Analysis
- max time kernel
118s - max time network
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 17:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_da7f7dc19777276643fbbf0ddbc0a93a_amadey_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_da7f7dc19777276643fbbf0ddbc0a93a_amadey_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-22_da7f7dc19777276643fbbf0ddbc0a93a_amadey_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
- Size 3.9MB
- Sample261023-v47svsft3n
- SHA256 3441dec5f97e55b0798d767273524e61b0e74f0c143c31df275c723b84464e2e
- MD5 da7f7dc19777276643fbbf0ddbc0a93a
- SHA1 b13aadc17da73b103f52b5114051e508fe5456fa
- SHA512 abf15ca41892da9da2a55d5a3d674cc9cb12b9197c96fb6fefd7505fb5f5baffe177b7f563d39107d06aaca0ebb01e3aacf59b30ed86668257baac2e955afaa9
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYq72X:TID41vd5/fkZcf6sk
- TLSH T182166C15B7F88A62E0B39175C9A29696FE7278510B30C6CF1385932C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 13 IoCs
pid Process 4508 patcher.exe 1876 412.#.exe 5868 442.#.exe 480 463.#.exe 5308 115.#.exe 5912 651.#.exe 5832 73.#.exe 3484 264.#.exe 244 230.#.exe 3240 771.#.exe 1288 789.#.exe 4504 79.#.exe 4100 462.#.exe - Adds Run key to start application 2 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 442.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 463.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 115.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 73.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 264.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 79.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 462.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-22_da7f7dc19777276643fbbf0ddbc0a93a_amadey_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 651.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 230.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 771.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 789.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 412.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ 2026-10-22_da7f7dc19777276643fbbf0ddbc0a93a_amadey_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lb-LU\ 442.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CONVERT\ 463.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ 73.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\ 412.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 651.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\ 412.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\ 651.#.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 264.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\ 412.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ 771.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\ 264.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sv-SE\ patcher.exe File opened for modification C:\Program Files\dotnet\host\fxr\8.0.15\ 463.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\ 463.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\ 264.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\ 442.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\ 463.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\ 651.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\ 463.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\osfFPA\ 463.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\ 412.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nl-NL\ 115.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Stationery\ 651.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 463.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\STARTUP\ 442.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\ 442.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\ 73.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ 412.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cy-GB\ 442.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\ 412.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\ 412.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 442.#.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\ 651.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\ 651.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 442.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hi-IN\ 412.#.exe File opened for modification C:\Program Files\Common Files\System\ado\ 463.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\ 73.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\ 73.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\ 771.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\ 771.#.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 264.#.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 442.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\ 442.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\ 412.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\ 73.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 651.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\el-GR\ 789.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\ 412.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\ 463.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\ 651.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\ 73.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\ 264.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts\ 771.#.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 771.#.exe File opened for modification C:\Windows\:\systemlog.bak 462.#.exe File opened for modification C:\Windows\:\systemlog.bak 651.#.exe File opened for modification C:\Windows\:\systemlog.bak 264.#.exe File opened for modification C:\Windows\:\systemlog.bak 789.#.exe File opened for modification C:\Windows\:\systemlog.bak 79.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 442.#.exe File opened for modification C:\Windows\:\systemlog.bak 463.#.exe File opened for modification C:\Windows\:\systemlog.bak 73.#.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 264.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 230.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 462.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_da7f7dc19777276643fbbf0ddbc0a93a_amadey_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 412.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 463.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 115.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 771.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 789.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 442.#.exe - NTFS ADS 14 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 789.#.exe File opened for modification C:\Windows\:\systemlog.bak 462.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-10-22_da7f7dc19777276643fbbf0ddbc0a93a_amadey_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 412.#.exe File opened for modification C:\Windows\:\systemlog.bak 442.#.exe File opened for modification C:\Windows\:\systemlog.bak 463.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 115.#.exe File opened for modification C:\Windows\:\systemlog.bak 651.#.exe File opened for modification C:\Windows\:\systemlog.bak 771.#.exe File opened for modification C:\Windows\:\systemlog.bak 79.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 73.#.exe File opened for modification C:\Windows\:\systemlog.bak 264.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 230.#.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 5668 2026-10-22_da7f7dc19777276643fbbf0ddbc0a93a_amadey_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe 4508 patcher.exe 1876 412.#.exe 5868 442.#.exe 480 463.#.exe 5308 115.#.exe 5912 651.#.exe 5832 73.#.exe 3484 264.#.exe 244 230.#.exe 3240 771.#.exe 1288 789.#.exe 4504 79.#.exe 4100 462.#.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 5668 wrote to memory of 1876 5668 2026-10-22_da7f7dc19777276643fbbf0ddbc0a93a_amadey_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe 93 PID 4508 wrote to memory of 5868 4508 patcher.exe 94 PID 5868 wrote to memory of 480 5868 442.#.exe 95 PID 1876 wrote to memory of 5308 1876 412.#.exe 96 PID 480 wrote to memory of 5912 480 463.#.exe 97 PID 5912 wrote to memory of 5832 5912 651.#.exe 99 PID 5832 wrote to memory of 3484 5832 73.#.exe 100 PID 5308 wrote to memory of 244 5308 115.#.exe 101 PID 3484 wrote to memory of 3240 3484 264.#.exe 102 PID 3240 wrote to memory of 1288 3240 771.#.exe 103 PID 1288 wrote to memory of 4504 1288 789.#.exe 104 PID 4504 wrote to memory of 4100 4504 79.#.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_da7f7dc19777276643fbbf0ddbc0a93a_amadey_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_da7f7dc19777276643fbbf0ddbc0a93a_amadey_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\412.#.exeC:\Users\Admin\AppData\Local\Temp\412.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\115.#.exeC:\Users\Admin\AppData\Local\Temp\115.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\230.#.exeC:\Users\Admin\AppData\Local\Temp\230.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:244 -
C:\Users\Admin\AppData\Local\Temp\595.#.exeC:\Users\Admin\AppData\Local\Temp\595.#.exe5⤵PID:1520
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\905c0769f9a06c95a24ddf945\442.#.exeC:\905c0769f9a06c95a24ddf945\442.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\905c0769f9a06c95a24ddf945\463.#.exeC:\905c0769f9a06c95a24ddf945\463.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:480 -
C:\905c0769f9a06c95a24ddf945\651.#.exeC:\905c0769f9a06c95a24ddf945\651.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\905c0769f9a06c95a24ddf945\73.#.exeC:\905c0769f9a06c95a24ddf945\73.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\905c0769f9a06c95a24ddf945\264.#.exeC:\905c0769f9a06c95a24ddf945\264.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\905c0769f9a06c95a24ddf945\771.#.exeC:\905c0769f9a06c95a24ddf945\771.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\905c0769f9a06c95a24ddf945\789.#.exeC:\905c0769f9a06c95a24ddf945\789.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\905c0769f9a06c95a24ddf945\79.#.exeC:\905c0769f9a06c95a24ddf945\79.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\905c0769f9a06c95a24ddf945\462.#.exeC:\905c0769f9a06c95a24ddf945\462.#.exe10⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4100 -
C:\905c0769f9a06c95a24ddf945\726.#.exeC:\905c0769f9a06c95a24ddf945\726.#.exe11⤵PID:3464
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.9MB
- SHA256 3441dec5f97e55b0798d767273524e61b0e74f0c143c31df275c723b84464e2e
- MD5 da7f7dc19777276643fbbf0ddbc0a93a
- SHA1 b13aadc17da73b103f52b5114051e508fe5456fa
- SHA512 abf15ca41892da9da2a55d5a3d674cc9cb12b9197c96fb6fefd7505fb5f5baffe177b7f563d39107d06aaca0ebb01e3aacf59b30ed86668257baac2e955afaa9
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYq72X:TID41vd5/fkZcf6sk
- TLSH T182166C15B7F88A62E0B39175C9A29696FE7278510B30C6CF1385932C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe$
- Size 3.9MB
- SHA256 7583cbff773293210bb18a8a919775fef81b976f84788ab229daa7c311a27b48
- MD5 9a4cab5ea6c8dc57945df96ffcb3f161
- SHA1 a37a2e0495bd9c3e562b94ed25d6f362cd9741c6
- SHA512 06c85297c1305188abb889137e1de300766592ca6c5bb858da7f6a9470ad0dfe275f29f926e6bf067db620a464f265804d2a8c206b7559fbdb4a17bcf16b316d
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYq72p:TID41vd5/fkZcf6sQ
- TLSH T19F166C15B7F88A62E0B39175C9A29696FE7278510B30C6CF1385932C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe$
- Size 3.9MB
- SHA256 0a372df2a9c90d0417053943f9973f365e827fbe02838131a42a57dc301d0f05
- MD5 643c7e522dfa645d30bde51cc717a65f
- SHA1 ee8ce9421b04d391ac9977d151575988bd405e44
- SHA512 c1329bd88b3b6c1295cccec9bbe59f17be93823fec11010fc442e74abc24d20105d279337dd3657df81fa98eba7ee8428ae58ed1b2722f8883ced8937847dd06
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYq723:TID41vd5/fkZcf6sW
- TLSH T115166C15B7F88A62E0B39175C9A29696FE7278510B30C6CF1385932C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$
- Size 3.9MB
- SHA256 00674833cd6c0a3d22c76255209debbaaf358a81487c3a1ba26e362f4f1037bc
- MD5 5444612916ee03f01b54457c4e08f38b
- SHA1 3ad6051dfa8598cd26a6079642d7ecb589cfb51e
- SHA512 40281fdfa507664944268901e8f3ae23a14229cd82501db7ee46affc8d1418e88aa3649d0e2ef186243137ddddec1c6a26ede0ab62e3863aded548201c4d17a1
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYq72E:TID41vd5/fkZcf6sp
- TLSH T1C4166C15B7F88A62E0B39175C9A29696FE7278510B30C6CF1385932C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$
- Size 3.9MB
- SHA256 b15e5bb5a672fcad32a2a4b059476bb21edcf79ae5195f18d81e173aea9848c4
- MD5 513e00eafe4f5b6ebb1f9777acfa28a2
- SHA1 10f62ab7e9af4609eddcd64ca9006a3476727189
- SHA512 b5c82ea56d9695b74fa0c39731f6d85d3ab00e00134b103ba4391a78c8b09f112caccb13fcc90a04703d4de21b1d807b6d11a6fff0809a8a9f21bf4b3400f4d9
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYq72v:TID41vd5/fkZcf6sG
- TLSH T1E3166C15B7F88A62E0B39175C9A29696FE7278510B30C6CF1385932C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$
- Size 3.9MB
- SHA256 37912ce9ec932e805166081417965e68a2db09b0318bd618b8af5bf979fd76d4
- MD5 bbfa4dd980ab70e6303ff409829b09bb
- SHA1 6cb3510ca73bd257e65b3367f5fa6e0939109825
- SHA512 9acb076b43d65150a255cd3fd57c0cc93eb1a8173e6a1129db9a41abac03898e13ef27c480c5d02d59db2680d9a69a72cabf0fdb8eeb305ed07c7376986e4533
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYq72A:TID41vd5/fkZcf6sl
- TLSH T1F9166C15B7F88A62E0B39175C9A29696FE7278510B30C6CF1385932C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$
- Size 3.9MB
- SHA256 891482c811ed6bd565ad918c883b9a9d1e20611c66b9df5af36795e7da46a8d5
- MD5 ce715933c30fe2ef5f8317d6cbdc0fee
- SHA1 ac79a7ba86e71e4a97533c2da43d795eb915ac22
- SHA512 ab471e0069ebbad6e5fba77ce9d294b798334e33d13602597c4a31a671c798b321af2e01fc154f6b3e5d0bfd5893aec279dd58ee6a9cc00a53853088c3c203f3
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYq72K:TID41vd5/fkZcf6sv
- TLSH T1BA166C15B7F84A62E0B39175C9A29696BE727C510B30C6CF1385A36C2E337D1DA36732
- MD5 SHA1 SHA512 SSDEEP TLSH