Analysis
- max time kernel
92s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/10/2026, 23:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
- Size 3.1MB
- Sample261003-3erpcaygnd
- SHA256 d24c0d032042dcf6a3f36aba8092bf9a43df2ad164fb8eff0defaca487ad2252
- MD5 f46de9654d75cc315bc37808e49b7127
- SHA1 bbb16fcaf6d1122d60f3d98970125dee46b2df9a
- SHA512 684656b3e5e0f4b5319da2fa0cd35c6ab038def3af43af698b8392ca9aebc35944b1d450d71ac9c123a25e59a2d561734f1c9f668ed461224fd4df8136c3c179
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYq:TID41F5IW6
- TLSH T121E57D55B7F44972E1B3427589B292925E327C211F34D3CF2394A27D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 15 IoCs
pid Process 2712 patcher.exe 2812 392.#.exe 3464 265.#.exe 3972 318.#.exe 3340 80.#.exe 3396 385.#.exe 3384 748.#.exe 4912 316.#.exe 4880 113.#.exe 2140 387.#.exe 1288 2.#.exe 2768 190.#.exe 3424 106.#.exe 4052 55.#.exe 1428 391.#.exe - Adds Run key to start application 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 385.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 316.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 190.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 392.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 387.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 318.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 748.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 113.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 106.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 391.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 265.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 80.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 55.#.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 80.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 748.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 113.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 2.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 106.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 391.#.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak patcher.exe File opened for modification C:\Windows\SysWOW64\:\systemlog.bak 265.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\es-ES\ 318.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 392.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ 265.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\ 385.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\ 385.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\ 316.#.exe File opened for modification C:\Program Files\dotnet\shared\ 318.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\ 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\images\ 748.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\ 392.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 265.#.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\ 80.#.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\ 80.#.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 80.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 748.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tr-TR\ 318.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\ 80.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\ 318.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ 265.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ 265.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 385.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 748.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\ 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\ 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\System\msadc\ 385.#.exe File opened for modification C:\Program Files\Internet Explorer\images\ 392.#.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\ 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\ 190.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\ 265.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\ 387.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-MX\ 385.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 748.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 385.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VGX\ 387.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\ 80.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sv-SE\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\ 80.#.exe File opened for modification C:\Program Files\dotnet\host\fxr\6.0.27\ 385.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\ 748.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 392.#.exe File opened for modification C:\Program Files\Common Files\System\ado\ 80.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\ 392.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ 80.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ 392.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\ 385.#.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 748.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 385.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\ 392.#.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\ 385.#.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hr-HR\ 385.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\ 265.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-CA\ 265.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\ 318.#.exe - System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 385.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 748.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 387.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 391.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 318.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 106.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 392.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 265.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 316.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 113.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 190.#.exe - NTFS ADS 8 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 385.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 316.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 387.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 190.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 55.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 392.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 318.#.exe - Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 1128 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe 2712 patcher.exe 2812 392.#.exe 3464 265.#.exe 3972 318.#.exe 3340 80.#.exe 3396 385.#.exe 3384 748.#.exe 4912 316.#.exe 4880 113.#.exe 2140 387.#.exe 1288 2.#.exe 2768 190.#.exe 3424 106.#.exe 4052 55.#.exe 1428 391.#.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1128 wrote to memory of 2812 1128 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe 92 PID 2712 wrote to memory of 3464 2712 patcher.exe 93 PID 2812 wrote to memory of 3972 2812 392.#.exe 94 PID 3464 wrote to memory of 3340 3464 265.#.exe 95 PID 3972 wrote to memory of 3396 3972 318.#.exe 96 PID 3340 wrote to memory of 3384 3340 80.#.exe 97 PID 3396 wrote to memory of 4912 3396 385.#.exe 100 PID 3384 wrote to memory of 4880 3384 748.#.exe 102 PID 4912 wrote to memory of 2140 4912 316.#.exe 105 PID 4880 wrote to memory of 1288 4880 113.#.exe 106 PID 2140 wrote to memory of 2768 2140 387.#.exe 110 PID 1288 wrote to memory of 3424 1288 2.#.exe 111 PID 2768 wrote to memory of 4052 2768 190.#.exe 113 PID 3424 wrote to memory of 1428 3424 106.#.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\392.#.exeC:\Users\Admin\AppData\Local\Temp\392.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\318.#.exeC:\Users\Admin\AppData\Local\Temp\318.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\385.#.exeC:\Users\Admin\AppData\Local\Temp\385.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\316.#.exeC:\Users\Admin\AppData\Local\Temp\316.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\387.#.exeC:\Users\Admin\AppData\Local\Temp\387.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\190.#.exeC:\Users\Admin\AppData\Local\Temp\190.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\55.#.exeC:\Users\Admin\AppData\Local\Temp\55.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\907.#.exeC:\Users\Admin\AppData\Local\Temp\907.#.exe9⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\353.#.exeC:\Users\Admin\AppData\Local\Temp\353.#.exe10⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\273.#.exeC:\Users\Admin\AppData\Local\Temp\273.#.exe11⤵PID:976
-
-
-
-
-
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\905c0769f9a06c95a24ddf945\265.#.exeC:\905c0769f9a06c95a24ddf945\265.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\905c0769f9a06c95a24ddf945\80.#.exeC:\905c0769f9a06c95a24ddf945\80.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\905c0769f9a06c95a24ddf945\748.#.exeC:\905c0769f9a06c95a24ddf945\748.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\905c0769f9a06c95a24ddf945\113.#.exeC:\905c0769f9a06c95a24ddf945\113.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\905c0769f9a06c95a24ddf945\2.#.exeC:\905c0769f9a06c95a24ddf945\2.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\905c0769f9a06c95a24ddf945\106.#.exeC:\905c0769f9a06c95a24ddf945\106.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\905c0769f9a06c95a24ddf945\391.#.exeC:\905c0769f9a06c95a24ddf945\391.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1428 -
C:\905c0769f9a06c95a24ddf945\485.#.exeC:\905c0769f9a06c95a24ddf945\485.#.exe9⤵PID:408
-
C:\905c0769f9a06c95a24ddf945\103.#.exeC:\905c0769f9a06c95a24ddf945\103.#.exe10⤵PID:1160
-
C:\905c0769f9a06c95a24ddf945\562.#.exeC:\905c0769f9a06c95a24ddf945\562.#.exe11⤵PID:4644
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.1MB
- SHA256 d24c0d032042dcf6a3f36aba8092bf9a43df2ad164fb8eff0defaca487ad2252
- MD5 f46de9654d75cc315bc37808e49b7127
- SHA1 bbb16fcaf6d1122d60f3d98970125dee46b2df9a
- SHA512 684656b3e5e0f4b5319da2fa0cd35c6ab038def3af43af698b8392ca9aebc35944b1d450d71ac9c123a25e59a2d561734f1c9f668ed461224fd4df8136c3c179
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYq:TID41F5IW6
- TLSH T121E57D55B7F44972E1B3427589B292925E327C211F34D3CF2394A27D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$
- Size 3.3MB
- SHA256 b22c47577c31e45e4e8de8bbe8a1cdcdb7e4ca41bffb2b7bc97ab83cc84f28a1
- MD5 0d097490a6df4a87ec9ef43717e29cd0
- SHA1 2e606ce2cf2a6c9b3f0854a6801ac30757b1dcca
- SHA512 461bbeb2ad39fe0065045930c834a05a006ac48c3587d961c00f93e4ebfd5d82621e5fc6922cde12d196e7163a0f446aaabe1c37edc15d31cfee32819902706d
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYqH:TID41F5IW6y
- TLSH T1AEF55B15F7E44962E0BB4275CAA252926E3378210B7492CF13D4E27D6F337C0AA76763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe$
- Size 3.1MB
- SHA256 4f85fd1d20a5795be132de84766fda1ace6d7626993ccd890b9c604491b84ce0
- MD5 a601274ecc8efb1b2356c8916303711d
- SHA1 868715cbd41ec51fffb8c33bbef505051e58a7b9
- SHA512 9105597a8a50fee67051ac63ecdbc40c4ef5e6d0ef5f1b561d70f445d225c48b763e9f58de5f8898458cd0c3165b2cca0c9b95e460fca9fd07aefbf1e4f9565c
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYqL:TID41F5IW6G
- TLSH T126E57D15B7F44972E1B3427599B292925E327C211F34D3CF2394A27D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 3.1MB
- SHA256 df28e7dbed697338e337259936e4107b9d42ebb67b9b1815693f9db6ac663fe8
- MD5 42af365ed01ac25aaf70fdc1a5eee0ba
- SHA1 3d3053c62d387f819c7afb7cc9e51fc2b3405e46
- SHA512 40901aad7029e9e7a51c324a027982a875bf8d3e8bc7ebce062560996793f1a42576715d001aa169cc54658846543de12519f60b9fc439374d4151f8c84c8f42
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYqu:TID41F5IW6z
- TLSH T114E57D15B7F44972E1B3427599B292925E327C211F34D3CF2394A27D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 3.1MB
- SHA256 b65068500c4a52bfbc243bb22b27e0e53c58f0ad42a5ea7e569d4e46b1e5ecf2
- MD5 2ad4a4e02c62bbe5aaaee5b93478e9e2
- SHA1 315c2c3dd7b05a29f8f7d4999acdedb43543d508
- SHA512 95a687aeab8ff2a7d81353a4d3072d10105e5f4b60f76ff730036114c5c9c450f4ab3f639d5f32e334c06b054fde5845f3cca4aa1e643f9db0abacc9545e1ada
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYqP:TID41F5IW62
- TLSH T1F6E57D15B7F44972E1B3427599B292925E327C211F34D3CF2394A27D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe$
- Size 3.1MB
- SHA256 514f76f3e65da0c1489e7a00fd705723beac4b7b872c229b43e3409101db0290
- MD5 06f9f413fa6ad1cc82061cf9078b9977
- SHA1 0ce3c41b78ca827b7414fc65b602ead7c8feab54
- SHA512 c83e791a6cf25d72ee8f0d285ab6fc735c47e57caf8d0060db3948046859342eec835bb334fce4d77e6e3d62de8f4bbd763319c01833b323667d6fde770a7607
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYqH:TID41F5IW6a
- TLSH T1D0E57D15B7F44972E1B3427599B292925E327C211F34D3CF2394A27D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$
- Size 3.2MB
- SHA256 10d4dce8647a7dec288bcac994bc316d4744ce40ff4208f371afcf268ca84bce
- MD5 ac1e1af4fdeb7ee35e776b4dcdc2e1a8
- SHA1 828505b5b75709e5aa704c34b5a47997ca991226
- SHA512 e9b9b74ad942175520427504ceaa91cb40ae3d9441a42913f9ce53cad2aea23c025c3d21cfd32cc5cf944236b53f8469f65c9f9e2f4321ba9a2cb13aec42cfa7
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYq85:TID41F5IW6F
- TLSH T1FAF58D51B7F44972E1B3427599B292925E327C211F34D3CF2394A36D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$
- Size 3.1MB
- SHA256 3496e539b3dd60d89a3f22cd0686f20df2f6f9ae72ed85f8ccddb790a862b44e
- MD5 dd34ca0bb7a4ad36b5778da2fad0be68
- SHA1 9a06e617c20f01966a3d6b99de732278d1ca1024
- SHA512 239c0c9301531bcc2f06fdde5c4ae39ffd44d8d856175d6b72dd72a19047930db4703b1b7a0f67360bf84461aff5029d7fa2b3330bd4593ab7ce2b052fca8fd2
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYqK:TID41F5IW6z
- TLSH T153E57D15B7F44972E1B3427599B292925E327C211F34D3CF2394A27D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH