Analysis
- max time kernel
114s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/08/2026, 09:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe
- Size 4.0MB
- Sample260828-k9j9msgm6t
- SHA256 638d4f3fc16cff863a6db4b02a6351badd56b638ee6dfa03b23a8f6fa5ff940f
- MD5 c04a32e526a3de7a918542e000c460bc
- SHA1 b5e8617e68d68067bfcc8ddc3bfde944b6f3bf98
- SHA512 be8f4bf8e851f73bc474b251192dc46cf73c2fa853f3959500fcc787e994104899659d52ced86274bbd7431e1655392be2b2a00d6f216fdd06fe546658218d05
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9dzy6i1zuajsauZjaFeW4SP:TID41vyW1Psznat8fkZc
- TLSH T151167C06B3F842B6E0B39135C5A65656FA7278211B31C6CF1384933D6F337D1AA39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 15 IoCs
pid Process 972 patcher.exe 4840 933.#.exe 1756 630.#.exe 4148 515.#.exe 1976 794.#.exe 4104 365.#.exe 3792 123.#.exe 3848 917.#.exe 2416 227.#.exe 4828 604.#.exe 3280 502.#.exe 3888 811.#.exe 1528 819.#.exe 2252 574.#.exe 1180 334.#.exe - Adds Run key to start application 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 515.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 227.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 604.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 811.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 574.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 334.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 933.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 365.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 123.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 819.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 630.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 794.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 502.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 917.#.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 227.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 502.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 819.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 334.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak patcher.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 630.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 794.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 123.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\en-US\ 227.#.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 933.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\ 794.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\ 365.#.exe File opened for modification C:\Program Files\Crashpad\reports\ 933.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ 933.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\ 794.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\ 365.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ 365.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\ 365.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ko-KR\ 227.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\ 794.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\en-US\ 933.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ 2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 515.#.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 515.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\ 123.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\ 515.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 227.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ 502.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nl-NL\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ 917.#.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\ 604.#.exe File opened for modification C:\Program Files\Common Files\System\es-ES\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\ 794.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\ 123.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\ 604.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\ 515.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ 604.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\TextConv\ patcher.exe File opened for modification C:\Program Files\Crashpad\ 365.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ 123.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 515.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\ 123.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ 604.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\ 630.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-MX\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\ 794.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 365.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\ 604.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\ 811.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\ 794.#.exe File opened for modification C:\Program Files\dotnet\host\ 123.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 933.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 515.#.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\ 365.#.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\ 2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\ 227.#.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 515.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ 2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\ 2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\ 123.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ 227.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\ 515.#.exe File opened for modification C:\Program Files\Common Files\System\en-US\ 630.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\ 123.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\ 365.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 794.#.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 123.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 227.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 811.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 933.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 917.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 604.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 574.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 334.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 630.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 515.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 502.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 819.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 794.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 365.#.exe - NTFS ADS 8 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 515.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 365.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 917.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 604.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 811.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 574.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 933.#.exe - Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 3788 2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe 972 patcher.exe 4840 933.#.exe 1756 630.#.exe 4148 515.#.exe 1976 794.#.exe 4104 365.#.exe 3792 123.#.exe 3848 917.#.exe 2416 227.#.exe 4828 604.#.exe 3280 502.#.exe 3888 811.#.exe 1528 819.#.exe 2252 574.#.exe 1180 334.#.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3788 wrote to memory of 4840 3788 2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe 87 PID 972 wrote to memory of 1756 972 patcher.exe 88 PID 4840 wrote to memory of 4148 4840 933.#.exe 89 PID 1756 wrote to memory of 1976 1756 630.#.exe 90 PID 4148 wrote to memory of 4104 4148 515.#.exe 91 PID 1976 wrote to memory of 3792 1976 794.#.exe 92 PID 4104 wrote to memory of 3848 4104 365.#.exe 95 PID 3792 wrote to memory of 2416 3792 123.#.exe 96 PID 3848 wrote to memory of 4828 3848 917.#.exe 97 PID 2416 wrote to memory of 3280 2416 227.#.exe 98 PID 4828 wrote to memory of 3888 4828 604.#.exe 101 PID 3280 wrote to memory of 1528 3280 502.#.exe 102 PID 3888 wrote to memory of 2252 3888 811.#.exe 107 PID 1528 wrote to memory of 1180 1528 819.#.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-28_c04a32e526a3de7a918542e000c460bc_amadey_elex_glassworm_icedid_njrat_remcos_vidar.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\933.#.exeC:\Users\Admin\AppData\Local\Temp\933.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\515.#.exeC:\Users\Admin\AppData\Local\Temp\515.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\365.#.exeC:\Users\Admin\AppData\Local\Temp\365.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\917.#.exeC:\Users\Admin\AppData\Local\Temp\917.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\604.#.exeC:\Users\Admin\AppData\Local\Temp\604.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\811.#.exeC:\Users\Admin\AppData\Local\Temp\811.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\574.#.exeC:\Users\Admin\AppData\Local\Temp\574.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\981.#.exeC:\Users\Admin\AppData\Local\Temp\981.#.exe9⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\862.#.exeC:\Users\Admin\AppData\Local\Temp\862.#.exe10⤵PID:2876
-
-
-
-
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972 -
C:\905c0769f9a06c95a24ddf945\630.#.exeC:\905c0769f9a06c95a24ddf945\630.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\905c0769f9a06c95a24ddf945\794.#.exeC:\905c0769f9a06c95a24ddf945\794.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\905c0769f9a06c95a24ddf945\123.#.exeC:\905c0769f9a06c95a24ddf945\123.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\905c0769f9a06c95a24ddf945\227.#.exeC:\905c0769f9a06c95a24ddf945\227.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\905c0769f9a06c95a24ddf945\502.#.exeC:\905c0769f9a06c95a24ddf945\502.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\905c0769f9a06c95a24ddf945\819.#.exeC:\905c0769f9a06c95a24ddf945\819.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\905c0769f9a06c95a24ddf945\334.#.exeC:\905c0769f9a06c95a24ddf945\334.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1180 -
C:\905c0769f9a06c95a24ddf945\701.#.exeC:\905c0769f9a06c95a24ddf945\701.#.exe9⤵PID:5068
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.0MB
- SHA256 638d4f3fc16cff863a6db4b02a6351badd56b638ee6dfa03b23a8f6fa5ff940f
- MD5 c04a32e526a3de7a918542e000c460bc
- SHA1 b5e8617e68d68067bfcc8ddc3bfde944b6f3bf98
- SHA512 be8f4bf8e851f73bc474b251192dc46cf73c2fa853f3959500fcc787e994104899659d52ced86274bbd7431e1655392be2b2a00d6f216fdd06fe546658218d05
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9dzy6i1zuajsauZjaFeW4SP:TID41vyW1Psznat8fkZc
- TLSH T151167C06B3F842B6E0B39135C5A65656FA7278211B31C6CF1384933D6F337D1AA39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$
- Size 4.0MB
- SHA256 94aefd3dd4298e5a8fb4aefbe94ffcb7eebf4d75e06a534609bd6c211fb7dded
- MD5 7c3d2cf621ec54dd9153c8072013cba7
- SHA1 66b59ab30f6f81e370db52d19cdf024181668044
- SHA512 ad105265f028d94359fd9c78fe80816559616d694a459caac44bf108d15a7439f3137ceaf207b5d8857fa48d69f5da3e5834d7c7112534dab54638e82c58a692
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9dzy6i1zuajsauZjaFeW4ST:TID41vyW1Psznat8fkZc7
- TLSH T131167C06B3F842B6E0B39135C5A65656FA7278211B31C6CF1384933D6F337D1AA39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe$
- Size 4.0MB
- SHA256 a5d92e704471d9eb206f2718485f28c23380463822490cad481fac18f8800b41
- MD5 c44e6530fe1921f95db252fe09aaa5a2
- SHA1 bdec4b79836532cc79e63c23d73998ea9ceff42c
- SHA512 76e63873baa608f6ba9ee52f363bd10dfa020853d0b5a2c9234a9d723404751785a1a403a1d28902d5bf5d7c9ae258aa6d23ce4ad3326839ae58ca132bbbcb98
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9dzy6i1zuajsauZjaFeW4SM:TID41vyW1Psznat8fkZcE
- TLSH T18B167C06B3F842B6E0B39135C5A65656FA7278211B31C6CF1384933D6F337D1AA39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 4.0MB
- SHA256 184de8e6871ca491aaecdc15b2f68602156ef05c9f1cd6d73e3b38d2a206a10d
- MD5 c850aaa6b183b38b89dbc710c82b3c2c
- SHA1 80ac702b0d9bc9b8cdbeb5d3bd5f70ce3cf33db5
- SHA512 fad28e5252951cfa5ba28a2111c18fdf75854b1e30baa690e6ba3f0b9fb22d26ecd69e0008e2522f520ab93901bd965c711e8656ecd428094f9298d93ddf1086
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9dzy6i1zuajsauZjaFeW4Sl:TID41vyW1Psznat8fkZct
- TLSH T17E167C06B3F842B6E0B39135C5A65656FA7278211B31C6CF1384933D6F337D1AA39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe$
- Size 4.0MB
- SHA256 6ca29b9e67c96e6aea9a45c75e4eb7185b2639b553cdbdb6ce12f2d1e019bf04
- MD5 a1c7041c4beadf839b3b48fa1b819ed2
- SHA1 558a703d3be12245c548a34938d1cda97f795773
- SHA512 37da19d619da1e9afd2fa8a9ebc4736fa159fa616a8636497ab5f7ef854d8a2d8002ed20e3be430e66872c616397af0a781d12e64b7aeed648e701691554af70
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9dzy6i1zuajsauZjaFeW4S3:TID41vyW1Psznat8fkZcP
- TLSH T18F167C06B3F842B6E0B39135C5A65656FA7278211B31C6CF1384933D6F337D1AA39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$
- Size 4.0MB
- SHA256 2db0ddd25cb28547bb64cdcbf66c51418e1f636b03a22f67552692e85e4d77bd
- MD5 42afab0242b8cbf3c8782a6e706f44f9
- SHA1 9b1a3f3c6d9fce5031fe2cd9b7450a3057768d29
- SHA512 e1571590628bf15be426cf336d7763c9afccafa471939f6156d1aee73c123634ac072acf4550169c5ffdc8212cc034998fcaf3f79a4bb3acc267dea53874fcf9
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9dzy6i1zuajsauZjaFeW4SE:TID41vyW1Psznat8fkZcc
- TLSH T154167C06B3F842B6E0B39135C5A65656FA7278211B31C6CF1384933D6F337D1AA39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$
- Size 4.1MB
- SHA256 8bf29ca97c2257ebafab4f447b28909dcc017162138a2d26c7e716e4b9ff712f
- MD5 58e4499857e8588ff864b0d63ff2d7b3
- SHA1 c387b60b838956612d3bbe99d0028538ae6f41f6
- SHA512 d1cfa3e5d8019ab6da48d931ed02d6c2324588089ca21f657510c6873fc077d34d2bcde60319e100320fd7bdbd440bd2d70e646f8e71a6c7260e5a58badfc637
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9dzy6i1zuajsauZjaFeW4Se:TID41vyW1Psznat8fkZcG
- TLSH T1E2167C06B3F842B6E0B39135C5A65656FA7278111B31C6CF1384933D6F33BD1AA39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$
- Size 4.0MB
- SHA256 94823390eff3ba2968d4eb0821299c65078dd7d0ce9171dbe4af855d91d08dd1
- MD5 7165efcce14cfbcba8e09083b5d80204
- SHA1 bd2655c91f84ea30eddf7db36401100d3884a0b5
- SHA512 fea3ef20189cbf89679b6c713a636c18dac640e3048d5e369770f58293d847424bb90be026757106e9e229e9a5707aea4c7d8ffd8c02c4c423da0afbaa02e1d5
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9dzy6i1zuajsauZjaFeW4SS:TID41vyW1Psznat8fkZcK
- TLSH T1A1167C06B3F842B6E0B39135C5A65656FA7278211B31C6CF1384933D6F337D1AA39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe$
- Size 4.0MB
- SHA256 d6e0662fe068928749bc08ade4b1ce3cbaa3eb887917db74f63d31690d4db359
- MD5 0cad5e715955c7b38d701c599cf4cff4
- SHA1 985b34c80b4e85b8849d46284d2252687e6bb825
- SHA512 282338b9f2985c9927a9d12604d6f3421aaf3d5606467f2a7d2a985d3c0ed123c7a317642e3344585c216b1cbefb5d274eef02b16b73c8ac5571fef83daf86d2
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9dzy6i1zuajsauZjaFeW4SK:TID41vyW1Psznat8fkZcy
- TLSH T1CC167C06B3F842B6E0B39135C5A65656FA7278211B31C6CF1384933D6F337D1AA39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\862.#.exe
- Size 3.4MB
- SHA256 964975c917da018b644c3069927092f5f9568ccfe179827a05f6fd0097e6dab4
- MD5 13d5f549917ec923f295eb90306b3f03
- SHA1 6f73f933ec36b992171227f430860c3809adad5c
- SHA512 6269d9eedb9845fc48579b6fc35f4a3f2221f7f04315832c1f026c771b48c372448966d7156fecb06ede8017e33a71469f4984ca2a49f3384a216478637939d5
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9dzy6i1zuajsauZjaFeW4f:TID41vyW1Psznat8E
- TLSH T1D6F58E06B7E840F5E5735235C5765262EA72B8211B31D6CF2390867D6F33BD0AE39B22
- MD5 SHA1 SHA512 SSDEEP TLSH