Analysis
- max time kernel
104s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 22:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe
- Size 4.2MB
- Sample260825-2h3ekser8x
- SHA256 71d825b4f514ae0b8a7cdb1c6e2e7ee6823a7d989729ff75ee910e1787409d15
- MD5 b14d604bd704dc849c3c970ac7b70a5f
- SHA1 530039caea11293ab9fdcd85de7226c9a518bcf2
- SHA512 c0200645faa37afd73dc0bbac54eabd395cb0925fab2b7ac898dc6eebaf5b0e1f82fc56f78920d7e9ca0ac507950f6aba6962351c2e2e94011cbc7f2a3b7f1e4
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQCy6i1zuajsauZjaV21eW4SkZP4sz9Mb:7IDQ/nW1Psz+twsfkZc
- TLSH T11D166A02E6BB4272ECB79075C6A66665BA337811177086CF0384D63D2F33BD19A39727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 13 IoCs
pid Process 2236 patcher.exe 4328 920.#.exe 1996 640.#.exe 4332 372.#.exe 4212 280.#.exe 4288 274.#.exe 3320 964.#.exe 3988 226.#.exe 3788 772.#.exe 1808 418.#.exe 5072 628.#.exe 3940 767.#.exe 1060 417.#.exe - Adds Run key to start application 2 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 226.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 418.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 628.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 920.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 640.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 964.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 772.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 767.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 417.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 372.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 280.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 274.#.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 280.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 964.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 772.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 628.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 417.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak patcher.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 640.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ 920.#.exe File opened for modification C:\Program Files\dotnet\swidtag\ 372.#.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 640.#.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\ 964.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ 772.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\ 772.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 372.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\ 772.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 920.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\ 372.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\ 964.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\ 372.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\ 372.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\dotnet\host\ 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ patcher.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\ 280.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\ 920.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\ 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 640.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\ 920.#.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\ 280.#.exe File opened for modification C:\Program Files\Common Files\System\en-US\ 274.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ 964.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\ 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ 280.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\ 372.#.exe File opened for modification C:\Program Files\dotnet\swidtag\ 280.#.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 372.#.exe File opened for modification C:\Program Files\Java\ 372.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tr-TR\ 920.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VC\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe File opened for modification C:\Program Files\Common Files\System\es-ES\ 274.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ 640.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 280.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ 964.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ 920.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 280.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ 772.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\ 772.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ 226.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nl-NL\ 640.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sl-SI\ 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 640.#.exe File opened for modification C:\Program Files\Common Files\System\ 964.#.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\ 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\ 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\ 372.#.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\ 920.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ 920.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ 640.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ 280.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\ 274.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\ 274.#.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 372.#.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 920.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 372.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 280.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 964.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 417.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 640.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 274.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 226.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 772.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 418.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 628.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 767.#.exe - NTFS ADS 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 920.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 372.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 274.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 226.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 418.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 767.#.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 4460 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe 2236 patcher.exe 4328 920.#.exe 1996 640.#.exe 4332 372.#.exe 4212 280.#.exe 4288 274.#.exe 3320 964.#.exe 3988 226.#.exe 3788 772.#.exe 1808 418.#.exe 5072 628.#.exe 3940 767.#.exe 1060 417.#.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4460 wrote to memory of 4328 4460 2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe 89 PID 2236 wrote to memory of 1996 2236 patcher.exe 90 PID 4328 wrote to memory of 4332 4328 920.#.exe 91 PID 1996 wrote to memory of 4212 1996 640.#.exe 92 PID 4332 wrote to memory of 4288 4332 372.#.exe 95 PID 4212 wrote to memory of 3320 4212 280.#.exe 97 PID 4288 wrote to memory of 3988 4288 274.#.exe 99 PID 3320 wrote to memory of 3788 3320 964.#.exe 100 PID 3988 wrote to memory of 1808 3988 226.#.exe 101 PID 3788 wrote to memory of 5072 3788 772.#.exe 102 PID 1808 wrote to memory of 3940 1808 418.#.exe 105 PID 5072 wrote to memory of 1060 5072 628.#.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_b14d604bd704dc849c3c970ac7b70a5f_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\920.#.exeC:\Users\Admin\AppData\Local\Temp\920.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\372.#.exeC:\Users\Admin\AppData\Local\Temp\372.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\274.#.exeC:\Users\Admin\AppData\Local\Temp\274.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\226.#.exeC:\Users\Admin\AppData\Local\Temp\226.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\418.#.exeC:\Users\Admin\AppData\Local\Temp\418.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\767.#.exeC:\Users\Admin\AppData\Local\Temp\767.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\637.#.exeC:\Users\Admin\AppData\Local\Temp\637.#.exe8⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\287.#.exeC:\Users\Admin\AppData\Local\Temp\287.#.exe9⤵PID:5040
-
-
-
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\905c0769f9a06c95a24ddf945\640.#.exeC:\905c0769f9a06c95a24ddf945\640.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\905c0769f9a06c95a24ddf945\280.#.exeC:\905c0769f9a06c95a24ddf945\280.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\905c0769f9a06c95a24ddf945\964.#.exeC:\905c0769f9a06c95a24ddf945\964.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\905c0769f9a06c95a24ddf945\772.#.exeC:\905c0769f9a06c95a24ddf945\772.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\905c0769f9a06c95a24ddf945\628.#.exeC:\905c0769f9a06c95a24ddf945\628.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\905c0769f9a06c95a24ddf945\417.#.exeC:\905c0769f9a06c95a24ddf945\417.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1060 -
C:\905c0769f9a06c95a24ddf945\714.#.exeC:\905c0769f9a06c95a24ddf945\714.#.exe8⤵PID:2280
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.2MB
- SHA256 71d825b4f514ae0b8a7cdb1c6e2e7ee6823a7d989729ff75ee910e1787409d15
- MD5 b14d604bd704dc849c3c970ac7b70a5f
- SHA1 530039caea11293ab9fdcd85de7226c9a518bcf2
- SHA512 c0200645faa37afd73dc0bbac54eabd395cb0925fab2b7ac898dc6eebaf5b0e1f82fc56f78920d7e9ca0ac507950f6aba6962351c2e2e94011cbc7f2a3b7f1e4
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQCy6i1zuajsauZjaV21eW4SkZP4sz9Mb:7IDQ/nW1Psz+twsfkZc
- TLSH T11D166A02E6BB4272ECB79075C6A66665BA337811177086CF0384D63D2F33BD19A39727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$
- Size 4.3MB
- SHA256 b852c74a990baeb087ff83fbcbb9f4fcf1cfd99bad103a16764111f447bd2b1e
- MD5 a85b93dc363b9818cb6471f28bc82f07
- SHA1 47e4a0a1d34dc86b673f567102668c3c9224209b
- SHA512 4a04310b80f7244f2ef78876b178eb440642055e0c53a6fcff6f21794c5596258bd9147c3812b4d1df7308d38a9a21c38b2788f7751df5d337f07b7c073efac3
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQCy6i1zuajsauZjaV21eW4SkZP4sz9Mbt:7IDQ/nW1Psz+twsfkZct
- TLSH T196266A02E2AB4272ECBB9075C7A65665BA33781117B086CF03C4D63D1F336D19AB9727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 4.2MB
- SHA256 baae20e05a53322717f4bcff1ddc47f236fa44341304d72769e3df0e7b09814d
- MD5 bfe59cb674623b630724e53d3e33a012
- SHA1 122e2f83e5af20e0f90f5edf2ee98ca894ce45b4
- SHA512 0ffaf3c43fe6c7fc372e49bef8eabae9fc02dec1192f35d70e5f1e157dd47e764f4d2c5533d15ebe8a5cd27e9f2b4a2c7f4b81d093484007c0a242f0ce3c3778
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQCy6i1zuajsauZjaV21eW4SkZP4sz9Mb4:7IDQ/nW1Psz+twsfkZc4
- TLSH T178166A02E6BB4272ECB79075C6A66665BA337811177086CF0384D63D2F33BD19A39727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$
- Size 4.2MB
- SHA256 9cac2c8f8424e3e0e7f96ae5c49bb56a5d05a42641f2cfad652586cd5074e171
- MD5 434c2e8ea4aa84c280357dab8ae14430
- SHA1 f45b7764f251245158f41b59291ba66ea51a24cf
- SHA512 de03e62f14e3e0c9a77cb2799db4dd467c05a0075f16f5661f44ebc0b683df634b60d3671739be13e31a799f584a724b3bf5d5fdbb348ec0a02fd5282e43a294
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQCy6i1zuajsauZjaV21eW4SkZP4sz9MbY:7IDQ/nW1Psz+twsfkZcY
- TLSH T1FD166A02E6BB4272ECB79075C6A66665BA337811177086CF0384D63D2F33BD19A39727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$
- Size 4.2MB
- SHA256 733f8dabe74cdd3f87df15f02f8dd89cf79db33d35ae2ab27939960d62ccc758
- MD5 b35604012b6cf68dbb9eeccfb83c9bb8
- SHA1 c53791b8557666d57c0d0ecb8d1464217d3a6781
- SHA512 1b30385d6c64cfef530999b5970b00e959f59037a67fb59b0a43622aad055bb3a0bbaff7dd0c057109b8ae269bb26a982befdddd3d69bad826c803fbf02d778b
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQCy6i1zuajsauZjaV21eW4SkZP4sz9MbQ:7IDQ/nW1Psz+twsfkZcQ
- TLSH T15E266A02E6BB4272ECB79075C6A66665BA337811177086CF0384D63D2F33BD19A39727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$
- Size 4.2MB
- SHA256 d93f407a1db7398945d5be92953fb8cc917459c82bb72cde062769ca578064c3
- MD5 ba09983ffe4099149952d02dac6ef85e
- SHA1 0d9930eaf0a14e4f199d695b0c2085fe70279f88
- SHA512 45c98241f7672bee5fe1cad937a7b15256f814e520d746797cb747bbd6eeb29b3f55c3ff057c3d8d3f93dca22b4f57b49cce23c757e5d291a11041d850dddca3
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQCy6i1zuajsauZjaV21eW4SkZP4sz9MbE:7IDQ/nW1Psz+twsfkZc
- TLSH T1E4266A02E6BB4272ECB79075C6A65665FA3378111B7086CF0384D63D2F23BD19A39727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$
- Size 4.2MB
- SHA256 639fa38b9f3e39787c529d152698a4f3997aabc99bcd5aed0be0cf6d21156f01
- MD5 966defeed3119b35f8bc2ac07c0bf383
- SHA1 10c581145cf85a107727269c99ad6e942122301d
- SHA512 568a644f827d71ce6c0e615cf8a278d447b73ae0ffa1eca13974f31c484d44ab5a7a41ed039f918841ce0fda9ec33baba5dbeac3e4d537e9dfcc4efb6c9bddf8
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQCy6i1zuajsauZjaV21eW4SkZP4sz9Mbij:7IDQ/nW1Psz+twsfkZcij
- TLSH T1BA266A02E6BB4272ECB79075C6A66665FA337811177086CF0384D63D2F23BD19A39727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\287.#.exe
- Size 1.4MB
- SHA256 f4d55500da4e13e3ff95ccd7055652e30d07efd58be7a21d97d0fd40317f9bbb
- MD5 131f6bc9854980e3633fe7a35a203948
- SHA1 eb39e856ddf86ddca6f6e0dadedc3e0f60261475
- SHA512 486b61b9c1dc11470a94ecc9aca929551bd472613ea2b84ce7d62a095b3adb2fdb661826d8b3efe7a6465affff79307bb6a4208dd36e9af8bd290f504b480d2a
- SSDEEP 24576:FV9V2fPi1dJU43I98U7nYYJ2tHhADSANLHgZpJEMLALMHA54ONf:O/4MnYYJ2ZhqSGLHkJEM/Q
- TLSH T16C65AD02FBF3A63BED63527148795235A776BD200B2086CB17415E6E2E367D1AA34337
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\287.#.exe
- Size 2.0MB
- SHA256 9e91b96d724c99b91a79f886cfa5b31ce08131fa2dd2ff77d3eda01a78c3eebb
- MD5 aac67feb474c04ab1de8629540df3dfb
- SHA1 893cfc91f4ec45efb2daebc779a8c2613c2540ce
- SHA512 362c0f34aebcc4e2f8628c1066208d94ae13f7cb8cd7e2e68ce78d8e2f3c1266dd4b5dd62191633a5b58e8eebf2f47ba467f71e192801ff15d511e68c6f4d07d
- SSDEEP 24576:FV9V2fPi1dJU43I98U7nYYJ2tHhADSANLHgZpJEMLALMHA54ONi6BavWrB1xetO+:O/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQt
- TLSH T1D1A59D02EBE35576EEB32531497952346A7BBE200B3086CF13445D6E5F72BD1AA3432B
- MD5 SHA1 SHA512 SSDEEP TLSH