c891a1ff5249a97a81fd1f7da76935d771857b4cee02dd3da35667e0a5b6ffb7

Analysis

max time kernel
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/10/2026, 23:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-07_fdbf58432e99e6d608b9b93d6460b2b9_amadey_cobalt-strike_elex_emotet_hijackloader_redline-st.exe
Size 5.2MB
Sample261007-3v8msshv2j
SHA256 c891a1ff5249a97a81fd1f7da76935d771857b4cee02dd3da35667e0a5b6ffb7
MD5 fdbf58432e99e6d608b9b93d6460b2b9
SHA1 9f986a4dcc91c1fb94d904a332ba2fdb1d674c98
SHA512 629450b22ae8fcc70abddcc4ccf2720d4a38c3675dad747ded0aa63d51ae05826482ce64e29c5018e0abf7c00771dfd82c74c43f691d277a56523c0f524f9487
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4Xrzz:TIDQ/rwIDQciTs+wE9XD8ystsFa6L88
TLSH
T174465A01A3634173DC626071C06A7B589A707FB42F22D6EBAE407619FE327C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4376	patcher.exe
4732	541.#.exe
4564	234.#.exe
4820	994.#.exe
1584	890.#.exe
2924	691.#.exe
3788	32.#.exe
5136	684.#.exe
4592	362.#.exe
3516	348.#.exe
5476	673.#.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	673.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-10-07_fdbf58432e99e6d608b9b93d6460b2b9_amadey_cobalt-strike_elex_emotet_hijackloader_redline-st.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	541.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	890.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	691.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	32.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	362.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	234.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	994.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	684.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	348.#.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\	234.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ml-IN\	691.#.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\de-DE\	32.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\	684.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\	890.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	890.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\QUERIES\	2026-10-07_fdbf58432e99e6d608b9b93d6460b2b9_amadey_cobalt-strike_elex_emotet_hijackloader_redline-st.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\	2026-10-07_fdbf58432e99e6d608b9b93d6460b2b9_amadey_cobalt-strike_elex_emotet_hijackloader_redline-st.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\	691.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pa-IN\	691.#.exe
File opened for modification	C:\Program Files\Google\Chrome\	32.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\	32.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\	890.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	691.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	234.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\	32.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\	541.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\	541.#.exe
File opened for modification	C:\Program Files\Internet Explorer\	691.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\	890.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\	541.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\	684.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\	994.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\MSMAPI\1033\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\	234.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\	2026-10-07_fdbf58432e99e6d608b9b93d6460b2b9_amadey_cobalt-strike_elex_emotet_hijackloader_redline-st.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\	890.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\qps-plocm\	234.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	890.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\	234.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\MSMAPI\	691.#.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-10-07_fdbf58432e99e6d608b9b93d6460b2b9_amadey_cobalt-strike_elex_emotet_hijackloader_redline-st.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CONVERT\1033\	234.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\	890.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ms-MY\	691.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	890.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\	234.#.exe
File opened for modification	C:\Program Files\Common Files\	890.#.exe
File opened for modification	C:\Program Files\Internet Explorer\de-DE\	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\	684.#.exe
File opened for modification	C:\Program Files\Internet Explorer\SIGNUP\	684.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\	541.#.exe
File opened for modification	C:\Program Files\Common Files\System\ado\	541.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\	32.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\	32.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\	2026-10-07_fdbf58432e99e6d608b9b93d6460b2b9_amadey_cobalt-strike_elex_emotet_hijackloader_redline-st.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\	32.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\	890.#.exe
File opened for modification	C:\Program Files\Common Files\System\ado\es-ES\	994.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\	541.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	234.#.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\	2026-10-07_fdbf58432e99e6d608b9b93d6460b2b9_amadey_cobalt-strike_elex_emotet_hijackloader_redline-st.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\	890.#.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\systemlog.bak	234.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	890.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	691.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	32.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	684.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	362.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	673.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	234.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	994.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	691.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	684.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	362.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	541.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	890.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	348.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	673.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-07_fdbf58432e99e6d608b9b93d6460b2b9_amadey_cobalt-strike_elex_emotet_hijackloader_redline-st.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 12 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	2026-10-07_fdbf58432e99e6d608b9b93d6460b2b9_amadey_cobalt-strike_elex_emotet_hijackloader_redline-st.exe
File opened for modification	C:\Windows\:\systemlog.bak	patcher.exe
File opened for modification	C:\Windows\:\systemlog.bak	234.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	890.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	691.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	32.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	362.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	348.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	541.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	994.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	684.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	673.#.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
5952	2026-10-07_fdbf58432e99e6d608b9b93d6460b2b9_amadey_cobalt-strike_elex_emotet_hijackloader_redline-st.exe
4376	patcher.exe
4732	541.#.exe
4564	234.#.exe
4820	994.#.exe
1584	890.#.exe
2924	691.#.exe
3788	32.#.exe
5136	684.#.exe
4592	362.#.exe
3516	348.#.exe
5476	673.#.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5952 wrote to memory of 4732	5952	2026-10-07_fdbf58432e99e6d608b9b93d6460b2b9_amadey_cobalt-strike_elex_emotet_hijackloader_redline-st.exe	92
PID 4376 wrote to memory of 4564	4376	patcher.exe	93
PID 4732 wrote to memory of 4820	4732	541.#.exe	94
PID 4564 wrote to memory of 1584	4564	234.#.exe	95
PID 1584 wrote to memory of 2924	1584	890.#.exe	96
PID 2924 wrote to memory of 3788	2924	691.#.exe	97
PID 3788 wrote to memory of 5136	3788	32.#.exe	98
PID 5136 wrote to memory of 4592	5136	684.#.exe	99
PID 4820 wrote to memory of 3516	4820	994.#.exe	100
PID 4592 wrote to memory of 5476	4592	362.#.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-10-07_fdbf58432e99e6d608b9b93d6460b2b9_amadey_cobalt-strike_elex_emotet_hijackloader_redline-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-07_fdbf58432e99e6d608b9b93d6460b2b9_amadey_cobalt-strike_elex_emotet_hijackloader_redline-st.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5952
- C:\Users\Admin\AppData\Local\Temp\541.#.exe
  C:\Users\Admin\AppData\Local\Temp\541.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Users\Admin\AppData\Local\Temp\994.#.exe
    C:\Users\Admin\AppData\Local\Temp\994.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\348.#.exe
      C:\Users\Admin\AppData\Local\Temp\348.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      PID:3516

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4376
- C:\905c0769f9a06c95a24ddf945\234.#.exe
  C:\905c0769f9a06c95a24ddf945\234.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\905c0769f9a06c95a24ddf945\890.#.exe
    C:\905c0769f9a06c95a24ddf945\890.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\905c0769f9a06c95a24ddf945\691.#.exe
      C:\905c0769f9a06c95a24ddf945\691.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2924
    - - C:\905c0769f9a06c95a24ddf945\32.#.exe
        
        C:\905c0769f9a06c95a24ddf945\32.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3788
      - C:\905c0769f9a06c95a24ddf945\684.#.exe
        
        C:\905c0769f9a06c95a24ddf945\684.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5136
        
        C:\905c0769f9a06c95a24ddf945\362.#.exe
        
        C:\905c0769f9a06c95a24ddf945\362.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\905c0769f9a06c95a24ddf945\673.#.exe
        
        C:\905c0769f9a06c95a24ddf945\673.#.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:5476
        
        C:\905c0769f9a06c95a24ddf945\836.#.exe
        
        C:\905c0769f9a06c95a24ddf945\836.#.exe
        9⤵
        
        PID:5936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 5.2MB
SHA256 c891a1ff5249a97a81fd1f7da76935d771857b4cee02dd3da35667e0a5b6ffb7
MD5 fdbf58432e99e6d608b9b93d6460b2b9
SHA1 9f986a4dcc91c1fb94d904a332ba2fdb1d674c98
SHA512 629450b22ae8fcc70abddcc4ccf2720d4a38c3675dad747ded0aa63d51ae05826482ce64e29c5018e0abf7c00771dfd82c74c43f691d277a56523c0f524f9487
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4Xrzz:TIDQ/rwIDQciTs+wE9XD8ystsFa6L88
TLSH
T174465A01A3634173DC626071C06A7B589A707FB42F22D6EBAE407619FE327C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe$

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$
Size 5.3MB
SHA256 79f23e1b089c1be8c9d5d897b4c1904ee259e53e1aa89d5bed161df7f9eec1f9
MD5 74cb307c244fedcf1511f05e714f9b9c
SHA1 c099f3d0d8b31b18337b151bd2cf1ae859367c65
SHA512 3ec57d26e3baa1976b00fa2c5614f07a0e4b68d3a584fed3474f2cf053a5777881bb4c9bf323212eab63652c64d23fc78649d4bf6d097941532d1bc2c539a697
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4Xrzz:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8O
TLSH
T192464901E3634173D8226071C1567758AA317FB42F62D6EBAE80B529BF327C2597337A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.3MB
SHA256 7ba7fc6dc3486fddebded0407cb8fee9188633004670c01fb198d870477bc3cb
MD5 957779175b76c1c6c72ad3d7930a2162
SHA1 113b4b8b2ce8aad0c429880d141131a1a356072b
SHA512 4d27b25af3e9a5f641c262a68cdadacfa97b93c83283c1a0b17e7026c562394adfcf3de559532629215394bed23ef8c3c5b06cbb37421c5598917d29d3e3ccf2
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4Xrz4:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8J
TLSH
T121464901E3634173D8226071C1567758AA317FB42F62D6EBAE80B529BF327C2597337A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe$

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$
Size 5.2MB
SHA256 1e444a40c822673452cd16fe0e5df564cc89548bd656399a232d476a183f98f1
MD5 b09784aa3eff1a8ea7962db788ae03d1
SHA1 6b88a2e535128eae010ff9a6232e0d7b7a827261
SHA512 3de09cfd1af2e4c525745d33d742af99397fa762f78a7ccb6552efa1919f101d4d47ace6a04f3907f7367e8833f5a7658566a0438ebae6019f118a7d0957c366
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4Xrz7:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8W
TLSH
T188465A01A3634173DC226071C06A7B589A707FB42F22D6EBAE407619FE727C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe$

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe$
Size 5.2MB
SHA256 2dc05bbfc9ffb4ef6f9c64c2e88a85d30c4c1d1da05dc290841da7f9a09dcad9
MD5 0c69deabdb3a65e3361d09a01036993f
SHA1 3165462abd148cb3008a8aa2bf4d2b1910263102
SHA512 c64917fa37e60b3fdb33cd21b698bce6e41ebb684ab58c38b1f6e1621be255d312cc72683b688cf234faaf37e62167b36ca4081eee5496ac028910bbf35ea3d3
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4Xrzh:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8I
TLSH
T1BE465A01A3634173DC226071C06A7B589A707FB42F22D6EBAE407619FE727C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 5.2MB
SHA256 f651e1de377e92a36f05a921e4818ffa1cae62f36dfce643da8abeed3dba487d
MD5 ed69085019333cda745f59430e4f3dd4
SHA1 e853e3070d0aa30a53c7c07694c8e1caf0fd8dff
SHA512 55ab77a0f52bd7d65d7b245ee8c4e2b94c9a53414bd0aee43d76546df84f0485e281f2c23586051ff9f8c707ce89e72fd211d7c426352ad85deb9758678ff442
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4XrzF:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8c
TLSH
T153465A01A3634173DC226071C06A7B589A707FB42F22D6EBAE407619FE727C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 5.2MB
SHA256 b820cf10ca8e075eb8bf9478ccf7308999df3d7197a5fecaf7b79e64409bc015
MD5 cd2720ea65ad2e24b757b07de626e774
SHA1 e9fab58b585c25cda4cbd402416ab6c197f4950c
SHA512 8e24e0dfa97971b97243d7505f26c54591b7df30ed389fb2a54ecce1a3f6fdd9c8db77c3f9b89f133d63cf90e90f9f69f90503760086de4d459a6cd113f5766a
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4XrzV:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8I
TLSH
T131465A01A3634173DC226071C06A7B589A707FB42F22D6EBAE407619FE727C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe$

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$
Size 5.2MB
SHA256 ea9e832ea4a3051eee2e9e367a13643a5aa2d07c6acf5b804a7b79a7357053f5
MD5 cc01b247c5aff2a7ac2901c071dcf4c8
SHA1 f45534fa622cad1bb25c80954da4c04f0aac3fba
SHA512 cae95b06f4590dafeeced0a9953243328ba800ff8c477d563402e26c5806b3ba99af2f382c70eadad014f2bce87a7620e768fafe3c99ba86b404c7042da2afe9
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4Xrze:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8H
TLSH
T176465A01A3634173DC226071C06A7B589A707FB42F22D6EBAE407619FE727C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe$

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe$
Size 5.2MB
SHA256 00f1a198e043e234926b3184d30ba99a760f15ac0651b8bce95ee938a0b9d083
MD5 cc8313a430101cc0f91140102610887d
SHA1 53c1aa9f55ec4bfd00604266d4ee14e135d3f511
SHA512 0779c80c07e216e1d6c33feca38059cfd0cdd70d251f1d1ae8e4df0e5d037bba6d29832782a1488538ba58a60d71d09ecce4df649ba05d2aefd747373e0d7c46
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4XrzX:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8G
TLSH
T128465A01A3634173DC226071C46A7B589A707FB42F22D6EBAE407619FE327C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe$

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$
Size 5.2MB
SHA256 4046c9f772793133ddafbdf1ef8c134498750c465874f1bf37844df1c114ef0c
MD5 e0c4952f97706b9d7428bef92ac0ab13
SHA1 e02d2f9241653547cbe4c4c7b13e4ac98a18f56c
SHA512 3322c8a2a29318799673d06c6e467485bc23125570872f1b8eab08e60417d53c76e67387928136ffda911ec18c5ec3b41866f4665929f035581ff4f9a50c03ed
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4XrzR:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8s
TLSH
T1CE465A01A3634173DC226071C06A7B589A707FB42F22D6EBAE407619FE727C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe$

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$
Size 5.2MB
SHA256 4e10879580728b72d703d34fff6e9c756042d86b57e83f8bba72e4b81a1cd9ab
MD5 9594a7fe7c74575620cd90ea10ed3d27
SHA1 c8d346a750d9cb829a7547429f6e04c1a7b8a22b
SHA512 6b6d219701d209f24d7837e60d99012d9fc2466d6aa8fdcde7d2a00ef299a042149b0007611f9b7e059c91a46ceec6211569e218bb66bac05cb808f7d19e6491
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4XrzF:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8s
TLSH
T1AC465A01A3634173DC226071C06A7B589A707FB42F22D6EBAE407619FE727C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$
Size 5.2MB
SHA256 cd710c66a4d3d041159fabdda2a7612a0b6e077166166b294e7a2ca2c3c40580
MD5 bb2b6db3253677a4fd49897935bd92bd
SHA1 db2dafadc9aecee7a7b6693f1a882d0bd2bd65d2
SHA512 1774dbfa3f385130c1f7eacc1a91c33da1f106dea7554afc697aa9a470b8e42153da8f8dc5ef8e699df5f982136d43bf0497ae4ec4821432f2dda67a7b9eccfd
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4Xrzh:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8g
TLSH
T12E465A01A3634173DC226071C06A7B589A707FB42F22D6EBAE407619FE727C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$
Size 5.2MB
SHA256 44c6e4c173f5669a70f4695e49d1313f0e4ea9c7608f0176db2caba2d65c59cc
MD5 18884f5a0facfd09439096958066b9a5
SHA1 476fcc159df4918e23e6ba410865d0c8f627f356
SHA512 0b4fde51522d46c495f4018d419b9d1919d9efa941bf3c9fe1642f3dd44d24db28dfad29222c0e6bff33efb72da5f090828ed7d66728be287852f8e7ee028f06
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4XrzF:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8c
TLSH
T135465A01A3634173DC226071C06A7B589A707FB42F22D6EBAE407619FE727C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe$

Path C:\Program Files\Java\jre-1.8\bin\keytool.exe$
Size 5.2MB
SHA256 df4a7888c5c76410618f77db91631f98fbf9cf68da05a1fa6d1a187e4c860d49
MD5 b70dda4724d233f7e8746bafe2e0429e
SHA1 ad8e37fe97df2554e288cc9a3325b774a9cf8ef2
SHA512 4eb9fb96ffb5ff2a0416e0055fcfab0fd2cec7f10a7b248b70e3ba2fc54da97d3c3a16103b7c890cd3000ecab0320a152ff1044dc6d2fef04d71c5afbd8d26ad
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4Xrzz:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8q
TLSH
T19D465A01A3634173DC226071C06A7B589A707FB42F22D6EBAE407619FE727C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Mashup.Container.NetFX45.exe$

Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$
Size 5.2MB
SHA256 f26c8b8a6c6af48e73a32b4be772c535809290ad023ae84059510816b315e241
MD5 17791dd5f723ad0aa643b96a2870ab82
SHA1 e38ddf5de60033fdb8d85b4b39b5b1ce13bda9a4
SHA512 2161d81ccf0aa0120e5a08232c6a085095294865b1025f52c16236e899be4ffb55229837d423a5a81e160e12b4051619ecc0fef87d032eda2d28e7036bf324c8
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4Xrzw:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8B
TLSH
T10A465A01A3634173DC626071C06A7B589A707FB42F22D6EBAE407619FE327C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelperBgt.exe$

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$
Size 5.2MB
SHA256 7cfc209b44fb4d0a9e6e669e447bf48f25d3399db1979668bf77e55040ae65a5
MD5 c6bb9015da7d5995d6d2634dbca2333d
SHA1 21ff484e29efb57f737ff9d79cade8889a672666
SHA512 0a505da64653cb6cf0b253e893e286f13d83269c24e6db156cdbaa40fbf409642baf1b8d9f383fb8674cc67c8fb341d09a2424ec97cd6c78b118125517ca8cbe
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4Xrzh:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8A
TLSH
T1F7465A01A3634173DC226071C06A7B589A707FB42F22D6EBAE407619FE727C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETLANG.EXE$

Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$
Size 5.2MB
SHA256 c653bb99afbf75ab103f8cb658af4df4ab4ed66869afca054067acce32064d8d
MD5 7260a6e099dee29fcef206c48fad2c6f
SHA1 6eb24dd3920ee7283f229e9665b9ce1f115d3c54
SHA512 d42773b0f5f1e8035e621050accfe0b139ca0be27e544ff4eb20eb1a3c7f5c5946c483000e5e2bb4ad46ecf64ac575b60a14d24d1715563cdf06bb0885965282
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4Xrzg:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8
TLSH
T1BA465A01A3634173DC626071C4667B589A707FB42F22D6EBAE40B619FE327C2593737A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DW20.EXE

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
Size 5.2MB
SHA256 bd3997a17a0140d5fadf02c8d5f6bbf7a476ea7a64519b0d03cc5e9cbe39b064
MD5 96a00de1dd1e46b4601dcc7bb7c42d1f
SHA1 2c5baf17cd00546f47e4cab9f6c47a38da2e1a7f
SHA512 f147ffe2d4fb3dd43bc0f11c6db90eba1f2b83b98f442b499491d5617e334dfdcb613a3e7425b4fba50709b57a85c63d2a5b4c525f3fccaa6f881e0cd63a6458
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4Xrz4:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8h
TLSH
T17C465A01A3634173DC626071C06A7B589A707FB42F22D6EBAE407619FE327C655373BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pj11icon.exe$

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$
Size 5.6MB
SHA256 e3e55b6dbdf03e3365e71bada56327a81320a764f26e3047adb6727fed0d966f
MD5 eb955b3341054282d80f407095a4bab4
SHA1 fa807daa9df7bdde76dd23f23e4a4b4ac7c51158
SHA512 12d73a83d9d6b39b39cf93e1b2a711a81d1352dfb2c626f9402c384517dfa8e3a816c2abf45dd7053bff905ed95093b4a34fb9da99ec911fa8bb13118dd90bc5
SSDEEP 98304:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8mi6:TuQUuQ7V9z8hmFa6L8l6
TLSH
T1EC565A02A3234873F8226070C056776856316FB42FA3D6D7AE497A19FE327C655F237A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

visicon.exe$

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$
Size 5.2MB
SHA256 888f56fd4357cf976042d756117790fbd696e1c998721103bf26b8c24839bd15
MD5 3e3fa42135bc5f3cf12352101ed00a82
SHA1 9692361674bf45d17ebca3070c943d561e70ee9c
SHA512 faaf28cd1414821c03c76c748a054a6af18e0188e28a145359542a81c9a1212dcb072aa1fad20cf674e6286008f1cfd4a887929dd4393a9f747fd24ed1d1962f
SSDEEP 49152:W/4MnYYJ2ZhqSGLHkJEM/rn/4MnYYJ2ZhqSGLHkJEMcinebutmkO+wAOInO4XrzW:TIDQ/rwIDQciTs+wE9XD8ystsFa6L8X
TLSH
T1D6465A01A3634173DC626071C46A7B589A707FB42F22D6EBAE407619FE327C655333BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads