637ab4e1d738e276defd842102068e8b7f49a7121279135705beb8f4e2b657f1

Analysis

max time kernel
96s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_a57424e32a8be1fd6d243b9297d3923f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Size 3.6MB
Sample260827-nbpcgshc78
SHA256 637ab4e1d738e276defd842102068e8b7f49a7121279135705beb8f4e2b657f1
MD5 a57424e32a8be1fd6d243b9297d3923f
SHA1 f2820f39d5d06b6e32e5588ba3d5676990505862
SHA512 1b6a186c520d7625df3935f91247cf98b1cab86888cf1886f4af1024386b0a97172534ff5002c20d8983530a4e8b51931d1a6b2f3c9aa95a3cfca47ad5a180b3
SSDEEP 98304:TID41qW1Pszj5xsNMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMj:TuqxsH5xs
TLSH
T1B0067D52F7E554A1E1B7253185278261AA72FC110B30869F33987B2E2F337D1FA3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4544	patcher.exe
2584	225.#.exe
5400	596.#.exe
2784	306.#.exe
908	618.#.exe
464	659.#.exe
2080	528.#.exe
992	214.#.exe
4472	588.#.exe
1296	24.#.exe
4124	856.#.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	225.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	306.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	618.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	659.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	528.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	214.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	588.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-27_a57424e32a8be1fd6d243b9297d3923f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	596.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	24.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	856.#.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\	225.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\	659.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\	528.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mk-MK\	306.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\	588.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\	528.#.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\System\it-IT\	2026-08-27_a57424e32a8be1fd6d243b9297d3923f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\	659.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	659.#.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\	2026-08-27_a57424e32a8be1fd6d243b9297d3923f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\8.0.15\	2026-08-27_a57424e32a8be1fd6d243b9297d3923f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\amd64\	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\	659.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SAMPLES\	2026-08-27_a57424e32a8be1fd6d243b9297d3923f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\	528.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\	306.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\	596.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\	214.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\	214.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\	596.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\	618.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-MX\	528.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses\	659.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\	528.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\	528.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\	618.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	659.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\	patcher.exe
File opened for modification	C:\Program Files\Common Files\System\it-IT\	214.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\	596.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SAMPLES\	225.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\	225.#.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\de-DE\	306.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\vi-VN\	2026-08-27_a57424e32a8be1fd6d243b9297d3923f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\he-IL\	225.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\da-DK\	659.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\applet\	2026-08-27_a57424e32a8be1fd6d243b9297d3923f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\te-IN\	588.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\am-ET\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\	659.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\	659.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\id-ID\	596.#.exe
File opened for modification	C:\Program Files\Common Files\	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\	618.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\	596.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\	659.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\	214.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	659.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\	596.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\	618.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\	528.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\	214.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\he-IL\	588.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\	659.#.exe
File opened for modification	C:\Program Files\dotnet\host\	306.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\systemlog.bak	588.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	856.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	patcher.exe
File opened for modification	C:\Windows\:\systemlog.bak	596.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	618.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	659.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	528.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	214.#.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_a57424e32a8be1fd6d243b9297d3923f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	596.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	214.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	225.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	306.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	618.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	659.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	528.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	588.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	856.#.exe

NTFS ADS 12 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	225.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	618.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	528.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	856.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	2026-08-27_a57424e32a8be1fd6d243b9297d3923f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\:\systemlog.bak	patcher.exe
File opened for modification	C:\Windows\:\systemlog.bak	596.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	306.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	659.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	214.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	588.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	24.#.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4720	2026-08-27_a57424e32a8be1fd6d243b9297d3923f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
4544	patcher.exe
2584	225.#.exe
5400	596.#.exe
2784	306.#.exe
908	618.#.exe
464	659.#.exe
2080	528.#.exe
992	214.#.exe
4472	588.#.exe
1296	24.#.exe
4124	856.#.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 2584	4720	2026-08-27_a57424e32a8be1fd6d243b9297d3923f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe	92
PID 4544 wrote to memory of 5400	4544	patcher.exe	93
PID 2584 wrote to memory of 2784	2584	225.#.exe	94
PID 5400 wrote to memory of 908	5400	596.#.exe	95
PID 908 wrote to memory of 464	908	618.#.exe	96
PID 464 wrote to memory of 2080	464	659.#.exe	98
PID 2080 wrote to memory of 992	2080	528.#.exe	99
PID 992 wrote to memory of 4472	992	214.#.exe	100
PID 2784 wrote to memory of 1296	2784	306.#.exe	101
PID 4472 wrote to memory of 4124	4472	588.#.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-27_a57424e32a8be1fd6d243b9297d3923f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_a57424e32a8be1fd6d243b9297d3923f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\225.#.exe
  C:\Users\Admin\AppData\Local\Temp\225.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Users\Admin\AppData\Local\Temp\306.#.exe
    C:\Users\Admin\AppData\Local\Temp\306.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\24.#.exe
      C:\Users\Admin\AppData\Local\Temp\24.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      PID:1296

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544
- C:\905c0769f9a06c95a24ddf945\596.#.exe
  C:\905c0769f9a06c95a24ddf945\596.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5400
- - C:\905c0769f9a06c95a24ddf945\618.#.exe
    C:\905c0769f9a06c95a24ddf945\618.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:908
  - - C:\905c0769f9a06c95a24ddf945\659.#.exe
      C:\905c0769f9a06c95a24ddf945\659.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:464
    - - C:\905c0769f9a06c95a24ddf945\528.#.exe
        
        C:\905c0769f9a06c95a24ddf945\528.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2080
      - C:\905c0769f9a06c95a24ddf945\214.#.exe
        
        C:\905c0769f9a06c95a24ddf945\214.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\905c0769f9a06c95a24ddf945\588.#.exe
        
        C:\905c0769f9a06c95a24ddf945\588.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\905c0769f9a06c95a24ddf945\856.#.exe
        
        C:\905c0769f9a06c95a24ddf945\856.#.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:4124
        
        C:\905c0769f9a06c95a24ddf945\409.#.exe
        
        C:\905c0769f9a06c95a24ddf945\409.#.exe
        9⤵
        
        PID:5136
        
        C:\905c0769f9a06c95a24ddf945\825.#.exe
        
        C:\905c0769f9a06c95a24ddf945\825.#.exe
        10⤵
        
        PID:2152
        
        C:\905c0769f9a06c95a24ddf945\270.#.exe
        
        C:\905c0769f9a06c95a24ddf945\270.#.exe
        11⤵
        
        PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 3.6MB
SHA256 637ab4e1d738e276defd842102068e8b7f49a7121279135705beb8f4e2b657f1
MD5 a57424e32a8be1fd6d243b9297d3923f
SHA1 f2820f39d5d06b6e32e5588ba3d5676990505862
SHA512 1b6a186c520d7625df3935f91247cf98b1cab86888cf1886f4af1024386b0a97172534ff5002c20d8983530a4e8b51931d1a6b2f3c9aa95a3cfca47ad5a180b3
SSDEEP 98304:TID41qW1Pszj5xsNMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMj:TuqxsH5xs
TLSH
T1B0067D52F7E554A1E1B7253185278261AA72FC110B30869F33987B2E2F337D1FA3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$
Size 3.6MB
SHA256 af1edb956648db05198e625d4d851164455b8c343640256f94453397bedd89f3
MD5 4de718d41b940c80286b723e5481d248
SHA1 b36766788b1faa8ba95538a446d88ac62d1c5b11
SHA512 27191c766afdba369fa528855e9e280ee91b45dd5c469cdeb6301b63d47f7412cbb36b860cd4f1b4b2b79d109e2e2087db6fa72bb7865484235cd0f375975115
SSDEEP 98304:TID41qW1Pszj5xsNMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMj:TuqxsH5xsP
TLSH
T1DA067D52F7E554A1E1B7253185278261AA72FC110B30869F33987B2E2F337D1FA3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
Size 3.6MB
SHA256 c2b210b53d9e74655b81ad41b59203ed85c20b0defb576049ccb72d14c12c766
MD5 30a8b81f411edbaa239b3c0a3413a692
SHA1 72413d6065e32067842312420ec50b9c3ca95b70
SHA512 2661b0a7388c34271c3ef7e7b8ada55e9fbba9f95cdf9f5da334138549ef5e1bfb3b85c0e75957afdf1a23ab03e17708662533fd1aaaa2a04a43e038d7d2b4cd
SSDEEP 98304:TID41qW1Pszj5xsNMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMk:TuqxsH5xsY
TLSH
T167067D52F7E554A1E1B7253185278261AA72FC110B30869F33987B2E2F337D1FA3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSetup.exe$

Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
Size 4.1MB
SHA256 9a87b0c479e3d15d79244c4fac3035bf40a28c6afc983ab156b09f354257a604
MD5 fbc61118f57c0ec58d9db49e44897202
SHA1 f7632ce60b9bd011ccf9bf0f223059ccb491d578
SHA512 b635b89a22f23158d3a11501ce6349512324ac34d76c09be6e5be9fd48418aca7dd6939877825889422ba3262b064a2239b74fc8c8d1924f059e75e38bdd9342
SSDEEP 98304:TID41qW1Pszj5xsNMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMC:TuqxsH5xsi9
TLSH
T149167C52F7A494E1D177653485678261AA72BC110B30878F3358BB2E2F337D1BE3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wordicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe
Size 3.7MB
SHA256 5e5db6ac7d81658e0e3539f7d18612a966ac3d25b370a937979d8f84ea4261db
MD5 a843274165cb96c01d0b0543ba0299c1
SHA1 1017e3f1b3c226df43cb94767b82a3b06c2243a7
SHA512 e7435cd1d159fd514ac8226feb27b7975e919e7ce7d7a45ca0a2918dac87949f7ba3ff52d2e1c58947fc1a607c5b932473e2c6611ced97be7987befc0019f7a3
SSDEEP 98304:TID41qW1Pszj5xsNMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMI:TuqxsH5xsc
TLSH
T197067D52F7D544A1E5B7253089278261AA72FC110B30869F33987B2E6F337D1FA3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads