Analysis
- max time kernel
92s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 22:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-28_0cb62325a1754589b5a2b792d81ca09f_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-28_0cb62325a1754589b5a2b792d81ca09f_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-28_0cb62325a1754589b5a2b792d81ca09f_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
- Size 2.7MB
- Sample260828-2ablwstvdy
- SHA256 fdd349d627115ec004322de0dafc4172c154e5a41a688a99e233919e1f25090c
- MD5 0cb62325a1754589b5a2b792d81ca09f
- SHA1 d6d931d019e8c602a22a554064fa911c86270502
- SHA512 3e3f12092f4bf9497d691c54f7dd8647fbf069433f516b983a8733fc5aa813dabc04baaa4d74b86aabc076ef56b060611cdbca80cb1712498e0b5b31efb19a9c
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9JqatglNqatgl:TID41vyW1Pszno6
- TLSH T1D7D58D42B78585F2E1670231486752A36BB6BC211F21D78F2394A27D9F337C0BB36766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 14 IoCs
pid Process 3076 patcher.exe 2100 234.#.exe 4088 460.#.exe 3576 99.#.exe 5520 511.#.exe 4348 364.#.exe 3080 183.#.exe 4340 14.#.exe 4280 990.#.exe 3112 225.#.exe 5252 171.#.exe 3448 651.#.exe 2080 472.#.exe 1436 779.#.exe - Adds Run key to start application 2 TTPs 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 364.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 183.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 14.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 990.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 779.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 460.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 651.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 234.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 99.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 511.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 225.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-28_0cb62325a1754589b5a2b792d81ca09f_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 171.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 472.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 14.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\ 234.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\ 99.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\id-ID\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\ 99.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ 460.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ 511.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\ 2026-08-28_0cb62325a1754589b5a2b792d81ca09f_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\ 364.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ug-CN\ 511.#.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ 14.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\ 14.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\ 990.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nl-NL\ 234.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\ 225.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses\ 225.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mk-MK\ 234.#.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 183.#.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\ 460.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ 511.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 511.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\or-IN\ 225.#.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\ patcher.exe File opened for modification C:\Program Files\dotnet\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\ 990.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 460.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 183.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ 511.#.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 14.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 460.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ 364.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\gl-ES\ 472.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\kok-IN\ 225.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 183.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\id-ID\ 651.#.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\ 225.#.exe File opened for modification C:\Program Files\Google\Chrome\ 460.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fa-IR\ 990.#.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 511.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ 511.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\ 460.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\ 2026-08-28_0cb62325a1754589b5a2b792d81ca09f_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lt-LT\ 990.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\ 990.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\ 364.#.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\ 511.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ 99.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\ 990.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ 225.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ne-NP\ 183.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\ 511.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ 234.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 511.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mr-IN\ 364.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\amd64\ 511.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 990.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ca-ES-valencia\ 511.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\ 990.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ 2026-08-28_0cb62325a1754589b5a2b792d81ca09f_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ca-ES-valencia\ 472.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ms-MY\ 990.#.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 460.#.exe File opened for modification C:\Windows\:\systemlog.bak 511.#.exe File opened for modification C:\Windows\:\systemlog.bak 183.#.exe File opened for modification C:\Windows\:\systemlog.bak 14.#.exe File opened for modification C:\Windows\:\systemlog.bak 225.#.exe File opened for modification C:\Windows\:\systemlog.bak 472.#.exe File opened for modification C:\Windows\:\systemlog.bak 779.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 990.#.exe File opened for modification C:\Windows\:\systemlog.bak 651.#.exe - System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 779.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 364.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 183.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 472.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 234.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 460.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 990.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 225.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-28_0cb62325a1754589b5a2b792d81ca09f_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 511.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 171.#.exe - NTFS ADS 15 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 364.#.exe File opened for modification C:\Windows\:\systemlog.bak 183.#.exe File opened for modification C:\Windows\:\systemlog.bak 472.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 99.#.exe File opened for modification C:\Windows\:\systemlog.bak 990.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 171.#.exe File opened for modification C:\Windows\:\systemlog.bak 225.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-08-28_0cb62325a1754589b5a2b792d81ca09f_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 234.#.exe File opened for modification C:\Windows\:\systemlog.bak 460.#.exe File opened for modification C:\Windows\:\systemlog.bak 511.#.exe File opened for modification C:\Windows\:\systemlog.bak 14.#.exe File opened for modification C:\Windows\:\systemlog.bak 651.#.exe File opened for modification C:\Windows\:\systemlog.bak 779.#.exe - Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 4108 2026-08-28_0cb62325a1754589b5a2b792d81ca09f_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe 3076 patcher.exe 2100 234.#.exe 4088 460.#.exe 3576 99.#.exe 5520 511.#.exe 4348 364.#.exe 3080 183.#.exe 4340 14.#.exe 4280 990.#.exe 3112 225.#.exe 5252 171.#.exe 3448 651.#.exe 2080 472.#.exe 1436 779.#.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4108 wrote to memory of 2100 4108 2026-08-28_0cb62325a1754589b5a2b792d81ca09f_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe 91 PID 3076 wrote to memory of 4088 3076 patcher.exe 92 PID 2100 wrote to memory of 3576 2100 234.#.exe 93 PID 4088 wrote to memory of 5520 4088 460.#.exe 94 PID 3576 wrote to memory of 4348 3576 99.#.exe 95 PID 5520 wrote to memory of 3080 5520 511.#.exe 96 PID 3080 wrote to memory of 4340 3080 183.#.exe 97 PID 4340 wrote to memory of 4280 4340 14.#.exe 99 PID 4280 wrote to memory of 3112 4280 990.#.exe 100 PID 4348 wrote to memory of 5252 4348 364.#.exe 101 PID 3112 wrote to memory of 3448 3112 225.#.exe 102 PID 3448 wrote to memory of 2080 3448 651.#.exe 103 PID 2080 wrote to memory of 1436 2080 472.#.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-28_0cb62325a1754589b5a2b792d81ca09f_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-28_0cb62325a1754589b5a2b792d81ca09f_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\234.#.exeC:\Users\Admin\AppData\Local\Temp\234.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\99.#.exeC:\Users\Admin\AppData\Local\Temp\99.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\364.#.exeC:\Users\Admin\AppData\Local\Temp\364.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\171.#.exeC:\Users\Admin\AppData\Local\Temp\171.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\158.#.exeC:\Users\Admin\AppData\Local\Temp\158.#.exe6⤵PID:2328
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\905c0769f9a06c95a24ddf945\460.#.exeC:\905c0769f9a06c95a24ddf945\460.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\905c0769f9a06c95a24ddf945\511.#.exeC:\905c0769f9a06c95a24ddf945\511.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\905c0769f9a06c95a24ddf945\183.#.exeC:\905c0769f9a06c95a24ddf945\183.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\905c0769f9a06c95a24ddf945\14.#.exeC:\905c0769f9a06c95a24ddf945\14.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\905c0769f9a06c95a24ddf945\990.#.exeC:\905c0769f9a06c95a24ddf945\990.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\905c0769f9a06c95a24ddf945\225.#.exeC:\905c0769f9a06c95a24ddf945\225.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\905c0769f9a06c95a24ddf945\651.#.exeC:\905c0769f9a06c95a24ddf945\651.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\905c0769f9a06c95a24ddf945\472.#.exeC:\905c0769f9a06c95a24ddf945\472.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\905c0769f9a06c95a24ddf945\779.#.exeC:\905c0769f9a06c95a24ddf945\779.#.exe10⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1436 -
C:\905c0769f9a06c95a24ddf945\372.#.exeC:\905c0769f9a06c95a24ddf945\372.#.exe11⤵PID:5912
-
C:\905c0769f9a06c95a24ddf945\347.#.exeC:\905c0769f9a06c95a24ddf945\347.#.exe12⤵PID:2944
-
C:\905c0769f9a06c95a24ddf945\898.#.exeC:\905c0769f9a06c95a24ddf945\898.#.exe13⤵PID:5016
-
C:\905c0769f9a06c95a24ddf945\551.#.exeC:\905c0769f9a06c95a24ddf945\551.#.exe14⤵PID:2812
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\551.#.exe
- Size 832KB
- SHA256 b33ff0fc7b5d16474629befd6886fd9558e40bd2eb6ed5842b2f72224be8a8bc
- MD5 3022180572594f8eeb650250db3999d6
- SHA1 7b906b7a3718db7951475432dabb5c245800c86f
- SHA512 12c70299c1dae8411f0f0dffc0b17a382f0017de981076faac4b84d18c5ea34abba724e2d1c7711fd1c2d9e1d8b54f8d7a0976a03dc3ea2082e297e24ceb4d33
- SSDEEP 24576:FV2fPi1dJU43I98U7nYYJ2tHhADSANLHgWExqatgl8bON:W/4MnYYJ2ZhqSGLHyqatglH
- TLSH T10A059D42FB8295B3D1570232446B22A23B7678201F56978B23946B7D6F333D1BB3536B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\905c0769f9a06c95a24ddf945\551.#.exe
- Size 1.5MB
- SHA256 3f97cd73920a0c447e40c46bfca4f579e8e8de1c2cf51ae7f12af4deb8da2522
- MD5 daadc467159a42586d3988150d79537c
- SHA1 20e64a6b390c5704296857e21d132cd50b17faf6
- SHA512 8c7b5e21531518d21c5536760d0aeb8df83bba125b0b6daa3e673b5b935e093bad689233a0b4305c60b1777ea3413e11548d4cc12e5b9dbb9ad2c379c7dd895f
- SSDEEP 24576:FV2fPi1dJU43I98U7nYYJ2tHhADSANLHgWExqatgl8bOkxqatgl8bQslZOZuW6B0:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWn
- TLSH T1FD758D42B79195F2D0670232486B52A26BB6BC211F21978F2394677D6F333C0BF36766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.7MB
- SHA256 fdd349d627115ec004322de0dafc4172c154e5a41a688a99e233919e1f25090c
- MD5 0cb62325a1754589b5a2b792d81ca09f
- SHA1 d6d931d019e8c602a22a554064fa911c86270502
- SHA512 3e3f12092f4bf9497d691c54f7dd8647fbf069433f516b983a8733fc5aa813dabc04baaa4d74b86aabc076ef56b060611cdbca80cb1712498e0b5b31efb19a9c
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9JqatglNqatgl:TID41vyW1Pszno6
- TLSH T1D7D58D42B78585F2E1670231486752A36BB6BC211F21D78F2394A27D9F337C0BB36766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe$
- Size 2.8MB
- SHA256 5b40dd6476f2607440b21c80e166a40bf40c59a059cff1ab524f7e0539e38a92
- MD5 494390f0bee0381c3743a03504bc9431
- SHA1 8190073fbe4620d3719f33a279e4d60e67884371
- SHA512 301f42fa16092272fd2343d5a6665a3659724e2c53ed16f4e4b5e857405808eb5448ede8c73779c01e2033e87f6a53653e1059b9899bfddfcc28645c6ffec086
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9JqatglNqatglV:TID41vyW1Pszno6S
- TLSH T1CAD58D42B78585F2E1670231486752A36BB6BC211F21D78F2394A27D9F337C0BB36766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
- Size 2.8MB
- SHA256 419bb0939d1a4860a701be095a540012600029c7b9b6a29f56511d865efd275f
- MD5 2e3b7c482478f0fce978ee8d3f279bea
- SHA1 8c9011f76778e47eecb26e8e69749af71f9106f3
- SHA512 524de4677cb3a7f82d1e12f7db70d9a2f1e177e45780f9ffa4fb528460636c0e3428a9aea422398fa73583b5bb6523b1fe6bd7ed19b6921455f37c6ba8100ce7
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9JqatglNqatglS:TID41vyW1Pszno61
- TLSH T117D58D42B78585F2E1670231486752A36BB6BC211F21D78F2394A27D9F337C0BB36766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
- Size 2.8MB
- SHA256 68f5b042ad446b7c42fea32c5583cbc689c7534ed9d589bca6525c289e3bebbd
- MD5 04e9e48819256138c3673f5a4a719224
- SHA1 14ff5f3e2f1b312b2cb34e2eb24c0800a04737bb
- SHA512 c9a7bd31fd246e1513728ac70ec3bc122c07cae1cdcd4ae70d84ab908187216a552f5f2a2a24438708a2054cbc4d8361c76aadd965d1e83c58eae2a7d54108bb
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9JqatglNqatglM:TID41vyW1Pszno67
- TLSH T1D5D58D42B78585F2E1670231486752A36BB6BC211F21D78F2394A27D9F337C0BB36766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
- Size 2.8MB
- SHA256 3ef55fa44011b382bf3aa906e5411d684b75fdd514e32d338f8c1b7c268c6d2c
- MD5 c1f735f630a77a735f8e430c070f8a58
- SHA1 edbc95badc66e854821598305a13fac10ec926cb
- SHA512 1a8aa2daaa842e3b3de4014c3bda4d15e08e9fd2c0a8dd8f1bf798c944d2a054e7f4d988633f40d1f9b5b51128c84a9aa292f464663b0a6432f3bc8572a80a96
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9JqatglNqatglC:TID41vyW1Pszno6R
- TLSH T13ED58D42B78585F2E1670231486752A36BB6BC211F21D78F2394A27D9F337C0BB36766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
- Size 2.8MB
- SHA256 2f5c4c3759d94a4c146066f042f9fe8d4e85790124f59767b675d4be18232328
- MD5 7156385cb357f6a66879c2944fbcde44
- SHA1 00748f4ca0fb1132cc460d503903922635a498af
- SHA512 3f36ccd27c1db963e18ed17f1074ce0eb0c816eeb4d6d8ec09b5b0f6345948ec46663acb155e02c750102573cef6df394190e1caa53ff2a6c01f187c78e500b0
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9JqatglNqatglO:TID41vyW1Pszno6B
- TLSH T15ED58D42B78585F2E1670231486752A36BB6BC211F21D78F2394A27D9F337C0BB36766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
- Size 2.8MB
- SHA256 c07a291d9d5c5d6d0612336807ce8600c5b56c0e737f49745fff9b77f80b52ae
- MD5 2020fe4d80fae540eccf90b4328af42f
- SHA1 f27702b9a51e52892550c818461db38e27fa63b4
- SHA512 bab855dcdb9bc6256572fd8ce10d0456009a7785130d9b5b9302e4c5be553d0ac37eee2d42c796f6a1504d3a865f12f0e03c03dee18087c968b0dd68a2ca5f84
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9JqatglNqatglh:TID41vyW1Pszno6u
- TLSH T101D58D42B78585F2E1670231486752A36BB6BC211F21D78F2394A27D9F337C0BB36766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$
- Size 2.8MB
- SHA256 ea13bd0601cec1c063967f33462cb6304efc7ef152b79c5f050484ecb9e607d8
- MD5 0ddee3231e578cc639e7642acd01ed6c
- SHA1 193b23dd54b96817f122f788398bee3b0b7f074f
- SHA512 056306b065c07df9e42f1ab150d4f8665d9e6c42064c35c9579c8b062f268ea68389274a7961e84c011fea5bceeabe8681afa71f3c5f028d58d6f7b29c607d4c
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9JqatglNqatgld:TID41vyW1Pszno6m
- TLSH T11CD58D42B78585F2E1670231486752A36BB6BC211F21D78F2394A27D9F337C0BB36766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$
- Size 3.5MB
- SHA256 f0ddda489ef50dee95817eb9fd6b4b8c626b7379e80195e8a0a6e208a5623f8d
- MD5 b22086bb3784e67d6850969b529e6b24
- SHA1 af15a188b854e2f21857e71bc5760c55baa764db
- SHA512 b28fc6e3a78be74ce9379b43263aebb8939a6b3fdddd528983d48f09284f677e3f4ad93d6d5e0f0e6b9a801734db378f0409f96c9d6f8a1a1a85366c133a61ae
- SSDEEP 98304:TID41vyW1Pszno6VMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMM:TuIXxso
- TLSH T121067C42B78595B2E0770231492742A25B72BC211F2197DF2394B37E6F337C1AB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$
- Size 2.8MB
- SHA256 ef883a9b1a2744e652f1b513c0ee7207fccfbe136de1c040fa747440d5b2d222
- MD5 97ba37f3547e781e01efdaf1a42e2913
- SHA1 c472d68d811510dae4ddec92dcfbca96648595bd
- SHA512 5545bc4d32e5f9e00e1204176095c63b440a6f1ea8ba0f113d953c895dcd7aa9756e230f2ba6518681e46d312b88529f857b99d261bb3ca61706bf4889c1d05f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9JqatglNqatglK:TID41vyW1Pszno6d
- TLSH T1B2D58D42B78585F2E1670231486B52A36B76BC211F21D78F2394A27D9F337C0BB36766
- MD5 SHA1 SHA512 SSDEEP TLSH