ce554286edb70968eca051272016d72076b5e4b0f14b81549f8bc1fd08361c18

Analysis

max time kernel
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 21:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_fc6f323b7610ae9897a5178a993cd336_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Size 4.9MB
Sample261002-1lay3aws2j
SHA256 ce554286edb70968eca051272016d72076b5e4b0f14b81549f8bc1fd08361c18
MD5 fc6f323b7610ae9897a5178a993cd336
SHA1 22905b5ffa61f772313444271acf25732f8eed7a
SHA512 be6f1d661920d85b772eafbc1c1f6617ed87565a8dba51bcc49a2735ddd8e857be69465d63301b006b50c7ca7437edcfd913210cc793c8bbacc403a618d757c9
SSDEEP 98304:TID41mt4MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMW:TudbP
TLSH
T179368D16B7F88562E0B34175C9B39655AA327C211B30C6CF2394B37D2E337C19A36B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3824	patcher.exe
3668	570.#.exe
5152	264.#.exe
264	245.#.exe
4344	542.#.exe
5396	763.#.exe
4392	528.#.exe
5452	121.#.exe
6116	467.#.exe
1828	660.#.exe
1160	228.#.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	467.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	660.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	570.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	542.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	763.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	228.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-10-02_fc6f323b7610ae9897a5178a993cd336_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	264.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	245.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	528.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	121.#.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\	264.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\	542.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	542.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\	763.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\	763.#.exe
File opened for modification	C:\Program Files\Common Files\	2026-10-02_fc6f323b7610ae9897a5178a993cd336_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tt-RU\	542.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1036\	542.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\	264.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\id-ID\	763.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\	763.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\	763.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\	528.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\kok-IN\	264.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\	542.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\	2026-10-02_fc6f323b7610ae9897a5178a993cd336_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\	2026-10-02_fc6f323b7610ae9897a5178a993cd336_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\	763.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\vi-VN\	542.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Document Parts\	2026-10-02_fc6f323b7610ae9897a5178a993cd336_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\	528.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\	2026-10-02_fc6f323b7610ae9897a5178a993cd336_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\	570.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\	121.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QHEADLES\	264.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VGX\	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\	570.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\	763.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\	264.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\	121.#.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\	2026-10-02_fc6f323b7610ae9897a5178a993cd336_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\be\	264.#.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\	570.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\	570.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\	542.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\	528.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\	570.#.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\	542.#.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\	570.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\	542.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\MSMAPI\1033\	763.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\id-ID\	245.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\	763.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\	2026-10-02_fc6f323b7610ae9897a5178a993cd336_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\	570.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\4C4619CB-80A7-4B1E-BA60-DDFED5A27D19\root\vfs\	763.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\	264.#.exe
File opened for modification	C:\Program Files\Google\Chrome\	528.#.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\	264.#.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\systemlog.bak	542.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	763.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	528.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	121.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	660.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	228.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	patcher.exe
File opened for modification	C:\Windows\:\systemlog.bak	264.#.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	542.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	121.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	467.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	660.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	264.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	245.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	763.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	528.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	228.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_fc6f323b7610ae9897a5178a993cd336_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	570.#.exe

NTFS ADS 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\systemlog.bak	542.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	528.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	121.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	467.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	660.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	228.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	570.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	264.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	245.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	763.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	2026-10-02_fc6f323b7610ae9897a5178a993cd336_amadey_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Windows\:\systemlog.bak	patcher.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1316	2026-10-02_fc6f323b7610ae9897a5178a993cd336_amadey_elex_glassworm_remcos_vidar_wannacry.exe
3824	patcher.exe
3668	570.#.exe
5152	264.#.exe
264	245.#.exe
4344	542.#.exe
5396	763.#.exe
4392	528.#.exe
5452	121.#.exe
6116	467.#.exe
1828	660.#.exe
1160	228.#.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 3668	1316	2026-10-02_fc6f323b7610ae9897a5178a993cd336_amadey_elex_glassworm_remcos_vidar_wannacry.exe	90
PID 3824 wrote to memory of 5152	3824	patcher.exe	91
PID 3668 wrote to memory of 264	3668	570.#.exe	92
PID 5152 wrote to memory of 4344	5152	264.#.exe	93
PID 4344 wrote to memory of 5396	4344	542.#.exe	94
PID 5396 wrote to memory of 4392	5396	763.#.exe	95
PID 4392 wrote to memory of 5452	4392	528.#.exe	96
PID 264 wrote to memory of 6116	264	245.#.exe	97
PID 5452 wrote to memory of 1828	5452	121.#.exe	98
PID 1828 wrote to memory of 1160	1828	660.#.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-10-02_fc6f323b7610ae9897a5178a993cd336_amadey_elex_glassworm_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_fc6f323b7610ae9897a5178a993cd336_amadey_elex_glassworm_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Users\Admin\AppData\Local\Temp\570.#.exe
  C:\Users\Admin\AppData\Local\Temp\570.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Users\Admin\AppData\Local\Temp\245.#.exe
    C:\Users\Admin\AppData\Local\Temp\245.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:264
  - - C:\Users\Admin\AppData\Local\Temp\467.#.exe
      C:\Users\Admin\AppData\Local\Temp\467.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      PID:6116

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824
- C:\905c0769f9a06c95a24ddf945\264.#.exe
  C:\905c0769f9a06c95a24ddf945\264.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\905c0769f9a06c95a24ddf945\542.#.exe
    C:\905c0769f9a06c95a24ddf945\542.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\905c0769f9a06c95a24ddf945\763.#.exe
      C:\905c0769f9a06c95a24ddf945\763.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5396
    - - C:\905c0769f9a06c95a24ddf945\528.#.exe
        
        C:\905c0769f9a06c95a24ddf945\528.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4392
      - C:\905c0769f9a06c95a24ddf945\121.#.exe
        
        C:\905c0769f9a06c95a24ddf945\121.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5452
        
        C:\905c0769f9a06c95a24ddf945\660.#.exe
        
        C:\905c0769f9a06c95a24ddf945\660.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1828
        
        C:\905c0769f9a06c95a24ddf945\228.#.exe
        
        C:\905c0769f9a06c95a24ddf945\228.#.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:1160
        
        C:\905c0769f9a06c95a24ddf945\993.#.exe
        
        C:\905c0769f9a06c95a24ddf945\993.#.exe
        9⤵
        
        PID:5968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 4.9MB
SHA256 ce554286edb70968eca051272016d72076b5e4b0f14b81549f8bc1fd08361c18
MD5 fc6f323b7610ae9897a5178a993cd336
SHA1 22905b5ffa61f772313444271acf25732f8eed7a
SHA512 be6f1d661920d85b772eafbc1c1f6617ed87565a8dba51bcc49a2735ddd8e857be69465d63301b006b50c7ca7437edcfd913210cc793c8bbacc403a618d757c9
SSDEEP 98304:TID41mt4MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMW:TudbP
TLSH
T179368D16B7F88562E0B34175C9B39655AA327C211B30C6CF2394B37D2E337C19A36B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe$

Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
Size 4.9MB
SHA256 16cd817629044c0eda5828b271d64e5ebb41be5b05eb09b93b02381a2552c445
MD5 ea9fedfe2562d9f5ac1cf60b9aa01fbf
SHA1 9ed53f983d8ffc577437881c0af251fb745c003f
SHA512 115a0707313d51ae0e8916434fcbfcf5dce1d42a24d85d4957c57114e55340226ae8d749078903d6c0464daf128690c3773200fc94e01b4be6e89bb1fc5e43cb
SSDEEP 98304:TID41mt4MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJML:TudbP6
TLSH
T101368E16B3F84662E0B34135C9B79655AA327C211B30C6CF2394B37D6E337C19A36B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads