Analysis
- max time kernel
102s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/07/2026, 22:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_.exe
- Size 3.4MB
- Sample260708-18b5msay2x
- SHA256 d75bf01c515a3955a2c67e75070c783f55f07889dfc0bf5344f9b723f0e437a5
- MD5 8b321d4f2ee279f3209f36b87097b7b2
- SHA1 28c4ef4d6516fd0e83b885464b790cab0968ebb1
- SHA512 6ed98d9d83e98203f02f5c4ddeb3c83ae44c8fcb4c792c0d2182b02100d9fe0e201199036c672ef60195f2cb02b49f882660b0e7c95d655705b20393e32c99fc
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhURJvy6i1zuajsauZjaEvJ:TIDQ/rwSR1t3x
- TLSH T1C1F55A02A3A305A6DD6B6130C2256210A273BE702F62D3DB6B90F93D7F327D16975727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 14 IoCs
pid Process 3760 patcher.exe 3680 910.#.exe 5092 699.#.exe 3076 67.#.exe 3088 707.#.exe 4740 959.#.exe 4588 789.#.exe 4204 452.#.exe 3272 428.#.exe 1080 635.#.exe 4840 777.#.exe 1520 984.#.exe 532 452.#.exe 3188 494.#.exe - Adds Run key to start application 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 959.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 428.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 777.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 984.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 494.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 699.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 635.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 452.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 910.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 789.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 452.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 67.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 707.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 236.#.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 707.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 789.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 428.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 777.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 452.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 494.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak patcher.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 699.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ 959.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\ 428.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\amd64\ 910.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\applet\ 910.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\el-GR\ 707.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 699.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ 959.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 67.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\ 67.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\ 707.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\ 452.#.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\ 428.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\ 910.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ 452.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\ 777.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\ 789.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_.exe File opened for modification C:\Program Files\Common Files\System\uk-UA\ 707.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\ 910.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ 789.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 910.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 699.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\ 67.#.exe File opened for modification C:\Program Files\dotnet\host\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\ 699.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ 2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 67.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\ 2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 67.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\ 707.#.exe File opened for modification C:\Program Files\Common Files\System\ 789.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 699.#.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 910.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 428.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\ 452.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\ 777.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\ 699.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\ 699.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 699.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sv-SE\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ 910.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 707.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\ 910.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ 789.#.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 67.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-TW\ 428.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ 910.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\ 2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_.exe File opened for modification C:\Program Files\dotnet\shared\ 67.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\ 428.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\applet\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 635.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ 789.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\ 67.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\ 699.#.exe - System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 452.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 452.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 236.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 494.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 959.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 635.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 777.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 984.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 910.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 707.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 789.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 428.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 699.#.exe - NTFS ADS 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 959.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 452.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 635.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 236.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 910.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 67.#.exe - Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2040 2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_.exe 3760 patcher.exe 3680 910.#.exe 5092 699.#.exe 3076 67.#.exe 3088 707.#.exe 4740 959.#.exe 4588 789.#.exe 4204 452.#.exe 3272 428.#.exe 1080 635.#.exe 4840 777.#.exe 532 452.#.exe 3744 236.#.exe 3188 494.#.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2040 wrote to memory of 3680 2040 2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_.exe 86 PID 3760 wrote to memory of 5092 3760 patcher.exe 87 PID 3680 wrote to memory of 3076 3680 910.#.exe 88 PID 5092 wrote to memory of 3088 5092 699.#.exe 89 PID 3076 wrote to memory of 4740 3076 67.#.exe 92 PID 3088 wrote to memory of 4588 3088 707.#.exe 93 PID 4740 wrote to memory of 4204 4740 959.#.exe 96 PID 4588 wrote to memory of 3272 4588 789.#.exe 97 PID 4204 wrote to memory of 1080 4204 452.#.exe 98 PID 3272 wrote to memory of 4840 3272 428.#.exe 99 PID 1080 wrote to memory of 1520 1080 635.#.exe 100 PID 4840 wrote to memory of 532 4840 777.#.exe 103 PID 532 wrote to memory of 3188 532 452.#.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_8b321d4f2ee279f3209f36b87097b7b2_amadey_cobalt-strike_coinminer_elex_emotet_hijackloader_.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\910.#.exeC:\Users\Admin\AppData\Local\Temp\910.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\67.#.exeC:\Users\Admin\AppData\Local\Temp\67.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\959.#.exeC:\Users\Admin\AppData\Local\Temp\959.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\452.#.exeC:\Users\Admin\AppData\Local\Temp\452.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\635.#.exeC:\Users\Admin\AppData\Local\Temp\635.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\984.#.exeC:\Users\Admin\AppData\Local\Temp\984.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\236.#.exeC:\Users\Admin\AppData\Local\Temp\236.#.exe8⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\857.#.exeC:\Users\Admin\AppData\Local\Temp\857.#.exe9⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\627.#.exeC:\Users\Admin\AppData\Local\Temp\627.#.exe10⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\331.#.exeC:\Users\Admin\AppData\Local\Temp\331.#.exe11⤵PID:4344
-
-
-
-
-
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\905c0769f9a06c95a24ddf945\699.#.exeC:\905c0769f9a06c95a24ddf945\699.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\905c0769f9a06c95a24ddf945\707.#.exeC:\905c0769f9a06c95a24ddf945\707.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\905c0769f9a06c95a24ddf945\789.#.exeC:\905c0769f9a06c95a24ddf945\789.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\905c0769f9a06c95a24ddf945\428.#.exeC:\905c0769f9a06c95a24ddf945\428.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\905c0769f9a06c95a24ddf945\777.#.exeC:\905c0769f9a06c95a24ddf945\777.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\905c0769f9a06c95a24ddf945\452.#.exeC:\905c0769f9a06c95a24ddf945\452.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532 -
C:\905c0769f9a06c95a24ddf945\494.#.exeC:\905c0769f9a06c95a24ddf945\494.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3188 -
C:\905c0769f9a06c95a24ddf945\987.#.exeC:\905c0769f9a06c95a24ddf945\987.#.exe9⤵PID:4068
-
C:\905c0769f9a06c95a24ddf945\680.#.exeC:\905c0769f9a06c95a24ddf945\680.#.exe10⤵PID:1332
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.4MB
- SHA256 d75bf01c515a3955a2c67e75070c783f55f07889dfc0bf5344f9b723f0e437a5
- MD5 8b321d4f2ee279f3209f36b87097b7b2
- SHA1 28c4ef4d6516fd0e83b885464b790cab0968ebb1
- SHA512 6ed98d9d83e98203f02f5c4ddeb3c83ae44c8fcb4c792c0d2182b02100d9fe0e201199036c672ef60195f2cb02b49f882660b0e7c95d655705b20393e32c99fc
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhURJvy6i1zuajsauZjaEvJ:TIDQ/rwSR1t3x
- TLSH T1C1F55A02A3A305A6DD6B6130C2256210A273BE702F62D3DB6B90F93D7F327D16975727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$
- Size 3.4MB
- SHA256 1f858dfd8cf4a4f3b54aa4ccb8e9e5cb5478f23348125e775674046235877c81
- MD5 51405a67926e4fe77c134a4ff9650795
- SHA1 98ad268671a4d02498cecbdf48408998c40250db
- SHA512 de8a93fd0e54b18375d2177754d8fd4673584fd38bc0fedc0c4faa5ee0fba0150b45a4d91a2a90158070b91bf9ff5f5b93c1188d530796aa54b10c9537e92020
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhURJvy6i1zuajsauZjaEv:TIDQ/rwSR1t3
- TLSH T1EEF55A02A3A305A6DD6B6130C2256610A273BE702F62D3DB6B90F93D7F327D06975727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 3.5MB
- SHA256 69d2df07a3d878c78aee4cfd3797a93618ea432eea7f24cbfce5f0367e70297b
- MD5 f9b13b4aa0c94ecb9ca5bf64766403d3
- SHA1 9c0f6311b4cdf5371329e7b9631459056295a3ca
- SHA512 325833c75f1bffaadccbcdf2a6cd8f9c35ee656a77305c82774d04742b36d540d3846e487ff4f300f3b5c5f3a926ebef854b06b2cfb616642bb9abdc803271b6
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhURJvy6i1zuajsauZjaEv0:TIDQ/rwSR1t3s
- TLSH T1EDF56A02A3A305A6DD6B6130C6256210A273BE702F62D3DF6A90F93D7F327D16975723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.5MB
- SHA256 4c0dd614b7f509f36987f4fa53c94656dc246565fd2f974eace9bf56b284e3b9
- MD5 99f686e5239f2753a548fc2bb684c1c3
- SHA1 41010e1c430def360185f4c2303dd0d63fb09751
- SHA512 05e49443ee3b08569d92d4a8582047ab8ff36a1f723707da77c6487cbed2752159af4684e0392f989cd275d9cc794214d02a8f10c7b0fad5ce595b43f1e53561
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhURJvy6i1zuajsauZjaEvG:TIDQ/rwSR1t3O
- TLSH T18F063802E2A305A6DC6F6130C7255610B273BE702FA293DB6AD0F93D7B326D059B5727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$
- Size 3.4MB
- SHA256 b396010ceca871815ad0814453f1b8ad6502da7b60edb4fe4f34b4ed9cb1583a
- MD5 ac17e66b66feb5f9d7940d25ac90c991
- SHA1 fc024f62a13ce81d151171369d93af72f05d9f88
- SHA512 da273c968382be9f0c49ffbbe20be642d2fa345b4d35262bda8fa2aa9c3309c61eb547b9755c38c3e586c49db8e911a79ff7a66cc7770fbacd7b3875c6a8a1ae
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhURJvy6i1zuajsauZjaEv4:TIDQ/rwSR1t3Q
- TLSH T160F55A02A3A305A6DC6B6130C2256210A673BE702F62D3DB6B90F93D7F327D16975727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 3.4MB
- SHA256 ca4131df9b33e6941d4ba7fe6fad9be40e401b678a92b992b97eb4b3e7202b94
- MD5 27fcb4c2b6bd966bb95d85330c2514eb
- SHA1 ee4ea5d3865c7e96c31fca516b876ed2b9d6ab2b
- SHA512 414f08edf0b65bddf57a4f765df7c6cbfc4dda0cc987be53833ae05821b2d914d817a0060f56642f4686bd5556b23925ba90268624eb2639ff57431d42bf29bb
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhURJvy6i1zuajsauZjaEvy:TIDQ/rwSR1t36
- TLSH T13FF55A02A3A305A6DC6B6130C2256210A673BE702F62D3DB6B90F93D7F327D16975727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe$
- Size 3.4MB
- SHA256 b570642e62e88e14e1c0f4f628117ed9946157753a9985fa7bac06721b9af975
- MD5 02d0319c1430666ab86cabbcf71fea92
- SHA1 82ff1868827464d316246e4e016734245a5d84bc
- SHA512 19d3ebae40255eb4d9e9f23f4494c59afe28425281785a537d0794faefdeaa262aa837ad80708ad96223616e96372af48b0c47e1a42346a5a6a6d1b7279082f7
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhURJvy6i1zuajsauZjaEvk:TIDQ/rwSR1t3c
- TLSH T11FF55A02A3A305A6DC6B6130C2256210A673BE702F62D3DB6B90F93D7F327D16975727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 3.4MB
- SHA256 2a1474f16ce193affa2427bdbbd41caf25803ce5288e89af941daee25acea588
- MD5 438be5b785d8d2dad5da120b79cc80c9
- SHA1 4fc18f4e569c2d1513eb5d2b921802592110bea1
- SHA512 42eb8fe76f5607b408e5c5a0249348b57988dff11002c0975d3bd474729f299efbf5e16da851c15b7a63b80ae73d6f5b8e7380b12808a5c322f1db7525674544
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhURJvy6i1zuajsauZjaEvE:TIDQ/rwSR1t3s
- TLSH T1BDF55A02A3A305A6DD6B6130C2256210A273BE702F62D3DB6B90F93D7F327D16975727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\kinit.exe$
- Size 3.4MB
- SHA256 1612416d774edb23ff0d408a5b23a685101e5c44415c1d005df01d1baa4fe925
- MD5 9a35956d5b63e8963aa6bbd99256e8aa
- SHA1 fbca1075e2b0101fa517ce4af56a58c9d44ee65d
- SHA512 2834c296744ced2d41b5c35a3cb8dc1839e629bed02ccc2cd6a21fc93fc1e2cbcef78f6d86e06f7a310b7d15d7bc2af072ac5b17798771b51ddb4ef8f1fa33c5
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhURJvy6i1zuajsauZjaEv+:TIDQ/rwSR1t32
- TLSH T13DF55A02A3A305A6DD6B6130C2256210A273BE702F62D3DB6B90F93D7F327D16975727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
- Size 3.4MB
- SHA256 6c0b682109c97944b6b0ba15b2a290a9f14f0a68ad2c7a99f458865fef8d4b40
- MD5 f5dad41b5b3fdf0aa2d3367d246ebb09
- SHA1 dda98d920863fa7f1238dd5ac6fb4698e960ae26
- SHA512 bfa800b0046a43256e34d8f24daace99aa7ed16422e6df1d1299c0339718e6aa081f718e0367dc07919a2d393134099e368a84736be97dffafa8566c729c2e89
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhURJvy6i1zuajsauZjaEvp/:TIDQ/rwSR1t3B/
- TLSH T195F55A02A3A305A6DC6B6130C2256210A673BE702F62D3DB6B90F93D7F327D16975727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmid.exe$
- Size 3.4MB
- SHA256 65e440646dafd0b831e7e4959e39c43e79f7e65f7477493aa431addcd7884910
- MD5 977ec7cfa997228a5b374256f6a431fe
- SHA1 95d0ce213dc2fb0f78a4d31d5ec94a7e47b253b4
- SHA512 813ebc6adb1a1ed2dbfed6ff051b2e29c8db7a2d9ac7bccd3e16fa0ed90c6f708564bf45424e20fcc0a3456c66bae5646f08a469905a0995eaff85364182d610
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhURJvy6i1zuajsauZjaEvR:TIDQ/rwSR1t35
- TLSH T1D0F55A02A3A305A6DD6B6130C2256210A273BE702F62D3DB6B90F93D7F327D16975727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 3.9MB
- SHA256 fe961c73dc268415caeef8c9cd9df6dcbba2b8b92cb46156b1b5268395415658
- MD5 75cc51a59c2a24f5d0d48574f6e20dfe
- SHA1 55ed006d621d71583c5f15438d2dc6aa1034cc2e
- SHA512 1ca1b86e46457afd642b1808fd3c62fa25376f329debeac7f357f949bdbe13d2d554ac947a35257efb5dced9d2f4ee427042c46461dbe9d9d03e78ecbf650a44
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhURJvy6i1zuajsauZjaEvpUOlk09:TIDQ/rwSR1t3D9
- TLSH T13B165A02E3A345A6DD6B6134C6665600A2727D301F62D3CB6A90F93D7F327D06E79B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\331.#.exe
- Size 1.9MB
- SHA256 af85511974612e68b534d66f2aaf5f671f19832520372ed92d4e1f8d069ff72a
- MD5 14bece6ef2e6b9855a9b07e6b313b20b
- SHA1 736f6ecc6bdcf5671d1a07c08729da11e23b8523
- SHA512 ed318e071e57546eddb27c2544b12b37ae7061c4b4731d256418ffdaecdd1b697fcda031e2518aec69593f5818327c020d22f902811d3cc86d2e2d5cf74ca912
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhK:TIDQ/rwY
- TLSH T19D955A01A7A35077DD632171842A77641764BFB02F67D2EBAF007919FA327C2693237A
- MD5 SHA1 SHA512 SSDEEP TLSH