Analysis
- max time kernel
83s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 04:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
- Size 2.7MB
- Sample260828-e38e1atarh
- SHA256 5ef84c14e31e4a2c12a745bed7836aa8679cc6f48dea93ad85be50143514dada
- MD5 dda3b94ed656c128922288348b74d42d
- SHA1 c59ae7ca0f8e3e68f2e83e324977d60e82e6b871
- SHA512 140ddff32b34fe05d5a6973a3fcacf4c88a3dee696b581249341490598002775a58d41dfe93290a9ae397334e77c4561b72f502232d52be50d4dea91614c4a44
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5:TID41vyW1Psznou5
- TLSH T1D6D57C46B79595F2E5731231882782A26F72B8211F2197CF2390A27D5F337C0BB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 14 IoCs
pid Process 4840 patcher.exe 4364 372.#.exe 4956 538.#.exe 3696 594.#.exe 1352 8.#.exe 1196 104.#.exe 3312 636.#.exe 1476 589.#.exe 3132 221.#.exe 3420 115.#.exe 3092 294.#.exe 6064 816.#.exe 1404 604.#.exe 4228 49.#.exe - Adds Run key to start application 2 TTPs 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 372.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 589.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 604.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 49.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 538.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 594.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 221.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 115.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 294.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 8.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 104.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 636.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 816.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hy-AM\ 594.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-RS\ 8.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\ 538.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\ 589.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ur-PK\ 816.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bn-IN\ 604.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bn-IN\ 115.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\applet\ 594.#.exe File opened for modification C:\Program Files\dotnet\swidtag\ 538.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\host\fxr\7.0.16\ 594.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\ 594.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ur-PK\ 104.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\ 8.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-BA\ 8.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\ 8.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ 636.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\ 8.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SAMPLES\ 589.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\ 594.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 538.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr\ 538.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 538.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\af-ZA\ 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hr-HR\ 8.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\ 104.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\ 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\ 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\ 115.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ 636.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\ 104.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\ 221.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\ 115.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\he-IL\ patcher.exe File opened for modification C:\Program Files\Common Files\System\ja-JP\ 636.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\ 8.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\ 221.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 8.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ 594.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ga-IE\ 538.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\ 8.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\ 538.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\management\ 221.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mt-MT\ 636.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\ 372.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\ 589.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\ 115.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ca-ES\ 8.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-TW\ 372.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\ 636.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 221.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\ 115.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\ 594.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ 372.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\ 372.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\ 372.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\az-Latn-AZ\ 538.#.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 538.#.exe File opened for modification C:\Windows\:\systemlog.bak 8.#.exe File opened for modification C:\Windows\:\systemlog.bak 636.#.exe File opened for modification C:\Windows\:\systemlog.bak 589.#.exe File opened for modification C:\Windows\:\systemlog.bak 115.#.exe File opened for modification C:\Windows\:\systemlog.bak 604.#.exe File opened for modification C:\Windows\:\systemlog.bak 49.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 221.#.exe File opened for modification C:\Windows\:\systemlog.bak 816.#.exe - System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 636.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 115.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 816.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 372.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 538.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 594.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 104.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 294.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 604.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 589.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 221.#.exe - NTFS ADS 15 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 372.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 104.#.exe File opened for modification C:\Windows\:\systemlog.bak 816.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 594.#.exe File opened for modification C:\Windows\:\systemlog.bak 115.#.exe File opened for modification C:\Windows\:\systemlog.bak 221.#.exe File opened for modification C:\Windows\:\systemlog.bak 604.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Windows\:\systemlog.bak 538.#.exe File opened for modification C:\Windows\:\systemlog.bak 8.#.exe File opened for modification C:\Windows\:\systemlog.bak 636.#.exe File opened for modification C:\Windows\:\systemlog.bak 589.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 294.#.exe File opened for modification C:\Windows\:\systemlog.bak 49.#.exe - Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 5824 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe 4840 patcher.exe 4364 372.#.exe 4956 538.#.exe 3696 594.#.exe 1352 8.#.exe 1196 104.#.exe 3312 636.#.exe 1476 589.#.exe 3132 221.#.exe 3420 115.#.exe 3092 294.#.exe 6064 816.#.exe 1404 604.#.exe 4228 49.#.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 5824 wrote to memory of 4364 5824 2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe 91 PID 4840 wrote to memory of 4956 4840 patcher.exe 92 PID 4364 wrote to memory of 3696 4364 372.#.exe 93 PID 4956 wrote to memory of 1352 4956 538.#.exe 94 PID 3696 wrote to memory of 1196 3696 594.#.exe 95 PID 1352 wrote to memory of 3312 1352 8.#.exe 96 PID 3312 wrote to memory of 1476 3312 636.#.exe 97 PID 1476 wrote to memory of 3132 1476 589.#.exe 98 PID 3132 wrote to memory of 3420 3132 221.#.exe 100 PID 1196 wrote to memory of 3092 1196 104.#.exe 101 PID 3420 wrote to memory of 6064 3420 115.#.exe 102 PID 6064 wrote to memory of 1404 6064 816.#.exe 103 PID 1404 wrote to memory of 4228 1404 604.#.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_dda3b94ed656c128922288348b74d42d_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\372.#.exeC:\Users\Admin\AppData\Local\Temp\372.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\594.#.exeC:\Users\Admin\AppData\Local\Temp\594.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\104.#.exeC:\Users\Admin\AppData\Local\Temp\104.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\294.#.exeC:\Users\Admin\AppData\Local\Temp\294.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\472.#.exeC:\Users\Admin\AppData\Local\Temp\472.#.exe6⤵PID:2608
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\905c0769f9a06c95a24ddf945\538.#.exeC:\905c0769f9a06c95a24ddf945\538.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\905c0769f9a06c95a24ddf945\8.#.exeC:\905c0769f9a06c95a24ddf945\8.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\905c0769f9a06c95a24ddf945\636.#.exeC:\905c0769f9a06c95a24ddf945\636.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\905c0769f9a06c95a24ddf945\589.#.exeC:\905c0769f9a06c95a24ddf945\589.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\905c0769f9a06c95a24ddf945\221.#.exeC:\905c0769f9a06c95a24ddf945\221.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\905c0769f9a06c95a24ddf945\115.#.exeC:\905c0769f9a06c95a24ddf945\115.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\905c0769f9a06c95a24ddf945\816.#.exeC:\905c0769f9a06c95a24ddf945\816.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\905c0769f9a06c95a24ddf945\604.#.exeC:\905c0769f9a06c95a24ddf945\604.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\905c0769f9a06c95a24ddf945\49.#.exeC:\905c0769f9a06c95a24ddf945\49.#.exe10⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4228 -
C:\905c0769f9a06c95a24ddf945\827.#.exeC:\905c0769f9a06c95a24ddf945\827.#.exe11⤵PID:3668
-
C:\905c0769f9a06c95a24ddf945\287.#.exeC:\905c0769f9a06c95a24ddf945\287.#.exe12⤵PID:5796
-
C:\905c0769f9a06c95a24ddf945\918.#.exeC:\905c0769f9a06c95a24ddf945\918.#.exe13⤵PID:3280
-
C:\905c0769f9a06c95a24ddf945\553.#.exeC:\905c0769f9a06c95a24ddf945\553.#.exe14⤵PID:1728
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.7MB
- SHA256 5ef84c14e31e4a2c12a745bed7836aa8679cc6f48dea93ad85be50143514dada
- MD5 dda3b94ed656c128922288348b74d42d
- SHA1 c59ae7ca0f8e3e68f2e83e324977d60e82e6b871
- SHA512 140ddff32b34fe05d5a6973a3fcacf4c88a3dee696b581249341490598002775a58d41dfe93290a9ae397334e77c4561b72f502232d52be50d4dea91614c4a44
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5:TID41vyW1Psznou5
- TLSH T1D6D57C46B79595F2E5731231882782A26F72B8211F2197CF2390A27D5F337C0BB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 2.7MB
- SHA256 0ecd0113cef495e8ef015ed3080811cb5f01700230621d390bf1eb84e359fdf8
- MD5 30f46f8aaaf01e02552ba00ab23a4eb2
- SHA1 f36eff214f02741659dc1d5fdc27bfb2ce1a9fe9
- SHA512 aac88f27b2ed74be05ac00d22ce5eab85780fb8086bf6f8674a6a111acc70d2d101d8ea440e71a9dc1b1f41bf9707165592f05bab6865926e2df629dea35e520
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5h:TID41vyW1Psznou5h
- TLSH T10DD57C46B79595F2E5731231882782A26F72B8211F2197CF2390A27D5F337C0BB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$
- Size 2.7MB
- SHA256 d56a7a03ed511280010b1183dad7bcd8a00405bcde303c650b91f57b022fa020
- MD5 ade2db45c7337d862c1b6e8e68ed2779
- SHA1 10ad8767ad894340f58f05408a172642c6b6a174
- SHA512 82a4a5612cdeb185f37daaaba28d6633e9dd7b79591e9cd37a431d2f1433e20294625cd375a1df18b6f90c89f10bd51cc6792ec1cc93b4edecef7573be99c217
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y53:TID41vyW1Psznou53
- TLSH T191D57C46B79595F2E5731231882782A26F72B8211F2197CF2390A27D5F337C0BB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ktab.exe$
- Size 2.7MB
- SHA256 d0d9213f146512468b147284a753441f2df8225346d798758711b65613fa4536
- MD5 55fd2b8f73e10cf06888eabfb14360a3
- SHA1 8f8690decca5b2289f8d1d70a4d229c3af7d2edb
- SHA512 6cfc7e02ed9fe06916cd8eef372433031c9907c389b38b9d567b6b6817c0590e25c9b953d32df966f4a118a63d8fea9698a2e59a8b0fe773d6b1a7088be3d2c5
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y51:TID41vyW1Psznou51
- TLSH T10FD57C46B79595F2E5731231882782A26F72B8211F2197CF2390A27D5F337C0BB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$
- Size 2.7MB
- SHA256 ebc901ba23eaaecd351e1982a805595d8547c4c2b9183d84411178cf568434f3
- MD5 12bb717f3e9943d9b487a841e2b15e09
- SHA1 8101696454de37d83117b0ce7a99e6ae8277e36e
- SHA512 aff456fe0e754d1febfcd0b45022af0bc1c45d65393f58096b1026d4844d4b6ec02c3e86f3ff9d28651a8e2c50bcf2ceb53c7d761f17ca1423312a589d17d3bd
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5g1:TID41vyW1Psznou54
- TLSH T113D57C46B79595F2E5731231882782A26F72B8211F21D78F2390A27D5F337C0BB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msotd.exe$
- Size 2.7MB
- SHA256 c22c1070bdf578068c07d5902ec307a0516f67b65d8cd5e307dd00cfa41bd3dc
- MD5 e799e891a1bd599e1c96e7b92f9b9cf7
- SHA1 12df2551018603effbe5024cbf0d5acb6f5d5038
- SHA512 96032d84ac1f6f56152127824669bd9c812a7d874aab57dde245e3c4e6fb4243c6fb273b9c9e1203559f16431a617f6557196199a8355b43941dbadedb42f683
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5G:TID41vyW1Psznou5G
- TLSH T10FD58C42B79555F2E5731231882782A2AF72B8210F21D78F2394A67D5F337D0BB3A716
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe
- Size 2.7MB
- SHA256 bfac1199d7d3b5caf5a5e35555b76b3e0c79e9951d3013b291b2b8dd9ef7394f
- MD5 75f9e9a62bdf34a8f9e26752efcec87d
- SHA1 aa169d985d92cd8914c09b72a0792eca2b70b3e5
- SHA512 255dbbe4ed98acdf4bb7e93e5f98cdd825265b4a82b0f3b61e5b826292cf49aa72938de7525387c4321237aa286e993a107dd949f45faf2b14f37a9e89ec0466
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5w2:TID41vyW1Psznou5L
- TLSH T154D58C46B79595F2E5731231882782A26F72B8211F21D78F2390A27D5F337C0BB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$
- Size 2.8MB
- SHA256 53b32a194df417c943a4444284eaa83364636975d17bfcc99a04cdcc793e2b25
- MD5 badff6973d0f1f18477f93f4b8c5fe42
- SHA1 4bc487ba800d16d229707e2e61062f1795d17e99
- SHA512 02b5baec8799191ca38f41743880bce3a99d18392b3131a91d0f1ec51b0b2946c721d9505e9b4e3d3053e81a53680521d0036c4057e6e5d6f8b81734a6a607d4
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5r:TID41vyW1Psznou5
- TLSH T153D58D42B7D555B2E5731231886782A26F72B8211F21D7CF2394A27D5F337C0AB3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe
- Size 2.7MB
- SHA256 090e80f36766d1da70ab7901e82082b481d0c48ed027bacc3ffae134d962f27b
- MD5 338abbc1507545775d43802f300acf9a
- SHA1 21ceea9c236077e9b23f6f7a1023aa6f4393dda1
- SHA512 046b63fd03bdf1623022dcb6cfd3b83ba38422c1315df3d6cddd5ee1d10f345ff8f4d1f54fd9d5d05e8652cdfd19c6aeafe9e3ddf2a0fe5f88a9fba5c565d4d7
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5e:TID41vyW1Psznou5e
- TLSH T1BCD58C46B79595F2E5731231882782A26F72B8211F21D78F2390A27D5F337C0BB3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$
- Size 3.1MB
- SHA256 e1b7240484f9ce150d3ba2a7b7ce3f8d2eafb4275b926486e73856e95983cf8b
- MD5 58dae9b847d748dd17d946d207a5f61e
- SHA1 2a6da993e2492c1cecf44d7c3a6fcc92dd72bd59
- SHA512 12753ef0d1c524d2a67e7834320bb831ee803de4bc240bcd7b35bf3a64c67237563078a1dd778866b264bd8909998f4bc8c581fde0aed022fd5563293461dcec
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Jqatgl8Y5+i6:TID41vyW1Psznou5+i6
- TLSH T1B2E57D8277869CB2F16A0530842742756A73BD240FE3968F238C7A6D9F337C4AAF5715
- MD5 SHA1 SHA512 SSDEEP TLSH