Analysis
- max time kernel
89s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 15:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe
- Size 3.0MB
- Sample261012-s2ctlaea49
- SHA256 e256b4de9a55c08e2f4bb1c4fcabeb4b5c18252b97daf067161fc42ba2d8aa0c
- MD5 95a11460c922065994fd2f71f77b4e81
- SHA1 865574bab4baa10bafb70c89496387326329d036
- SHA512 f4cbfc584f188563c79eb3e1a480e42e30fca06f7bbf9ea1f14e5dc51b4e17a05f801922cbcdffd7769b9b8a7a224734dba7d05e37b5254c20e6f26fe57d84c3
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJLwj:TID41qW1PszV+t8j
- TLSH T139E59D02B7D540B2E1771231857752A2AB72B8211F31D6CF2394967D6F33BC0AB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 13 IoCs
pid Process 5648 patcher.exe 5548 364.#.exe 5216 159.#.exe 5152 109.#.exe 1812 931.#.exe 2684 540.#.exe 4596 223.#.exe 5136 303.#.exe 3324 375.#.exe 3540 102.#.exe 5532 618.#.exe 1728 535.#.exe 3856 691.#.exe - Adds Run key to start application 2 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 618.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 535.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 691.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 364.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 159.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 109.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 931.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 540.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 102.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 223.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 303.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 375.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\host\fxr\ 931.#.exe File opened for modification C:\Program Files\dotnet\host\ 540.#.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\ 375.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nn-NO\ 159.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 931.#.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\ 375.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 159.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lb-LU\ 618.#.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 159.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\ 159.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\ 375.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\ 303.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\ 2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\ 931.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\applet\ 540.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\ 931.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ 375.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\ 109.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\plugin2\ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\ 931.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\AugLoop\ 159.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\ 540.#.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\te-IN\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\ 931.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 931.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f33\ 540.#.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 159.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sl-SI\ 2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\ 364.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\ patcher.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\ 102.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\ 931.#.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\ 109.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ 375.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\ 931.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\ 159.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\ 159.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ patcher.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\ patcher.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ 303.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\ 303.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ 159.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ 159.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\ 2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ 109.#.exe File opened for modification C:\Program Files\Java\jre-1.8\ 303.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\ 303.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\ 2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-BA\ 303.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\ 931.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\ 931.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fa-IR\ 375.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\ 303.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\ 540.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ar-SA\ 2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 540.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\ 102.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ 159.#.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 618.#.exe File opened for modification C:\Windows\:\systemlog.bak 535.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 159.#.exe File opened for modification C:\Windows\:\systemlog.bak 303.#.exe File opened for modification C:\Windows\:\systemlog.bak 375.#.exe File opened for modification C:\Windows\:\systemlog.bak 102.#.exe File opened for modification C:\Windows\:\systemlog.bak 931.#.exe File opened for modification C:\Windows\:\systemlog.bak 540.#.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 109.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 375.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 618.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 535.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 691.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 931.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 540.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 223.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 303.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 102.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 364.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 159.#.exe - NTFS ADS 14 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 540.#.exe File opened for modification C:\Windows\:\systemlog.bak 618.#.exe File opened for modification C:\Windows\:\systemlog.bak 535.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 691.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 364.#.exe File opened for modification C:\Windows\:\systemlog.bak 159.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 109.#.exe File opened for modification C:\Windows\:\systemlog.bak 931.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 223.#.exe File opened for modification C:\Windows\:\systemlog.bak 303.#.exe File opened for modification C:\Windows\:\systemlog.bak 375.#.exe File opened for modification C:\Windows\:\systemlog.bak 102.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 5820 2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe 5648 patcher.exe 5548 364.#.exe 5216 159.#.exe 5152 109.#.exe 1812 931.#.exe 2684 540.#.exe 4596 223.#.exe 5136 303.#.exe 3324 375.#.exe 3540 102.#.exe 5532 618.#.exe 1728 535.#.exe 3856 691.#.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 5820 wrote to memory of 5548 5820 2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe 91 PID 5648 wrote to memory of 5216 5648 patcher.exe 92 PID 5548 wrote to memory of 5152 5548 364.#.exe 93 PID 5216 wrote to memory of 1812 5216 159.#.exe 94 PID 1812 wrote to memory of 2684 1812 931.#.exe 95 PID 5152 wrote to memory of 4596 5152 109.#.exe 96 PID 2684 wrote to memory of 5136 2684 540.#.exe 97 PID 5136 wrote to memory of 3324 5136 303.#.exe 99 PID 3324 wrote to memory of 3540 3324 375.#.exe 100 PID 3540 wrote to memory of 5532 3540 102.#.exe 101 PID 5532 wrote to memory of 1728 5532 618.#.exe 102 PID 4596 wrote to memory of 3856 4596 223.#.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-11_95a11460c922065994fd2f71f77b4e81_amadey_cobalt-strike_elex_glassworm_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\364.#.exeC:\Users\Admin\AppData\Local\Temp\364.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\109.#.exeC:\Users\Admin\AppData\Local\Temp\109.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\223.#.exeC:\Users\Admin\AppData\Local\Temp\223.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\691.#.exeC:\Users\Admin\AppData\Local\Temp\691.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3856
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\905c0769f9a06c95a24ddf945\159.#.exeC:\905c0769f9a06c95a24ddf945\159.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\905c0769f9a06c95a24ddf945\931.#.exeC:\905c0769f9a06c95a24ddf945\931.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\905c0769f9a06c95a24ddf945\540.#.exeC:\905c0769f9a06c95a24ddf945\540.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\905c0769f9a06c95a24ddf945\303.#.exeC:\905c0769f9a06c95a24ddf945\303.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\905c0769f9a06c95a24ddf945\375.#.exeC:\905c0769f9a06c95a24ddf945\375.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\905c0769f9a06c95a24ddf945\102.#.exeC:\905c0769f9a06c95a24ddf945\102.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\905c0769f9a06c95a24ddf945\618.#.exeC:\905c0769f9a06c95a24ddf945\618.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\905c0769f9a06c95a24ddf945\535.#.exeC:\905c0769f9a06c95a24ddf945\535.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1728 -
C:\905c0769f9a06c95a24ddf945\326.#.exeC:\905c0769f9a06c95a24ddf945\326.#.exe10⤵PID:4416
-
C:\905c0769f9a06c95a24ddf945\311.#.exeC:\905c0769f9a06c95a24ddf945\311.#.exe11⤵PID:988
-
C:\905c0769f9a06c95a24ddf945\84.#.exeC:\905c0769f9a06c95a24ddf945\84.#.exe12⤵PID:6136
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.0MB
- SHA256 e256b4de9a55c08e2f4bb1c4fcabeb4b5c18252b97daf067161fc42ba2d8aa0c
- MD5 95a11460c922065994fd2f71f77b4e81
- SHA1 865574bab4baa10bafb70c89496387326329d036
- SHA512 f4cbfc584f188563c79eb3e1a480e42e30fca06f7bbf9ea1f14e5dc51b4e17a05f801922cbcdffd7769b9b8a7a224734dba7d05e37b5254c20e6f26fe57d84c3
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJLwj:TID41qW1PszV+t8j
- TLSH T139E59D02B7D540B2E1771231857752A2AB72B8211F31D6CF2394967D6F33BC0AB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe$
- Size 3.0MB
- SHA256 f0ccd4ceb73bf013b0d585d21e8c6a5b2f26a1f95e1e81b37dd33386ef2d09e6
- MD5 b0e07061503459de1bb4a464ef5938f2
- SHA1 831c20240346cf243c74b56da1bde38d97137ccf
- SHA512 4c0090da0ffe61720c6c099d00cc61a486d80eab362c2d0ef66f5d6d8b91b4150cafee564130242f5923fca96d451c3f80f7331b7c62a43b3080f91e2b388fbf
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJLw6:TID41qW1PszV+t86
- TLSH T196E59D02B7D540B2E1771231857752A2AB72B8211F31D6CF2394967D6F33BC0AB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$
- Size 3.0MB
- SHA256 ff08f2a02b4a50c2d6d71f59bc7fdc6510d615a61354fbb6508f904f02d76beb
- MD5 d2f17f5050f1a5c388438edffdfc0575
- SHA1 312dd3cf766817b1572f7802494eada1ed4b4a5f
- SHA512 02f3db6a1f87751eecfb8c6e1519f2007d2573efb506a5246d0848692f5e5edd2fb880c7b644b613686d8c708dea21b1d40aecad0b715ae459dca49d0fb8155e
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJLwS:TID41qW1PszV+t8S
- TLSH T116E59D02B7D540B2E1771231857752A2AB72B8211F31D6CF2394967D6F33BC0AB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
- Size 1.5MB
- SHA256 f0b99beeb234ce14e6f03ffb37197597edd1af4e2b690d1ce590e0927d519435
- MD5 fc0856ab19ce9a2623b73f666d6419d4
- SHA1 93c676abca284d80c25001b241efec5bf4d076ed
- SHA512 c5108ff87175764ae3ffdf6a08b6eb841c8d8d5a4cce4e4babe55ffd054ca7a3685ca78d7cbfb70d61944bf84c802691a3c8e511ec7b805344b8fdad5647a938
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsE:TID41qW1Pszr
- TLSH T1CD759E42F78285B3D1671232442B52B62BB9B9111F11978F2394667E6F337C0BB3636B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
- Size 3.0MB
- SHA256 20be962697d49352576058e415c7bf88be8e5bf08b0e92c9ec83ee31ecbc2434
- MD5 58fbded582a5b371f6152a957b9a415a
- SHA1 aa1e09827fcaa5ca46dda55fc673ac8897452801
- SHA512 3d964b5fc1b9a14365c3a604a841dcca9bb0857bbe6d13c0be6a508986971c934c3c7030a918809178c8af4cc74f2e16479884730f9f7b4dea27d35a91f25fc9
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJLws:TID41qW1PszV+t8s
- TLSH T1AAE59D02B7D540B2E1771231857752A2AB72B8211F31D6CF2394967D6F33BC0AB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$
- Size 2.6MB
- SHA256 bfb04c0931d3a4eab06bfb59dc72638d442d14167a68bb017fcc78cca662b739
- MD5 ce52310ca443f2d0e774f76b9775ee26
- SHA1 e398310fdf6a5b7325233d614584e5bbd92e7683
- SHA512 0bd817c6ba79204477bcfd9a1edcc94eec0576117c2e04b1a4e5793653cc9339f3adba0e334a9bcbd87be53c1630d508b594adb267112a55883ce274773f496b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZD:TID41qW1PszV+tp
- TLSH T154C5AE42B7C540B2D5671231852B52A36BB2B8211F3197CF2394967D9F33BC0BB3AB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$
- Size 3.0MB
- SHA256 474997fb348655b6b3b386adabdc82c7dfaeaf218455bf229cb4c5b5dd416488
- MD5 367520969894a29ee701477efd6e7742
- SHA1 919fe6d3ea797ebac815ee054616eee40002d786
- SHA512 29197c37bb696bbcd9d3c18b8a1b187ac790068d1a6570a58f125db7c982a0dfab10ef612b9a13beb652a58f9e1e27181b3b8f9690643e07dbd21f28d290c23e
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJLwD:TID41qW1PszV+t8D
- TLSH T1B3E59D02B7D540B2E1771231857752A2AB72B8211F31D6CF2394967D6F33BC0AB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$
- Size 3.8MB
- SHA256 b3d8f6889a93d132bd1df6f86985c343e0a80155656818bf8774c2d9a71edbf0
- MD5 e164c47fea772795c3e4061ac7d0f41d
- SHA1 91549fe367a791639733a0dc550fb73b17605ba9
- SHA512 732b8c7af3cefb32a280b2e44df7af010fef4ee8efa579fead31414b005e44b82dc86125328542e961ae86ebb50541e37eb5f5b22ffb424ae2c7f9c86623c176
- SSDEEP 98304:TID41qW1PszV+t8TMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMM:Tuqxs4ie
- TLSH T1A2069D42B7D580B2E0771231893742626B72BC211F3196DF2394B67E6F337C1AA36B56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$
- Size 3.0MB
- SHA256 80c4a383cdcdaa6839f9d61d2f8f909ec63808817d37b8d21a98159cb2b0d4bc
- MD5 f6628bf9e972b33190269ecc2bbdee1e
- SHA1 000eb8a893cfa2352883b65ed075dd7d2d2c71c1
- SHA512 6aa2941ce82f571bd978fc39d96f6db1cc59d5103d55f9e5c1489e9731edaaa6ad873354cf16eca91dd1794b6db90b9f40ac803d33417a3966a662ff26d43ac8
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJLw1:TID41qW1PszV+t81
- TLSH T1C3E59D02B7D540B2E1771231857752A2AB72B8211F31D6CF2394967D6F33BC0AB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$
- Size 3.6MB
- SHA256 80f75a04c54790a795626356de4b311ba90205745b3add20470c6131586ab5b6
- MD5 06ed143b7a15c38006feefec98d69082
- SHA1 be015dbb7bab0a4e9e757fc990c135b935ad2f1b
- SHA512 c1f5b6b235eb7446d89648b7c4a4c6049ad0054fd73c3ba7f4e2aa1a0d23aa65b4a7b3fea3bb8bb2c667d240a71e90a27970782f4de6ebb65202e6f45d825750
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJLwBIWM:TID41qW1PszV+t8BxGX
- TLSH T1F3068D02B7D540B2D567513189674263AB72B8212F3097DF2394EA7E6F337C0AB3971A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
- Size 64KB
- SHA256 ca99c19359d2a7ebd5d0b5b242600e96af11639f9c12629b093e94f8591cba71
- MD5 f6c4bf261ecb0d99865e87350cf94b05
- SHA1 99c0ffb4da610d4a52e671c0f886c38b34854bea
- SHA512 7946814caac9c9b1fd8d0f3215fde71afaa3bf64e04767559ed4be2896ca5f9189a2139041dabe43de43034cc91791c97fd061dfd57ae261cdca75d52e399413
- SSDEEP 768:/WBTubtYLuNHpfrmH6CLj5ZcY4jvwS2Et:/aqbtmuNHZiH665ZczwS9t
- TLSH T1C553C603E7A494DBE652CAF21CE985696A377D700641CE8F29144E6E1D35783B8E132F
- MD5 SHA1 SHA512 SSDEEP TLSH