Analysis
- max time kernel
107s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 00:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_ce86ebb2d577e381e10fbfef46b169c9_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_ce86ebb2d577e381e10fbfef46b169c9_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-24_ce86ebb2d577e381e10fbfef46b169c9_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe
- Size 3.4MB
- Sample260825-a3eqgavhph
- SHA256 08d7c15c813101556bde40491fdbae1326470ac5eb9f2586b2829a8e8dc88429
- MD5 ce86ebb2d577e381e10fbfef46b169c9
- SHA1 f454f856a6d4fde0adda1244b641029b954049ff
- SHA512 83f20b613158e5aaf873c62c1ed60a2fd5c805c0b51c0d6cbd6d5c018187776a8142c9e696d78ae6334789b2ce697caf671d00f9bf526f4b4684d3980c6bb12b
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQCy6i1zuajsauZjaV2:7IDQ/nW1Psz+tw
- TLSH T117F57A02E7E700B6ED6B5130C6695221BA77B82117B086CF13D4D93E1F32BD1AA79727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 14 IoCs
pid Process 464 patcher.exe 4804 582.#.exe 4216 2.#.exe 540 452.#.exe 248 644.#.exe 5948 919.#.exe 2144 394.#.exe 2956 695.#.exe 3264 0.#.exe 2532 954.#.exe 4920 235.#.exe 3288 497.#.exe 2908 316.#.exe 2080 954.#.exe - Adds Run key to start application 2 TTPs 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 0.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 316.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-24_ce86ebb2d577e381e10fbfef46b169c9_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 954.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 582.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 452.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 394.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 695.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 235.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 497.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 954.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 644.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 919.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\ 452.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\ 919.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\ 582.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\ 2026-08-24_ce86ebb2d577e381e10fbfef46b169c9_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\ 582.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lt-LT\ 2.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\qps-plocm\ 2.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lv-LV\ 644.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\ 644.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ 0.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office15\ 0.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VGX\ 954.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\ patcher.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\ 2.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hi-IN\ 919.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sk-SK\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\el-GR\ 919.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ 452.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\ 0.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\ 0.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\id-ID\ 2.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-CA\ 2026-08-24_ce86ebb2d577e381e10fbfef46b169c9_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fa-IR\ 644.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\ 644.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\plugin2\ 394.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SAMPLES\ 582.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\ 2.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\ 2.#.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\ 919.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ 644.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\applet\ 919.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\ 394.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\ 2.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\ 644.#.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\ patcher.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\ 2.#.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\ 2.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ 582.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 2.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\ 919.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 644.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\ 0.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\ 954.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\ 452.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\ 954.#.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\ 582.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\ 919.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ 2.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\ 394.#.exe File opened for modification C:\Program Files\Common Files\System\ado\ 0.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\ 2.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ca-ES-valencia\ 919.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hr-HR\ 919.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\ 0.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ 919.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 644.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\ 644.#.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 2.#.exe File opened for modification C:\Windows\:\systemlog.bak 644.#.exe File opened for modification C:\Windows\:\systemlog.bak 394.#.exe File opened for modification C:\Windows\:\systemlog.bak 954.#.exe File opened for modification C:\Windows\:\systemlog.bak 954.#.exe File opened for modification C:\Windows\:\systemlog.bak 919.#.exe File opened for modification C:\Windows\:\systemlog.bak 0.#.exe File opened for modification C:\Windows\:\systemlog.bak 235.#.exe File opened for modification C:\Windows\:\systemlog.bak 497.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 919.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 695.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 497.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 954.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 582.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 644.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 394.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 316.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 954.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 235.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_ce86ebb2d577e381e10fbfef46b169c9_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 452.#.exe - NTFS ADS 15 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 452.#.exe File opened for modification C:\Windows\:\systemlog.bak 644.#.exe File opened for modification C:\Windows\:\systemlog.bak 0.#.exe File opened for modification C:\Windows\:\systemlog.bak 235.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 919.#.exe File opened for modification C:\Windows\:\systemlog.bak 394.#.exe File opened for modification C:\Windows\:\systemlog.bak 954.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-08-24_ce86ebb2d577e381e10fbfef46b169c9_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe File opened for modification C:\Windows\:\systemlog.bak 2.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 695.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 316.#.exe File opened for modification C:\Windows\:\systemlog.bak 954.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 582.#.exe File opened for modification C:\Windows\:\systemlog.bak 497.#.exe - Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 4668 2026-08-24_ce86ebb2d577e381e10fbfef46b169c9_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe 464 patcher.exe 4804 582.#.exe 4216 2.#.exe 540 452.#.exe 248 644.#.exe 5948 919.#.exe 2144 394.#.exe 2956 695.#.exe 3264 0.#.exe 2532 954.#.exe 4920 235.#.exe 3288 497.#.exe 2908 316.#.exe 2080 954.#.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4668 wrote to memory of 4804 4668 2026-08-24_ce86ebb2d577e381e10fbfef46b169c9_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe 91 PID 464 wrote to memory of 4216 464 patcher.exe 92 PID 4804 wrote to memory of 540 4804 582.#.exe 93 PID 4216 wrote to memory of 248 4216 2.#.exe 94 PID 248 wrote to memory of 5948 248 644.#.exe 95 PID 5948 wrote to memory of 2144 5948 919.#.exe 96 PID 540 wrote to memory of 2956 540 452.#.exe 97 PID 2144 wrote to memory of 3264 2144 394.#.exe 99 PID 3264 wrote to memory of 2532 3264 0.#.exe 100 PID 2532 wrote to memory of 4920 2532 954.#.exe 101 PID 4920 wrote to memory of 3288 4920 235.#.exe 102 PID 2956 wrote to memory of 2908 2956 695.#.exe 103 PID 3288 wrote to memory of 2080 3288 497.#.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_ce86ebb2d577e381e10fbfef46b169c9_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_ce86ebb2d577e381e10fbfef46b169c9_amadey_cobalt-strike_elex_emotet_hijackloader_remcos_smo.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\582.#.exeC:\Users\Admin\AppData\Local\Temp\582.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\452.#.exeC:\Users\Admin\AppData\Local\Temp\452.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\695.#.exeC:\Users\Admin\AppData\Local\Temp\695.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\316.#.exeC:\Users\Admin\AppData\Local\Temp\316.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2908
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464 -
C:\905c0769f9a06c95a24ddf945\2.#.exeC:\905c0769f9a06c95a24ddf945\2.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\905c0769f9a06c95a24ddf945\644.#.exeC:\905c0769f9a06c95a24ddf945\644.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\905c0769f9a06c95a24ddf945\919.#.exeC:\905c0769f9a06c95a24ddf945\919.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\905c0769f9a06c95a24ddf945\394.#.exeC:\905c0769f9a06c95a24ddf945\394.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\905c0769f9a06c95a24ddf945\0.#.exeC:\905c0769f9a06c95a24ddf945\0.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\905c0769f9a06c95a24ddf945\954.#.exeC:\905c0769f9a06c95a24ddf945\954.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\905c0769f9a06c95a24ddf945\235.#.exeC:\905c0769f9a06c95a24ddf945\235.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\905c0769f9a06c95a24ddf945\497.#.exeC:\905c0769f9a06c95a24ddf945\497.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\905c0769f9a06c95a24ddf945\954.#.exeC:\905c0769f9a06c95a24ddf945\954.#.exe10⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2080 -
C:\905c0769f9a06c95a24ddf945\758.#.exeC:\905c0769f9a06c95a24ddf945\758.#.exe11⤵PID:888
-
C:\905c0769f9a06c95a24ddf945\217.#.exeC:\905c0769f9a06c95a24ddf945\217.#.exe12⤵PID:4156
-
C:\905c0769f9a06c95a24ddf945\859.#.exeC:\905c0769f9a06c95a24ddf945\859.#.exe13⤵PID:2040
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.4MB
- SHA256 08d7c15c813101556bde40491fdbae1326470ac5eb9f2586b2829a8e8dc88429
- MD5 ce86ebb2d577e381e10fbfef46b169c9
- SHA1 f454f856a6d4fde0adda1244b641029b954049ff
- SHA512 83f20b613158e5aaf873c62c1ed60a2fd5c805c0b51c0d6cbd6d5c018187776a8142c9e696d78ae6334789b2ce697caf671d00f9bf526f4b4684d3980c6bb12b
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQCy6i1zuajsauZjaV2:7IDQ/nW1Psz+tw
- TLSH T117F57A02E7E700B6ED6B5130C6695221BA77B82117B086CF13D4D93E1F32BD1AA79727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$
- Size 3.4MB
- SHA256 5204420910820d2f8fed92a75954f7ccb83009fc72b890fd79f73da7af3a4a29
- MD5 c24d9202c59e20da3276d29f86a5b099
- SHA1 9c8230fc0223648121fcf21d76b367985a0c34f9
- SHA512 1a52975b021c81d4d2071151032b4a5595d12a179f92c405c6de6c49c04be0175119779e85a88c8bd6fbe01ccf9006d4024491ca72ecb4408c900e0403d0e9be
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQCy6i1zuajsauZjaV2V:7IDQ/nW1Psz+tw8
- TLSH T17EF57A02E7E700B6ED6B5130C6695221BA77B82117B086CF13D4D93E1F32BD1AA79727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$
- Size 4.2MB
- SHA256 d66f4e96e692a1bc415c73c104d00d6525315220b5d45798141015a8f8649507
- MD5 5bd23e4fa976b0029f63c4a3d3fe83f0
- SHA1 8cec69c1f64523eab2a507722dbf2f6562fae548
- SHA512 80c9c1913232c4d75eb9591bb3dfbd7f7da12c8056b0dbad50b0f9b950814bd94e428df5147e667a0a76a53cf9e1b5f97a6329cfcac147feffbbd2cb86af31aa
- SSDEEP 98304:7IDQ/nW1Psz+twZMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMR:7uQ+xsq6k
- TLSH T1E6167C02E7E740B5ED6B5130C6764225AA77BC211B7086CF2394EA3E1F327C19A75B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe
- Size 3.5MB
- SHA256 08fb7268ed79b7ecbbd31fc697e2a6539397991430e4eebd4cd4c746dd0292e4
- MD5 56b01520136afdf2e315ce8df0456980
- SHA1 a8013af76a907c8baa8cbbdec5a161a57fecfbcf
- SHA512 0033781612bf71b9f70f5d9d1bf5e97c2125884e8512c9679cc28a0218438bb1b1a4dbe8b28fe6ae2310e85e5f1926a50b10dfe011b46b58d0181c9350a20930
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHkJEM/nW1PszNsQCy6i1zuajsauZjaV2O:7IDQ/nW1Psz+tw3
- TLSH T1E1F57B02E7E700B5ED6B5130CA655221BA77BC2117B086CF1394EA3D1F32BD1AA79727
- MD5 SHA1 SHA512 SSDEEP TLSH