Analysis
- max time kernel
105s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 23:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 3.3MB
- Sample260828-3gl7mstyct
- SHA256 caaa21c8d1eeb0fd4851dc58412b41ff761620f1aa0965e87dd4739b886c863c
- MD5 01e51ed3b6af2d4cff99bd38f50fa164
- SHA1 f112cfc8236525cf2d945b23e293198e28485570
- SHA512 b0cae4cb3de70f580301825547dd342aee3ebc8b4ae7ef0a0d86be61804c26bc9dff3117fe708e2e7800516c0eb06a8d8819fc8f43704dede7834d3cd5f3e729
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmNY5CBFXpV56rNLeW4SkZP4sz9Mb:TID41m5CQrJfkZc
- TLSH T174F55B56B7A88B72D0B78175C4979696BE723C111F2087CF1344AB2C2F337D1AA36726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 13 IoCs
pid Process 1696 patcher.exe 3816 803.#.exe 3768 233.#.exe 4352 291.#.exe 2288 446.#.exe 548 651.#.exe 2628 487.#.exe 2012 419.#.exe 1344 151.#.exe 1712 638.#.exe 1280 521.#.exe 1140 505.#.exe 544 651.#.exe - Adds Run key to start application 2 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 233.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 291.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 651.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 487.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 419.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 151.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 803.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 446.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 638.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 521.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 505.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 651.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\ 803.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\ 651.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\ 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\ 803.#.exe File opened for modification C:\Program Files\dotnet\host\fxr\7.0.16\ 651.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ 651.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Stationery\1033\ 803.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lb-LU\ 521.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\am-ET\ 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\ 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\ 291.#.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\ 291.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\ 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\ 803.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\ 419.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\ 803.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\Data Sources\ 291.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\ 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\ 233.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\ 446.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\ 233.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\ 803.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\ 419.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\ 487.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\ 651.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ms-MY\ 803.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 233.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\ 446.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\ 487.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ 487.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\kok-IN\ 419.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\limited\ 487.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ 419.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office15\ 291.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mk-MK\ 419.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\ 803.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ 291.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\ 291.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 233.#.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 291.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ 446.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\ 651.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\kok-IN\ 233.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\ 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\System\en-US\ 291.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 233.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\ 651.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\ 233.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\ 419.#.exe File opened for modification C:\Program Files\dotnet\host\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ 233.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\ 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\ 291.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\ 446.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\ 651.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\ 651.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mr-IN\ 291.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ug-CN\ 291.#.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 233.#.exe File opened for modification C:\Windows\:\systemlog.bak 291.#.exe File opened for modification C:\Windows\:\systemlog.bak 651.#.exe File opened for modification C:\Windows\:\systemlog.bak 638.#.exe File opened for modification C:\Windows\:\systemlog.bak 521.#.exe File opened for modification C:\Windows\:\systemlog.bak 651.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 487.#.exe File opened for modification C:\Windows\:\systemlog.bak 419.#.exe File opened for modification C:\Windows\:\systemlog.bak 505.#.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 291.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 487.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 419.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 151.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 505.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 803.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 233.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 446.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 638.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 521.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe - NTFS ADS 14 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 651.#.exe File opened for modification C:\Windows\:\systemlog.bak 638.#.exe File opened for modification C:\Windows\:\systemlog.bak 651.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Windows\:\systemlog.bak 233.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 446.#.exe File opened for modification C:\Windows\:\systemlog.bak 487.#.exe File opened for modification C:\Windows\:\systemlog.bak 419.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 151.#.exe File opened for modification C:\Windows\:\systemlog.bak 521.#.exe File opened for modification C:\Windows\:\systemlog.bak 505.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 803.#.exe File opened for modification C:\Windows\:\systemlog.bak 291.#.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3556 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe 1696 patcher.exe 3816 803.#.exe 3768 233.#.exe 4352 291.#.exe 2288 446.#.exe 548 651.#.exe 2628 487.#.exe 2012 419.#.exe 1344 151.#.exe 1712 638.#.exe 1280 521.#.exe 1140 505.#.exe 544 651.#.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3556 wrote to memory of 3816 3556 2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe 91 PID 1696 wrote to memory of 3768 1696 patcher.exe 92 PID 3768 wrote to memory of 4352 3768 233.#.exe 93 PID 3816 wrote to memory of 2288 3816 803.#.exe 94 PID 4352 wrote to memory of 548 4352 291.#.exe 95 PID 548 wrote to memory of 2628 548 651.#.exe 96 PID 2628 wrote to memory of 2012 2628 487.#.exe 98 PID 2288 wrote to memory of 1344 2288 446.#.exe 99 PID 2012 wrote to memory of 1712 2012 419.#.exe 100 PID 1712 wrote to memory of 1280 1712 638.#.exe 101 PID 1280 wrote to memory of 1140 1280 521.#.exe 102 PID 1140 wrote to memory of 544 1140 505.#.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-28_01e51ed3b6af2d4cff99bd38f50fa164_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\803.#.exeC:\Users\Admin\AppData\Local\Temp\803.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\446.#.exeC:\Users\Admin\AppData\Local\Temp\446.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\151.#.exeC:\Users\Admin\AppData\Local\Temp\151.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\551.#.exeC:\Users\Admin\AppData\Local\Temp\551.#.exe5⤵PID:4976
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\905c0769f9a06c95a24ddf945\233.#.exeC:\905c0769f9a06c95a24ddf945\233.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\905c0769f9a06c95a24ddf945\291.#.exeC:\905c0769f9a06c95a24ddf945\291.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\905c0769f9a06c95a24ddf945\651.#.exeC:\905c0769f9a06c95a24ddf945\651.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:548 -
C:\905c0769f9a06c95a24ddf945\487.#.exeC:\905c0769f9a06c95a24ddf945\487.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\905c0769f9a06c95a24ddf945\419.#.exeC:\905c0769f9a06c95a24ddf945\419.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\905c0769f9a06c95a24ddf945\638.#.exeC:\905c0769f9a06c95a24ddf945\638.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\905c0769f9a06c95a24ddf945\521.#.exeC:\905c0769f9a06c95a24ddf945\521.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\905c0769f9a06c95a24ddf945\505.#.exeC:\905c0769f9a06c95a24ddf945\505.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\905c0769f9a06c95a24ddf945\651.#.exeC:\905c0769f9a06c95a24ddf945\651.#.exe10⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:544 -
C:\905c0769f9a06c95a24ddf945\361.#.exeC:\905c0769f9a06c95a24ddf945\361.#.exe11⤵PID:3888
-
C:\905c0769f9a06c95a24ddf945\984.#.exeC:\905c0769f9a06c95a24ddf945\984.#.exe12⤵PID:4472
-
C:\905c0769f9a06c95a24ddf945\801.#.exeC:\905c0769f9a06c95a24ddf945\801.#.exe13⤵PID:3208
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.3MB
- SHA256 caaa21c8d1eeb0fd4851dc58412b41ff761620f1aa0965e87dd4739b886c863c
- MD5 01e51ed3b6af2d4cff99bd38f50fa164
- SHA1 f112cfc8236525cf2d945b23e293198e28485570
- SHA512 b0cae4cb3de70f580301825547dd342aee3ebc8b4ae7ef0a0d86be61804c26bc9dff3117fe708e2e7800516c0eb06a8d8819fc8f43704dede7834d3cd5f3e729
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmNY5CBFXpV56rNLeW4SkZP4sz9Mb:TID41m5CQrJfkZc
- TLSH T174F55B56B7A88B72D0B78175C4979696BE723C111F2087CF1344AB2C2F337D1AA36726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe$
- Size 3.3MB
- SHA256 f1afddca59b44df00f57bcd8a411c29d303720efb15b4f7f111f0a66a3c3dc06
- MD5 a375e93b5c668575f9c0831cb02409a6
- SHA1 094f9116cb5c233828ba604c3363ffee26f86797
- SHA512 2c808cc4f89f10027224ec9803e64c46cbefc74b28609ccaf789c45dba37d5261785fb3df0638ee9d64e747129fa0b5d6b679ecb3157adb92ac429d36a9483e0
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmNY5CBFXpV56rNLeW4SkZP4sz9Mbo:TID41m5CQrJfkZco
- TLSH T170F55B56B7A88B72E0778175C4979696BE723C111F2087CF1344AB2C2F337D1AA36726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$
- Size 3.3MB
- SHA256 9a2e9dc2cdb72317e549f6c1a549141775ef2e329e16ee91c83f54ddb6a78700
- MD5 4754a1da1bce97ff16b0988439953192
- SHA1 b0426492499f8ffebe6ebadbafac7a6c4365980d
- SHA512 28f4e9616edab9db22a9864187ef0e9e839427b0388e1cacd5e9fff9eb017192104623aa8b5910b43946b90e65999a3de4112a255936e9f1dfcd20386e35af8b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglmNY5CBFXpV56rNLeW4SkZP4sz9MbR1:TID41m5CQrJfkZcj
- TLSH T1F7F55B56B7A88B72D0B78175C4979696BE723C111F2087CF1344BB2C2E337D1AA36726
- MD5 SHA1 SHA512 SSDEEP TLSH