aba85ac8b3cce6cfa5986e87a55667f7ef559f1830d3644fa21e027561fed5ca

Analysis

max time kernel
103s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_e367bdd7859e42f7b969e7249f488958_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
Size 3.8MB
Sample260828-ee2bsabg35
SHA256 aba85ac8b3cce6cfa5986e87a55667f7ef559f1830d3644fa21e027561fed5ca
MD5 e367bdd7859e42f7b969e7249f488958
SHA1 2ef60e9fb54ed2b2ef9956de067a3885ec770986
SHA512 54d78c5c983286616e5e36ca93769f9ead436bc34578baeba4f217d6549312af25a1cbbd35feac63a1ae51a2a2184a42622f372817e76bae2d7dbd93a7c34aa1
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglwy6i1zuajsauZjaxiw2ux:TID41qW1PszVztC6m5
TLSH
T116068D06B7E841B2E0735135C5A752A6AE7278211F31D7CF1384A63D6F337D0AA39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
1544	patcher.exe
4532	886.#.exe
5864	116.#.exe
2660	775.#.exe
2728	532.#.exe
244	749.#.exe
2072	409.#.exe
952	812.#.exe
1048	205.#.exe
5024	788.#.exe
5768	995.#.exe
5796	740.#.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-27_e367bdd7859e42f7b969e7249f488958_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	886.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	116.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	775.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	205.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	995.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	740.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	532.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	749.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	409.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	812.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	788.#.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\	886.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\	788.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\	812.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\	2026-08-27_e367bdd7859e42f7b969e7249f488958_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\	749.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\	788.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\	749.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\	116.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\	886.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\	788.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\	2026-08-27_e367bdd7859e42f7b969e7249f488958_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ml-IN\	775.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\	886.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\	775.#.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	409.#.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\es-ES\	788.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\	116.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\	2026-08-27_e367bdd7859e42f7b969e7249f488958_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\	886.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	116.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\is-IS\	749.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\	886.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\loc\	116.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\	532.#.exe
File opened for modification	C:\Program Files\Internet Explorer\de-DE\	409.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\	409.#.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\	788.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\	788.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\af-ZA\	116.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\	749.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\	788.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\	532.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\	886.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\	749.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\	812.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\	788.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\id-ID\	886.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\3082\	409.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\	409.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\	409.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\	116.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\	812.#.exe
File opened for modification	C:\Program Files\Java\	812.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\	2026-08-27_e367bdd7859e42f7b969e7249f488958_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\	749.#.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\	812.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\	886.#.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\	2026-08-27_e367bdd7859e42f7b969e7249f488958_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\	749.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\	532.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\	patcher.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\it-IT\	409.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\	812.#.exe
File opened for modification	C:\Program Files\Google\	2026-08-27_e367bdd7859e42f7b969e7249f488958_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\systemlog.bak	patcher.exe
File opened for modification	C:\Windows\:\systemlog.bak	116.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	532.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	749.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	788.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	995.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	740.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	409.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	812.#.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	886.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	775.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	409.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	788.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	995.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	740.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	116.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	532.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	749.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	812.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	205.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_e367bdd7859e42f7b969e7249f488958_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe

NTFS ADS 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\systemlog.bak	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	886.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	775.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	409.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	205.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	740.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	116.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	532.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	749.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	812.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	788.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	995.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	2026-08-27_e367bdd7859e42f7b969e7249f488958_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3836	2026-08-27_e367bdd7859e42f7b969e7249f488958_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
1544	patcher.exe
4532	886.#.exe
5864	116.#.exe
2660	775.#.exe
2728	532.#.exe
244	749.#.exe
2072	409.#.exe
952	812.#.exe
1048	205.#.exe
5024	788.#.exe
5768	995.#.exe
5796	740.#.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3836 wrote to memory of 4532	3836	2026-08-27_e367bdd7859e42f7b969e7249f488958_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe	91
PID 1544 wrote to memory of 5864	1544	patcher.exe	92
PID 4532 wrote to memory of 2660	4532	886.#.exe	93
PID 5864 wrote to memory of 2728	5864	116.#.exe	94
PID 2728 wrote to memory of 244	2728	532.#.exe	95
PID 244 wrote to memory of 2072	244	749.#.exe	97
PID 2072 wrote to memory of 952	2072	409.#.exe	98
PID 2660 wrote to memory of 1048	2660	775.#.exe	99
PID 952 wrote to memory of 5024	952	812.#.exe	100
PID 5024 wrote to memory of 5768	5024	788.#.exe	101
PID 5768 wrote to memory of 5796	5768	995.#.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-27_e367bdd7859e42f7b969e7249f488958_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_e367bdd7859e42f7b969e7249f488958_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Users\Admin\AppData\Local\Temp\886.#.exe
  C:\Users\Admin\AppData\Local\Temp\886.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Users\Admin\AppData\Local\Temp\775.#.exe
    C:\Users\Admin\AppData\Local\Temp\775.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\205.#.exe
      C:\Users\Admin\AppData\Local\Temp\205.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\873.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\873.#.exe
        5⤵
        
        PID:1268

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544
- C:\905c0769f9a06c95a24ddf945\116.#.exe
  C:\905c0769f9a06c95a24ddf945\116.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\905c0769f9a06c95a24ddf945\532.#.exe
    C:\905c0769f9a06c95a24ddf945\532.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\905c0769f9a06c95a24ddf945\749.#.exe
      C:\905c0769f9a06c95a24ddf945\749.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:244
    - - C:\905c0769f9a06c95a24ddf945\409.#.exe
        
        C:\905c0769f9a06c95a24ddf945\409.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2072
      - C:\905c0769f9a06c95a24ddf945\812.#.exe
        
        C:\905c0769f9a06c95a24ddf945\812.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:952
        
        C:\905c0769f9a06c95a24ddf945\788.#.exe
        
        C:\905c0769f9a06c95a24ddf945\788.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\905c0769f9a06c95a24ddf945\995.#.exe
        
        C:\905c0769f9a06c95a24ddf945\995.#.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5768
        
        C:\905c0769f9a06c95a24ddf945\740.#.exe
        
        C:\905c0769f9a06c95a24ddf945\740.#.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:5796
        
        C:\905c0769f9a06c95a24ddf945\955.#.exe
        
        C:\905c0769f9a06c95a24ddf945\955.#.exe
        10⤵
        
        PID:612
        
        C:\905c0769f9a06c95a24ddf945\796.#.exe
        
        C:\905c0769f9a06c95a24ddf945\796.#.exe
        11⤵
        
        PID:3912
        
        C:\905c0769f9a06c95a24ddf945\256.#.exe
        
        C:\905c0769f9a06c95a24ddf945\256.#.exe
        12⤵
        
        PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

256.#.exe

Path C:\905c0769f9a06c95a24ddf945\256.#.exe
Size 320KB
SHA256 0bee91765aeaed69c08428a422e43b2c98add5245aca81ad4552e1cb8518132b
MD5 9903ecb8457923744f9b86a84aa73905
SHA1 c9de5ecba7275af364d2ce8190b02a67fb0f4723
SHA512 4f06d65c3d9d52420386c0a6e97dd11c21ba47ac6c745548dd97fa4d8af431894799436baa95afd61d0993a6445fac15d5f1fe089de2c2f9e75d731db60fd6da
SSDEEP 6144:Nbj21RzSV7SrZzLd2Sk6hDXPi1dJEXiz3r3/vI9VzUMplaufdemhEn/:NcRzSV7KfPi1dJU0L/vI9mOxPE/
TLSH
T1BD649D13FBE25C33C653463166685230377B6D301A968B8B17642E98393A7D26F3836F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

256.#.exe

Path C:\905c0769f9a06c95a24ddf945\256.#.exe
Size 256KB
SHA256 bf2bd4de1e66471a09fd82e3b7c5202334df59f7516c19f6efc4d479d703ff17
MD5 b91699aeae7fbf0c09a100b18c3c063d
SHA1 0c1b69d32d8d8065383570726ca0657e6036693c
SHA512 4185447947e9c10ed6af8ffc2da2e5b734bc30ba758736fe8f2a471072e501155c638d99ee78f107c4ba57f24420fac83f6c062b4dc4661bf1dc3cbf170c7f9e
SSDEEP 6144:Nbj21RzSV7SrZzLd2Sk6hDXPi1dJEXiz3r3/vI9VzUMplaa:NcRzSV7KfPi1dJU0L/vI9mOV
TLSH
T19E448D23F7E24D37C646467055689230373B6E701A628B8F27646E6D29397E26F7032F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 3.8MB
SHA256 aba85ac8b3cce6cfa5986e87a55667f7ef559f1830d3644fa21e027561fed5ca
MD5 e367bdd7859e42f7b969e7249f488958
SHA1 2ef60e9fb54ed2b2ef9956de067a3885ec770986
SHA512 54d78c5c983286616e5e36ca93769f9ead436bc34578baeba4f217d6549312af25a1cbbd35feac63a1ae51a2a2184a42622f372817e76bae2d7dbd93a7c34aa1
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglwy6i1zuajsauZjaxiw2ux:TID41qW1PszVztC6m5
TLSH
T116068D06B7E841B2E0735135C5A752A6AE7278211F31D7CF1384A63D6F337D0AA39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe$

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe$
Size 3.8MB
SHA256 6b7b330cb668c29b6e3546d4e6ddf46583e4716c0a2ba620a28bc2942d5b1fe0
MD5 84657589315866636fc1a80febf7fa3d
SHA1 37a31bdc6da866505945d528a9110be0185ed253
SHA512 ef393900331cb6d308cdac4ca37935d22746152b15fb93cd938a333b525c0d08ccc67f31504c25fa64c6a21f06fd3204e12708f08849b4c3dacdb68af6dc79df
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglwy6i1zuajsauZjaxiw2uc:TID41qW1PszVztC6m5i
TLSH
T19B068D06B7E845B2E0735135C5A742A6AE7278211F31D7CF2384963D6F337D0AA39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe$

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$
Size 3.8MB
SHA256 7bc8fc06b558f0383556cdb99e9ce2aefcdcf5280da2fe1ad2aaeca36317954c
MD5 6a5d8ae046b5247492fa94360c6a0e28
SHA1 b5674236117454e459dffc8282736095dde46514
SHA512 9a9791618a45667a6b67a2bb228062aec487c7fe30cb13a2854cde169df60dcabd350daa16579a59404a149b27e97ba6a4bd5ced2630b2c944770a0a7165356a
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglwy6i1zuajsauZjaxiw2un:TID41qW1PszVztC6m5p
TLSH
T144068D06B7E845B2E0735135C5A742A6AE7278211F31D7CF2384963D6F337D0AA39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe$

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe$
Size 3.8MB
SHA256 1d1011539e9e86952dad9f19545aead25996718f8fb10a17bca6e10fc07b3be6
MD5 22d8c363663c4c3359c66b7401fd4731
SHA1 e4d851ee84ba564cc2dfe7438e152e9731bedf77
SHA512 6d320721db654721f3ce97f3db6fa7930fdf33fe94866d00689af351fd17bec0442ad14da0e5cd0ef737616f7a016d08574b0e493edb5af110aa803fd93cc7d4
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglwy6i1zuajsauZjaxiw2uG:TID41qW1PszVztC6m5k
TLSH
T192068D06B7E845B2E0735135C5A742A6AE7278211F31D7CF2384963D6F337D0AA39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe$

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe$
Size 3.8MB
SHA256 d228c87243661b9ddb7aa26c9472eb270f2b8bd9ccad3c829340882449763e9c
MD5 a6485722e174fa90ee2b634f9f3da384
SHA1 a13bfa2ef6021a51d4402adaf0df7c3ce5961077
SHA512 ad670b97b56e74426ee70012d46247c2f912c37973bd77432cb272c4a8465d24e699d6d47f9fc006ed6827efab820b88bf0c9d4013891fa64d434cf73cda72f6
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglwy6i1zuajsauZjaxiw2uc:TID41qW1PszVztC6m5O
TLSH
T128068D06B7E845B2E0735135C5A742A6AE7278211F31D7CF2384963D6F337D0AA39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe$

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe$
Size 4.6MB
SHA256 64338754b59ecdd3df3e91a4507307dcfeb96f81164ed4b5c87f279342382760
MD5 ba51e67176f1d7e11c4afa6de8d6d6c2
SHA1 d288be96a85b486173f3e42f76c45affbd7d8dfa
SHA512 8c196245d5099fe7edfefd17ef6976c1e7c7bf2fa58e6ddc08aae3be1da027a3b0b32435ccfdf3b32a2a4f27c498d5d9c0a000990150029f999fe068fe6983e2
SSDEEP 98304:TID41qW1PszVztC6m58MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMF:Tuqxsdc6m5P
TLSH
T1FE267D06B7D84561E0735131896782A6AE72BC211F3197CF2394B73D2F337D1AA36B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe$

Path C:\Program Files\Java\jre-1.8\bin\policytool.exe$
Size 3.8MB
SHA256 b41355dc7c44c1a93822bd46abf92902e3749854bdd69a8c44f065086e9cf6e0
MD5 dc5d0b6ecbc27de77fef0ad12d28e747
SHA1 11e1685fad4ede61e64d07778d81a89761134afe
SHA512 25ef2df5e01be251dea920279dcd2935501415d783531a598422a5a9a3c1c086e462a1877112ac0684c87e2b09ed3ffcbfd39f840375b3959d7b767879aca873
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglwy6i1zuajsauZjaxiw2u5:TID41qW1PszVztC6m5n
TLSH
T185068D06B7E845B2E0735135C5A742A6AE7278211F31D7CF2384963D6F337D0AA39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

POWERPNT.EXE$

Path C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$
Size 4.6MB
SHA256 ee3eb2b43f7cf13f0a28910484835bb6ce7606a2d5db23aec9a8081b6dc532f1
MD5 35b3b179b1794e591569d3a16a19dcd6
SHA1 94c7cf2b84720f0043bc9b5c03b48c80cb4ed0f4
SHA512 9c5d13b4e68f2a10e4cb0d0a7bfeb8cabe5f78e06ca020cc2f0a21dee24246ab0f5b12a82d8fb129d1abd36d425f268d079897ea8b8ec95c5fce9aeaeea87a32
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglwy6i1zuajsauZjaxiw2u9:TID41qW1PszVztC6m5wUEW
TLSH
T1A9267C56B7E845A1E173513589B682A2EEB278111F31D7CF1390963D1F33BD0AE39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe$

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
Size 3.8MB
SHA256 cacae32dee87ea2f721e725d5c58945b46ea85945a744292b6f346b8c039ee41
MD5 955e874977b0c84022f1c598fb3c49cb
SHA1 823ae2e05d62e97fab0dcaf56c04e9ba48cc810a
SHA512 a7aa895c8d43daa60215b3fe1f237d7d17e67af87a08ab8822e89e0308c8082c81bd8a2b7153f1cf2323a2c54f07d7ae6640abf4eae1dbcadb11ae6f110dcbf4
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglwy6i1zuajsauZjaxiw2uK:TID41qW1PszVztC6m5U
TLSH
T11D167D06B7E841A2E1735135C96782A2AE727C211B31D7CF1394B63D5F337D0AA39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe$

Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
Size 3.8MB
SHA256 8d7f4d98b4798b2cee633b9c81ec071d7c68a683a82dda7e1b12b6af392591b3
MD5 47e54e6a4e2e75a146dcc382b214b54c
SHA1 d55d9f5889803d75ddebdd48e271b83061f32179
SHA512 e1781909078a96e7d880294d83c39f1fb1a4d70635b5ddad7da98c70ff5326037410f4d930dcda090765445e64b1a6e2abc057c93279730995025c02de90d5a2
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglwy6i1zuajsauZjaxiw2u9:TID41qW1PszVztC6m5v
TLSH
T185167D06B7E841A2E1735135C96782A2AE727C211B31D7CF1394B63D5F337D0AA39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads