Analysis
- max time kernel
83s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 23:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_127d39956bec28dcd6ded60421b3ab6f_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_127d39956bec28dcd6ded60421b3ab6f_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-17_127d39956bec28dcd6ded60421b3ab6f_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
- Size 2.1MB
- Sample260717-3wr2fadv4t
- SHA256 2aa607b82ed14094824e27433eb898039ea488db942bbb9d270bc1c81ff2ebb2
- MD5 127d39956bec28dcd6ded60421b3ab6f
- SHA1 62747f4b8fef3ebff0518bef1076fa5a1cc5afbf
- SHA512 ff8eef31d882ead8881542021e2c0e5dba8416d6c6aaad9da784f779d92efcaf36718a33a77b3d50aa7c46494189042a9013e6e63c21c3a134e87f686eabc3cd
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEMyqatgl0iw2/C5556ru56rJ:TIDQ4L56rbrJ
- TLSH T180A53A1577EA5F65E9BF9234886642A2AA737C105F2183CF1340BE2D3E336D0AA35717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 15 IoCs
pid Process 4612 patcher.exe 5068 739.#.exe 1744 575.#.exe 5432 979.#.exe 3412 250.#.exe 4280 568.#.exe 4792 878.#.exe 5448 309.#.exe 3084 785.#.exe 6076 975.#.exe 4688 919.#.exe 1296 550.#.exe 3796 239.#.exe 3824 716.#.exe 4396 455.#.exe - Adds Run key to start application 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 919.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 239.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 455.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 309.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 575.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 979.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 785.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 716.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 739.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 250.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 878.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 975.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 550.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-17_127d39956bec28dcd6ded60421b3ab6f_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 568.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nl-NL\ 2026-07-17_127d39956bec28dcd6ded60421b3ab6f_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\ 785.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 575.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ur-PK\ 975.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\amd64\ 575.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\ patcher.exe File created C:\Program Files\7-Zip\7zFM.exe 979.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ 309.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\kk-KZ\ 785.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 878.#.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\ 2026-07-17_127d39956bec28dcd6ded60421b3ab6f_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\ 568.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\ 250.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\ 979.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\quz-PE\ 309.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ 739.#.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 575.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ 979.#.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\applet\ 309.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ 575.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ 575.#.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 309.#.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\ 979.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\ 309.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 575.#.exe File opened for modification C:\Program Files\Common Files\System\it-IT\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\ 250.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 878.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\ 550.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ 250.#.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 250.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ 309.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\as-IN\ 739.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\te-IN\ 309.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\ 309.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\id-ID\ 979.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-TW\ 739.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\ 785.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ 575.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ 309.#.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\ 878.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\ 575.#.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 979.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lb-LU\ 568.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\ 975.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\ 979.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ 878.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-CA\ 2026-07-17_127d39956bec28dcd6ded60421b3ab6f_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\ 575.#.exe File opened for modification C:\Program Files\Common Files\System\de-DE\ 575.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\ 250.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\gl-ES\ 785.#.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\ 250.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ 975.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 309.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\af-ZA\ 309.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ 575.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\ 309.#.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 785.#.exe File opened for modification C:\Windows\:\systemlog.bak 975.#.exe File opened for modification C:\Windows\:\systemlog.bak 716.#.exe File opened for modification C:\Windows\:\systemlog.bak 575.#.exe File opened for modification C:\Windows\:\systemlog.bak 250.#.exe File opened for modification C:\Windows\:\systemlog.bak 878.#.exe File opened for modification C:\Windows\:\systemlog.bak 309.#.exe File opened for modification C:\Windows\:\systemlog.bak 550.#.exe File opened for modification C:\Windows\:\systemlog.bak 239.#.exe File opened for modification C:\Windows\:\systemlog.bak 455.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 975.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 919.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 716.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 979.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 239.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 455.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 878.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 309.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 785.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 550.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_127d39956bec28dcd6ded60421b3ab6f_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 739.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 575.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 568.#.exe - NTFS ADS 16 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-07-17_127d39956bec28dcd6ded60421b3ab6f_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 979.#.exe File opened for modification C:\Windows\:\systemlog.bak 250.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 568.#.exe File opened for modification C:\Windows\:\systemlog.bak 575.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 739.#.exe File opened for modification C:\Windows\:\systemlog.bak 975.#.exe File opened for modification C:\Windows\:\systemlog.bak 455.#.exe File opened for modification C:\Windows\:\systemlog.bak 878.#.exe File opened for modification C:\Windows\:\systemlog.bak 309.#.exe File opened for modification C:\Windows\:\systemlog.bak 785.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 919.#.exe File opened for modification C:\Windows\:\systemlog.bak 550.#.exe File opened for modification C:\Windows\:\systemlog.bak 239.#.exe File opened for modification C:\Windows\:\systemlog.bak 716.#.exe - Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 2780 2026-07-17_127d39956bec28dcd6ded60421b3ab6f_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 4612 patcher.exe 5068 739.#.exe 1744 575.#.exe 5432 979.#.exe 3412 250.#.exe 4280 568.#.exe 4792 878.#.exe 5448 309.#.exe 3084 785.#.exe 6076 975.#.exe 4688 919.#.exe 1296 550.#.exe 3796 239.#.exe 3824 716.#.exe 4396 455.#.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2780 wrote to memory of 5068 2780 2026-07-17_127d39956bec28dcd6ded60421b3ab6f_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 91 PID 4612 wrote to memory of 1744 4612 patcher.exe 92 PID 5068 wrote to memory of 5432 5068 739.#.exe 93 PID 1744 wrote to memory of 3412 1744 575.#.exe 94 PID 5432 wrote to memory of 4280 5432 979.#.exe 95 PID 3412 wrote to memory of 4792 3412 250.#.exe 96 PID 4792 wrote to memory of 5448 4792 878.#.exe 97 PID 5448 wrote to memory of 3084 5448 309.#.exe 99 PID 3084 wrote to memory of 6076 3084 785.#.exe 100 PID 4280 wrote to memory of 4688 4280 568.#.exe 101 PID 6076 wrote to memory of 1296 6076 975.#.exe 102 PID 1296 wrote to memory of 3796 1296 550.#.exe 103 PID 3796 wrote to memory of 3824 3796 239.#.exe 104 PID 3824 wrote to memory of 4396 3824 716.#.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_127d39956bec28dcd6ded60421b3ab6f_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_127d39956bec28dcd6ded60421b3ab6f_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\739.#.exeC:\Users\Admin\AppData\Local\Temp\739.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\979.#.exeC:\Users\Admin\AppData\Local\Temp\979.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\568.#.exeC:\Users\Admin\AppData\Local\Temp\568.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\919.#.exeC:\Users\Admin\AppData\Local\Temp\919.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\184.#.exeC:\Users\Admin\AppData\Local\Temp\184.#.exe6⤵PID:2244
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\905c0769f9a06c95a24ddf945\575.#.exeC:\905c0769f9a06c95a24ddf945\575.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\905c0769f9a06c95a24ddf945\250.#.exeC:\905c0769f9a06c95a24ddf945\250.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\905c0769f9a06c95a24ddf945\878.#.exeC:\905c0769f9a06c95a24ddf945\878.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\905c0769f9a06c95a24ddf945\309.#.exeC:\905c0769f9a06c95a24ddf945\309.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\905c0769f9a06c95a24ddf945\785.#.exeC:\905c0769f9a06c95a24ddf945\785.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\905c0769f9a06c95a24ddf945\975.#.exeC:\905c0769f9a06c95a24ddf945\975.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\905c0769f9a06c95a24ddf945\550.#.exeC:\905c0769f9a06c95a24ddf945\550.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\905c0769f9a06c95a24ddf945\239.#.exeC:\905c0769f9a06c95a24ddf945\239.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\905c0769f9a06c95a24ddf945\716.#.exeC:\905c0769f9a06c95a24ddf945\716.#.exe10⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\905c0769f9a06c95a24ddf945\455.#.exeC:\905c0769f9a06c95a24ddf945\455.#.exe11⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4396 -
C:\905c0769f9a06c95a24ddf945\390.#.exeC:\905c0769f9a06c95a24ddf945\390.#.exe12⤵PID:4112
-
C:\905c0769f9a06c95a24ddf945\49.#.exeC:\905c0769f9a06c95a24ddf945\49.#.exe13⤵PID:4956
-
C:\905c0769f9a06c95a24ddf945\441.#.exeC:\905c0769f9a06c95a24ddf945\441.#.exe14⤵PID:4788
-
C:\905c0769f9a06c95a24ddf945\224.#.exeC:\905c0769f9a06c95a24ddf945\224.#.exe15⤵PID:1664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.1MB
- SHA256 2aa607b82ed14094824e27433eb898039ea488db942bbb9d270bc1c81ff2ebb2
- MD5 127d39956bec28dcd6ded60421b3ab6f
- SHA1 62747f4b8fef3ebff0518bef1076fa5a1cc5afbf
- SHA512 ff8eef31d882ead8881542021e2c0e5dba8416d6c6aaad9da784f779d92efcaf36718a33a77b3d50aa7c46494189042a9013e6e63c21c3a134e87f686eabc3cd
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEMyqatgl0iw2/C5556ru56rJ:TIDQ4L56rbrJ
- TLSH T180A53A1577EA5F65E9BF9234886642A2AA737C105F2183CF1340BE2D3E336D0AA35717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$
- Size 2.1MB
- SHA256 3670422f03d3293e300111f28491b461a64d6f0bb6ce2485ef153c1be810571a
- MD5 cc9a6f775c11da69e968ee53c15b890d
- SHA1 482cacd03747b2982bbfd5fd593137c5aa0a8492
- SHA512 569449d7a5e4a5271feb2f94233952c6fdabd6356649d0478b9307401c568a00fd902c296bfce2e294eb6c1f1f88f975690405202605ecaa273635969656faaa
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEMyqatgl0iw2/C5556ru56rE:TIDQ4L56rbrE
- TLSH T14DA53A0577EA5F65E9BF9234886642A2AA737C115F2183CF1340BE2D3E336D0AA35717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$
- Size 2.1MB
- SHA256 2d36d0ad7f685862e1f7429b18066f4983db95a7c635c40d9e83acbd82dd2640
- MD5 f480dd1e3d093373375d405cdc33d8bd
- SHA1 9085f47ccbb3a4e4601ca468d370e79470401ad0
- SHA512 67cbd8e8b7c431b65a73042ea9965f2d374385f279b9e1276915a0966e6c96632eddd99102ff4847cb156252ff51f1e802d19de967f89adaf43226cb14a6c696
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEMyqatgl0iw2/C5556ru56rc:TIDQ4L56rbrc
- TLSH T1D7A53A0577EA5F65E9BF9234886642A2AA737C115F2183CF1340BE2D3E336D0AA35717
- MD5 SHA1 SHA512 SSDEEP TLSH