Analysis
- max time kernel
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
- Size 3.9MB
- Sample261024-gwalhags4x
- SHA256 bf3404c9f9fd960cecafc6a7608c0d26285955c50ad6eb0b950266d4fd32f050
- MD5 85a9e444ec75f8c2a39f4f108e801355
- SHA1 a6d0242ca851d2ab966ad210a143032b859fb5e9
- SHA512 5bdaaaef5526b9b2373c9f62e0584518b0b1842c17e3d2556b5d09842e6dac5563a614b51f0370b3a804ac3bc8974244f71ccd6f063212534dac80cf8cdff593
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqm2bgG:TID41vd5/fkZcf6e
- TLSH T1B3166B15B7F88A62E0B39175C9A29696FE7238510B30C7CF1285936C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 13 IoCs
pid Process 4184 patcher.exe 4136 195.#.exe 2276 96.#.exe 2072 175.#.exe 3180 132.#.exe 4140 65.#.exe 1828 877.#.exe 4728 354.#.exe 3728 736.#.exe 3740 280.#.exe 1764 687.#.exe 4616 616.#.exe 3176 985.#.exe - Adds Run key to start application 2 TTPs 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 280.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 616.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 195.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 96.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 175.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 65.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 877.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 687.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 132.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 354.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 736.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ 132.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\ 2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 877.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\osfFPA\ 354.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ms-MY\ 96.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\ 132.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\ 175.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\ 280.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ta-IN\ 175.#.exe File opened for modification C:\Program Files\Common Files\System\es-ES\ 175.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 96.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1036\ 96.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 132.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\ 2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 132.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mk-MK\ 687.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\quz-PE\ 96.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nn-NO\ 65.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 132.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ 354.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\ 96.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\ 132.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 132.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\ 354.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\osfFPA\ 96.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\ 65.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\ 195.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 132.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\el-GR\ 175.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\ 175.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 132.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 65.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lt-LT\ 687.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ 96.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\ patcher.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\ 354.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office15\ 877.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\osfFPA\ 195.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\ 2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\host\fxr\8.0.15\ 65.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\ 96.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ga-IE\ 132.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\te-IN\ 65.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 132.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 96.#.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 877.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\ 280.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lt-LT\ 2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ 2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ar-SA\ 280.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\ 195.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\ 280.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\id-ID\ 2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ 65.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hi-IN\ 195.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 96.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ 132.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\ 877.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\ 354.#.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 65.#.exe File opened for modification C:\Windows\:\systemlog.bak 877.#.exe File opened for modification C:\Windows\:\systemlog.bak 280.#.exe File opened for modification C:\Windows\:\systemlog.bak 687.#.exe File opened for modification C:\Windows\:\systemlog.bak 616.#.exe File opened for modification C:\Windows\:\systemlog.bak 96.#.exe File opened for modification C:\Windows\:\systemlog.bak 354.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 132.#.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 616.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 985.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 132.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 877.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 736.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 280.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 687.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 195.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 175.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 354.#.exe - NTFS ADS 13 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 687.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 195.#.exe File opened for modification C:\Windows\:\systemlog.bak 96.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 175.#.exe File opened for modification C:\Windows\:\systemlog.bak 132.#.exe File opened for modification C:\Windows\:\systemlog.bak 616.#.exe File opened for modification C:\Windows\:\systemlog.bak 65.#.exe File opened for modification C:\Windows\:\systemlog.bak 877.#.exe File opened for modification C:\Windows\:\systemlog.bak 354.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 736.#.exe File opened for modification C:\Windows\:\systemlog.bak 280.#.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2136 2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe 4184 patcher.exe 4136 195.#.exe 2276 96.#.exe 2072 175.#.exe 3180 132.#.exe 4140 65.#.exe 1828 877.#.exe 4728 354.#.exe 3728 736.#.exe 3740 280.#.exe 1764 687.#.exe 4616 616.#.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2136 wrote to memory of 4136 2136 2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe 91 PID 4184 wrote to memory of 2276 4184 patcher.exe 92 PID 4136 wrote to memory of 2072 4136 195.#.exe 93 PID 2276 wrote to memory of 3180 2276 96.#.exe 94 PID 3180 wrote to memory of 4140 3180 132.#.exe 95 PID 4140 wrote to memory of 1828 4140 65.#.exe 96 PID 1828 wrote to memory of 4728 1828 877.#.exe 97 PID 2072 wrote to memory of 3728 2072 175.#.exe 98 PID 4728 wrote to memory of 3740 4728 354.#.exe 99 PID 3740 wrote to memory of 1764 3740 280.#.exe 100 PID 1764 wrote to memory of 4616 1764 687.#.exe 101 PID 4616 wrote to memory of 3176 4616 616.#.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_85a9e444ec75f8c2a39f4f108e801355_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\195.#.exeC:\Users\Admin\AppData\Local\Temp\195.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\175.#.exeC:\Users\Admin\AppData\Local\Temp\175.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\736.#.exeC:\Users\Admin\AppData\Local\Temp\736.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\381.#.exeC:\Users\Admin\AppData\Local\Temp\381.#.exe5⤵PID:2968
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\905c0769f9a06c95a24ddf945\96.#.exeC:\905c0769f9a06c95a24ddf945\96.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\905c0769f9a06c95a24ddf945\132.#.exeC:\905c0769f9a06c95a24ddf945\132.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\905c0769f9a06c95a24ddf945\65.#.exeC:\905c0769f9a06c95a24ddf945\65.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\905c0769f9a06c95a24ddf945\877.#.exeC:\905c0769f9a06c95a24ddf945\877.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\905c0769f9a06c95a24ddf945\354.#.exeC:\905c0769f9a06c95a24ddf945\354.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\905c0769f9a06c95a24ddf945\280.#.exeC:\905c0769f9a06c95a24ddf945\280.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\905c0769f9a06c95a24ddf945\687.#.exeC:\905c0769f9a06c95a24ddf945\687.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\905c0769f9a06c95a24ddf945\616.#.exeC:\905c0769f9a06c95a24ddf945\616.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\905c0769f9a06c95a24ddf945\985.#.exeC:\905c0769f9a06c95a24ddf945\985.#.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3176 -
C:\905c0769f9a06c95a24ddf945\831.#.exeC:\905c0769f9a06c95a24ddf945\831.#.exe11⤵PID:3132
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.9MB
- SHA256 bf3404c9f9fd960cecafc6a7608c0d26285955c50ad6eb0b950266d4fd32f050
- MD5 85a9e444ec75f8c2a39f4f108e801355
- SHA1 a6d0242ca851d2ab966ad210a143032b859fb5e9
- SHA512 5bdaaaef5526b9b2373c9f62e0584518b0b1842c17e3d2556b5d09842e6dac5563a614b51f0370b3a804ac3bc8974244f71ccd6f063212534dac80cf8cdff593
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqm2bgG:TID41vd5/fkZcf6e
- TLSH T1B3166B15B7F88A62E0B39175C9A29696FE7238510B30C7CF1285936C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 4.0MB
- SHA256 ef7fabfe2f973de6bcfb63b9846fc357c58054110a3f813a5732c85cabf49aaf
- MD5 414d267093ec2fb03df2c30598772588
- SHA1 cbfe817fff26b7a5071a9dffddb66a6a6b970c39
- SHA512 9507c1cf5f07393694190c843a393111ded4dd4785baf6705a87dd1b83186b8f5bad57e05cf7f474ca4fe3990320ccd95004a71dcb0adc10ca4b76db9bea7cd8
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqm2bg7:TID41vd5/fkZcf6T
- TLSH T164163915F7F84A62E0B79175CAA29696BE7338510B3086CF1285D33D2F337D19A36722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$
- Size 4.0MB
- SHA256 99c5dbe09f5331cf051ed3b37c72dc70bd95da815e6b65ae60dfca1a834d0676
- MD5 9716860411a898e28d9b0547d8a10587
- SHA1 5857d78db2203661bffd96563eb9d99cef3d4b88
- SHA512 32c7c95e3686e3d360721b606911050ff62c839137e980599f4691929c32f30085624cc677a41a3ad9043399415cc56c58beb2dd12336e17a7e6c30f0b432363
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqm2bgw:TID41vd5/fkZcf6Y
- TLSH T1F9163915F7F84A62E0B79175CAA29696BE7338510B3086CF1285D33D2F337D19A36722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe$
- Size 3.9MB
- SHA256 886fd0c6e30383cb951a9a65669027e1287dff54232dca4e048a9e368238266a
- MD5 9673f49b0cca8c7e6680a8b948449a19
- SHA1 dac642ed56d164b6c1e39dab87b8279f87bd7035
- SHA512 7ba68d8db859d70f71bd5e0d1f9c248d48365b609ebea051bc98cb13622619497e05bad07179e896dac48d7283b1d17103d701172548c48305572e7f76e405a3
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqm2bgw:TID41vd5/fkZcf6o
- TLSH T164166B15B7F88A62E0B39175C9A29696FE7238510B30C7CF1285936C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe$
- Size 3.9MB
- SHA256 9214a4cf27ef95feacf028c91f2a5c0b4a8f468644f5cd29faad70d20234c9bc
- MD5 082d4506ce83865712f2b972f569f44f
- SHA1 0bd0ffbc66c01b3258674316551b97d59aa474a8
- SHA512 9fdff3d834ac02d2fe6d8435be9ad250559503bb26db756804010a414881f42cabaacbb33e59c375f75a1e0c270042e8bef424e8f3f411177bb2c994fc870ca9
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqm2bgs:TID41vd5/fkZcf60
- TLSH T129166B15B7F88A62E0B39175C9A29696FE7278510B30C7CF1285932C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$
- Size 3.9MB
- SHA256 f8f281f1ecfd105e24ff07145a63d527fcf53f71104b88d7547cdf55e4d67cc3
- MD5 58c469eb1e930c713c89b3dbad4570b8
- SHA1 89cfe94d591b6f5e62ccb1b05b05001e6e62ab94
- SHA512 bac07b13a2312f07f62c3dfb363fc43c2422de13cb6be59ae864952b84425490469b8daab85cc5d7a9f61e0b05ba6a2abb4c8f4a36e25dc52278770a862f322f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqm2bgT:TID41vd5/fkZcf6r
- TLSH T1BE166B15B7F88A62E0B39175C9A29696FE7278510B30C7CF1285932C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$
- Size 3.9MB
- SHA256 537c96ec522c175758d89c90c706f10ad50dd5ab116d863c2f5aabfca64ca5a6
- MD5 cc9fb7ea59e78a1f65167af6216ce87e
- SHA1 0d96b2996e85e74f6d7c06ccfe1a15d24a0b4433
- SHA512 401f658cebd64c377fa8f84e12a61fdb10b9fae81d2fcfdb7dab1dd453ce1c7ff80c900b8818a4676e38913a243022d3624b798f1c53330c0184553b1d5b5d8b
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqm2bgP:TID41vd5/fkZcf63
- TLSH T1B8166B15B7F88A62E0B39175C9A29696FE7238510B30C7CF1285936C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$
- Size 3.9MB
- SHA256 9f6b1467cdea8f0eeb250f107206d8bb340fd2abfe6c6416af51545a66578383
- MD5 73327a4592062560b4ef1c2f7b082233
- SHA1 f68f45ebaadeb0f33fd3cff5fb9474047b1f64f2
- SHA512 beb3566db8eb872cba48390ca0985b3a3dfb8eefb90e15003a6b006f5ff047dd36248684efc3ce25899dfef5ada27ca36df766da525638eea7731af6a17b3805
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqm2bg1:TID41vd5/fkZcf6t
- TLSH T114166B15B7F88A62E0B39175C9A29696FE7238510B30C7CF1285936C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$
- Size 3.9MB
- SHA256 7bfc22d316869042cf58b38f93256494ff316585ddda90024c41f3fa159ff06a
- MD5 b6083223bd7810a345a7ad4f71b97d9d
- SHA1 2790892f18175a55094a69b794d6293ef9455efd
- SHA512 92636447ddf12b12c9484654b4c96136157beee2f49cbfc56033beba6c3d516a0330fb6effd9ebebdc5c63534e55431ddab282bdd945d7f47e010c851d97434e
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqm2bgI:TID41vd5/fkZcf6Q
- TLSH T130166B15B7F88A62E0B39175C9A29696FE7238510B30C7CF1285936C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$
- Size 4.1MB
- SHA256 fb843df3d09ac442d3636e52c8e81d20264c34c355a094b4acde99ff982667d4
- MD5 6b42574c1c496e63da0d5d32acdae9ba
- SHA1 5a26f470e2e9c4b11f5b754daf7d43bfc82c3588
- SHA512 4e160f36a234e96444d04363a988c18221e69821a07770b7ecdc5059abcca290cab6d12958100bf1c4452e0ba2984bddf20b6455e1ab9468d2df57469bc8c32d
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqm2bgh0:TID41vd5/fkZcf6ZTQ
- TLSH T1DA166B15B7F88A62E0B39175C9A29696FE7278510B30C7CF1285932D2F337D19A36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$
- Size 4.1MB
- SHA256 cb90ecf8023f9d23a8f8df225787ec33574a2f20fe4451e86c6cbf5baa72337b
- MD5 560a22515f581e09c9ccd36134164922
- SHA1 a870ae14c563038dc1946c774c5cb489cf6d8d4c
- SHA512 fe4a95e96fd487ac83c0d39fcb6433c99d091deebde21e2a527c8d72a442225f1bddb835d3aa7dab0d0d1aeef9824aeb0720b36cf13659a293c2a93f7a89a6ce
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqm2bgU0:TID41vd5/fkZcf6cTQ
- TLSH T1CA166B15B7F88A62E0B39175C9A29696FE7278510B30C7CF1285932D2F337D19A36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$
- Size 4.7MB
- SHA256 df704cc744edb4a7618609a61deeb4a1313e3661ce78ee1894908cb475dcb2f6
- MD5 84bdad3ab96e22884abf559367a75474
- SHA1 831d879d4edb76f545be0b1c7c214d28881c9d31
- SHA512 b385ec69b8f63ead999367d08ec5ac05bfde7356a09da7a0cdffd52c6ab3e38d9adb9881b44bec82abbe42115d8b380222a026a211ae897424db2b8c29c14f45
- SSDEEP 98304:TID41vd5/fkZcf6uMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMM:TuId53Pf6B
- TLSH T1D8367D15B7F88A62E0B39175C9B29695AE727C510B30C7CF1285B32D2E337D19A36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$
- Size 4.5MB
- SHA256 1f1c35f6921ef3d4c86c2aec84bc551ad59c28377958ace64d59c62ccf4358c6
- MD5 16ca93455626ac6fc28d6a94cc5c9057
- SHA1 8da768cc10f11b9baefb980dff5f5a5e79c6e058
- SHA512 06cead5c0c7593e5ac6204b8f2717786480851f305956410f70af63d95694a64af1311c7364c0ae5ef4feeedfc4e130dd534f6b009cc86925c8b245a22dc209c
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqm2bgpW:TID41vd5/fkZcf6RxGX
- TLSH T133267C15B3F84662E0B38175C9A29696FE7278511B30C7CF1284E72D2F337D19A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe$
- Size 4.2MB
- SHA256 58c4387d4807ab912bd905579b45da4caf6edea8b553a0cc73f599cafbf2b079
- MD5 f64c07bf0affad90818cc3b99109c03e
- SHA1 31eb13d30554b68354b315a62658209cab280148
- SHA512 f1bcd4303cc2d9e40707f06b4b452129915eccde2d92ffccb3753d5b225dfcb6b65f72e77590ea778b1ae485c177b6b23ca5e083bbb454cb92bde5090cb6d46f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqm2bgS3:TID41vd5/fkZcf60
- TLSH T1C4166B15B7F88A62E0B39175C9A29696FE7278510B30C7CF1285932D2E337D19E36732
- MD5 SHA1 SHA512 SSDEEP TLSH