e256b4de9a55c08e2f4bb1c4fcabeb4b5c18252b97daf067161fc42ba2d8aa0c

Analysis

max time kernel
63s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
Size 3.0MB
Sample261012-s2ctlaea49
SHA256 e256b4de9a55c08e2f4bb1c4fcabeb4b5c18252b97daf067161fc42ba2d8aa0c
MD5 95a11460c922065994fd2f71f77b4e81
SHA1 865574bab4baa10bafb70c89496387326329d036
SHA512 f4cbfc584f188563c79eb3e1a480e42e30fca06f7bbf9ea1f14e5dc51b4e17a05f801922cbcdffd7769b9b8a7a224734dba7d05e37b5254c20e6f26fe57d84c3
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJLwj:TID41qW1PszV+t8j
TLSH
T139E59D02B7D540B2E1771231857752A2AB72B8211F31D6CF2394967D6F33BC0AB36B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
2384	patcher.exe
2856	196.#.exe
3532	525.#.exe
2984	563.#.exe
4772	952.#.exe
3052	140.#.exe
3796	285.#.exe
4608	103.#.exe
1712	524.#.exe
4836	103.#.exe
772	245.#.exe
3820	127.#.exe
4480	281.#.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	281.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	525.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	140.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	285.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	103.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	127.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	196.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	563.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	952.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	524.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	103.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	245.#.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	285.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	524.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	245.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	281.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	patcher.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	525.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	952.#.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\	952.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\	196.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\	952.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\	2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Crashpad\attachments\	525.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\	525.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\	2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\	563.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\	525.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\	103.#.exe
File opened for modification	C:\Program Files\Common Files\System\ado\	140.#.exe
File opened for modification	C:\Program Files\Common Files\System\	285.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\	525.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\	285.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	525.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	563.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	285.#.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\de-DE\	2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\	196.#.exe
File opened for modification	C:\Program Files\Crashpad\reports\	140.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\	2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\	196.#.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\da-DK\	563.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\	563.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	196.#.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\	525.#.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\	140.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\	140.#.exe
File opened for modification	C:\Program Files\7-Zip\	285.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\	140.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\	563.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\	103.#.exe
File opened for modification	C:\Program Files\Common Files\System\it-IT\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VGX\	patcher.exe
File opened for modification	C:\Program Files\Common Files\System\ado\ja-JP\	196.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\	patcher.exe
File opened for modification	C:\Program Files\dotnet\host\	285.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	103.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	952.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\	140.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\	952.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\	196.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\	103.#.exe
File opened for modification	C:\Program Files\Crashpad\attachments\	196.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\	103.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\	196.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\	285.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\da-DK\	952.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\	196.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-GB\	563.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\	2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\	563.#.exe
File opened for modification	C:\Program Files\dotnet\swidtag\	563.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\et-EE\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Triedit\	2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\ja-JP\	196.#.exe
File opened for modification	C:\Program Files\Common Files\System\	196.#.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\	563.#.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	196.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	563.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	140.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	245.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	127.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	281.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	525.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	952.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	285.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	103.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	524.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	103.#.exe

NTFS ADS 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	103.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	127.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	196.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	563.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	140.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	103.#.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
5100	2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
2384	patcher.exe
2856	196.#.exe
3532	525.#.exe
2984	563.#.exe
4772	952.#.exe
3052	140.#.exe
3796	285.#.exe
4608	103.#.exe
1712	524.#.exe
4836	103.#.exe
772	245.#.exe
3820	127.#.exe
4480	281.#.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 2856	5100	2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe	90
PID 2384 wrote to memory of 3532	2384	patcher.exe	91
PID 2856 wrote to memory of 2984	2856	196.#.exe	92
PID 3532 wrote to memory of 4772	3532	525.#.exe	93
PID 2984 wrote to memory of 3052	2984	563.#.exe	94
PID 4772 wrote to memory of 3796	4772	952.#.exe	95
PID 3052 wrote to memory of 4608	3052	140.#.exe	98
PID 3796 wrote to memory of 1712	3796	285.#.exe	101
PID 4608 wrote to memory of 4836	4608	103.#.exe	106
PID 1712 wrote to memory of 772	1712	524.#.exe	107
PID 4836 wrote to memory of 3820	4836	103.#.exe	109
PID 772 wrote to memory of 4480	772	245.#.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\196.#.exe
  C:\Users\Admin\AppData\Local\Temp\196.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\563.#.exe
    C:\Users\Admin\AppData\Local\Temp\563.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\140.#.exe
      C:\Users\Admin\AppData\Local\Temp\140.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\103.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\103.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\103.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\103.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\127.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\127.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\886.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\886.#.exe
        8⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\79.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\79.#.exe
        9⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\481.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\481.#.exe
        10⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\870.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\870.#.exe
        11⤵
        
        PID:3064

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\905c0769f9a06c95a24ddf945\525.#.exe
  C:\905c0769f9a06c95a24ddf945\525.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\905c0769f9a06c95a24ddf945\952.#.exe
    C:\905c0769f9a06c95a24ddf945\952.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\905c0769f9a06c95a24ddf945\285.#.exe
      C:\905c0769f9a06c95a24ddf945\285.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3796
    - - C:\905c0769f9a06c95a24ddf945\524.#.exe
        
        C:\905c0769f9a06c95a24ddf945\524.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1712
      - C:\905c0769f9a06c95a24ddf945\245.#.exe
        
        C:\905c0769f9a06c95a24ddf945\245.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\905c0769f9a06c95a24ddf945\281.#.exe
        
        C:\905c0769f9a06c95a24ddf945\281.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4480
        
        C:\905c0769f9a06c95a24ddf945\700.#.exe
        
        C:\905c0769f9a06c95a24ddf945\700.#.exe
        8⤵
        
        PID:2624
        
        C:\905c0769f9a06c95a24ddf945\342.#.exe
        
        C:\905c0769f9a06c95a24ddf945\342.#.exe
        9⤵
        
        PID:4044
        
        C:\905c0769f9a06c95a24ddf945\878.#.exe
        
        C:\905c0769f9a06c95a24ddf945\878.#.exe
        10⤵
        
        PID:4184
        
        C:\905c0769f9a06c95a24ddf945\409.#.exe
        
        C:\905c0769f9a06c95a24ddf945\409.#.exe
        11⤵
        
        PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 3.0MB
SHA256 e256b4de9a55c08e2f4bb1c4fcabeb4b5c18252b97daf067161fc42ba2d8aa0c
MD5 95a11460c922065994fd2f71f77b4e81
SHA1 865574bab4baa10bafb70c89496387326329d036
SHA512 f4cbfc584f188563c79eb3e1a480e42e30fca06f7bbf9ea1f14e5dc51b4e17a05f801922cbcdffd7769b9b8a7a224734dba7d05e37b5254c20e6f26fe57d84c3
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJLwj:TID41qW1PszV+t8j
TLSH
T139E59D02B7D540B2E1771231857752A2AB72B8211F31D6CF2394967D6F33BC0AB36B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe$

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$
Size 3.1MB
SHA256 51b341d3950ca7543ce11bb45f5df37108677de715d9f76b75d6ba8351f12d90
MD5 bab803d41009e27c2b0715643b204762
SHA1 b90be0c65d6ae50a54c19fa9e01e6e751de94e05
SHA512 e8eab75bdeccfe652e6f382f68abf9d317f8abeae4a8ec0fe1cc11483cb48bfe702af14cebd2b2e2ca326aa48a03b7caacd301e06abd86d8fb604158db157aea
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJLwG:TID41qW1PszV+t8G
TLSH
T115E59D02B7D540B2E1771231857752A2AB72B8211F3197CF2394967D6F33BC0AB36B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe$

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$
Size 3.1MB
SHA256 bb42ce9a0a59adf66d31799ebfd5c08c41b13c25c9627129f3a56785a10127bc
MD5 51cefe5c05c0fe22ca4581ef6626fbcd
SHA1 f59e993e6e75e02ad5447c9a1c1075720e5e8387
SHA512 ec44a78d23b08f726ef9ed17ac307970bf5e8c91a75220098ca1ec1d8811aeb341440293c39fa39e1e8cf80e737720819f62b87f437d0bfe8626d9c15d07725c
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJLwo:TID41qW1PszV+t8o
TLSH
T185E57C02F7D540A2E16B1231C6674262BA73B8211BB196CF23D4E67D6F337C0AA75B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$
Size 3.0MB
SHA256 ebb1ada33f7496b8d049f8b82aec3275d87907fcc80b7f092393718e4fddd2f9
MD5 4b457e2dd16d26cd3ea636c5c14e63ce
SHA1 d920c744a0ae297d755c871eb5dfe7a5ff9241fb
SHA512 7ed19f90c97689b0877cef5162f613cecad8840017f1b12beb88305e9eb554aca83339fe0e6b5f2187614750c43ba66d8fd0829ba9aa6b04daf6ce3f9f5a7284
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJLwm:TID41qW1PszV+t8m
TLSH
T149E59D02B7D540B2E1771231857752A2AB72B8211F31D6CF2394967D6F33BC0AB36B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe$

Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$
Size 3.0MB
SHA256 f7281682b44334f6160fd9c9c0c814524765ad1987d2ca4a69e0dbddc16e37e6
MD5 1cc3c8bf865ca9852d12556077bf14f5
SHA1 a46dd3164c2c0ceaab44454a2690fc6aae400f21
SHA512 0f07c73637907c573429d253e4797ab70eb68727831fabb0101d1010e07be26d28a7ebe6fbe791be18cf60d734fe5d7c8fbdaa4afcb6ee183ad514a5cc7ae78e
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJLwk:TID41qW1PszV+t8k
TLSH
T146E59D02B7D540B2E1771231857752A2AB72B8211F31D6CF2394967D6F33BC0AB36B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads