Analysis
- max time kernel
142s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 17:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
- Size 5.3MB
- Sample260415-vtpvashv4x
- SHA256 b8641df2872f49dd3bddbb236fac843daea9ea1db88aafb9844c63728ca5f112
- MD5 c7bd3ac72bfc46ae0340adf96a3f48a7
- SHA1 b6f6c3f1024d6f59fd4749a0a6dabaa61d509c84
- SHA512 95a12c836aae74e19b3ec2d8a99dfe47692091ce76522923c5ced7286127c66ab08350517972d893070cdf74f5056d950fa041407874252545dad38a926eafb2
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglLsy6i1zuajsauZpY5CwqB:TID41qW1PszVBts5LufkZcPrX
- TLSH T176467B11B3F84E62E1BB5175C5A29695AE337C210F3493CF1294AA6D3E337C09A36763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 13 IoCs
pid Process 5056 patcher.exe 3164 630.#.exe 4916 760.#.exe 5108 332.#.exe 3380 463.#.exe 5700 476.#.exe 1668 215.#.exe 1960 334.#.exe 3824 787.#.exe 2260 904.#.exe 1052 431.#.exe 1136 453.#.exe 5384 968.#.exe - Adds Run key to start application 2 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 476.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 787.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 904.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 215.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 334.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 431.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 453.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 968.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 630.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 760.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 332.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 463.#.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 968.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak patcher.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 760.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 463.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 215.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 787.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 431.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\ 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\osfFPA\ 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\ 215.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\ 332.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\ 215.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\management\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ 787.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\ 630.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-TW\ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 463.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\3082\ 476.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\ 332.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ 332.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ 760.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ 334.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office15\ 463.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\eu-ES\ 463.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 476.#.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\ 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 787.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\ 215.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\ 334.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\ 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\ 476.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\ 334.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\ 476.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\ 215.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\ 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ 463.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 332.#.exe File opened for modification C:\Program Files\Microsoft Office\Office16\ 476.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\management\ 334.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\ 904.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\ 215.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hr-HR\ 463.#.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\ 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 463.#.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 476.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\ 332.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ patcher.exe File opened for modification C:\Program Files\Common Files\System\ado\ 904.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\ 334.#.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\ 215.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\ 463.#.exe File opened for modification C:\Program Files\Internet Explorer\ 787.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-MX\ 630.#.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 760.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 630.#.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 332.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 760.#.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 334.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ca-ES\ 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lt-LT\ 463.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\ 463.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\ 215.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\ 476.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\ 463.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\ 215.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\ 760.#.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 332.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 334.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 787.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 431.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 453.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 968.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 630.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 760.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 463.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 476.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 215.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 904.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 476.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 334.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 904.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 453.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 630.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 332.#.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3440 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 5056 patcher.exe 3164 630.#.exe 4916 760.#.exe 5108 332.#.exe 3380 463.#.exe 5700 476.#.exe 1668 215.#.exe 1960 334.#.exe 3824 787.#.exe 2260 904.#.exe 1052 431.#.exe 1136 453.#.exe 5384 968.#.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3440 wrote to memory of 3164 3440 2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 81 PID 5056 wrote to memory of 4916 5056 patcher.exe 82 PID 3164 wrote to memory of 5108 3164 630.#.exe 83 PID 4916 wrote to memory of 3380 4916 760.#.exe 84 PID 5108 wrote to memory of 5700 5108 332.#.exe 85 PID 3380 wrote to memory of 1668 3380 463.#.exe 86 PID 5700 wrote to memory of 1960 5700 476.#.exe 87 PID 1668 wrote to memory of 3824 1668 215.#.exe 88 PID 1960 wrote to memory of 2260 1960 334.#.exe 89 PID 3824 wrote to memory of 1052 3824 787.#.exe 90 PID 2260 wrote to memory of 1136 2260 904.#.exe 91 PID 1052 wrote to memory of 5384 1052 431.#.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_c7bd3ac72bfc46ae0340adf96a3f48a7_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\630.#.exeC:\Users\Admin\AppData\Local\Temp\630.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\332.#.exeC:\Users\Admin\AppData\Local\Temp\332.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\476.#.exeC:\Users\Admin\AppData\Local\Temp\476.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\334.#.exeC:\Users\Admin\AppData\Local\Temp\334.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\904.#.exeC:\Users\Admin\AppData\Local\Temp\904.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\453.#.exeC:\Users\Admin\AppData\Local\Temp\453.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\139.#.exeC:\Users\Admin\AppData\Local\Temp\139.#.exe8⤵PID:3804
-
-
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\905c0769f9a06c95a24ddf945\760.#.exeC:\905c0769f9a06c95a24ddf945\760.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\905c0769f9a06c95a24ddf945\463.#.exeC:\905c0769f9a06c95a24ddf945\463.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\905c0769f9a06c95a24ddf945\215.#.exeC:\905c0769f9a06c95a24ddf945\215.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\905c0769f9a06c95a24ddf945\787.#.exeC:\905c0769f9a06c95a24ddf945\787.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\905c0769f9a06c95a24ddf945\431.#.exeC:\905c0769f9a06c95a24ddf945\431.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\905c0769f9a06c95a24ddf945\968.#.exeC:\905c0769f9a06c95a24ddf945\968.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5384
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 5.3MB
- SHA256 b8641df2872f49dd3bddbb236fac843daea9ea1db88aafb9844c63728ca5f112
- MD5 c7bd3ac72bfc46ae0340adf96a3f48a7
- SHA1 b6f6c3f1024d6f59fd4749a0a6dabaa61d509c84
- SHA512 95a12c836aae74e19b3ec2d8a99dfe47692091ce76522923c5ced7286127c66ab08350517972d893070cdf74f5056d950fa041407874252545dad38a926eafb2
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglLsy6i1zuajsauZpY5CwqB:TID41qW1PszVBts5LufkZcPrX
- TLSH T176467B11B3F84E62E1BB5175C5A29695AE337C210F3493CF1294AA6D3E337C09A36763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$
- Size 5.4MB
- SHA256 5c9d775d1aec1039ad28fb5fc90fcbdc9a3b033b15e49c228eaae7ab32b7cfb4
- MD5 88e80068ce2c4d01389a5405bc4cefe3
- SHA1 663a1192ed7bd65ee35def9300fee0a7ccc58556
- SHA512 768d6c7f8fefb3a18fb38f173424f0849994dc6303805a3114abaed33a1eff3afe3c5e95d0c5e2a93ade564e5ad7ef7e3a027d16756072e406d30925047c30c1
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglLsy6i1zuajsauZpY5CwqT:TID41qW1PszVBts5LufkZcPrZ
- TLSH T194466B11B3F84E62E1BB5175C5A29696AE337C110F3493CF1294AA6D3E337C09A36763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe$
- Size 5.4MB
- SHA256 27f9b61c8f11671f250713801667ad1281ced1f1da8b49fbf29416f42f859e2a
- MD5 8592708884dadbb741e7c27c09bb2abf
- SHA1 08ce954397b9526956fc751b065f2dbbe02c80d9
- SHA512 0e09741bce0264dfa18fe49cb2d5cfaf4e91881790c7e764a27c20ccac15401e0c3e4476fc787f62b5d352697e0bd5a3b70841c2bbb0ca538a279b9b1d840300
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglLsy6i1zuajsauZpY5Cwq2:TID41qW1PszVBts5LufkZcPrc
- TLSH T1F8466B11B3F84E62E1BB5175C5A29696AE337C110F3493CF1294AA6D3E337C09A36763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$
- Size 5.4MB
- SHA256 4325169a5c30f6d05aa978e46ce1a8bcbfbfde49844e7e29ab9c852e3a86611a
- MD5 b084daf1c900b4d47238a79c5081d16e
- SHA1 ca7d145ec030b1bf367911273a70c5fe06a11158
- SHA512 bf12b8ccf00227621efd1bf16b42e76302c3e9540df871134652dc7070e5cabd9dfd6cc8470e8496f8347083a2058308f2844930f54b2a13905c3674fc89573c
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglLsy6i1zuajsauZpY5Cwq2:TID41qW1PszVBts5LufkZcPrU
- TLSH T16F466B11B3F84E62E1BB5175C5A29696AE337C110F3493CF1294AA6D3E337C09A36763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$
- Size 5.8MB
- SHA256 b4f609925dfe811354e6d4fd5094de14921deb106234bc6bdabdab805df1518b
- MD5 85f3b72b605ade24505eee044f0720e3
- SHA1 d38d6fa95c4a2dd07948770eb7bf4576a3186f6c
- SHA512 cad8e9e464d36f90f8b6ca7bfd19f522c482bebd353bb70986e08fc78c97e7fbc690f84a8d1786b4268dd8610998e1c0f7eb271429efbb2ab28547d8b1c16fef
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglLsy6i1zuajsauZpY5CwqD:TID41qW1PszVBts5LufkZcPrC0QA
- TLSH T19C566C15B7E84BA6D4B75135C5A25661AE737C110F30E3CF1298AA2D2E33BC09A37763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$
- Size 5.4MB
- SHA256 23c7f3165d0f83d243f747b423bdc41c4b0515ae5ee889a173d9d584683f578b
- MD5 b6f73d4675c31a5734521f91722521c6
- SHA1 35939eb109c9bebc53e1cb1ae20580faec7add4d
- SHA512 b9e7bc5963308650f3427662259ad09f3c18f3a64cf0fcfd56b1666e1fe53b1a9881cbf2bb142e69a31933128fb21d93d65765f72bd0d5ba3de31ff1c5e99c65
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglLsy6i1zuajsauZpY5CwqC:TID41qW1PszVBts5LufkZcPrKD
- TLSH T173467B11B3F84E62E1BB5175C5A29696AE337C110F3493CF1294AA6D3E337C09A36763
- MD5 SHA1 SHA512 SSDEEP TLSH