Analysis
- max time kernel
114s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 12:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_55cbea40fc82217155fe4c15d533832c_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_55cbea40fc82217155fe4c15d533832c_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-22_55cbea40fc82217155fe4c15d533832c_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
- Size 3.9MB
- Sample261024-p3nqpsvsat
- SHA256 d0ca912003709c38a954a4bf546c86292403c465c803d5806fc76d8d5641ae87
- MD5 55cbea40fc82217155fe4c15d533832c
- SHA1 803cbc71eea9299c49ffcfb4208ad4082b50dc51
- SHA512 fa78d563da4a70efb76b79dacd5d329e727db9d017e716e1c4bc9651ee9ccb5934b7c40053df0ddb13ef5235fcf9ed9e5ec06d4793a5d29a3ba9da7bb761f08f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYq:TID41vd5/fkZcf6
- TLSH T1F5166C15B7F88A62E0B39175C9A29696FE7238510B30C7CF1285936C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 12 IoCs
pid Process 1992 patcher.exe 4376 692.#.exe 5476 267.#.exe 3848 739.#.exe 5112 167.#.exe 5740 669.#.exe 708 283.#.exe 4312 616.#.exe 3168 656.#.exe 200 359.#.exe 3428 241.#.exe 2832 650.#.exe - Adds Run key to start application 2 TTPs 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-22_55cbea40fc82217155fe4c15d533832c_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 267.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 283.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 656.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 359.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 241.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 650.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 692.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 739.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 167.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 669.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 616.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ 167.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ 267.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\ 2026-10-22_55cbea40fc82217155fe4c15d533832c_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\ 267.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\as-IN\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\ 2026-10-22_55cbea40fc82217155fe4c15d533832c_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\ 739.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 267.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ 616.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\ 267.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.AdomdClient\ 283.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ko-KR\ 692.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\management\ 167.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SAMPLES\ 669.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ur-PK\ 739.#.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 267.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Stationery\ 267.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ 692.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\ 616.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\he-IL\ 241.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\ 167.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 267.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLSTART\ 167.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\ 2026-10-22_55cbea40fc82217155fe4c15d533832c_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ 167.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 267.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\ 669.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\ 692.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\ 167.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\ 283.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\ 283.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 267.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\ 283.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\ 167.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\ 616.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ 359.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\130\ 2026-10-22_55cbea40fc82217155fe4c15d533832c_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\ 616.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ 692.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 267.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\ 167.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ 669.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\ 241.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ga-IE\ 241.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\ 167.#.exe File opened for modification C:\Program Files\Common Files\System\en-US\ 692.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\ 616.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\ 616.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\SystemX86\ 283.#.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\ 267.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\ 2026-10-22_55cbea40fc82217155fe4c15d533832c_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\ 616.#.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\ 739.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\ 283.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\ 616.#.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 267.#.exe File opened for modification C:\Windows\:\systemlog.bak 669.#.exe File opened for modification C:\Windows\:\systemlog.bak 359.#.exe File opened for modification C:\Windows\:\systemlog.bak 241.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 167.#.exe File opened for modification C:\Windows\:\systemlog.bak 283.#.exe File opened for modification C:\Windows\:\systemlog.bak 616.#.exe File opened for modification C:\Windows\:\systemlog.bak 650.#.exe - System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 650.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_55cbea40fc82217155fe4c15d533832c_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 267.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 739.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 167.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 283.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 656.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 359.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 692.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 669.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 616.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 241.#.exe - NTFS ADS 13 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-10-22_55cbea40fc82217155fe4c15d533832c_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe File opened for modification C:\Windows\:\systemlog.bak 267.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 739.#.exe File opened for modification C:\Windows\:\systemlog.bak 669.#.exe File opened for modification C:\Windows\:\systemlog.bak 616.#.exe File opened for modification C:\Windows\:\systemlog.bak 359.#.exe File opened for modification C:\Windows\:\systemlog.bak 241.#.exe File opened for modification C:\Windows\:\systemlog.bak 650.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 692.#.exe File opened for modification C:\Windows\:\systemlog.bak 167.#.exe File opened for modification C:\Windows\:\systemlog.bak 283.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 656.#.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4464 2026-10-22_55cbea40fc82217155fe4c15d533832c_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe 1992 patcher.exe 4376 692.#.exe 5476 267.#.exe 3848 739.#.exe 5112 167.#.exe 5740 669.#.exe 708 283.#.exe 4312 616.#.exe 3168 656.#.exe 200 359.#.exe 3428 241.#.exe 2832 650.#.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4464 wrote to memory of 4376 4464 2026-10-22_55cbea40fc82217155fe4c15d533832c_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe 91 PID 1992 wrote to memory of 5476 1992 patcher.exe 92 PID 4376 wrote to memory of 3848 4376 692.#.exe 93 PID 5476 wrote to memory of 5112 5476 267.#.exe 94 PID 5112 wrote to memory of 5740 5112 167.#.exe 95 PID 5740 wrote to memory of 708 5740 669.#.exe 97 PID 708 wrote to memory of 4312 708 283.#.exe 98 PID 3848 wrote to memory of 3168 3848 739.#.exe 99 PID 4312 wrote to memory of 200 4312 616.#.exe 100 PID 200 wrote to memory of 3428 200 359.#.exe 101 PID 3428 wrote to memory of 2832 3428 241.#.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_55cbea40fc82217155fe4c15d533832c_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_55cbea40fc82217155fe4c15d533832c_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\692.#.exeC:\Users\Admin\AppData\Local\Temp\692.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\739.#.exeC:\Users\Admin\AppData\Local\Temp\739.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\656.#.exeC:\Users\Admin\AppData\Local\Temp\656.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\9.#.exeC:\Users\Admin\AppData\Local\Temp\9.#.exe5⤵PID:4556
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\905c0769f9a06c95a24ddf945\267.#.exeC:\905c0769f9a06c95a24ddf945\267.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\905c0769f9a06c95a24ddf945\167.#.exeC:\905c0769f9a06c95a24ddf945\167.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\905c0769f9a06c95a24ddf945\669.#.exeC:\905c0769f9a06c95a24ddf945\669.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\905c0769f9a06c95a24ddf945\283.#.exeC:\905c0769f9a06c95a24ddf945\283.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708 -
C:\905c0769f9a06c95a24ddf945\616.#.exeC:\905c0769f9a06c95a24ddf945\616.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\905c0769f9a06c95a24ddf945\359.#.exeC:\905c0769f9a06c95a24ddf945\359.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:200 -
C:\905c0769f9a06c95a24ddf945\241.#.exeC:\905c0769f9a06c95a24ddf945\241.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\905c0769f9a06c95a24ddf945\650.#.exeC:\905c0769f9a06c95a24ddf945\650.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2832 -
C:\905c0769f9a06c95a24ddf945\691.#.exeC:\905c0769f9a06c95a24ddf945\691.#.exe10⤵PID:3036
-
C:\905c0769f9a06c95a24ddf945\495.#.exeC:\905c0769f9a06c95a24ddf945\495.#.exe11⤵PID:1340
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.9MB
- SHA256 d0ca912003709c38a954a4bf546c86292403c465c803d5806fc76d8d5641ae87
- MD5 55cbea40fc82217155fe4c15d533832c
- SHA1 803cbc71eea9299c49ffcfb4208ad4082b50dc51
- SHA512 fa78d563da4a70efb76b79dacd5d329e727db9d017e716e1c4bc9651ee9ccb5934b7c40053df0ddb13ef5235fcf9ed9e5ec06d4793a5d29a3ba9da7bb761f08f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYq:TID41vd5/fkZcf6
- TLSH T1F5166C15B7F88A62E0B39175C9A29696FE7238510B30C7CF1285936C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
- Size 3.9MB
- SHA256 1d4f097325eb53f3acf307084b230da3f176fab228e172d36daf00d55c74c291
- MD5 7bcd0f45dad11d2ef52956accdfe570e
- SHA1 0c7e58c212398cafc5199621cb78e15c8b19f212
- SHA512 b82711b67e46dfb75aeb0f5007d6a92ae74921b079753a1b8daeebb273528e6f162a80adbbe70bd827ed4a7cd82b0f8eeadb06f5176fd4d5f125ad718b806245
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYq9:TID41vd5/fkZcf6+
- TLSH T113166B15B7F88A62E0B39175C9A29696FE7238510B30C7CF1285936C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$
- Size 4.0MB
- SHA256 d1b0ef3b012366eb668297f65ea89df87a6607b375befaa934f02513eded0faa
- MD5 ecb8dd9dae392f2132c9db1cd7ad606d
- SHA1 43066a25fc29ee301a1b6012df436bb5100b97cd
- SHA512 185f5f56a2786cf287e85643399eda68434fc3d9e25cc345bc62e9f7c6ec3e35464ac656f71bf2e906a476f050b09b4fd2c814fa9b7429ee5feb38427b8b8821
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqS:TID41vd5/fkZcf6x
- TLSH T1B5166B15B7F88A62E0B39175C9A29696EE7238510B30C7CF1385936D2E337D1DA36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$
- Size 3.9MB
- SHA256 63739c1c92af08e2b940a958b4db63896c21fa7d34da4845307dd924b4876d41
- MD5 ee61c459f07589682653fde20da2f45a
- SHA1 3562bdc267164459043aab097b525ce64bdd017e
- SHA512 aeb162a257113fbdfcf6607a750990a969b0ca5cb1c69a4915613d1a4f57bf0bb6db4cdef3f0270c17cf31f63879c26812074d53231cf110dd0517667908ef98
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5vVwqXiw2+eW4SkZP4sz9MbfpYqu:TID41vd5/fkZcf6h
- TLSH T159166B15B7F88A62E0B39175C9A29696FE7238510B30C7CF1285936C2E337D1DA36772
- MD5 SHA1 SHA512 SSDEEP TLSH