Analysis
- max time kernel
102s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 23:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
- Size 3.1MB
- Sample261003-3erpcaygnd
- SHA256 d24c0d032042dcf6a3f36aba8092bf9a43df2ad164fb8eff0defaca487ad2252
- MD5 f46de9654d75cc315bc37808e49b7127
- SHA1 bbb16fcaf6d1122d60f3d98970125dee46b2df9a
- SHA512 684656b3e5e0f4b5319da2fa0cd35c6ab038def3af43af698b8392ca9aebc35944b1d450d71ac9c123a25e59a2d561734f1c9f668ed461224fd4df8136c3c179
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYq:TID41F5IW6
- TLSH T121E57D55B7F44972E1B3427589B292925E327C211F34D3CF2394A27D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 14 IoCs
pid Process 2240 patcher.exe 4340 604.#.exe 3320 398.#.exe 4456 372.#.exe 4628 821.#.exe 5364 964.#.exe 1048 206.#.exe 1344 691.#.exe 5072 580.#.exe 3348 573.#.exe 712 323.#.exe 2920 226.#.exe 1084 520.#.exe 3712 781.#.exe - Adds Run key to start application 2 TTPs 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 398.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 206.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 691.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 520.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 604.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 372.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 580.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 323.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 226.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 781.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 821.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 964.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 573.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mi-NZ\ 691.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\ 372.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ 580.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\ 821.#.exe File opened for modification C:\Program Files\Common Files\System\uk-UA\ 573.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\ 964.#.exe File opened for modification C:\Program Files\7-Zip\7z.exe 604.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\ 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hr-HR\ 573.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\ 964.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\ 691.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\ 580.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\ 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ 398.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\ 580.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ar-SA\ 206.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ 573.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\ 372.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ 372.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\ 691.#.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 691.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CONVERT\1033\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\ 964.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\ 580.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\ 821.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\ 372.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ro-RO\ 964.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\ 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\qps-plocm\ 580.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jfr\ 964.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\ 821.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\ 573.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cy-GB\ 226.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ga-IE\ 821.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 398.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\ 580.#.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 691.#.exe File opened for modification C:\Program Files\Microsoft Office\root\loc\ 398.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\ 573.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\ patcher.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\ 821.#.exe File opened for modification C:\Program Files\dotnet\host\ 964.#.exe File opened for modification C:\Program Files\Common Files\System\de-DE\ 604.#.exe File opened for modification C:\Program Files\7-Zip\Lang\ 573.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\ 580.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ 580.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\ 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\ 398.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\as-IN\ 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\ 372.#.exe File opened for modification C:\Program Files\7-Zip\ 580.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ko-KR\ 580.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\applet\ 821.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\ 964.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CONVERT\ 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ 398.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\ 964.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\ 398.#.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 821.#.exe File opened for modification C:\Windows\:\systemlog.bak 964.#.exe File opened for modification C:\Windows\:\systemlog.bak 573.#.exe File opened for modification C:\Windows\:\systemlog.bak 323.#.exe File opened for modification C:\Windows\:\systemlog.bak 781.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 691.#.exe File opened for modification C:\Windows\:\systemlog.bak 580.#.exe File opened for modification C:\Windows\:\systemlog.bak 226.#.exe File opened for modification C:\Windows\:\systemlog.bak 398.#.exe - System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 604.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 372.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 964.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 206.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 691.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 520.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 398.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 580.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 573.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 323.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 226.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 821.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 781.#.exe - NTFS ADS 15 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 604.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 372.#.exe File opened for modification C:\Windows\:\systemlog.bak 580.#.exe File opened for modification C:\Windows\:\systemlog.bak 821.#.exe File opened for modification C:\Windows\:\systemlog.bak 964.#.exe File opened for modification C:\Windows\:\systemlog.bak 323.#.exe File opened for modification C:\Windows\:\systemlog.bak 398.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 206.#.exe File opened for modification C:\Windows\:\systemlog.bak 691.#.exe File opened for modification C:\Windows\:\systemlog.bak 573.#.exe File opened for modification C:\Windows\:\systemlog.bak 226.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 520.#.exe File opened for modification C:\Windows\:\systemlog.bak 781.#.exe - Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 1504 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe 2240 patcher.exe 4340 604.#.exe 3320 398.#.exe 4456 372.#.exe 4628 821.#.exe 5364 964.#.exe 1048 206.#.exe 1344 691.#.exe 5072 580.#.exe 3348 573.#.exe 712 323.#.exe 2920 226.#.exe 1084 520.#.exe 3712 781.#.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1504 wrote to memory of 4340 1504 2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe 91 PID 2240 wrote to memory of 3320 2240 patcher.exe 92 PID 4340 wrote to memory of 4456 4340 604.#.exe 93 PID 3320 wrote to memory of 4628 3320 398.#.exe 94 PID 4628 wrote to memory of 5364 4628 821.#.exe 95 PID 4456 wrote to memory of 1048 4456 372.#.exe 96 PID 5364 wrote to memory of 1344 5364 964.#.exe 97 PID 1344 wrote to memory of 5072 1344 691.#.exe 99 PID 5072 wrote to memory of 3348 5072 580.#.exe 100 PID 3348 wrote to memory of 712 3348 573.#.exe 101 PID 712 wrote to memory of 2920 712 323.#.exe 102 PID 1048 wrote to memory of 1084 1048 206.#.exe 103 PID 2920 wrote to memory of 3712 2920 226.#.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-03_f46de9654d75cc315bc37808e49b7127_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\604.#.exeC:\Users\Admin\AppData\Local\Temp\604.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\372.#.exeC:\Users\Admin\AppData\Local\Temp\372.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\206.#.exeC:\Users\Admin\AppData\Local\Temp\206.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\520.#.exeC:\Users\Admin\AppData\Local\Temp\520.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1084
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\905c0769f9a06c95a24ddf945\398.#.exeC:\905c0769f9a06c95a24ddf945\398.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\905c0769f9a06c95a24ddf945\821.#.exeC:\905c0769f9a06c95a24ddf945\821.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\905c0769f9a06c95a24ddf945\964.#.exeC:\905c0769f9a06c95a24ddf945\964.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\905c0769f9a06c95a24ddf945\691.#.exeC:\905c0769f9a06c95a24ddf945\691.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\905c0769f9a06c95a24ddf945\580.#.exeC:\905c0769f9a06c95a24ddf945\580.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\905c0769f9a06c95a24ddf945\573.#.exeC:\905c0769f9a06c95a24ddf945\573.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\905c0769f9a06c95a24ddf945\323.#.exeC:\905c0769f9a06c95a24ddf945\323.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712 -
C:\905c0769f9a06c95a24ddf945\226.#.exeC:\905c0769f9a06c95a24ddf945\226.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\905c0769f9a06c95a24ddf945\781.#.exeC:\905c0769f9a06c95a24ddf945\781.#.exe10⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3712 -
C:\905c0769f9a06c95a24ddf945\225.#.exeC:\905c0769f9a06c95a24ddf945\225.#.exe11⤵PID:1776
-
C:\905c0769f9a06c95a24ddf945\704.#.exeC:\905c0769f9a06c95a24ddf945\704.#.exe12⤵PID:1628
-
C:\905c0769f9a06c95a24ddf945\601.#.exeC:\905c0769f9a06c95a24ddf945\601.#.exe13⤵PID:3396
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.1MB
- SHA256 d24c0d032042dcf6a3f36aba8092bf9a43df2ad164fb8eff0defaca487ad2252
- MD5 f46de9654d75cc315bc37808e49b7127
- SHA1 bbb16fcaf6d1122d60f3d98970125dee46b2df9a
- SHA512 684656b3e5e0f4b5319da2fa0cd35c6ab038def3af43af698b8392ca9aebc35944b1d450d71ac9c123a25e59a2d561734f1c9f668ed461224fd4df8136c3c179
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYq:TID41F5IW6
- TLSH T121E57D55B7F44972E1B3427589B292925E327C211F34D3CF2394A27D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 3.1MB
- SHA256 df28e7dbed697338e337259936e4107b9d42ebb67b9b1815693f9db6ac663fe8
- MD5 42af365ed01ac25aaf70fdc1a5eee0ba
- SHA1 3d3053c62d387f819c7afb7cc9e51fc2b3405e46
- SHA512 40901aad7029e9e7a51c324a027982a875bf8d3e8bc7ebce062560996793f1a42576715d001aa169cc54658846543de12519f60b9fc439374d4151f8c84c8f42
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYqu:TID41F5IW6z
- TLSH T114E57D15B7F44972E1B3427599B292925E327C211F34D3CF2394A27D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe$
- Size 3.1MB
- SHA256 b65068500c4a52bfbc243bb22b27e0e53c58f0ad42a5ea7e569d4e46b1e5ecf2
- MD5 2ad4a4e02c62bbe5aaaee5b93478e9e2
- SHA1 315c2c3dd7b05a29f8f7d4999acdedb43543d508
- SHA512 95a687aeab8ff2a7d81353a4d3072d10105e5f4b60f76ff730036114c5c9c450f4ab3f639d5f32e334c06b054fde5845f3cca4aa1e643f9db0abacc9545e1ada
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYqP:TID41F5IW62
- TLSH T1F6E57D15B7F44972E1B3427599B292925E327C211F34D3CF2394A27D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
- Size 3.1MB
- SHA256 f17204b4ee7524dbf869870214b99215695554b3a946f94e5b7408a61d8f4bd1
- MD5 18ab455c661c92bc8e74e84b5c6b0265
- SHA1 ac911d75659457728996d438cacace3f6cefcf05
- SHA512 47d02c80f86303461ec54706c496cb245379a825012202bfe899bfbc0055fa4cea77b6d2f530a3b90d81adf8b894b52d5631d228e42df20a787ef7a84059b3c1
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYqZ:TID41F5IW60
- TLSH T123E57D15B7F44972E1B3427599B292925E327C211F34D3CF2394A27D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$
- Size 3.3MB
- SHA256 ca6e0568af028bd38c1e79da848324168b01802f5be92af64105b3b7f003bc30
- MD5 41e7e2afb4278822af49a845f1fdbb32
- SHA1 6671b790bdcd23740e132aef0e177c5c52046436
- SHA512 4c60c6c6276049e8d026ed073a2d1f8dfe19a73b08660d3edcb52d3b5a2872c9ccb4243821093b86463473275cf1f4df9278e1922d71e3bb5fe28938c1142f89
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYqE:TID41F5IW65
- TLSH T1C4F57E51B7F44972E1B3427589B252929E727C211F34D3CF2394A27D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$
- Size 3.1MB
- SHA256 a31665b918c2af6b953168913328a944411bdf602f4a27322bda51fce25d5c66
- MD5 74fad5989811a24cacd1adba067e86c5
- SHA1 28eec4b6a05635c94bec909bef0ce0796494cb5e
- SHA512 7ffaf940bd47324771570b24c599b75d1ed25c674811199e27bdce49bde0cac00a516afbb63e7f821d873f508bc318afe4fa5e70d15e07a7d8b4ae5b45a95c8a
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYq6:TID41F5IW6H
- TLSH T17EE57D15B7F44972E1B3427599B292925E327C211F34D3CF2394A27D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe$
- Size 3.1MB
- SHA256 a30cbedb802b1248e3c290e9bcb413883d1c6fa7dfc4368cb98bdba05f0c7650
- MD5 0fa7a8cff6ac2146d9f0420a4cd8bc7b
- SHA1 5d2c365097635dc6de4e4a7f2c65a078feea88a0
- SHA512 34e4ffb3499255d54959f711adf009e4e91943df992a306a6406f809894cf8e907e33178a5d482461a896fdb5ef76835b10e277d7946a1cc1d42ec104f074edf
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYqM:TID41F5IW65
- TLSH T17AE57D15B7F44972E1B3427599B292925E327C211F34D3CF2394A27D6E337C0AA36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
- Size 3.6MB
- SHA256 3e6e60294c19cf1eceb0637e922c70a4bbc2bdca2d7e37ad56dd35656da6dbde
- MD5 ac671485ee09ef452fc963108af4283e
- SHA1 d305ed782b9d1c07eb78599c3bf21c7ba2da932c
- SHA512 fe8e205fd7dcecec93e989af6afc0f04a450a7039e2b4413bb34953656ea131b76e120d45ce7aa12f1f5c381bd43cc9cbf1bf8a745afc95794873e6e5bcda0d5
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYqTUOlk09:TID41F5IW6G9
- TLSH T10D067D55B7E44972E1B3467599B292429E727C210F30D3CF2394A27D6E337C0AE36B62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe$
- Size 3.2MB
- SHA256 55774f6ab0778906e3f90daa6386d455f7a8fcfcd2c88f633efe8d2d1f764f6d
- MD5 892d8e58bb224e49e79e5c2a34cc32ac
- SHA1 c8dfc598cea2623e319c015e75f50c7886a1d07d
- SHA512 d208258d863ec86f25a6e70eed1b6946f8d55885723390fbac84222fb97715b35cd4fced7201c6be70a0a3b948b2db0a05670750375d04b966d9f622e2152592
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluwqjXpMC5IhOXpYq9:TID41F5IW6A
- TLSH T1B9F58E11B7F44972E1B3427589B292929E327C211F34D3CF2394A67D6E337D0AA36762
- MD5 SHA1 SHA512 SSDEEP TLSH