Analysis
- max time kernel
64s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 23:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-02_ee196baa5814bb779ec42ab4fd53c6fb_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-02_ee196baa5814bb779ec42ab4fd53c6fb_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-02_ee196baa5814bb779ec42ab4fd53c6fb_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
- Size 2.5MB
- Sample261002-22rgesvdmb
- SHA256 4d81d67c6b8465971ab9517ff279df4b61e88f43d9d0d2841d127ae16401c738
- MD5 ee196baa5814bb779ec42ab4fd53c6fb
- SHA1 e786b256b06d4ada5c17984170da53bf0905667b
- SHA512 83558cba310a0c23cad2cb709fc70c69e0ca85d5381c39ddf5a1be454e64cffd10b1c8d7435407c38caa4aa41f97e754760c87d64ce6aebe0ecaa78915f22ecf
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglL3sv56rX:7ID41qW1PszVOrX
- TLSH T1BEC57C42B7858A72E16B1231486752A22B777C111F3197CF23987E6E6F337C0AA3175B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 13 IoCs
pid Process 2804 patcher.exe 4736 272.#.exe 4856 207.#.exe 5332 717.#.exe 5792 567.#.exe 1600 150.#.exe 1152 325.#.exe 756 345.#.exe 6032 488.#.exe 2412 985.#.exe 2576 21.#.exe 4440 957.#.exe 1196 411.#.exe - Adds Run key to start application 2 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 717.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 150.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 985.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 207.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 567.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 325.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 345.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 488.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 21.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 957.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 411.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-02_ee196baa5814bb779ec42ab4fd53c6fb_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 272.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ta-IN\ 345.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ 488.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\ 567.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\ 325.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ 567.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\ 345.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\ 207.#.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\ 717.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 207.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\ 150.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\or-IN\ 488.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ 345.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\ 150.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\ 567.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ko-KR\ 567.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ 325.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 207.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sq-AL\ 717.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\ 567.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\ 207.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 567.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ 717.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\ 985.#.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tt-RU\ 207.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ 2026-10-02_ee196baa5814bb779ec42ab4fd53c6fb_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VGX\ 325.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\ 488.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\ 325.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 325.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\ 567.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\ 207.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ca-ES\ 272.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\ 150.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\ 345.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\ 717.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\ 345.#.exe File opened for modification C:\Program Files\Common Files\DESIGNER\ 985.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ms-MY\ 985.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\ 207.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\ 207.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\ 345.#.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\ 325.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lo-LA\ 272.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hi-IN\ 985.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\ 2026-10-02_ee196baa5814bb779ec42ab4fd53c6fb_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\ 272.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\ 717.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\ 207.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ 567.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bn-IN\ 207.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\ 717.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\ 2026-10-02_ee196baa5814bb779ec42ab4fd53c6fb_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ 272.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\ 325.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 325.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\ patcher.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 207.#.exe File opened for modification C:\Windows\:\systemlog.bak 325.#.exe File opened for modification C:\Windows\:\systemlog.bak 345.#.exe File opened for modification C:\Windows\:\systemlog.bak 488.#.exe File opened for modification C:\Windows\:\systemlog.bak 957.#.exe File opened for modification C:\Windows\:\systemlog.bak 411.#.exe File opened for modification C:\Windows\:\systemlog.bak 567.#.exe File opened for modification C:\Windows\:\systemlog.bak 985.#.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 272.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 567.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 150.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 325.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 488.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 985.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 207.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 717.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 345.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 957.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 411.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-02_ee196baa5814bb779ec42ab4fd53c6fb_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 14 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 150.#.exe File opened for modification C:\Windows\:\systemlog.bak 325.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 21.#.exe File opened for modification C:\Windows\:\systemlog.bak 957.#.exe File opened for modification C:\Windows\:\systemlog.bak 411.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 272.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 717.#.exe File opened for modification C:\Windows\:\systemlog.bak 567.#.exe File opened for modification C:\Windows\:\systemlog.bak 345.#.exe File opened for modification C:\Windows\:\systemlog.bak 488.#.exe File opened for modification C:\Windows\:\systemlog.bak 985.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-10-02_ee196baa5814bb779ec42ab4fd53c6fb_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 207.#.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 4148 2026-10-02_ee196baa5814bb779ec42ab4fd53c6fb_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 2804 patcher.exe 4736 272.#.exe 4856 207.#.exe 5332 717.#.exe 5792 567.#.exe 1600 150.#.exe 1152 325.#.exe 756 345.#.exe 6032 488.#.exe 2412 985.#.exe 2576 21.#.exe 4440 957.#.exe 1196 411.#.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4148 wrote to memory of 4736 4148 2026-10-02_ee196baa5814bb779ec42ab4fd53c6fb_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe 92 PID 2804 wrote to memory of 4856 2804 patcher.exe 93 PID 4736 wrote to memory of 5332 4736 272.#.exe 94 PID 4856 wrote to memory of 5792 4856 207.#.exe 95 PID 5332 wrote to memory of 1600 5332 717.#.exe 96 PID 5792 wrote to memory of 1152 5792 567.#.exe 97 PID 1152 wrote to memory of 756 1152 325.#.exe 98 PID 756 wrote to memory of 6032 756 345.#.exe 99 PID 6032 wrote to memory of 2412 6032 488.#.exe 101 PID 1600 wrote to memory of 2576 1600 150.#.exe 102 PID 2412 wrote to memory of 4440 2412 985.#.exe 103 PID 4440 wrote to memory of 1196 4440 957.#.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_ee196baa5814bb779ec42ab4fd53c6fb_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_ee196baa5814bb779ec42ab4fd53c6fb_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\272.#.exeC:\Users\Admin\AppData\Local\Temp\272.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\717.#.exeC:\Users\Admin\AppData\Local\Temp\717.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\150.#.exeC:\Users\Admin\AppData\Local\Temp\150.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\21.#.exeC:\Users\Admin\AppData\Local\Temp\21.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\113.#.exeC:\Users\Admin\AppData\Local\Temp\113.#.exe6⤵PID:4420
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\905c0769f9a06c95a24ddf945\207.#.exeC:\905c0769f9a06c95a24ddf945\207.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\905c0769f9a06c95a24ddf945\567.#.exeC:\905c0769f9a06c95a24ddf945\567.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\905c0769f9a06c95a24ddf945\325.#.exeC:\905c0769f9a06c95a24ddf945\325.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\905c0769f9a06c95a24ddf945\345.#.exeC:\905c0769f9a06c95a24ddf945\345.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\905c0769f9a06c95a24ddf945\488.#.exeC:\905c0769f9a06c95a24ddf945\488.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\905c0769f9a06c95a24ddf945\985.#.exeC:\905c0769f9a06c95a24ddf945\985.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\905c0769f9a06c95a24ddf945\957.#.exeC:\905c0769f9a06c95a24ddf945\957.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\905c0769f9a06c95a24ddf945\411.#.exeC:\905c0769f9a06c95a24ddf945\411.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1196 -
C:\905c0769f9a06c95a24ddf945\993.#.exeC:\905c0769f9a06c95a24ddf945\993.#.exe10⤵PID:5592
-
C:\905c0769f9a06c95a24ddf945\247.#.exeC:\905c0769f9a06c95a24ddf945\247.#.exe11⤵PID:3396
-
C:\905c0769f9a06c95a24ddf945\357.#.exeC:\905c0769f9a06c95a24ddf945\357.#.exe12⤵PID:936
-
C:\905c0769f9a06c95a24ddf945\584.#.exeC:\905c0769f9a06c95a24ddf945\584.#.exe13⤵PID:4260
-
C:\905c0769f9a06c95a24ddf945\451.#.exeC:\905c0769f9a06c95a24ddf945\451.#.exe14⤵PID:4908
-
C:\905c0769f9a06c95a24ddf945\515.#.exeC:\905c0769f9a06c95a24ddf945\515.#.exe15⤵PID:3036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.5MB
- SHA256 4d81d67c6b8465971ab9517ff279df4b61e88f43d9d0d2841d127ae16401c738
- MD5 ee196baa5814bb779ec42ab4fd53c6fb
- SHA1 e786b256b06d4ada5c17984170da53bf0905667b
- SHA512 83558cba310a0c23cad2cb709fc70c69e0ca85d5381c39ddf5a1be454e64cffd10b1c8d7435407c38caa4aa41f97e754760c87d64ce6aebe0ecaa78915f22ecf
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglL3sv56rX:7ID41qW1PszVOrX
- TLSH T1BEC57C42B7858A72E16B1231486752A22B777C111F3197CF23987E6E6F337C0AA3175B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 3.3MB
- SHA256 1fda81105a88f96ff227d5b6193f3d24919e9c105eed744c49870b9661ae316c
- MD5 88b4bb70ba52684d27959e8859be50fe
- SHA1 c9481c55d65fb1c3df04488a7c74f7d87326901c
- SHA512 425daaf1a0ec50621ae5925c018deb1d47617a29bd9ecc3532334a549eafbc6b7ae41c986fa5fd698238ba993a57a1209671d4c202e1860fdeeee77f2a230644
- SSDEEP 98304:7ID41qW1PszVOrvMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMR:7uqxsoK
- TLSH T1ABF57C42B7858972E16B1231483742A25B77BC111F2187DF23987A6E7F337C1AA3275B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$
- Size 2.5MB
- SHA256 435f2e3bea224fd323c1f79ebb7ac46fb6859a9467a9388d22869d48a13e7974
- MD5 938de47f990475d7e2a947d59086256e
- SHA1 2eabbc0149a909bad30add27ff2ec84a9dbcbd10
- SHA512 12a8e9cd8e1a6dcf005f1b5b803844461cac1185b05e1f0f68869b6c93f06471a58a5590a732146db71f415e82ce96ae70185bb2b2d838a67dbbd17c64d9c7a7
- SSDEEP 49152:O/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglL3sv56r5:7ID41qW1PszVOr5
- TLSH T195C57C42B7858A72E16B1231486752A22B777C111F3197CF23987E6E6F337C0AA3175B
- MD5 SHA1 SHA512 SSDEEP TLSH