171f1b7c9d62c43f7bb44086424f5305c138b3eb0b38ec4ab3e4e6abd2efdf46

Analysis

max time kernel
125s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Size 4.4MB
Sample261024-bcwfzaey91
SHA256 171f1b7c9d62c43f7bb44086424f5305c138b3eb0b38ec4ab3e4e6abd2efdf46
MD5 abc1ffca55190104b832bde709b8cb22
SHA1 8818ec46d0be6d62420848b0cf2c17c9cd53737e
SHA512 ca9b25da60a0b8fe6bf6675cb414b4e1d95f5f6d76ac05a33d4e7dd86ba2b13af1ea1d5d2d37d370a7b23ee460ab7459c2ba89cd2b7b8bcbc544901b4cfcf3c1
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mqN:TID41qW1PszV+tA5mkfkZc
TLSH
T17C266B16F7A88272E0739175C5A7A6A6FE7234111B3086CF1344A77C2F337D19A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
4668	patcher.exe
6132	493.#.exe
4472	340.#.exe
1272	976.#.exe
2812	657.#.exe
5928	979.#.exe
4124	535.#.exe
3232	870.#.exe
5644	777.#.exe
1656	796.#.exe
2012	978.#.exe
4560	805.#.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	777.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	805.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	493.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	976.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	535.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	796.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	978.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	340.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	657.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	979.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	870.#.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\	493.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\	493.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\	976.#.exe
File opened for modification	C:\Program Files\Internet Explorer\SIGNUP\	2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\	340.#.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\	870.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\lo-LA\	patcher.exe
File opened for modification	C:\Program Files\dotnet\host\	976.#.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\7.0.16\	2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\	870.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\	870.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\	979.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ug-CN\	340.#.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\	2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\	535.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\	796.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\qps-plocm\	976.#.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\	340.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\th-TH\	796.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	870.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\	340.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\kok-IN\	493.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-RS\	976.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\	979.#.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\	535.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	535.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\	976.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\3082\	535.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fa-IR\	2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mk-MK\	2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\chr-CHER-US\	979.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hy-AM\	979.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ug-CN\	979.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\	493.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\	976.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\	340.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\	2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\	976.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\	976.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\	340.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\	870.#.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	340.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\vi-VN\	535.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\	976.#.exe
File opened for modification	C:\Program Files\Common Files\System\ado\de-DE\	657.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\	796.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\	979.#.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	976.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\	535.#.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\	2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	340.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\	340.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\	340.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\	979.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\be-BY\	870.#.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\systemlog.bak	976.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	535.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	978.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	805.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	340.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	979.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	870.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	796.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	796.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	493.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	976.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	870.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	978.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	805.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	340.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	657.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	979.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	535.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	777.#.exe

NTFS ADS 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\systemlog.bak	976.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	979.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	535.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	870.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	796.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	978.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
File opened for modification	C:\Windows\:\systemlog.bak	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	493.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	340.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	657.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	777.#.exe
File opened for modification	C:\Windows\:\systemlog.bak	805.#.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
5436	2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
4668	patcher.exe
6132	493.#.exe
4472	340.#.exe
1272	976.#.exe
2812	657.#.exe
5928	979.#.exe
4124	535.#.exe
3232	870.#.exe
5644	777.#.exe
1656	796.#.exe
2012	978.#.exe
4560	805.#.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5436 wrote to memory of 6132	5436	2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe	91
PID 4668 wrote to memory of 4472	4668	patcher.exe	92
PID 4472 wrote to memory of 1272	4472	340.#.exe	93
PID 6132 wrote to memory of 2812	6132	493.#.exe	94
PID 1272 wrote to memory of 5928	1272	976.#.exe	95
PID 5928 wrote to memory of 4124	5928	979.#.exe	97
PID 4124 wrote to memory of 3232	4124	535.#.exe	98
PID 2812 wrote to memory of 5644	2812	657.#.exe	99
PID 3232 wrote to memory of 1656	3232	870.#.exe	100
PID 1656 wrote to memory of 2012	1656	796.#.exe	101
PID 2012 wrote to memory of 4560	2012	978.#.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_abc1ffca55190104b832bde709b8cb22_amadey_cobalt-strike_elex_glassworm_hijackloader_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Users\Admin\AppData\Local\Temp\493.#.exe
  C:\Users\Admin\AppData\Local\Temp\493.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Users\Admin\AppData\Local\Temp\657.#.exe
    C:\Users\Admin\AppData\Local\Temp\657.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\777.#.exe
      C:\Users\Admin\AppData\Local\Temp\777.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      PID:5644

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668
- C:\905c0769f9a06c95a24ddf945\340.#.exe
  C:\905c0769f9a06c95a24ddf945\340.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\905c0769f9a06c95a24ddf945\976.#.exe
    C:\905c0769f9a06c95a24ddf945\976.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\905c0769f9a06c95a24ddf945\979.#.exe
      C:\905c0769f9a06c95a24ddf945\979.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5928
    - - C:\905c0769f9a06c95a24ddf945\535.#.exe
        
        C:\905c0769f9a06c95a24ddf945\535.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4124
      - C:\905c0769f9a06c95a24ddf945\870.#.exe
        
        C:\905c0769f9a06c95a24ddf945\870.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\905c0769f9a06c95a24ddf945\796.#.exe
        
        C:\905c0769f9a06c95a24ddf945\796.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\905c0769f9a06c95a24ddf945\978.#.exe
        
        C:\905c0769f9a06c95a24ddf945\978.#.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\905c0769f9a06c95a24ddf945\805.#.exe
        
        C:\905c0769f9a06c95a24ddf945\805.#.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:4560
        
        C:\905c0769f9a06c95a24ddf945\998.#.exe
        
        C:\905c0769f9a06c95a24ddf945\998.#.exe
        10⤵
        
        PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 4.4MB
SHA256 171f1b7c9d62c43f7bb44086424f5305c138b3eb0b38ec4ab3e4e6abd2efdf46
MD5 abc1ffca55190104b832bde709b8cb22
SHA1 8818ec46d0be6d62420848b0cf2c17c9cd53737e
SHA512 ca9b25da60a0b8fe6bf6675cb414b4e1d95f5f6d76ac05a33d4e7dd86ba2b13af1ea1d5d2d37d370a7b23ee460ab7459c2ba89cd2b7b8bcbc544901b4cfcf3c1
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mqN:TID41qW1PszV+tA5mkfkZc
TLSH
T17C266B16F7A88272E0739175C5A7A6A6FE7234111B3086CF1344A77C2F337D19A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE$

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$
Size 4.6MB
SHA256 df6734367299696428fca1a1d9ff76476e51674a730f09421a0a27955b00c3f9
MD5 5dd00258d15a2f1009c715346990f9cc
SHA1 58610ac132e880e5aed654e24fe2abf86d0b8dc1
SHA512 eca151bef98a3ce470d8c63bde1c3b0b9da6c5c79ceef8e02628c5e823cc5ce57da8dd3f13d5232a16502e47e08798a7ac6cc9391f2835eed553698dd2d012cf
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mqS:TID41qW1PszV+tA5mkfkZcAx
TLSH
T1CF266B16B7A88272E0739175C5A7A6A6FE7234111B3086CF1344D73D2F337D1AA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe$

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$
Size 4.5MB
SHA256 9f85ca90e1ed2fa5cdfd6b7f93c7cd7567a70ccf592ed9230aeba95bf5809176
MD5 2d55c1230738defc75ef5fcd0754c202
SHA1 10d9b5f2312e3a96ce831e8a6882b61fa2ee0ede
SHA512 ddcb9e6ae3447529f5376f5df9a175e22c7ac4db4c4fc79787b08b9f62043c13eb13d832fb3a5326900c4d04bb8af24c63f47a568cc22f645aceab0cf7c667a7
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mqT:TID41qW1PszV+tA5mkfkZct
TLSH
T120265A16F7A88262D0779175C6A796A6BE7334111B3086CF1384E73C2F337D19A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$
Size 4.4MB
SHA256 beb4fbdc87f2cdc823a4d3c6e0d733669c8fa1f90bf6314695bb6e76affba226
MD5 a6a731741925d9418b3a363992cf6249
SHA1 83b1069b04e83b14849569f949ab06ec0d010185
SHA512 4b03770a16366701411c881b32977e461f1db92a841d29d653b461b439a917aa5ff4c451cd265e884d021ca76fd6a65f86a0bc6dc13337562f0ea1f31e04a1b6
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mqz:TID41qW1PszV+tA5mkfkZcJ
TLSH
T142266B16F7A88272E0739175C5A7A6A6FE7234111B3086CF1344A77C2F337D19A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXCEL.EXE$

Path C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$
Size 4.6MB
SHA256 55812471ad2c0717d752c13a0aef8175aa328fc9490eb25ad122146609c47eab
MD5 09a9587e3c5477d6abc17cadc8400fc5
SHA1 09472026edc888faf9e5699efe2a66b4c9549a15
SHA512 c3329a4930a8847efedf11fc8cc83b9688dd487fa8c57b938c6296f40e1e18ac4d21c37d39895bda48db524a00c7e7ee939eafe6cf10aeded13909d7e01099af
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mqZ:TID41qW1PszV+tA5mkfkZciTQ
TLSH
T172266B16B7A88272E0739175C5A7A6A6FE7234111B3086CF1344D73D2F337D1AA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelperBgt.exe$

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$
Size 4.4MB
SHA256 3aa26ee2d168a18a73cf838086eb6660b9425e1a5116399756b1b195cf02363e
MD5 cddc95dac41f7599e78fbd8bfa5233ef
SHA1 6050074c5495bff5cadbb478a50885df6672cc3d
SHA512 55567b1f5741efd0f3dad2879d580a740fc5002a9d1ed4f235d2bd5c44e209f6bcb192029ec7104d0ad552a1627c2c502e0643933ab0934cacd3c970621246c8
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mqB:TID41qW1PszV+tA5mkfkZcj
TLSH
T103266B16F7A88272E0739175C5A7A6A6FE7234111B3086CF1344A77C2F337D19A3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osmclienticon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe
Size 4.4MB
SHA256 3685bc72389a58a63923640374082a37003bb897f299381b4aba9cfa46ff89bf
MD5 fc7e20eeaa30616fdb1bf754ffa9df16
SHA1 2c815ae0d02b65e84a58699ef537fdff71ebb5f1
SHA512 887dd5efd03cbdb9abbea2a995f18d1d151b455688816851b5b6ae7d4aac61ab0a1e566ed5dc9774f8c6d43d7c440a65d4a481aa2ea3d8dc2c970266bd2a57df
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglBW1PszNsQ9qatglly6i1zuajsauZnJPY5mqE:TID41qW1PszV+tA5mkfkZc6
TLSH
T101267C16F7A88272D0739175C5A79696FE7274111B3086CF1348973C2F33BE1AA3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads