Analysis
- max time kernel
105s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 04:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe
- Size 3.0MB
- Sample260828-evvtyatape
- SHA256 4b7b5e0f7ebf0df55491dbcbf87b74558f14926c0b8f8f4d376e9d62860c41fa
- MD5 e003cb0cfb2e0e0fc54449f2b11754b1
- SHA1 d64c4963cb9cf5876d99d601448a9e0785dd496c
- SHA512 7d473cedf6abf20dc9df0865dc9b376ccb829f2f2806c689a49bd7c1d4db59400c59682d1676612b74f8c97ec04cbd9eb7c374b62edbb095c68cf175d5697a9b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Kwq7Z:TID41vyW1Psznv
- TLSH T1F7E57B41F3E448A2E1BB1231CA7251512A77B9210B64D28F23D4D67E5F337C0AEB6B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 15 IoCs
pid Process 3772 patcher.exe 956 17.#.exe 4232 822.#.exe 3288 533.#.exe 2016 557.#.exe 5832 336.#.exe 4108 313.#.exe 4644 562.#.exe 1144 185.#.exe 2124 969.#.exe 4444 65.#.exe 1784 878.#.exe 4216 642.#.exe 3516 946.#.exe 2588 698.#.exe - Adds Run key to start application 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 17.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 336.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 185.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 946.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 533.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 557.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 65.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 698.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 822.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 562.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 969.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 878.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 642.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 313.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\ 969.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\qps-plocm\ 17.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\he-IL\ 185.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 185.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\amd64\ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 557.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-BA\ 336.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 822.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ 2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\ 2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\ 562.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ 185.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\ 562.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tt-RU\ 2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\ 822.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ 533.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 557.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\kn-IN\ 336.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nl-NL\ 2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ 533.#.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\ 336.#.exe File opened for modification C:\Program Files\Common Files\System\uk-UA\ 822.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\ 557.#.exe File opened for modification C:\Program Files\Common Files\ 562.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\ 336.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 822.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\qps-plocm\ 2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\km-KH\ 562.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 336.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\ 65.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pl-PL\ 185.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jfr\ 185.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\ 822.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 185.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\ 2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ 2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\ 2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\ 822.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ 336.#.exe File opened for modification C:\Program Files\Internet Explorer\SIGNUP\ 557.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\ 65.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\amd64\ 557.#.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 336.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\ 2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\System\ado\ 969.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 969.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\ 336.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lb-LU\ 562.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ 533.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\ 562.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ 969.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ca-ES\ 313.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ 185.#.exe File opened for modification C:\Program Files\Common Files\System\ado\ 313.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\ 336.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\ 562.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\ 642.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\ 562.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\ 185.#.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 822.#.exe File opened for modification C:\Windows\:\systemlog.bak 336.#.exe File opened for modification C:\Windows\:\systemlog.bak 562.#.exe File opened for modification C:\Windows\:\systemlog.bak 185.#.exe File opened for modification C:\Windows\:\systemlog.bak 642.#.exe File opened for modification C:\Windows\:\systemlog.bak 946.#.exe File opened for modification C:\Windows\:\systemlog.bak 698.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 557.#.exe File opened for modification C:\Windows\:\systemlog.bak 969.#.exe File opened for modification C:\Windows\:\systemlog.bak 65.#.exe - System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 336.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 878.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 698.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 313.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 533.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 185.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 969.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 557.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 562.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 946.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 822.#.exe - NTFS ADS 16 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 878.#.exe File opened for modification C:\Windows\:\systemlog.bak 946.#.exe File opened for modification C:\Windows\:\systemlog.bak 698.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 17.#.exe File opened for modification C:\Windows\:\systemlog.bak 822.#.exe File opened for modification C:\Windows\:\systemlog.bak 557.#.exe File opened for modification C:\Windows\:\systemlog.bak 65.#.exe File opened for modification C:\Windows\:\systemlog.bak 336.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 313.#.exe File opened for modification C:\Windows\:\systemlog.bak 185.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 533.#.exe File opened for modification C:\Windows\:\systemlog.bak 642.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 562.#.exe File opened for modification C:\Windows\:\systemlog.bak 969.#.exe - Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 1968 2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe 3772 patcher.exe 956 17.#.exe 4232 822.#.exe 3288 533.#.exe 2016 557.#.exe 5832 336.#.exe 4108 313.#.exe 4644 562.#.exe 1144 185.#.exe 2124 969.#.exe 4444 65.#.exe 1784 878.#.exe 4216 642.#.exe 3516 946.#.exe 2588 698.#.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1968 wrote to memory of 956 1968 2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe 91 PID 3772 wrote to memory of 4232 3772 patcher.exe 92 PID 956 wrote to memory of 3288 956 17.#.exe 93 PID 4232 wrote to memory of 2016 4232 822.#.exe 94 PID 2016 wrote to memory of 5832 2016 557.#.exe 95 PID 3288 wrote to memory of 4108 3288 533.#.exe 96 PID 5832 wrote to memory of 4644 5832 336.#.exe 97 PID 4644 wrote to memory of 1144 4644 562.#.exe 99 PID 1144 wrote to memory of 2124 1144 185.#.exe 100 PID 2124 wrote to memory of 4444 2124 969.#.exe 101 PID 4108 wrote to memory of 1784 4108 313.#.exe 102 PID 4444 wrote to memory of 4216 4444 65.#.exe 103 PID 4216 wrote to memory of 3516 4216 642.#.exe 104 PID 3516 wrote to memory of 2588 3516 946.#.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_e003cb0cfb2e0e0fc54449f2b11754b1_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\17.#.exeC:\Users\Admin\AppData\Local\Temp\17.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\533.#.exeC:\Users\Admin\AppData\Local\Temp\533.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\313.#.exeC:\Users\Admin\AppData\Local\Temp\313.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\878.#.exeC:\Users\Admin\AppData\Local\Temp\878.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1784
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\905c0769f9a06c95a24ddf945\822.#.exeC:\905c0769f9a06c95a24ddf945\822.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\905c0769f9a06c95a24ddf945\557.#.exeC:\905c0769f9a06c95a24ddf945\557.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\905c0769f9a06c95a24ddf945\336.#.exeC:\905c0769f9a06c95a24ddf945\336.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\905c0769f9a06c95a24ddf945\562.#.exeC:\905c0769f9a06c95a24ddf945\562.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\905c0769f9a06c95a24ddf945\185.#.exeC:\905c0769f9a06c95a24ddf945\185.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\905c0769f9a06c95a24ddf945\969.#.exeC:\905c0769f9a06c95a24ddf945\969.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\905c0769f9a06c95a24ddf945\65.#.exeC:\905c0769f9a06c95a24ddf945\65.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\905c0769f9a06c95a24ddf945\642.#.exeC:\905c0769f9a06c95a24ddf945\642.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\905c0769f9a06c95a24ddf945\946.#.exeC:\905c0769f9a06c95a24ddf945\946.#.exe10⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\905c0769f9a06c95a24ddf945\698.#.exeC:\905c0769f9a06c95a24ddf945\698.#.exe11⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2588 -
C:\905c0769f9a06c95a24ddf945\915.#.exeC:\905c0769f9a06c95a24ddf945\915.#.exe12⤵PID:1104
-
C:\905c0769f9a06c95a24ddf945\770.#.exeC:\905c0769f9a06c95a24ddf945\770.#.exe13⤵PID:3012
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.0MB
- SHA256 4b7b5e0f7ebf0df55491dbcbf87b74558f14926c0b8f8f4d376e9d62860c41fa
- MD5 e003cb0cfb2e0e0fc54449f2b11754b1
- SHA1 d64c4963cb9cf5876d99d601448a9e0785dd496c
- SHA512 7d473cedf6abf20dc9df0865dc9b376ccb829f2f2806c689a49bd7c1d4db59400c59682d1676612b74f8c97ec04cbd9eb7c374b62edbb095c68cf175d5697a9b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Kwq7Z:TID41vyW1Psznv
- TLSH T1F7E57B41F3E448A2E1BB1231CA7251512A77B9210B64D28F23D4D67E5F337C0AEB6B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
- Size 3.0MB
- SHA256 124812172e1434eadcabdf4aafb9ecea97ee5b5344de5956dadc1eeefb335946
- MD5 1f6b580ca9c18703ed1d992714f2b0be
- SHA1 cf8a3fa364abaa308206db0e85cd54c0afd90895
- SHA512 54e20105a98068a3d0658b6405e45bd4c03f200d651ebf3e3c16b48e7252dc0f797e8861913ef0ff8e587f43ca2d2900b81e466e4f08e51808995b6880837a52
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Kwq79:TID41vyW1Pszn7
- TLSH T197E57B41F3E448A2E1BB1231DA7251516A77B9210B64D28F23D4D27E5F337C0AEB6B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$
- Size 3.0MB
- SHA256 863a65675d521badf3bf905db78ed88fec5ca28a600bb3b63e5b495c71face36
- MD5 45d3b8cf07188993a1be8dcaba34f651
- SHA1 4a0a1a20d9f8a7cae034996a9c0c67e6f0b1fd83
- SHA512 bb3479c94948eda1276a5e22134e5f8685022113d18e903e478763cf0c7c7662450a3364929e15debf6ebdb5dc4190ae0f6c42efe9c4e5b0e76295b2cccbc311
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Kwq7D:TID41vyW1PsznZ
- TLSH T174E57B41F3E448A2E1BB1231DA7251516A77B9210B64D28F23D4D27E5F337C0AEB6B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
- Size 3.0MB
- SHA256 ef99c222cbc8c6d09dbe032d296b51c8e62ee3dbb10c9b0475472fcd58103aca
- MD5 001d0312eca0539a505c8c832e1052d6
- SHA1 e4387d84705719e88257ae4fa03bc656a82960c2
- SHA512 fc3b617baf23e97e5ff7ea16f80ff83947605d8968fd4131954a5457cc7fd013670f6e9efa2dc0efcdecd87b7b4c438e2f1e3cae714d1ca7aaf179fa2af015d2
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Kwq7y:TID41vyW1Pszn4
- TLSH T106E57B41F3E448A2E1BB1231DA7251516A77B9210B64D28F23D4D27E5F337C0AEB6B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe
- Size 3.0MB
- SHA256 8816b7feebe3645d7347734416fa35666e9576eb56a6eebdc19f132defebffcb
- MD5 9bef0243028d6ddc6f5070ba2f1462b8
- SHA1 2cc8fc7916259a6d11d122e86c397eecbb531b3e
- SHA512 a5a9ed5185d0ff027bfb7ebacce315a32879f95a73d3cf9368165f5e397b1a82be17ccb04e02b7f7ecae4c36def394fafcef54ef49dfb99429e3c3c14dac07fa
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Kwq79:TID41vyW1PsznL
- TLSH T10CE57C41F3E448A2E1BB1231DA7251516A77B9210B64D28F23D4D27E5F337C0AEB6B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$
- Size 3.3MB
- SHA256 9dd170a262ba6e216b79ed433c6ced4e071a5d6b15a3925428c9ea0b9ab2535e
- MD5 bc0d2684709957a9bdd8fa84e9b717cc
- SHA1 0d4a17705147e50c8a660de0d9f12a9d705dde38
- SHA512 4c6a9cb72e19aaf1abda4f4fce64771e98a41f02cb8497ea4fe83a970a33aa1f3e91bafd233f04f38aba4652f8dccce5f759f5abf09154ff9cec7990ddbe2e86
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Kwq7eTeX:TID41vyW1PszngTQ
- TLSH T124F56B41F3E448E2E1BB1231867252616A77B9210B64D28F23D4D67E5F337C0AE76B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe
- Size 3.1MB
- SHA256 25b534f4424f9978ca9dfbd445c693f6014ee05550bf1e5b43617a0296fccb4a
- MD5 477762f75722fd2d90873492e9722112
- SHA1 6288ab70763859ca56370024d6802c27836b4923
- SHA512 fb3aa8e36c7b68b610686a1c140f47fda63485fb10af0dfc6065d7d0680e78b54562e4f6cae9d9ebb329efc219a53aeb45d431aa74268948e9e84d3ff7ab0dfe
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9Kwq78:TID41vyW1PsznK
- TLSH T1B3E57B42F3E448A2E1BB1231C67251516A77B9250B60D28F23D4D67E5F337C0AEB6B63
- MD5 SHA1 SHA512 SSDEEP TLSH