1985fff720434b61e8947431b5f8a8312fdc31bab93f1ad1fe62c970500c5a47

Analysis

max time kernel
93s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_ea34653733061e00e43084d271dbd47c_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Size 2.8MB
Sample261014-cx76yaew2w
SHA256 1985fff720434b61e8947431b5f8a8312fdc31bab93f1ad1fe62c970500c5a47
MD5 ea34653733061e00e43084d271dbd47c
SHA1 739059fc69675cd2347a7cd1a19616cb196ae7bc
SHA512 ab142529515a497645914b718de12054dabd4f0a8e11f88f513634b70c0eaf11bd21d25bbaa801fcf849370a8d8bb4825870e21e21053ab898bae7d393002a69
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vo+y6i1zuajsauZnJp56rX:TID41vd5RtarX
TLSH
T147D56D0A73E846A5E17B423585664152AA73BC211F21D7DF2350AA7D3F337D0AE39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 15 IoCs

pid	Process
4640	patcher.exe
3392	903.#.exe
5732	337.#.exe
4920	993.#.exe
2640	201.#.exe
5264	838.#.exe
1900	398.#.exe
2956	803.#.exe
2068	236.#.exe
2052	964.#.exe
2816	881.#.exe
2728	652.#.exe
460	882.#.exe
5844	825.#.exe
2880	493.#.exe

Adds Run key to start application 2 TTPs 15 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	803.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	964.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	882.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	881.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	201.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	652.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	993.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	838.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	398.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	236.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	825.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-10-13_ea34653733061e00e43084d271dbd47c_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	903.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	337.#.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\	236.#.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\	337.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\id-ID\	964.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	803.#.exe
File opened for modification	C:\Program Files\dotnet\swidtag\	903.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\	964.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\	201.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pa-IN\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\	236.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	838.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\	881.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\3082\	803.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\	337.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ka-GE\	236.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	201.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\	2026-10-13_ea34653733061e00e43084d271dbd47c_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	803.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	201.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\	398.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\	803.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\	337.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\be-BY\	903.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\plugin2\	803.#.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\ja-JP\	201.#.exe
File opened for modification	C:\Program Files\Common Files\System\ado\it-IT\	803.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\kok-IN\	236.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	838.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\	964.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\	337.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\	398.#.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	337.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\gl-ES\	337.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\	201.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pa-IN\	2026-10-13_ea34653733061e00e43084d271dbd47c_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\be-BY\	964.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\applet\	236.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\	964.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\	838.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\	201.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\	337.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\	803.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\	337.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\	993.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\	838.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\	903.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	236.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\or-IN\	881.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\	838.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	337.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	838.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\	881.#.exe
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\	881.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\	201.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\	838.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\	201.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\	964.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\es-ES\	881.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\loc\	838.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\be-BY\	201.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\	201.#.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\systemlog.bak	patcher.exe
File opened for modification	C:\Windows\:\systemlog.bak	337.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	838.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	803.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	236.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	964.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	882.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	201.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	881.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	825.#.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	903.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	398.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	652.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	825.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	493.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-13_ea34653733061e00e43084d271dbd47c_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	337.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	201.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	236.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	964.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	882.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	993.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	838.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	803.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	881.#.exe

NTFS ADS 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\systemlog.bak	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	398.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	803.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	964.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	903.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	337.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	993.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	881.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	652.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	201.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	838.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	825.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	236.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	882.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	2026-10-13_ea34653733061e00e43084d271dbd47c_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
4404	2026-10-13_ea34653733061e00e43084d271dbd47c_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
4640	patcher.exe
3392	903.#.exe
5732	337.#.exe
4920	993.#.exe
2640	201.#.exe
5264	838.#.exe
1900	398.#.exe
2956	803.#.exe
2068	236.#.exe
2052	964.#.exe
2816	881.#.exe
2728	652.#.exe
460	882.#.exe
5844	825.#.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 3392	4404	2026-10-13_ea34653733061e00e43084d271dbd47c_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe	92
PID 4640 wrote to memory of 5732	4640	patcher.exe	93
PID 3392 wrote to memory of 4920	3392	903.#.exe	94
PID 5732 wrote to memory of 2640	5732	337.#.exe	95
PID 2640 wrote to memory of 5264	2640	201.#.exe	96
PID 4920 wrote to memory of 1900	4920	993.#.exe	97
PID 5264 wrote to memory of 2956	5264	838.#.exe	98
PID 2956 wrote to memory of 2068	2956	803.#.exe	100
PID 2068 wrote to memory of 2052	2068	236.#.exe	101
PID 2052 wrote to memory of 2816	2052	964.#.exe	102
PID 1900 wrote to memory of 2728	1900	398.#.exe	103
PID 2816 wrote to memory of 460	2816	881.#.exe	104
PID 460 wrote to memory of 5844	460	882.#.exe	105
PID 5844 wrote to memory of 2880	5844	825.#.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-10-13_ea34653733061e00e43084d271dbd47c_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_ea34653733061e00e43084d271dbd47c_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Users\Admin\AppData\Local\Temp\903.#.exe
  C:\Users\Admin\AppData\Local\Temp\903.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Users\Admin\AppData\Local\Temp\993.#.exe
    C:\Users\Admin\AppData\Local\Temp\993.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\398.#.exe
      C:\Users\Admin\AppData\Local\Temp\398.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\652.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\652.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\974.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\974.#.exe
        6⤵
        
        PID:4740

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640
- C:\905c0769f9a06c95a24ddf945\337.#.exe
  C:\905c0769f9a06c95a24ddf945\337.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\905c0769f9a06c95a24ddf945\201.#.exe
    C:\905c0769f9a06c95a24ddf945\201.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\905c0769f9a06c95a24ddf945\838.#.exe
      C:\905c0769f9a06c95a24ddf945\838.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5264
    - - C:\905c0769f9a06c95a24ddf945\803.#.exe
        
        C:\905c0769f9a06c95a24ddf945\803.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2956
      - C:\905c0769f9a06c95a24ddf945\236.#.exe
        
        C:\905c0769f9a06c95a24ddf945\236.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\905c0769f9a06c95a24ddf945\964.#.exe
        
        C:\905c0769f9a06c95a24ddf945\964.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\905c0769f9a06c95a24ddf945\881.#.exe
        
        C:\905c0769f9a06c95a24ddf945\881.#.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\905c0769f9a06c95a24ddf945\882.#.exe
        
        C:\905c0769f9a06c95a24ddf945\882.#.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:460
        
        C:\905c0769f9a06c95a24ddf945\825.#.exe
        
        C:\905c0769f9a06c95a24ddf945\825.#.exe
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5844
        
        C:\905c0769f9a06c95a24ddf945\493.#.exe
        
        C:\905c0769f9a06c95a24ddf945\493.#.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2880
        
        C:\905c0769f9a06c95a24ddf945\466.#.exe
        
        C:\905c0769f9a06c95a24ddf945\466.#.exe
        12⤵
        
        PID:3704
        
        C:\905c0769f9a06c95a24ddf945\172.#.exe
        
        C:\905c0769f9a06c95a24ddf945\172.#.exe
        13⤵
        
        PID:1400
        
        C:\905c0769f9a06c95a24ddf945\693.#.exe
        
        C:\905c0769f9a06c95a24ddf945\693.#.exe
        14⤵
        
        PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

693.#.exe

Path C:\905c0769f9a06c95a24ddf945\693.#.exe
Size 1.5MB
SHA256 e28210c06925928f8e1706e4bf357acd17f53357482d6d8f51b313ba00eac1df
MD5 e1d8cb9daced83f0faa998494dbd5557
SHA1 e1f8a0526a6df833aafab72e2299db7758b44ab8
SHA512 03eff928f5201f29251d3d3ba1bb1f28434f6214e0763f7abcda05e1b7e363587a37d3f52545a4c3a69c01514c59d533629c6105fdf47af0d0724df72efa3c8e
SSDEEP 24576:FV2fPi1dJU43I98U7nYYJ2tHhADSANLHgWExqatgl8bOkxqatgl8bQslZOZ1rCnL:W/4MnYYJ2ZhqSGLHyqatglYqatgluCCL
TLSH
T1AB757C46B7D195B2E5630231886792A26F727C211F25938F2350A76D6F333D0FB3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 2.8MB
SHA256 1985fff720434b61e8947431b5f8a8312fdc31bab93f1ad1fe62c970500c5a47
MD5 ea34653733061e00e43084d271dbd47c
SHA1 739059fc69675cd2347a7cd1a19616cb196ae7bc
SHA512 ab142529515a497645914b718de12054dabd4f0a8e11f88f513634b70c0eaf11bd21d25bbaa801fcf849370a8d8bb4825870e21e21053ab898bae7d393002a69
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vo+y6i1zuajsauZnJp56rX:TID41vd5RtarX
TLSH
T147D56D0A73E846A5E17B423585664152AA73BC211F21D7DF2350AA7D3F337D0AE39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe$

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$
Size 2.9MB
SHA256 3bf9930c036dcd17901cdd6db8ce3c88b031f374a181dabf6bb35f2a766ff19c
MD5 9d169cb95952a6e29de8f8d12991ece3
SHA1 9c866f4cf826475b0f507addf89a1b4e6eeeb58a
SHA512 28cf18d8233104ebc706e5d2bcf6ed2bbe3bd61dca1ccc219378abac35d1fffc7f1e54dd1b532a585c3ade7456f324ff1f475fb16688094906039fc106cdfdba
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vo+y6i1zuajsauZnJp56rU:TID41vd5RtarU
TLSH
T1C2E53A0AB3E846A5E17F4235C6664152BA737C211F6193DF1390EA3D2F336D0AA79B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe$

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$
Size 2.8MB
SHA256 6b3e71537b138381bb11533486d625a88ae772d8fa0d60d51dad1ddabf97d82d
MD5 353218aecf52c1819cc6cb843be31ff2
SHA1 7fe5bfb844610fa8177b8c05aef53f71400f5617
SHA512 ed847e016b5115c775884d6c6e242c6613156818073907bbd88d40b5c718e6d7eb863efb970fbe6f8e5041d801c19317246ba4fe841928a9583c457d78b05319
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vo+y6i1zuajsauZnJp56r+:TID41vd5Rtar+
TLSH
T1F7D56D0A73E846A5E57B423585664152AA73BC211F21D7DF2350AA3D3F337D0AE39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe$

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe$
Size 2.8MB
SHA256 12db828d8a3a378b85a25f913244a29fd1ae8578f1f1444107ef7274b1f2d3d4
MD5 cab3530754379c70410f9096c50d577b
SHA1 753ce03a933a5aa1163bf8ffb4c457d80eb61192
SHA512 d8b244ff2a80fd8e87662517b40e3e36983de031c15a1b7ab625086351e2c2bdcffdb83a3c4ac4c97b170cd565114ec35303f0d7e3fdee18b646a03e0f7f3d99
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vo+y6i1zuajsauZnJp56r3:TID41vd5Rtar3
TLSH
T151D56D0A73E846A5E57B423585664152AA73BC211F21D7DF2350AA3D3F337D0AE39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$
Size 2.8MB
SHA256 bc7c4693cf65373ffcfa726be2ab80c2b9c948644bc30bbac34181a152a7d6a9
MD5 9b59d9c577c9bd0948e99b839e0f2ca2
SHA1 f1376be65481343e1c354602f6b4d49b6d77c8c9
SHA512 4f6bd0032cd222cdf03625931234e1b36e7c3ef20652738f9cc0b446c9dacbb61effddc34e94b7be5ba230f029eee962b976f474ea6981e29831a9a8a386170e
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vo+y6i1zuajsauZnJp56ra:TID41vd5Rtara
TLSH
T10FD56D0A73E846A5E57B423585664152AA73BC211F21D7DF2350AA3D3F337D0AE39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$
Size 2.8MB
SHA256 4351539347d8f168e85d60b03b84fba8b32a4bfa168ac4d156d5a0ea9c97c763
MD5 659d8c3c41eede8de225430ea2ae81ba
SHA1 d595c865ee6b2be702309d4f967f078f690a336e
SHA512 e16ed7119ab947c4a72bf2ec6f230776f6723ee4b8e68326bb44c7e7ec370ff8bab1d0366b42fe9c1394b5c758c3cf0aff009edeb5ebea460ce1c95203fc5477
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vo+y6i1zuajsauZnJp56ra:TID41vd5Rtara
TLSH
T1A2D56D0A73E846A5E57B423585664152AA73BC211F21D7DF2350AA3D3F337D0AE39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GRAPH.EXE

Path C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE
Size 3.0MB
SHA256 3f1f12e34fda83db2f87d8b5c712e6b67e7480f2837a8a2884842419e7d0ece3
MD5 44159a49d22ea6c081a5e58dae971d86
SHA1 30a2b4239015ae65919739401b8c4fa9f783bc83
SHA512 04d805c8a801813e5347008e52aceaffd045ee45b0ec44c78e1e8346cf5d8df6c1d8a9caf281488f453db191690317a21a4460358a9bd2489a40c43d937bd8b9
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vo+y6i1zuajsauZnJp56rtTeX:TID41vd5RtartTQ
TLSH
T1E7E55C4A73E846E5E177423585664262AB73BC211F2197CF1350AA7D3F337D0AE39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads