Analysis
- max time kernel
102s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 23:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe
- Size 1.5MB
- Sample260814-213s3ace39
- SHA256 52f04b1f1ae9b926556444bf96c671f9cee37ace79a620c690ecccd42c94848e
- MD5 c4b4d1e043534a9fff2507cb070a7d2c
- SHA1 3a3ddb056909326820960915bc7f827294fe9838
- SHA512 b6fc2d3383de09bc138c4a837380fa89211cc276d0229d02857b420a35b049a6ebc7e4f0813f31a5a9fdef5e02b518dba4c43583a6183995f1a3d39cec009c77
- SSDEEP 49152:T92dc8MNFGD9zEX/IabjKoh9WtPji0Aj:TwcQAvIabjKoh9WNjo
- TLSH T106755B22F7A48A62C17784F685E19346EA717C510B2187CBE354B72CAF336D19E37722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1860 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3412 2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1860 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_c4b4d1e043534a9fff2507cb070a7d2c_amadey_elex_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3412
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1860
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 52f04b1f1ae9b926556444bf96c671f9cee37ace79a620c690ecccd42c94848e
- MD5 c4b4d1e043534a9fff2507cb070a7d2c
- SHA1 3a3ddb056909326820960915bc7f827294fe9838
- SHA512 b6fc2d3383de09bc138c4a837380fa89211cc276d0229d02857b420a35b049a6ebc7e4f0813f31a5a9fdef5e02b518dba4c43583a6183995f1a3d39cec009c77
- SSDEEP 49152:T92dc8MNFGD9zEX/IabjKoh9WtPji0Aj:TwcQAvIabjKoh9WNjo
- TLSH T106755B22F7A48A62C17784F685E19346EA717C510B2187CBE354B72CAF336D19E37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.1MB
- SHA256 8a25121688eba4bcb20761459876e4c5a34f4470b77c322322f2155dce367286
- MD5 6df8479ee6a0d77ac59ffaaa0f242fb3
- SHA1 829e6c97b0652c309f20d141381eab0ea9ec2370
- SHA512 298b01cec3c4fcd75cb189621763f7ee39c67849b6f55ab27d06bdcfebee604cbf7f12e539120e8710b02dbfe2e5dd1138bc757994933401cdec53fb600ea748
- SSDEEP 49152:T92dc8MNFGD9zEX/IabjKoh9WtPji0AjKPji0Aj:TwcQAvIabjKoh9WNjo0jo
- TLSH T14EA54A26F6648B61D07380FAC5E2974AEA713C910B3087CB9255B76C6F336D19A37732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 1.6MB
- SHA256 e8c587f30bc061268503f106ee969db13405e47f203024259d183fe9a2fab823
- MD5 32fd2f17a98adb0c5ce4169618281ec8
- SHA1 79541484e5b37d813e2b09fc316f741b7810fc43
- SHA512 d38f17bd2bbece83dc6fe634daa7fa904333d4e97cd5b1b4651752f72364eea5b20ab3b28d47bbd0a24f78602fa6de5fb0a7db2078fd4321e2ff4e64df56bc58
- SSDEEP 49152:T92dc8MNFGD9zEX/IabjKoh9WtPji0AjR:TwcQAvIabjKoh9WNjod
- TLSH T11F756B22F6A48A62C17784F685E19346EA717C510B2187CBE354B72CAF336D19F37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.6MB
- SHA256 21f84cf818878c5bd7f5ff629370fa7e348e22d00a149683d8bb2d9b22076635
- MD5 50f2b3d053a8fc42286bbf301a6c4f17
- SHA1 dcb9a473bef9f792921d44f047df8fec86532d4e
- SHA512 aefdc9d6e8be6de550c38a663a14f0eda1315ef3830781ca97ab4c505b678789f29ea64e3c74f9f6323ed6fb3bd7a2439ecd4ac197844a12281ff1d2cb5a18b3
- SSDEEP 49152:T92dc8MNFGD9zEX/IabjKoh9WtPji0Aj7:TwcQAvIabjKoh9WNjoX
- TLSH T101755B22F7A48A62C17784F685E19346EA717C510B2187CBE354B72CAF336D19E37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe
- Size 2.0MB
- SHA256 ee72e8d841283282e58110f1fd8bdcb41c98e09bba38132a6a354e9874918042
- MD5 5954ea6ce586189f7800a4f57766fac9
- SHA1 9a52e589ae036c3ff6aec0b39f6562781f96896a
- SHA512 dcb52a3d7253e205ca43de9777fa78aa51f98d79a44cf0710d4cdd21c52a1a29da18774ccc113e88df0174e8728baa60dfc6c29b04e61e97e977acdf6417634a
- SSDEEP 49152:T92dc8MNFGD9zEX/IabjKoh9WtPji0AjAi6:TwcQAvIabjKoh9WNjo8i6
- TLSH T1D4A55B93BB54DD72F06E84B58491833996327E680BE34787E24E7B1D9F322C54AF6321
- MD5 SHA1 SHA512 SSDEEP TLSH