Analysis
- max time kernel
126s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 15:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 4.8MB
- Sample260416-sdnwyscv3p
- SHA256 83e1522d2625b440f768f3e7c6326d8cf92b26a4f399d3b84356d5f4da6c3d02
- MD5 52790d4f038749b0c7f33bf3fa43383c
- SHA1 4ac7d417a4a87d7c86c58b1bb003d1a6268d16d5
- SHA512 b6f89b5e07eb7a55ad758dbf6b7fc979f0036a1a216e11ea9b9d30d057d551e11461a0babb63fd7120c098110aa48aede44a3e7c7feded37528dacf9db86d347
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqL:7ID41qM5ram6m5h6N
- TLSH T1F8364A16B7A486A2D0779175C9A29296FE7238510F3087CF1385A73D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 15 IoCs
pid Process 5268 patcher.exe 5280 848.#.exe 916 794.#.exe 3840 516.#.exe 5160 903.#.exe 936 688.#.exe 4288 907.#.exe 3076 617.#.exe 3084 575.#.exe 3476 787.#.exe 2912 154.#.exe 5148 357.#.exe 4908 84.#.exe 5988 831.#.exe 4528 42.#.exe - Adds Run key to start application 2 TTPs 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 688.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 907.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 831.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 848.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 794.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 575.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 84.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 903.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 617.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 787.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 516.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 154.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 357.#.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\systemlog.bak patcher.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 794.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 903.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 907.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 575.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 154.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 84.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ 2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\STARTUP\ 794.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 794.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\ 516.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\ 617.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\ 617.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\3082\ 2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\ 516.#.exe File opened for modification C:\Program Files\Internet Explorer\images\ 903.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\ 688.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\ 575.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ 688.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\ 794.#.exe File opened for modification C:\Program Files\7-Zip\ 794.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\ 794.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-TW\ 907.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ 575.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 903.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 794.#.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\ 2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\ 907.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ 688.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\ 907.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\amd64\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\ 903.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\ 848.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\3082\ 903.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\ 2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ 848.#.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ 575.#.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 794.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 794.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 848.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\ 688.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\ 2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\ 903.#.exe File opened for modification C:\Program Files\7-Zip\Lang\ 794.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\ 688.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VGX\ 907.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\ 688.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\ 848.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\ 154.#.exe File opened for modification C:\Program Files\Internet Explorer\SIGNUP\ 848.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\ 516.#.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 848.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\ 575.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\ 2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\ 848.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 794.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\ 794.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\vi-VN\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ 2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ 617.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\applet\ 617.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\ 516.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ 688.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\ 575.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sl-SI\ 575.#.exe - System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 516.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 794.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 907.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 787.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 357.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 688.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 575.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 154.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 848.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 903.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 617.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 831.#.exe - NTFS ADS 8 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 848.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 516.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 688.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 617.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 787.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 357.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 831.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 436 2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe 5268 patcher.exe 5280 848.#.exe 916 794.#.exe 3840 516.#.exe 5160 903.#.exe 936 688.#.exe 4288 907.#.exe 3076 617.#.exe 3084 575.#.exe 3476 787.#.exe 2912 154.#.exe 5148 357.#.exe 4908 84.#.exe 5988 831.#.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 436 wrote to memory of 5280 436 2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe 81 PID 5268 wrote to memory of 916 5268 patcher.exe 82 PID 5280 wrote to memory of 3840 5280 848.#.exe 83 PID 916 wrote to memory of 5160 916 794.#.exe 84 PID 3840 wrote to memory of 936 3840 516.#.exe 85 PID 5160 wrote to memory of 4288 5160 903.#.exe 86 PID 936 wrote to memory of 3076 936 688.#.exe 87 PID 4288 wrote to memory of 3084 4288 907.#.exe 88 PID 3076 wrote to memory of 3476 3076 617.#.exe 89 PID 3084 wrote to memory of 2912 3084 575.#.exe 90 PID 3476 wrote to memory of 5148 3476 787.#.exe 91 PID 2912 wrote to memory of 4908 2912 154.#.exe 92 PID 5148 wrote to memory of 5988 5148 357.#.exe 93 PID 4908 wrote to memory of 4528 4908 84.#.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_52790d4f038749b0c7f33bf3fa43383c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\848.#.exeC:\Users\Admin\AppData\Local\Temp\848.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\516.#.exeC:\Users\Admin\AppData\Local\Temp\516.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\688.#.exeC:\Users\Admin\AppData\Local\Temp\688.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\617.#.exeC:\Users\Admin\AppData\Local\Temp\617.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\787.#.exeC:\Users\Admin\AppData\Local\Temp\787.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\357.#.exeC:\Users\Admin\AppData\Local\Temp\357.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\831.#.exeC:\Users\Admin\AppData\Local\Temp\831.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5988
-
-
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\905c0769f9a06c95a24ddf945\794.#.exeC:\905c0769f9a06c95a24ddf945\794.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\905c0769f9a06c95a24ddf945\903.#.exeC:\905c0769f9a06c95a24ddf945\903.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\905c0769f9a06c95a24ddf945\907.#.exeC:\905c0769f9a06c95a24ddf945\907.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\905c0769f9a06c95a24ddf945\575.#.exeC:\905c0769f9a06c95a24ddf945\575.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\905c0769f9a06c95a24ddf945\154.#.exeC:\905c0769f9a06c95a24ddf945\154.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\905c0769f9a06c95a24ddf945\84.#.exeC:\905c0769f9a06c95a24ddf945\84.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\905c0769f9a06c95a24ddf945\42.#.exeC:\905c0769f9a06c95a24ddf945\42.#.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4528
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.8MB
- SHA256 83e1522d2625b440f768f3e7c6326d8cf92b26a4f399d3b84356d5f4da6c3d02
- MD5 52790d4f038749b0c7f33bf3fa43383c
- SHA1 4ac7d417a4a87d7c86c58b1bb003d1a6268d16d5
- SHA512 b6f89b5e07eb7a55ad758dbf6b7fc979f0036a1a216e11ea9b9d30d057d551e11461a0babb63fd7120c098110aa48aede44a3e7c7feded37528dacf9db86d347
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqL:7ID41qM5ram6m5h6N
- TLSH T1F8364A16B7A486A2D0779175C9A29296FE7238510F3087CF1385A73D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 4.8MB
- SHA256 c5e9e85299db279e56914413e009ad0c98abe6ef1da23869bd3cb59a32a2db14
- MD5 a755aa5e0476a31b577b5171666f88c7
- SHA1 e7e884578d77b38e516d1917f73eeddd5aa838c5
- SHA512 8da521761f98ce59c7b26e8a9a60d7c771f6c9d9744a13ce10a3f60aa1f86571265a1712d8026dcfb7ff09526195b3a21bd3562306cd30624fc679c91c78bbcb
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqQ:7ID41qM5ram6m5h6NH
- TLSH T16D364A16B7A486A2D0779175C9A29296FE7238510F3087CF1385A73D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$
- Size 5.2MB
- SHA256 990413bbf55bfc889ea11c49157e9b464f2b85a0638e87c05080d366fdecb41d
- MD5 52f7d54e855973e5189e8103c369e2a8
- SHA1 dee7cacdce90a143c106f72c9dfa6c08bae0fa96
- SHA512 7df678724f0d1d35879641bc477d211871e0b563362efa61c278bfddf2fe491839ddb4e71ba80f1eb80df025a42ba8879fcfcd0500cf51a971e3341d27fbbc49
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqk:7ID41qM5ram6m5h6NkCq6
- TLSH T14B464A15B7A486A2E077D175C9A29296FE7278510F3087CF1384A72D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe$
- Size 4.8MB
- SHA256 ee651b212ffc80318b6494fe0a1717160760ef419bd72f55324a83ea88cedc6c
- MD5 0b8678280cf63b5584a4131dac71207b
- SHA1 7428fc2ecb076a4448fefd301b71e9ff21572efa
- SHA512 be13b5729fa5d78e27d43badaf87f0e58150c4ac63ccbbccdfe6a3ed0ed0f8412ad4b69b71e387ebedee5249a0ea266f2b4798ba2c7e17a7111482e3d78e448e
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqI:7ID41qM5ram6m5h6NL
- TLSH T15D364A16B7A486A2D0779175C9A29296FE7238510F3087CF1385A73D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe$
- Size 4.8MB
- SHA256 c7ebc468f7897209c988d07b3de9d6f5f080034053f9b7135759616dd58620e5
- MD5 8105df105b9f60c10361e9b1034329e6
- SHA1 233863d354831581621ad91372aaae212ec5c70a
- SHA512 c92550dcf8df101ea7096629318107b3d84a3e5b480a924772264ec62995e77c6bc2aba5e89077e37d31c6185be4090e6a48c8b7875f68e5fff8c033d6cd22af
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqa:7ID41qM5ram6m5h6N9
- TLSH T1DE364A16B7A486A2D0779175C9A29296FE7238510F3087CF1385A73D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$
- Size 4.8MB
- SHA256 6d4eef908a9798de6ce3fd9d0a2880b97a753d3c604304f76eaf8fae7dbb2fd8
- MD5 e9714727a107acb458e26fb79276d7d0
- SHA1 c9ac368ccdecba103ec1298ad04ce5a3104979ef
- SHA512 49fbac3225673b5aaa7f6e9dedbf4389d095a18a7a60f8c517d703d33dbf977cfa7eb32d042296f1ccf71682d4bf72b13ea293317e41aa0465bb2cfb489cf33c
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqn:7ID41qM5ram6m5h6NQ
- TLSH T137364A16B7A486A2D0779175C9A29296FE7238510F3087CF1385A73D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$
- Size 4.8MB
- SHA256 d1d2b9bf6b78a6b0d11b67fd52684c940d1e39188c3612db76074418bd2d412b
- MD5 e2df1c6944490f8e3cd6e6ab1e83fa7f
- SHA1 f26242194d4bcb911976e8b0b5f0ae728df04608
- SHA512 049afff5e7d2addc7ec3f2e6d702e3f42252bbf2f4f58312af68428576b5e9a331667ac5c52ed698c7d815f2c6e79a29b1ff961b04a9f15f76285597eb3b1c66
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqT:7ID41qM5ram6m5h6Ng
- TLSH T17A364A16B7A486A2D0779175C9A29296FE7238510F3087CF1385A73D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$
- Size 4.8MB
- SHA256 7a973c9fe1f8407d2f4e4bfc0a5172602ca16da1b66600b023938fdffa15cdd6
- MD5 4ac174c2e556b6537b41cc64dc3d2a1f
- SHA1 14ac4638969f1c231050256a59298d90c77f7cff
- SHA512 a171d8a9b5efd6b37df79cddbdf2f37923d8d28d30a97a7c86a513515c981fe0ad38fdf0c34dce3d82f0e1b758f462af113eaa7f342e625110e98e855f733fd4
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsq/:7ID41qM5ram6m5h6N8
- TLSH T119364A16B7A486A2D0779175C9A29296FE7238510F3087CF1385A73D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
- Size 4.8MB
- SHA256 51bd76364131342f8f50dbe16495c5a0ea8ad4307489161bf47b17f2372bb12c
- MD5 6fe7208ab91408ae2b44bb04142e5b14
- SHA1 bd03e86cf519bc5702f8224a9a2c96dcb9138244
- SHA512 39371684b5344fed3081e0b9ad56fa932a33dd2ca208a676e2660050de60b43a80a1d313c2c2c0db5749664611d6ac8810ac7d7d9a4d22349a0a638d3f10cd40
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqy:7ID41qM5ram6m5h6NJ
- TLSH T136364A16B7A486A2D0779175C9A29296FE7238510F3087CF1385A73D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$
- Size 4.9MB
- SHA256 8659870c4085620e71f43c1cc2b7061883f42ce9a1c49fa6c380167d3186fb1c
- MD5 4340289643448a438416d6058b646c52
- SHA1 9c4d7d6929be11471d7b6519ee4146229fbd3571
- SHA512 7b3e223d1546c65890aaf348ec5015903a09359275d53da715142a1697556f7dff0e9f758209c22eb460d7547bf5ae655f3ea8136c4087eeb6b940d4aaa56d66
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqS:7ID41qM5ram6m5h6N5
- TLSH T178364A15B7A486A2E077D175C9A29296FE7238510F3087CF1385A72D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$
- Size 4.8MB
- SHA256 25368918f628567f01a85e491cb1b78991dccd8ce6a51a834d614067b0c68c81
- MD5 30537aceb282b5214c9d8d8be5479b32
- SHA1 c9800f5a9a3d739b1337925671d7c805a91694f2
- SHA512 7244ae698bebb614b52232775b868d5b56b1753521c0b2f608b47ff30b7f4ea88e71c1e1fba0b2c61ca1afd2650395ccdeb776424fb46acc371ee39a0e3137cc
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqN:7ID41qM5ram6m5h6Na
- TLSH T108364A16B7A486A2D0779175C9A29296FE7238510F3087CF1385A73D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe$
- Size 4.8MB
- SHA256 341c661da130b790e28600a6b76533b7ace942437dee2b03df3ba51004d5f777
- MD5 a9cb3909b26c8258c1e3d865d5ddf232
- SHA1 2901bc3acaf8a304a98c931f1ff2994136500ec0
- SHA512 b6a256a949229b6840e5a82915f8b84fd0a7dc8ad95c2fd47ab7f5262bd25407465600d4bf80a15300235c27042c1311aa611f2b8d85615f468af4782bb889ac
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqV:7ID41qM5ram6m5h6NK
- TLSH T1D1364A16B7A486A2D0779175C9A29296FE7238510F3087CF1385A73D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ktab.exe$
- Size 5.2MB
- SHA256 db60328abd0234114e64e5d230701781c0ae62dcf2b506e82e066a711adc41d9
- MD5 eb12b10a8b0575032d3ea9cf8ffd10c7
- SHA1 d86eda32547610f9bbb626c8cc6b98e544b8e999
- SHA512 d317bfdace7174645f71149f0ed50c7ca216e84227cf7debe8c0a01bd5b31f178a8779e14c917716e34cea5d6c4f44e209c7b5ab93ccf722c02d788e6de88e93
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqd:7ID41qM5ram6m5h6NVCqo
- TLSH T1B6464A15B7A486A2E077D175C9A29296FE7278510F3087CF1384A72D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ktab.exe$
- Size 5.6MB
- SHA256 21dd05e953eb3529202b44fc2a0e97119dc490e22682dbecfa05bd841d68005b
- MD5 066d119b183f9b3c356c22475a928869
- SHA1 2049bb850105d14f251ca283f05b14d7c90fd51b
- SHA512 0ef7c8f4c44aba14fe90ef04e2371a83efb6c67a570eebf803709c96171ee96c088735bbbf68f8ee534a3d1e02e169eb8e592e22a6ebf54eb2743d2659d3e343
- SSDEEP 98304:7ID41qM5ram6m5h6NfMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMP:7ui52m6m5h6N
- TLSH T18E464A16B7A486A1D0778175C9A29296FE727C510F3087CF2285B72D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$
- Size 5.3MB
- SHA256 89999b79d812f2e8dcb1edbf691e7396b2950fd209de5a907d240cbb0f6645bf
- MD5 8fda3891ab32b3b4f5ace49d9562b530
- SHA1 a0576a833ea56b4668c7271185c7e405a7a302d7
- SHA512 2e3fd543ea4db29faa4e7821090b717bef3349e7e950a963aa9cae468060445eade0fd3def9b41c8fc267ffeb09eb90ecffabf4109ddccdb7ac0eda17b6595f3
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsqY:7ID41qM5ram6m5h6NQ0QA
- TLSH T1D9464905B7A486A5D4739175C9A292A6FE727C510F30D7CF1284E72D2F33BD0A93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe$
- Size 4.8MB
- SHA256 574ff1a62ab4b705b46f74f0751e12fc2b57807e4dab6158f11a4ddda80e0887
- MD5 f9bddd03947699f918c4eb9081f6cd77
- SHA1 09591d90c83067f01bc74342580193cd794ae99a
- SHA512 217c81fbd0d5f580aa712b6f60dd0823ad8d9ef4f75ba00a6c85d5a8d43bdce2f1fca12da545ccee827eb51a96626f545476a3da32caef4fc05200f2b00d6096
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5G7iw2bqrGdpYqsq3:7ID41qM5ram6m5h6NA
- TLSH T1CA364A16B7A486A2D0779175C9A29296FE7278510F3087CF1384A73D2F337D1E93A722
- MD5 SHA1 SHA512 SSDEEP TLSH