Analysis
- max time kernel
57s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 15:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe
- Size 1.5MB
- Sample260826-s95vcaeb42
- SHA256 ba82c0262bfb47aa0bdcab4a6277b99001814e394fbdabf2a2820ec52985ceb6
- MD5 9cae2295d9c6309afca2e1471be91d0b
- SHA1 6db84ce7054153bbe9443cb6190a23d37dc0cffe
- SHA512 1bc1927a32bdc1abdb8a1c96ea65c111a037ec828255d0629bfd0be262adb27b5d9558c2e8ae769ce51c307bd4a242bebe63dbfbe4bb178bf0c7946b2d45eb70
- SSDEEP 12288:NcRzSV7xcRzSV7d1JYcRzSV7xcRzSV7d1JJfccRzSV7xcRzSV7d1JYcRzSV7xcR+:FV9VZ1mV9VZ1DsV9VZ1mV9VZ1DpGtUD
- TLSH T13D653A02E7A440A6E59E85B1CBA58615B6377D2007D086CF16D4FA7E0F323D2ADF532B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 17 IoCs
pid Process 6104 patcher.exe 5928 443.#.exe 3096 473.#.exe 2696 511.#.exe 3820 147.#.exe 2392 250.#.exe 4664 621.#.exe 4328 57.#.exe 4596 60.#.exe 4140 239.#.exe 2812 64.#.exe 3364 859.#.exe 2096 82.#.exe 2016 280.#.exe 5948 578.#.exe 3024 396.#.exe 2072 755.#.exe - Adds Run key to start application 2 TTPs 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 473.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 511.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 147.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 250.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 57.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 859.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 443.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 239.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 755.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 621.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 60.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 82.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 280.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 578.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 64.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 396.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\ 60.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\ 250.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 147.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\ 239.#.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 473.#.exe File opened for modification C:\Program Files\7-Zip\Lang\ 64.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fa-IR\ 82.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ar-SA\ 57.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\ 2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\as-IN\ 621.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ 621.#.exe File opened for modification C:\Program Files\Common Files\System\de-DE\ 473.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ 473.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\am-ET\ 859.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\af-ZA\ 57.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ca-ES-valencia\ 473.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hi-IN\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\or-IN\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ur-PK\ 2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\id-ID\ 859.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\ 60.#.exe File opened for modification C:\Program Files\dotnet\ 2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\gd-GB\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ko-KR\ 147.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\am-ET\ 621.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pa-IN\ 60.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ 621.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ 621.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bn-IN\ 82.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ 239.#.exe File opened for modification C:\Program Files\Common Files\System\it-IT\ 60.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 473.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\ 859.#.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\ 473.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\ 473.#.exe File opened for modification C:\Program Files\Common Files\System\de-DE\ 2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\ 82.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ 239.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 147.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 621.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\id-ID\ 2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\ 60.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ 147.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ 147.#.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 473.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ 239.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ 239.#.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\ 239.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ar-SA\ 473.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\vi-VN\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VGX\ 147.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bn-IN\ 60.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\ 147.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ 473.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ 621.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\ 250.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ 60.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sq-AL\ 239.#.exe File opened for modification C:\Program Files\Internet Explorer\images\ 2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 147.#.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 82.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 621.#.exe File opened for modification C:\Windows\:\systemlog.bak 60.#.exe File opened for modification C:\Windows\:\systemlog.bak 239.#.exe File opened for modification C:\Windows\:\systemlog.bak 280.#.exe File opened for modification C:\Windows\:\systemlog.bak 396.#.exe File opened for modification C:\Windows\:\systemlog.bak 755.#.exe File opened for modification C:\Windows\:\systemlog.bak 473.#.exe File opened for modification C:\Windows\:\systemlog.bak 147.#.exe File opened for modification C:\Windows\:\systemlog.bak 859.#.exe - System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 396.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 443.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 511.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 621.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 239.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 859.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 280.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 578.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 473.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 147.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 755.#.exe - NTFS ADS 18 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 473.#.exe File opened for modification C:\Windows\:\systemlog.bak 60.#.exe File opened for modification C:\Windows\:\systemlog.bak 239.#.exe File opened for modification C:\Windows\:\systemlog.bak 82.#.exe File opened for modification C:\Windows\:\systemlog.bak 621.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 64.#.exe File opened for modification C:\Windows\:\systemlog.bak 859.#.exe File opened for modification C:\Windows\:\systemlog.bak 396.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 443.#.exe File opened for modification C:\Windows\:\systemlog.bak 147.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 57.#.exe File opened for modification C:\Windows\:\systemlog.bak 280.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 578.#.exe File opened for modification C:\Windows\:\systemlog.bak 755.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 511.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 250.#.exe - Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 5156 2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe 6104 patcher.exe 5928 443.#.exe 3096 473.#.exe 2696 511.#.exe 3820 147.#.exe 2392 250.#.exe 4664 621.#.exe 4328 57.#.exe 4596 60.#.exe 4140 239.#.exe 2812 64.#.exe 3364 859.#.exe 2096 82.#.exe 2016 280.#.exe 5948 578.#.exe 3024 396.#.exe 2072 755.#.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 5156 wrote to memory of 5928 5156 2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe 92 PID 6104 wrote to memory of 3096 6104 patcher.exe 93 PID 5928 wrote to memory of 2696 5928 443.#.exe 94 PID 3096 wrote to memory of 3820 3096 473.#.exe 95 PID 2696 wrote to memory of 2392 2696 511.#.exe 96 PID 3820 wrote to memory of 4664 3820 147.#.exe 97 PID 2392 wrote to memory of 4328 2392 250.#.exe 98 PID 4664 wrote to memory of 4596 4664 621.#.exe 99 PID 4596 wrote to memory of 4140 4596 60.#.exe 100 PID 4328 wrote to memory of 2812 4328 57.#.exe 101 PID 4140 wrote to memory of 3364 4140 239.#.exe 102 PID 3364 wrote to memory of 2096 3364 859.#.exe 103 PID 2096 wrote to memory of 2016 2096 82.#.exe 105 PID 2812 wrote to memory of 5948 2812 64.#.exe 106 PID 2016 wrote to memory of 3024 2016 280.#.exe 107 PID 3024 wrote to memory of 2072 3024 396.#.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_9cae2295d9c6309afca2e1471be91d0b_amadey_cobalt-strike_elex_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\443.#.exeC:\Users\Admin\AppData\Local\Temp\443.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\511.#.exeC:\Users\Admin\AppData\Local\Temp\511.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\250.#.exeC:\Users\Admin\AppData\Local\Temp\250.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\57.#.exeC:\Users\Admin\AppData\Local\Temp\57.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\64.#.exeC:\Users\Admin\AppData\Local\Temp\64.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\578.#.exeC:\Users\Admin\AppData\Local\Temp\578.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\401.#.exeC:\Users\Admin\AppData\Local\Temp\401.#.exe8⤵PID:3716
-
-
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\905c0769f9a06c95a24ddf945\473.#.exeC:\905c0769f9a06c95a24ddf945\473.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\905c0769f9a06c95a24ddf945\147.#.exeC:\905c0769f9a06c95a24ddf945\147.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\905c0769f9a06c95a24ddf945\621.#.exeC:\905c0769f9a06c95a24ddf945\621.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\905c0769f9a06c95a24ddf945\60.#.exeC:\905c0769f9a06c95a24ddf945\60.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\905c0769f9a06c95a24ddf945\239.#.exeC:\905c0769f9a06c95a24ddf945\239.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\905c0769f9a06c95a24ddf945\859.#.exeC:\905c0769f9a06c95a24ddf945\859.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\905c0769f9a06c95a24ddf945\82.#.exeC:\905c0769f9a06c95a24ddf945\82.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\905c0769f9a06c95a24ddf945\280.#.exeC:\905c0769f9a06c95a24ddf945\280.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\905c0769f9a06c95a24ddf945\396.#.exeC:\905c0769f9a06c95a24ddf945\396.#.exe10⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\905c0769f9a06c95a24ddf945\755.#.exeC:\905c0769f9a06c95a24ddf945\755.#.exe11⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2072 -
C:\905c0769f9a06c95a24ddf945\357.#.exeC:\905c0769f9a06c95a24ddf945\357.#.exe12⤵PID:2288
-
C:\905c0769f9a06c95a24ddf945\288.#.exeC:\905c0769f9a06c95a24ddf945\288.#.exe13⤵PID:5976
-
C:\905c0769f9a06c95a24ddf945\752.#.exeC:\905c0769f9a06c95a24ddf945\752.#.exe14⤵PID:1212
-
C:\905c0769f9a06c95a24ddf945\726.#.exeC:\905c0769f9a06c95a24ddf945\726.#.exe15⤵PID:2424
-
C:\905c0769f9a06c95a24ddf945\952.#.exeC:\905c0769f9a06c95a24ddf945\952.#.exe16⤵PID:2916
-
C:\905c0769f9a06c95a24ddf945\822.#.exeC:\905c0769f9a06c95a24ddf945\822.#.exe17⤵PID:3444
-
C:\905c0769f9a06c95a24ddf945\384.#.exeC:\905c0769f9a06c95a24ddf945\384.#.exe18⤵PID:5872
-
C:\905c0769f9a06c95a24ddf945\316.#.exeC:\905c0769f9a06c95a24ddf945\316.#.exe19⤵PID:3624
-
C:\905c0769f9a06c95a24ddf945\924.#.exeC:\905c0769f9a06c95a24ddf945\924.#.exe20⤵PID:4340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 ba82c0262bfb47aa0bdcab4a6277b99001814e394fbdabf2a2820ec52985ceb6
- MD5 9cae2295d9c6309afca2e1471be91d0b
- SHA1 6db84ce7054153bbe9443cb6190a23d37dc0cffe
- SHA512 1bc1927a32bdc1abdb8a1c96ea65c111a037ec828255d0629bfd0be262adb27b5d9558c2e8ae769ce51c307bd4a242bebe63dbfbe4bb178bf0c7946b2d45eb70
- SSDEEP 12288:NcRzSV7xcRzSV7d1JYcRzSV7xcRzSV7d1JJfccRzSV7xcRzSV7d1JYcRzSV7xcR+:FV9VZ1mV9VZ1DsV9VZ1mV9VZ1DpGtUD
- TLSH T13D653A02E7A440A6E59E85B1CBA58615B6377D2007D086CF16D4FA7E0F323D2ADF532B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
- Size 1.5MB
- SHA256 767c5cb26a8c1a57d609b729feb34d66c77f67bcd3fbadb18aa948ec02a4ba82
- MD5 4cd30f1e86dfaeb9c8d39133ecd69e45
- SHA1 d60ad867f777fa9e06c90055e42c9ec4414f66ab
- SHA512 03fe300ffb168528f67343e050f9b88db626bdee5414ed392521caf9d95b0d40356ed279c2be319a33ea6978d3650bccedee17f43118394627265b487592f2f4
- SSDEEP 12288:NcRzSV7xcRzSV7d1JYcRzSV7xcRzSV7d1JJfccRzSV7xcRzSV7d1JYcRzSV7xcR0:FV9VZ1mV9VZ1DsV9VZ1mV9VZ1DpGtU0W
- TLSH T136753A02E7A440A6E59E85B1CBA58615B6377D2007E086CF16D4F67E0F323D2ADF532B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$
- Size 1.5MB
- SHA256 f32cdd996ae516f07b1bd1c8847c23a9eed9fba12921ca2b8c680e56b00c4e74
- MD5 b85a293e184b8bd656847a50645fd42e
- SHA1 696c811fc7d324cb22cdf9a76eed970a10ba1254
- SHA512 b55e5cfff44293cadfe5b213bbef2eee59915c2a1827c2f2dd0bb69f08392d1daf014f4367e585e0fa0557195bf66f69a83f5461d9b786f7d89f6be4d069fef9
- SSDEEP 12288:NcRzSV7xcRzSV7d1JYcRzSV7xcRzSV7d1JJfccRzSV7xcRzSV7d1JYcRzSV7xcRm:FV9VZ1mV9VZ1DsV9VZ1mV9VZ1DpGtUnd
- TLSH T1F3753A02E7A440A6E59E85B1CBA58615B6377D2007E086CF16D4F67E0F323D2ADF532B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$
- Size 2.3MB
- SHA256 f1f48ad96ae5567c2092555b94543893af53c9f713b9efcf25461144f3f262dd
- MD5 9d804489f30043ef97837386bf813426
- SHA1 29b37b889372b83a619ef7101c916eea6b919b5b
- SHA512 705c432e1c3e667edc53a30783565e2e020bfdcbfec2d96fb25b902143162e2ee21dc5087280c06e01753c240d46159880587d02430f0b05ef2e86846f633183
- SSDEEP 49152:xoaoPtMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMzB:mMMHMMMvMMZMMMlmMMMiMMMYJMMHMMMw
- TLSH T1F4B54A02F39480A6E4AE46B1CB668655B637BC2107D086DF25D4F67E1F323C2A9F171B
- MD5 SHA1 SHA512 SSDEEP TLSH