Analysis
- max time kernel
96s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/08/2026, 23:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 3.3MB
- Sample260828-3gl7mstyct
- SHA256 caaa21c8d1eeb0fd4851dc58412b41ff761620f1aa0965e87dd4739b886c863c
- MD5 01e51ed3b6af2d4cff99bd38f50fa164
- SHA1 f112cfc8236525cf2d945b23e293198e28485570
- SHA512 b0cae4cb3de70f580301825547dd342aee3ebc8b4ae7ef0a0d86be61804c26bc9dff3117fe708e2e7800516c0eb06a8d8819fc8f43704dede7834d3cd5f3e729
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmNY5CBFXpV56rNLeW4SkZP4sz9Mb:TID41m5CQrJfkZc
- TLSH T174F55B56B7A88B72D0B78175C4979696BE723C111F2087CF1344AB2C2F337D1AA36726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 15 IoCs
pid Process 868 patcher.exe 4708 503.#.exe 1488 892.#.exe 2236 109.#.exe 4472 874.#.exe 4796 322.#.exe 1772 564.#.exe 224 322.#.exe 3496 32.#.exe 4184 998.#.exe 3860 752.#.exe 3124 176.#.exe 3408 66.#.exe 3840 847.#.exe 3880 883.#.exe - Adds Run key to start application 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 752.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 32.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 176.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 847.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 503.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 322.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 564.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 998.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 109.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 874.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 66.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 883.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 892.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 322.#.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 66.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 883.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak patcher.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 892.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 874.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 564.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 32.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 752.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\ 322.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\ 564.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\ 752.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\ 874.#.exe File opened for modification C:\Program Files\Common Files\DESIGNER\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ 503.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\ 874.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\ 892.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ 109.#.exe File opened for modification C:\Program Files\7-Zip\ 892.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\ 109.#.exe File opened for modification C:\Program Files\Common Files\System\de-DE\ 892.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\ 564.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 109.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\ 322.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ 503.#.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 874.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 322.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\ 892.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 892.#.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 874.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\ 564.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\ 322.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\ 322.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 752.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ 874.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ 503.#.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\ 874.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 892.#.exe File opened for modification C:\Program Files\Common Files\ 874.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ 322.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr\ 109.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\ 892.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sl-SI\ 874.#.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\ 892.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ 874.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ 109.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\ 322.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\ 564.#.exe File opened for modification C:\Program Files\Common Files\System\de-DE\ 32.#.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\ 503.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Google\Chrome\ 892.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\ 752.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\ 892.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\ 503.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\ 503.#.exe File opened for modification C:\Program Files\Common Files\Services\ 503.#.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\ 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Internet Explorer\images\ 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\ 564.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\ 874.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sk-SK\ 503.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\ 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 503.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\ 322.#.exe File opened for modification C:\Program Files\Common Files\DESIGNER\ 998.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 503.#.exe - System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 564.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 109.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 874.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 322.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 847.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 503.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 892.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 998.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 752.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 883.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 322.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 176.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66.#.exe - NTFS ADS 8 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 998.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 176.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 847.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 503.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 109.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 322.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 322.#.exe - Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 4548 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe 868 patcher.exe 4708 503.#.exe 1488 892.#.exe 2236 109.#.exe 4472 874.#.exe 4796 322.#.exe 1772 564.#.exe 224 322.#.exe 3496 32.#.exe 4184 998.#.exe 3860 752.#.exe 3124 176.#.exe 3408 66.#.exe 3840 847.#.exe 3880 883.#.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4548 wrote to memory of 4708 4548 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe 85 PID 868 wrote to memory of 1488 868 patcher.exe 86 PID 4708 wrote to memory of 2236 4708 503.#.exe 87 PID 1488 wrote to memory of 4472 1488 892.#.exe 90 PID 2236 wrote to memory of 4796 2236 109.#.exe 91 PID 4472 wrote to memory of 1772 4472 874.#.exe 92 PID 4796 wrote to memory of 224 4796 322.#.exe 95 PID 1772 wrote to memory of 3496 1772 564.#.exe 96 PID 224 wrote to memory of 4184 224 322.#.exe 97 PID 3496 wrote to memory of 3860 3496 32.#.exe 100 PID 4184 wrote to memory of 3124 4184 998.#.exe 102 PID 3860 wrote to memory of 3408 3860 752.#.exe 103 PID 3124 wrote to memory of 3840 3124 176.#.exe 107 PID 3408 wrote to memory of 3880 3408 66.#.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\503.#.exeC:\Users\Admin\AppData\Local\Temp\503.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\109.#.exeC:\Users\Admin\AppData\Local\Temp\109.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\322.#.exeC:\Users\Admin\AppData\Local\Temp\322.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\322.#.exeC:\Users\Admin\AppData\Local\Temp\322.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\998.#.exeC:\Users\Admin\AppData\Local\Temp\998.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\176.#.exeC:\Users\Admin\AppData\Local\Temp\176.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\847.#.exeC:\Users\Admin\AppData\Local\Temp\847.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\668.#.exeC:\Users\Admin\AppData\Local\Temp\668.#.exe9⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\129.#.exeC:\Users\Admin\AppData\Local\Temp\129.#.exe10⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\10.#.exeC:\Users\Admin\AppData\Local\Temp\10.#.exe11⤵PID:980
-
-
-
-
-
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868 -
C:\905c0769f9a06c95a24ddf945\892.#.exeC:\905c0769f9a06c95a24ddf945\892.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\905c0769f9a06c95a24ddf945\874.#.exeC:\905c0769f9a06c95a24ddf945\874.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\905c0769f9a06c95a24ddf945\564.#.exeC:\905c0769f9a06c95a24ddf945\564.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\905c0769f9a06c95a24ddf945\32.#.exeC:\905c0769f9a06c95a24ddf945\32.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\905c0769f9a06c95a24ddf945\752.#.exeC:\905c0769f9a06c95a24ddf945\752.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\905c0769f9a06c95a24ddf945\66.#.exeC:\905c0769f9a06c95a24ddf945\66.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\905c0769f9a06c95a24ddf945\883.#.exeC:\905c0769f9a06c95a24ddf945\883.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3880 -
C:\905c0769f9a06c95a24ddf945\80.#.exeC:\905c0769f9a06c95a24ddf945\80.#.exe9⤵PID:2984
-
C:\905c0769f9a06c95a24ddf945\755.#.exeC:\905c0769f9a06c95a24ddf945\755.#.exe10⤵PID:4660
-
C:\905c0769f9a06c95a24ddf945\127.#.exeC:\905c0769f9a06c95a24ddf945\127.#.exe11⤵PID:3736
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\127.#.exe
- Size 2.7MB
- SHA256 f2e4d5b3b132422580ed874d14e8767771b9dbfad9f97acf1258a6f1db28bcf8
- MD5 854ac77f8e4bd9f4249b63173977417b
- SHA1 1fa254d23b645b2ff0ef8cb98f9f834970c8a397
- SHA512 d0e46eff2f8d869469c2d21a5de345a2af5831acdf0f7635447a6d5638fa52ec089da4ab58590722ab2edfedc1fbd3478d09106557d1417e14e55886693ed99c
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmNY5CBFXpV56rNLeW4G:TID41m5CQrJR
- TLSH T123D57C16B7944AB2E0674235845792A2AB737C211F2197CF1390BB6D7F337D0AA39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.3MB
- SHA256 caaa21c8d1eeb0fd4851dc58412b41ff761620f1aa0965e87dd4739b886c863c
- MD5 01e51ed3b6af2d4cff99bd38f50fa164
- SHA1 f112cfc8236525cf2d945b23e293198e28485570
- SHA512 b0cae4cb3de70f580301825547dd342aee3ebc8b4ae7ef0a0d86be61804c26bc9dff3117fe708e2e7800516c0eb06a8d8819fc8f43704dede7834d3cd5f3e729
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmNY5CBFXpV56rNLeW4SkZP4sz9Mb:TID41m5CQrJfkZc
- TLSH T174F55B56B7A88B72D0B78175C4979696BE723C111F2087CF1344AB2C2F337D1AA36726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$
- Size 3.3MB
- SHA256 1ac2173724be38e8421d577f12e8905fbc23d21663579dd80ece040154b183ec
- MD5 666ec1983cd6e2b493c40dbb5e06d6cc
- SHA1 c1880d37f72aafa4322d4d57d892568a5baf5143
- SHA512 f74fdf7b28a303ac10962b351adfd6efccc17c58215192d35939387e11829cd571b3c48308154306a010dc28b5e26ea1c677ad6c6c9123a28e6ed44527a10411
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmNY5CBFXpV56rNLeW4SkZP4sz9MbM:TID41m5CQrJfkZcM
- TLSH T169F55B56B7A88B72E0778175C4979696BE723C111F2087CF1344AB2C2F337D1AA36726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe$
- Size 3.3MB
- SHA256 9a54091f7271d6ff3a40823d898bd19248923a42499d7a73fc2c87a446d73747
- MD5 b012e062bba7a43bbbd4aa533d815102
- SHA1 1dc61bd547fb0e01df4928890a0fadbaaf6e70f3
- SHA512 d474a20d19c45acde4b298b86dd847b2be97ad88b1ea7b1f1de4fbfea5df88761dab153610f94e946c69554ca1f1e5aba4c9f0d52e2822406c45ffcc41f094a8
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmNY5CBFXpV56rNLeW4SkZP4sz9Mb6:TID41m5CQrJfkZc6
- TLSH T105F55B56B7A88B72E0778175C4979696BE723C111F2087CF1344AB2C2F337D1AA36726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe$
- Size 3.4MB
- SHA256 307f799591c8f71e44fa2b830d4c4c93fdbb9830802fde9877ab5782a64fb580
- MD5 7ead328e38a2d3e853955f4c8ae7952c
- SHA1 549d6b651dabc24cea6967f9fadaaf7a7ecfad70
- SHA512 e7a70186987084c039461f37c48567c1f613e9f2372d40050ffdbb69d58125564653db9e812d9d5f21b6e904d164eab1b174486c03214d4200c546329f404fd8
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmNY5CBFXpV56rNLeW4SkZP4sz9Mb2x:TID41m5CQrJfkZci
- TLSH T121F55B56B7A88B72E0778175C4979696BE723C111F2087CF1344BB2C2E337D1AA36726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmid.exe$
- Size 3.3MB
- SHA256 6d26931f318cc874881926e71a9f43eeb63d876042d0f8271f0f9b43f0afcd78
- MD5 9b43fca57834d0bb12c7fd7d0f7c4060
- SHA1 5f87b90e2596c336d42ccbf3e735c83d8588a3ea
- SHA512 add225257c60efd7a999e24542875decb03e7680b6417b793a540ce3d754c5125f302c3ee36b8216b32effe3a23de0b0d2a7b0bf68edefcf11ca69ee358451fe
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmNY5CBFXpV56rNLeW4SkZP4sz9MbW:TID41m5CQrJfkZcW
- TLSH T1AEF55B56B7A88B72E0778175C4979696BE723C111F2087CF1344AB2C2F337D1AA36726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
- Size 3.7MB
- SHA256 35687e2d8a5fbeb290ef3551d5e3e1c4a1e34ad41635c223775d2a31894e2ed3
- MD5 2bc7bf7aaf6909eb83cce1b6a0484520
- SHA1 74889e44831ad753493169f5ecc10395b0bbff17
- SHA512 d96fb8334d2a9fc06f04c64bc0debfa679aff8fc32dbbb31887612efc828308319870b040876f888bb2eb188a59dbccdff62e786c3ecc888dd08bb47869fadea
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmNY5CBFXpV56rNLeW4SkZP4sz9MbPZkk:TID41m5CQrJfkZcxF
- TLSH T116065A46B7A88B72D0778175C4A796A6FA727C111F2087CB1344E72D2F337D0AA39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$
- Size 3.7MB
- SHA256 d62b22fce7a4c4ac73f6ce021daa259a73af7085809f7c7a252f8b8c82a7393a
- MD5 15797b08134ae12333e7ef7dfc681aae
- SHA1 897a28034e25b67362a7570d589351e1224c87be
- SHA512 6d6610613b50345ec8fbcb602dffa8d78fc5236244e08d61de9ad01736fc56ed80dac3bf316595f2fd384e6a52a3e1583a6d6ca8650b4852a4dab820ebbda5a0
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmNY5CBFXpV56rNLeW4SkZP4sz9MbmZkk:TID41m5CQrJfkZc0F
- TLSH T1F4065A46B7A88B72D0778175C4A796A6FA727C111F2087CB1344E72D2F337D0AA39726
- MD5 SHA1 SHA512 SSDEEP TLSH