Analysis
- max time kernel
89s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 20:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_0d37845cad63a25d92eb857c451619f5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_0d37845cad63a25d92eb857c451619f5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-01_0d37845cad63a25d92eb857c451619f5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
- Size 2.6MB
- Sample261002-yzyk6stsg1
- SHA256 6ecbfdad86663f7d6439695c3925646499a8113cdc4d72bb60d54d6f23002706
- MD5 0d37845cad63a25d92eb857c451619f5
- SHA1 eb01ad304c317233c076bba9d842043610d0a14f
- SHA512 7a6d8358f2fe69a682176d7596261a66beab93938f25239a60e667a433212527445c3c41b3e20478ef9e950e92305887279c65d13f8f2c4ad5a20a2f88706d49
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhQjXzqatglp:TIDQ/rwwXk
- TLSH T1CAD53902A79340B3DD622530842A665D1760BE70AF23DEDB6A407D9DFFB27C15A32376
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 13 IoCs
pid Process 4324 patcher.exe 1120 142.#.exe 5336 617.#.exe 2924 820.#.exe 1056 593.#.exe 5524 153.#.exe 5688 262.#.exe 4980 826.#.exe 5592 780.#.exe 1740 248.#.exe 4412 340.#.exe 5100 504.#.exe 5484 696.#.exe - Adds Run key to start application 2 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 617.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 593.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 153.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 826.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 780.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 340.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 142.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 820.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 262.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 248.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 504.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 696.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-01_0d37845cad63a25d92eb857c451619f5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ 617.#.exe File created C:\Program Files\7-Zip\7zFM.exe 262.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\ 820.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\ 262.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ 262.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ 142.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ 820.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\ 826.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ 262.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ 826.#.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 593.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ml-IN\ 142.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\or-IN\ 262.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\te-IN\ 262.#.exe File opened for modification C:\Program Files\Common Files\System\de-DE\ 2026-10-01_0d37845cad63a25d92eb857c451619f5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 262.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\he-IL\ 153.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 780.#.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 826.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ 2026-10-01_0d37845cad63a25d92eb857c451619f5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Microsoft Office\Office16\ 262.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\ 2026-10-01_0d37845cad63a25d92eb857c451619f5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hr-HR\ 2026-10-01_0d37845cad63a25d92eb857c451619f5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ 826.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\ 142.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\ 780.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 262.#.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hu-HU\ 593.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\ 142.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ 262.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VGX\ 826.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\ 2026-10-01_0d37845cad63a25d92eb857c451619f5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Program Files\Common Files\ 826.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\ 617.#.exe File opened for modification C:\Program Files\Internet Explorer\en-US\ 248.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ar-SA\ 617.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\chr-CHER-US\ 820.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\ 142.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\ 262.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ 262.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ 248.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 617.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\af-ZA\ 142.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 617.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\ 617.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jfr\ 780.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ 142.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ 826.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ 142.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 262.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\ 593.#.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\ 617.#.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\ 617.#.exe File opened for modification C:\Program Files\7-Zip\Lang\ 142.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ 617.#.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\ 262.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ 262.#.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\ 826.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\ 142.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ 780.#.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 262.#.exe File opened for modification C:\Windows\:\systemlog.bak 826.#.exe File opened for modification C:\Windows\:\systemlog.bak 340.#.exe File opened for modification C:\Windows\:\systemlog.bak 696.#.exe File opened for modification C:\Windows\:\systemlog.bak 617.#.exe File opened for modification C:\Windows\:\systemlog.bak 593.#.exe File opened for modification C:\Windows\:\systemlog.bak 780.#.exe File opened for modification C:\Windows\:\systemlog.bak 248.#.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 593.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 153.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 262.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 826.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 248.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 142.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 617.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 780.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 340.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 504.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 696.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_0d37845cad63a25d92eb857c451619f5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 820.#.exe - NTFS ADS 14 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-10-01_0d37845cad63a25d92eb857c451619f5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe File opened for modification C:\Windows\:\systemlog.bak 617.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 820.#.exe File opened for modification C:\Windows\:\systemlog.bak 593.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 153.#.exe File opened for modification C:\Windows\:\systemlog.bak 248.#.exe File opened for modification C:\Windows\:\systemlog.bak 340.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 142.#.exe File opened for modification C:\Windows\:\systemlog.bak 262.#.exe File opened for modification C:\Windows\:\systemlog.bak 826.#.exe File opened for modification C:\Windows\:\systemlog.bak 780.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 504.#.exe File opened for modification C:\Windows\:\systemlog.bak 696.#.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 1648 2026-10-01_0d37845cad63a25d92eb857c451619f5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 4324 patcher.exe 1120 142.#.exe 5336 617.#.exe 2924 820.#.exe 1056 593.#.exe 5524 153.#.exe 5688 262.#.exe 4980 826.#.exe 5592 780.#.exe 1740 248.#.exe 4412 340.#.exe 5100 504.#.exe 5484 696.#.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1648 wrote to memory of 1120 1648 2026-10-01_0d37845cad63a25d92eb857c451619f5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe 91 PID 4324 wrote to memory of 5336 4324 patcher.exe 92 PID 1120 wrote to memory of 2924 1120 142.#.exe 93 PID 5336 wrote to memory of 1056 5336 617.#.exe 94 PID 2924 wrote to memory of 5524 2924 820.#.exe 95 PID 1056 wrote to memory of 5688 1056 593.#.exe 96 PID 5688 wrote to memory of 4980 5688 262.#.exe 97 PID 4980 wrote to memory of 5592 4980 826.#.exe 98 PID 5592 wrote to memory of 1740 5592 780.#.exe 99 PID 1740 wrote to memory of 4412 1740 248.#.exe 100 PID 5524 wrote to memory of 5100 5524 153.#.exe 101 PID 4412 wrote to memory of 5484 4412 340.#.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_0d37845cad63a25d92eb857c451619f5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_0d37845cad63a25d92eb857c451619f5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\142.#.exeC:\Users\Admin\AppData\Local\Temp\142.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\820.#.exeC:\Users\Admin\AppData\Local\Temp\820.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\153.#.exeC:\Users\Admin\AppData\Local\Temp\153.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\504.#.exeC:\Users\Admin\AppData\Local\Temp\504.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5100
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\905c0769f9a06c95a24ddf945\617.#.exeC:\905c0769f9a06c95a24ddf945\617.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\905c0769f9a06c95a24ddf945\593.#.exeC:\905c0769f9a06c95a24ddf945\593.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\905c0769f9a06c95a24ddf945\262.#.exeC:\905c0769f9a06c95a24ddf945\262.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\905c0769f9a06c95a24ddf945\826.#.exeC:\905c0769f9a06c95a24ddf945\826.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\905c0769f9a06c95a24ddf945\780.#.exeC:\905c0769f9a06c95a24ddf945\780.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\905c0769f9a06c95a24ddf945\248.#.exeC:\905c0769f9a06c95a24ddf945\248.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\905c0769f9a06c95a24ddf945\340.#.exeC:\905c0769f9a06c95a24ddf945\340.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\905c0769f9a06c95a24ddf945\696.#.exeC:\905c0769f9a06c95a24ddf945\696.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5484 -
C:\905c0769f9a06c95a24ddf945\691.#.exeC:\905c0769f9a06c95a24ddf945\691.#.exe10⤵PID:4636
-
C:\905c0769f9a06c95a24ddf945\564.#.exeC:\905c0769f9a06c95a24ddf945\564.#.exe11⤵PID:4528
-
C:\905c0769f9a06c95a24ddf945\17.#.exeC:\905c0769f9a06c95a24ddf945\17.#.exe12⤵PID:3928
-
C:\905c0769f9a06c95a24ddf945\895.#.exeC:\905c0769f9a06c95a24ddf945\895.#.exe13⤵PID:3224
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.6MB
- SHA256 6ecbfdad86663f7d6439695c3925646499a8113cdc4d72bb60d54d6f23002706
- MD5 0d37845cad63a25d92eb857c451619f5
- SHA1 eb01ad304c317233c076bba9d842043610d0a14f
- SHA512 7a6d8358f2fe69a682176d7596261a66beab93938f25239a60e667a433212527445c3c41b3e20478ef9e950e92305887279c65d13f8f2c4ad5a20a2f88706d49
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhQjXzqatglp:TIDQ/rwwXk
- TLSH T1CAD53902A79340B3DD622530842A665D1760BE70AF23DEDB6A407D9DFFB27C15A32376
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$
- Size 2.8MB
- SHA256 16c755f1fa6977a01b47481957dc3efa85b8c40b23894852824b5c4acbdde95c
- MD5 ca78bafd808e026915d35e261433118d
- SHA1 b5cd8bf2611a5d3f6b490bd7ff128bd9168f8996
- SHA512 e973194f151c25be31043ee7359943f694d46fca7c8349694bb7ccd7f8aed8cf6fdc03b0bd7d1e8e7151db9da998ad0e3fd0bebb7955d114ec6a3d45773b6f4b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhQjXzqatglx:TIDQ/rwwXm
- TLSH T161D53901E7534073DC1A2130C626661827627E709FA39EDB6A80BDADFBB27C15972377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 2.6MB
- SHA256 2b301f38a368f787fc57fcf61e7a223a2e75ec6e9856da09b3f70a09605f77ed
- MD5 213617724e5fddee19e3ae4143b7e1e6
- SHA1 d7080c11fc2693c7bac2c40e87390b5f2a7b6ce4
- SHA512 5c265c66a14c4040eb47111062252e126fcbeb5b3ca2e422a928a1675a6d9dd829448548bd101548168ec39891aee0c9efb336ca8bc806f16bbddaf74f5bb2bd
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhQjXzqatglG:TIDQ/rwwXt
- TLSH T1D5D53802A79340B3DD622530842A665D1760BE70AF23DEDB6A407D9DFFB27C15A32376
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe$
- Size 2.6MB
- SHA256 98bf40f1e2d48119c38a3228389285756d546f30c898cabe71709c84ac236e4b
- MD5 acc28a02f5f2a8d95166998fa98ea3f6
- SHA1 0a56050c89320e4db6cc35294d8a59fd447a95ec
- SHA512 c7972cadabd77d58cebc10df15c6d12690ebf14451bfe8fc2e21f2944eafa7c880aa2579fac53235d28be62d00d5fd36b68c08ba47ac20c4b588df64b273ab3c
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhQjXzqatglS:TIDQ/rwwXx
- TLSH T19DD53802A79340B3DD622530842A665D1760BE70AF23DEDB6A407D9DFFB27C15A32376
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE
- Size 2.7MB
- SHA256 59e8e1275197046d59be8bc7f6bfc5e72198b3695b82eae4b5d0a8e416578c06
- MD5 746cb73ae02a47802a0494eb1e6364b1
- SHA1 be20fa9a7c806fa19bec110bbef9267545718547
- SHA512 df4e30a619d1f5748b45e71c60248178e288d5a4bda267dcaa171f09b096937b8add2d1d6c1c7685a9f367699486da14857b18262b04789c28b737b2fb8c924c
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhQjXzqatglg1:TIDQ/rwwXX
- TLSH T1D7D53902A79340B3DD622530842A665D1760BE70AF23DEDB6A407D9DFFB27C15A32376
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$
- Size 2.7MB
- SHA256 2214d7ff4ae571819f321a2b4df172122c5a49af2d6da414819e50ea57011f35
- MD5 198cccf83cf69dc3d42c145e1c650cf1
- SHA1 909aacebb319d6113af184eb235342a3947a5cda
- SHA512 307f41cded4d24c4e3c5a0ab8919afc67052e8254bc9b6fa951ac67b9b4c26c10623854b1e8735b73d5dd4ce7fa1e957fb603b82ccf0071ebde9fbdcb869b260
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhQjXzqatglt1:TIDQ/rwwX4
- TLSH T18CD53902A79340B3DD622530842A665D1760BE70AF23DEDB6A407D9DFFB27C15A32376
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$
- Size 2.7MB
- SHA256 34275e85001d5608d12f63e2504107d7134a74de607ccb33508977ded3dc35b0
- MD5 5c8212770ea2a12a491c67937d63a609
- SHA1 75ce5d3b12311af7d2d7f716929b1fe8d99d26a4
- SHA512 6d5889dbf1c816cd4f4444a09584ce296abc2c8b4e737e9579fecd68fb9f0319e6246d6e2c82356c4a7f7c9eac31b14cd2acedf3c0266360cd7b0178c15d6090
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhQjXzqatglJ:TIDQ/rwwX6
- TLSH T1B1D53902A79340B3DD622530842A665D1760BE70AF23DEDB6A407D9DFFB27C15A32376
- MD5 SHA1 SHA512 SSDEEP TLSH