247e443ee0d08dc9a3f5d05cc5c98a9a12d78cca95fc1417ae8d30b1052b7b3269c348973e7b7
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GWF12WTgADeW4Sk2:TID41qM5ram6m517hDfkZc1
TLSH
T1B8266A56B7A88762D0778175C4979296FE7278110F2087CF1394EB2C2F337D1AA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-775-0x0000000000880000-0x0000000000942000-memory.dmp

Download

memory/436-971-0x0000000000880000-0x0000000000942000-memory.dmp

Download

memory/1104-1078-0x0000000000890000-0x0000000000952000-memory.dmp

Download

memory/1176-20-0x0000000000A00000-0x0000000000AC2000-memory.dmp

Download

memory/1176-932-0x0000000000A00000-0x0000000000AC2000-memory.dmp

Download

memory/1600-123-0x00000000008D0000-0x0000000000992000-memory.dmp

Download

memory/1600-886-0x00000000008D0000-0x0000000000992000-memory.dmp

Download

memory/2260-894-0x00000000008F0000-0x00000000009B2000-memory.dmp

Download

memory/2260-365-0x00000000008F0000-0x00000000009B2000-memory.dmp

Download

memory/2288-1099-0x00000000008B0000-0x0000000000972000-memory.dmp

Download

memory/2312-934-0x0000000000820000-0x00000000008E2000-memory.dmp

Download

memory/2312-744-0x0000000000820000-0x00000000008E2000-memory.dmp

Download

memory/2556-243-0x0000000000850000-0x0000000000912000-memory.dmp

Download

memory/2556-915-0x0000000000850000-0x0000000000912000-memory.dmp

Download

memory/2656-944-0x00000000008B0000-0x0000000000972000-memory.dmp

Download

memory/2656-247-0x00000000008B0000-0x0000000000972000-memory.dmp

Download

memory/2836-943-0x0000000000840000-0x0000000000902000-memory.dmp

Download

memory/2836-21-0x0000000000840000-0x0000000000902000-memory.dmp

Download

memory/3884-34-0x0000000000870000-0x0000000000932000-memory.dmp

Download

memory/3884-906-0x0000000000870000-0x0000000000932000-memory.dmp

Download

memory/4040-970-0x0000000000830000-0x00000000008F2000-memory.dmp

Download

memory/4040-351-0x0000000000830000-0x00000000008F2000-memory.dmp

Download

memory/4108-974-0x00000000008A0000-0x0000000000962000-memory.dmp

Download

memory/4228-122-0x0000000000850000-0x0000000000912000-memory.dmp

Download

memory/4228-969-0x0000000000850000-0x0000000000912000-memory.dmp

Download

memory/4384-42-0x00000000008A0000-0x0000000000962000-memory.dmp

Download

memory/4384-933-0x00000000008A0000-0x0000000000962000-memory.dmp

Download

memory/4512-1013-0x0000000000830000-0x00000000008F2000-memory.dmp

Download

memory/4804-52-0x0000000000830000-0x00000000008F2000-memory.dmp

Download

memory/4804-908-0x0000000000830000-0x00000000008F2000-memory.dmp

Download

memory/5044-907-0x0000000000820000-0x00000000008E2000-memory.dmp

Download

memory/5044-51-0x0000000000820000-0x00000000008E2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads