Analysis
- max time kernel
101s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/08/2026, 04:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
- Size 2.7MB
- Sample260828-e38e1atarh
- SHA256 5ef84c14e31e4a2c12a745bed7836aa8679cc6f48dea93ad85be50143514dada
- MD5 dda3b94ed656c128922288348b74d42d
- SHA1 c59ae7ca0f8e3e68f2e83e324977d60e82e6b871
- SHA512 140ddff32b34fe05d5a6973a3fcacf4c88a3dee696b581249341490598002775a58d41dfe93290a9ae397334e77c4561b72f502232d52be50d4dea91614c4a44
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5:TID41vyW1Psznou5
- TLSH T1D6D57C46B79595F2E5731231882782A26F72B8211F2197CF2390A27D5F337C0BB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 18 IoCs
pid Process 1044 patcher.exe 2548 90.#.exe 2844 222.#.exe 3872 240.#.exe 3512 502.#.exe 4380 39.#.exe 3708 922.#.exe 3952 620.#.exe 2020 122.#.exe 3076 947.#.exe 3820 229.#.exe 1188 840.#.exe 2988 974.#.exe 1840 364.#.exe 1596 69.#.exe 1796 499.#.exe 4220 485.#.exe 3532 670.#.exe - Adds Run key to start application 2 TTPs 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 240.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 670.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 947.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 229.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 974.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 39.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 922.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 122.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 364.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 69.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 499.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 840.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 90.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 502.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 620.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 485.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 222.#.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 222.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 122.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 229.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 502.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 922.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 974.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 69.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 485.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 502.#.exe File opened for modification C:\Program Files\Crashpad\reports\ 90.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 502.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\ 229.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\ 122.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\management\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\ 39.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\ 90.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\ 122.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ 222.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\ 222.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\ 90.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ 620.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\ 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sv-SE\ 122.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\ 122.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\ 229.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-MX\ 840.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 240.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\ 947.#.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 90.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\ 222.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ 222.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ 240.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ patcher.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\ 840.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr\ 222.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ 39.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ 240.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ 502.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 240.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 502.#.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 222.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ 620.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ 240.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\ 922.#.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 502.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\ 502.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\plugin2\ 240.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ 922.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\ 502.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tr-TR\ 222.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\management\ 122.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\ 364.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\ 122.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\ 222.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\ 90.#.exe File opened for modification C:\Program Files\Internet Explorer\images\ 240.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\ 620.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ 90.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\ 222.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\ 240.#.exe File opened for modification C:\Program Files\Internet Explorer\images\ 922.#.exe File opened for modification C:\Program Files\Internet Explorer\ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 39.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\ 222.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\ 922.#.exe - System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 222.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 502.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 229.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 499.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 922.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 670.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 620.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 485.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 240.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 122.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 947.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 840.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 974.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 364.#.exe - NTFS ADS 10 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 364.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 670.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 90.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 39.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 620.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 499.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 240.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 947.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 840.#.exe - Suspicious use of SetWindowsHookEx 19 IoCs
pid Process 4440 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe 1044 patcher.exe 2548 90.#.exe 2844 222.#.exe 3872 240.#.exe 3512 502.#.exe 4380 39.#.exe 3708 922.#.exe 3952 620.#.exe 2020 122.#.exe 3076 947.#.exe 3820 229.#.exe 1188 840.#.exe 2988 974.#.exe 1840 364.#.exe 1596 69.#.exe 1796 499.#.exe 4220 485.#.exe 3532 670.#.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4440 wrote to memory of 2548 4440 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe 89 PID 1044 wrote to memory of 2844 1044 patcher.exe 90 PID 2548 wrote to memory of 3872 2548 90.#.exe 91 PID 2844 wrote to memory of 3512 2844 222.#.exe 93 PID 3872 wrote to memory of 4380 3872 240.#.exe 94 PID 3512 wrote to memory of 3708 3512 502.#.exe 95 PID 4380 wrote to memory of 3952 4380 39.#.exe 96 PID 3708 wrote to memory of 2020 3708 922.#.exe 97 PID 3952 wrote to memory of 3076 3952 620.#.exe 100 PID 2020 wrote to memory of 3820 2020 122.#.exe 101 PID 3076 wrote to memory of 1188 3076 947.#.exe 104 PID 3820 wrote to memory of 2988 3820 229.#.exe 105 PID 1188 wrote to memory of 1840 1188 840.#.exe 106 PID 2988 wrote to memory of 1596 2988 974.#.exe 109 PID 1840 wrote to memory of 1796 1840 364.#.exe 113 PID 1596 wrote to memory of 4220 1596 69.#.exe 114 PID 1796 wrote to memory of 3532 1796 499.#.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\90.#.exeC:\Users\Admin\AppData\Local\Temp\90.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\240.#.exeC:\Users\Admin\AppData\Local\Temp\240.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\39.#.exeC:\Users\Admin\AppData\Local\Temp\39.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\620.#.exeC:\Users\Admin\AppData\Local\Temp\620.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\947.#.exeC:\Users\Admin\AppData\Local\Temp\947.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\840.#.exeC:\Users\Admin\AppData\Local\Temp\840.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\364.#.exeC:\Users\Admin\AppData\Local\Temp\364.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\499.#.exeC:\Users\Admin\AppData\Local\Temp\499.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\670.#.exeC:\Users\Admin\AppData\Local\Temp\670.#.exe10⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\324.#.exeC:\Users\Admin\AppData\Local\Temp\324.#.exe11⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\385.#.exeC:\Users\Admin\AppData\Local\Temp\385.#.exe12⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\517.#.exeC:\Users\Admin\AppData\Local\Temp\517.#.exe13⤵PID:5008
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\905c0769f9a06c95a24ddf945\222.#.exeC:\905c0769f9a06c95a24ddf945\222.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\905c0769f9a06c95a24ddf945\502.#.exeC:\905c0769f9a06c95a24ddf945\502.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\905c0769f9a06c95a24ddf945\922.#.exeC:\905c0769f9a06c95a24ddf945\922.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\905c0769f9a06c95a24ddf945\122.#.exeC:\905c0769f9a06c95a24ddf945\122.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\905c0769f9a06c95a24ddf945\229.#.exeC:\905c0769f9a06c95a24ddf945\229.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\905c0769f9a06c95a24ddf945\974.#.exeC:\905c0769f9a06c95a24ddf945\974.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\905c0769f9a06c95a24ddf945\69.#.exeC:\905c0769f9a06c95a24ddf945\69.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\905c0769f9a06c95a24ddf945\485.#.exeC:\905c0769f9a06c95a24ddf945\485.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4220 -
C:\905c0769f9a06c95a24ddf945\500.#.exeC:\905c0769f9a06c95a24ddf945\500.#.exe10⤵PID:2464
-
C:\905c0769f9a06c95a24ddf945\887.#.exeC:\905c0769f9a06c95a24ddf945\887.#.exe11⤵PID:4764
-
C:\905c0769f9a06c95a24ddf945\703.#.exeC:\905c0769f9a06c95a24ddf945\703.#.exe12⤵PID:4372
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.7MB
- SHA256 5ef84c14e31e4a2c12a745bed7836aa8679cc6f48dea93ad85be50143514dada
- MD5 dda3b94ed656c128922288348b74d42d
- SHA1 c59ae7ca0f8e3e68f2e83e324977d60e82e6b871
- SHA512 140ddff32b34fe05d5a6973a3fcacf4c88a3dee696b581249341490598002775a58d41dfe93290a9ae397334e77c4561b72f502232d52be50d4dea91614c4a44
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5:TID41vyW1Psznou5
- TLSH T1D6D57C46B79595F2E5731231882782A26F72B8211F2197CF2390A27D5F337C0BB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.8MB
- SHA256 07c38e43d9a3bb8ea6a3a4a7474c9bc72c8856a495b517dc2def86e1c727b492
- MD5 5371c326457f2af50da7dc305ef9cf94
- SHA1 726c6e4be50ab06d06a653024241df61a6bbcee2
- SHA512 36b8c8840303aa794ebb768a4994d5d7e434e3110170e5d3137b1870fd88001d89006406d12450a1720877ffd71d290f87ef7fb881416860bfc651efefda7425
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5x:TID41vyW1Psznou5x
- TLSH T1A5D57C46F79555A2D16B1231C62782A27E73B8210FA1978F23D0E23D5F337C0AA7A717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 2.7MB
- SHA256 a7eae5a623c37d8c6432884671190029e59d76e7ee26af86d8e997b62741293e
- MD5 d68afd87c27c454967fe3e44dd38f7a0
- SHA1 1274ffa0797e2a81f5f09224044c1c486fc237f3
- SHA512 5e33a9df9b18e1deb168b4a2d7377d1313667a61f1bd6d719bcc0baab3ac0c58695ac639ef4ff25067ad7deea18f89d5c2240e8bf3543583dd9c7849e9630d97
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5H:TID41vyW1Psznou5H
- TLSH T11AD57C46B79595F2E5731231882782A26F72B8211F2197CF2390A27D5F337C0BB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$
- Size 2.9MB
- SHA256 42ef6cc6111e02ef459c8f1bd52fa05698b50d0e6b5a8567db086e495ce42cab
- MD5 fd0360cda47cdbb5cb7fc72da265fecc
- SHA1 bff1d35f5a304c30c24e361aba2d3a764608a307
- SHA512 29fa06bf217c2b4b0b3e3007a8482e8a66b03af6002a8b681a5cfc9476809d19dd92a8c2bc20e2b8b0d2fbf300a179b7f74c987c82111446da9c5e5d5f9394e7
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5mZM9zfu:TID41vyW1Psznou5Vzfu
- TLSH T1F9E58D46B79555F2E5730231882782A2AF72B8211F21D78F2394A27D5F337C0BE3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe$
- Size 2.7MB
- SHA256 fac48173e8cdf293758de0f0491a9afd44647ac7f49c1689fd0eff9165d8b049
- MD5 d92a6b2cef5ce603e85463cc05d5f02d
- SHA1 7c47ba367117361eec46dffdbc4b38f35abd797e
- SHA512 f45eb30670e7466f0fbbc56c0a80cc0286cf808e03e46dc7e0ca858b028a52f984f44ff8dc70352ce9a85822bf8759a105c146fee38f4180c200161f2c6d677b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y56:TID41vyW1Psznou56
- TLSH T1B4D57C46B79595F2E5731231882782A26F72B8211F2197CF2390A27D5F337C0BB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 2.7MB
- SHA256 9a3cd50d02023bb53a828ca3592072be399209b434da80fc9ce3a60eac7dd078
- MD5 7ea8b8f72232fa90b4c9b3b5449287ef
- SHA1 c8c6fb07d729624d79a5c48d2fc0eeb2d2561b80
- SHA512 aba2c73a4c506ea4206200f79a7b56afb200df13119d783d48d0568847e663a77d603ac69f73194ae56f0d94a5f17297ff437c34ac5ab691d130e45ffe07778c
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5f:TID41vyW1Psznou5f
- TLSH T1C7D57C46B79595F2E5731231882782A26F72B8211F2197CF2390A27D5F337C0BB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$
- Size 2.7MB
- SHA256 2391056195fa3e97641b754c16285b6b4214ce1827dd958a614497325655c37e
- MD5 ae68bbc00bb1970d8611d978f79939ed
- SHA1 9f9edb024b8f364737cb265420cfde85b0e44eae
- SHA512 cdbbd5c6689968366421fcd838f05be2d8d9d3178f6bbf94e735937eae47f9de0794b8016bf93d3d18b956b21d70b543f9ae408f9b140ceb4f940873a24fc0be
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5U:TID41vyW1Psznou5U
- TLSH T155D57C46B79595F2E5731231882782A26F72B8211F2197CF2390A27D5F337C0BB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$
- Size 2.7MB
- SHA256 8ffa6e239f5d32a75f78420112f2b72a3ab306f93b0c43e609a61a6d8238bd16
- MD5 eb6e6752d081f87ecab2abc07c7d4f7a
- SHA1 6333fae04012f75a81560585323bdc6711b0d9b2
- SHA512 9d2a3e94f3309d08d834755135f0842ffc90ea380b0597409be135d3b8a92c3e04edfd4b28726849eabe6d154865de0a004db53c1a7da3a67e3996be8d8f0f01
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5z:TID41vyW1Psznou5z
- TLSH T1F6D57C46B79595F2E5731231882782A26F72B8211F2197CF2390A27D5F337C0BB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH