Analysis
- max time kernel
109s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 13:04
Behavioral task
behavioral1
Sample
2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
- Size 1.8MB
- Sample260707-qa82lsfv5j
- SHA256 cf690ae335ab34565367a1d4dc3473f4dc8c496a62b91f37421767b698189758
- MD5 93ddbc1be1616a82f33a1301a4bc138e
- SHA1 68918b66729cb35bb6aa9ff15dde554b47c5abc4
- SHA512 d06ae50a1b1e4e9dbcb1afeaf8bd8faf5a481f22408894de6950d688dc093c24c9bf9318954f1d292b23bd71e476c3ae8cdb262cec987ef14a4ca1e34f09fdb5
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6r2JoNa45jcAkSYqyE05jcAkSYqyE:A3kMPljRpYqqpYq
- TLSH T139956C26F6748675D073C0B9CAD2A75AEE3134410B308ACB5399C76C2F277D29A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/5032-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c5b9-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b29e-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5032-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3632-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0009000000019ccf-1012.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0f4-1014.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019ca9-1288.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c5b9-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b29e-11.dat aspack_v212_v242 behavioral2/files/0x0009000000019ccf-1012.dat aspack_v212_v242 behavioral2/files/0x000300000001a0f4-1014.dat aspack_v212_v242 behavioral2/files/0x0004000000019ca9-1288.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3632 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe - Drops file in Windows directory 23 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5032 2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe 3632 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_93ddbc1be1616a82f33a1301a4bc138e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5032
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3632
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 cf690ae335ab34565367a1d4dc3473f4dc8c496a62b91f37421767b698189758
- MD5 93ddbc1be1616a82f33a1301a4bc138e
- SHA1 68918b66729cb35bb6aa9ff15dde554b47c5abc4
- SHA512 d06ae50a1b1e4e9dbcb1afeaf8bd8faf5a481f22408894de6950d688dc093c24c9bf9318954f1d292b23bd71e476c3ae8cdb262cec987ef14a4ca1e34f09fdb5
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6r2JoNa45jcAkSYqyE05jcAkSYqyE:A3kMPljRpYqqpYq
- TLSH T139956C26F6748675D073C0B9CAD2A75AEE3134410B308ACB5399C76C2F277D29A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 6adc2b1c9564abb256dde62085819970099909c271149cc562fd954eacae7f59
- MD5 c4cf0d563800f261689bcd5e39090b93
- SHA1 2c0953f273471da7d4779327ceb7ba5ce1deb872
- SHA512 7919378ed56d1633f959bc00e7a965185407a82f665d2f1e4c571e7532671a18fb1da07b21a0c2e522ae80097f7bdead52c107e5a99bc5c70ce5aa1e48788658
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6r2JoNa45jcAkSYqyE05jcAkSYqyED0Le5ji0hmxNw:A3kMPljRpYqqpYqjPji0Aj
- TLSH T184B54B26F6748675D073C0B9C5D2A79AEE7134410B308ACB5399C76C2F277E29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE
- Size 2.4MB
- SHA256 1ecaf560cc1813f715567dc9a3019f03565e74147a35c890dc953972e679b04b
- MD5 d40ef2fd393756bcfd4b53bf002368e5
- SHA1 a98d7dd1b044f97ec712d06403b1dcaef2a63810
- SHA512 e82b3ff769af5bb6875fc3d851ec1068c407c0aef0b21e444bbb582fb27813fff1737da8be55c9c5835e17c5c4dd444982dacb313d252b2f668763acba0f60d4
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6r2JoNa45jcAkSYqyE05jcAkSYqyER3N+tCn50ChWD:A3kMPljRpYqqpYqx8tDZqrKV
- TLSH T18BC56A16FB7486B1D073C0B9C6E29676FA7234410B309ACB5395C76D2F236E19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$
- Size 2.4MB
- SHA256 1301db3d0d4edde51c71f9cbd7108a077afd8d07654cb8e64a8cb0d5ac3b6df8
- MD5 89b52477609e9e88d9012bc3a415813b
- SHA1 ad075d0bc81523fe1efc9c64b4485ec3729df321
- SHA512 0ae1be992484e05c84010856ba44dab564f9433c3b163f3b335db3d140d05ef22bac055213a6b34b44c0f13811adb02bce459cb60edd387256d31ed37d3ae416
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6r2JoNa45jcAkSYqyE05jcAkSYqyEuwyCn50ChWdAk:A3kMPljRpYqqpYqSDZqrKV
- TLSH T108C55A16FB7486B1D073C179CAE29666FA7134410B308ACB5399C76D2F237E19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.9MB
- SHA256 109a031e55048b0ce316bd2cd98908fcf3fafa492e01110203fa74d33eb5d7b7
- MD5 fcb954f14cf12974f8c52aab22c59151
- SHA1 f3bd0dd92f596c19eb72edee0f179c701f950c35
- SHA512 ebbad4cc4830c5c8ae2b7bc388aba0b1620801ec5e4b9bc759871470429a25ba2cb5dea32989c32aa63a1e124d336e31ef157b8eb24c1a0534e5bb5cfffdb3e4
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6r2JoNa45jcAkSYqyE05jcAkSYqyEPF:A3kMPljRpYqqpYqt
- TLSH T11B954A12F6748675D073C0B5CAD2975AEA313C810B308ADB5399E7682F337D29A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH