8f12563d53db00ca819dc05173b70c071c11a971c997645a8dabb5c783de2f2c

Analysis

max time kernel
63s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Size 2.4MB
Sample261024-yahtesdx4k
SHA256 8f12563d53db00ca819dc05173b70c071c11a971c997645a8dabb5c783de2f2c
MD5 1fffed70421c1a6c20dbcab301e4a702
SHA1 c47f31e1f6b39e192e531c29034a43adaf0558e5
SHA512 be6a8edd400e65dea2ed59dd65342fdd648c2d2395a73b8a79debbf468ec07c1d5c6f072cf753b7790f9ea7fd37381d731ba380735f358e512c69f98e26b3acb
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5/Y5fqatglZVtDtL:TID41vd5g5r+V
TLSH
T172B56B49B7D555A2E5634231886782A26F727C201F2193DF2390B23D5F337D0FA3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 14 IoCs

pid	Process
1496	patcher.exe
4176	655.#.exe
5400	358.#.exe
2424	934.#.exe
1804	138.#.exe
440	307.#.exe
2968	447.#.exe
5156	49.#.exe
5216	441.#.exe
6072	855.#.exe
1460	688.#.exe
4496	433.#.exe
5444	672.#.exe
4536	989.#.exe

Adds Run key to start application 2 TTPs 15 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	447.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	441.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	433.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	307.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	655.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	49.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	688.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	672.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	989.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	358.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	934.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	138.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	855.#.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	patcher.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	358.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	138.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	447.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	441.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	688.#.exe
File opened for modification	C:\Windows\SysWOW64\:\systemlog.bak	672.#.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\System\ado\it-IT\	358.#.exe
File opened for modification	C:\Program Files\Crashpad\	138.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	934.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\	934.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\	655.#.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\	358.#.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\es-ES\	447.#.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\7.0.16\	138.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\	358.#.exe
File opened for modification	C:\Program Files\edge_BITS_4252_1564470756\	934.#.exe
File opened for modification	C:\Program Files\edge_BITS_4332_1025103648\	307.#.exe
File opened for modification	C:\Program Files\7-Zip\	655.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\	934.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\	934.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\	49.#.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\	358.#.exe
File opened for modification	C:\Program Files\Common Files\System\	2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\dotnet\host\	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\	358.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\	2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\	138.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\	138.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\	441.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Triedit\en-US\	441.#.exe
File opened for modification	C:\Program Files\Common Files\System\fr-FR\	2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\	655.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\	447.#.exe
File opened for modification	C:\Program Files\edge_BITS_4332_1025103648\	934.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\	934.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\da-DK\	447.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\	2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\	441.#.exe
File opened for modification	C:\Program Files\Common Files\System\ado\ja-JP\	447.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\	934.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\	49.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\	447.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\	655.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\	2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\	307.#.exe
File opened for modification	C:\Program Files\dotnet\swidtag\	655.#.exe
File opened for modification	C:\Program Files\Common Files\System\fr-FR\	49.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\el-GR\	2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\	655.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\	307.#.exe
File opened for modification	C:\Program Files\Common Files\System\ado\fr-FR\	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\	655.#.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\	138.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	138.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Triedit\	934.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\	49.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\	655.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\	358.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\	2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\	49.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	358.#.exe
File opened for modification	C:\Program Files\Common Files\System\en-US\	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\	138.#.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\	447.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\	2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\	447.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\	358.#.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	655.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	934.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	441.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	433.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	138.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	358.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	989.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	307.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	447.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	855.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	688.#.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	672.#.exe

NTFS ADS 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	655.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	934.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	307.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	49.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	855.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	433.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak	989.#.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
3252	2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
1496	patcher.exe
4176	655.#.exe
5400	358.#.exe
2424	934.#.exe
1804	138.#.exe
440	307.#.exe
2968	447.#.exe
5156	49.#.exe
5216	441.#.exe
6072	855.#.exe
1460	688.#.exe
4496	433.#.exe
5444	672.#.exe
4536	989.#.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 4176	3252	2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe	91
PID 1496 wrote to memory of 5400	1496	patcher.exe	92
PID 4176 wrote to memory of 2424	4176	655.#.exe	93
PID 5400 wrote to memory of 1804	5400	358.#.exe	94
PID 2424 wrote to memory of 440	2424	934.#.exe	95
PID 1804 wrote to memory of 2968	1804	138.#.exe	96
PID 440 wrote to memory of 5156	440	307.#.exe	97
PID 2968 wrote to memory of 5216	2968	447.#.exe	98
PID 5156 wrote to memory of 6072	5156	49.#.exe	103
PID 5216 wrote to memory of 1460	5216	441.#.exe	104
PID 6072 wrote to memory of 4496	6072	855.#.exe	106
PID 1460 wrote to memory of 5444	1460	688.#.exe	108
PID 4496 wrote to memory of 4536	4496	433.#.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Users\Admin\AppData\Local\Temp\655.#.exe
  C:\Users\Admin\AppData\Local\Temp\655.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Users\Admin\AppData\Local\Temp\934.#.exe
    C:\Users\Admin\AppData\Local\Temp\934.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\307.#.exe
      C:\Users\Admin\AppData\Local\Temp\307.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      NTFS ADS
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:440
    - - C:\Users\Admin\AppData\Local\Temp\49.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\49.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\855.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\855.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\433.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\433.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\989.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\989.#.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        NTFS ADS
        Suspicious use of SetWindowsHookEx
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\82.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\82.#.exe
        9⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\607.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\607.#.exe
        10⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\404.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\404.#.exe
        11⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\871.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\871.#.exe
        12⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\924.#.exe
        
        C:\Users\Admin\AppData\Local\Temp\924.#.exe
        13⤵
        
        PID:3156

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496
- C:\905c0769f9a06c95a24ddf945\358.#.exe
  C:\905c0769f9a06c95a24ddf945\358.#.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5400
- - C:\905c0769f9a06c95a24ddf945\138.#.exe
    C:\905c0769f9a06c95a24ddf945\138.#.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\905c0769f9a06c95a24ddf945\447.#.exe
      C:\905c0769f9a06c95a24ddf945\447.#.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\905c0769f9a06c95a24ddf945\441.#.exe
        
        C:\905c0769f9a06c95a24ddf945\441.#.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5216
      - C:\905c0769f9a06c95a24ddf945\688.#.exe
        
        C:\905c0769f9a06c95a24ddf945\688.#.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\905c0769f9a06c95a24ddf945\672.#.exe
        
        C:\905c0769f9a06c95a24ddf945\672.#.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5444
        
        C:\905c0769f9a06c95a24ddf945\781.#.exe
        
        C:\905c0769f9a06c95a24ddf945\781.#.exe
        8⤵
        
        PID:1120
        
        C:\905c0769f9a06c95a24ddf945\705.#.exe
        
        C:\905c0769f9a06c95a24ddf945\705.#.exe
        9⤵
        
        PID:2508
        
        C:\905c0769f9a06c95a24ddf945\696.#.exe
        
        C:\905c0769f9a06c95a24ddf945\696.#.exe
        10⤵
        
        PID:5692
        
        C:\905c0769f9a06c95a24ddf945\400.#.exe
        
        C:\905c0769f9a06c95a24ddf945\400.#.exe
        11⤵
        
        PID:4324
        
        C:\905c0769f9a06c95a24ddf945\737.#.exe
        
        C:\905c0769f9a06c95a24ddf945\737.#.exe
        12⤵
        
        PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 2.4MB
SHA256 8f12563d53db00ca819dc05173b70c071c11a971c997645a8dabb5c783de2f2c
MD5 1fffed70421c1a6c20dbcab301e4a702
SHA1 c47f31e1f6b39e192e531c29034a43adaf0558e5
SHA512 be6a8edd400e65dea2ed59dd65342fdd648c2d2395a73b8a79debbf468ec07c1d5c6f072cf753b7790f9ea7fd37381d731ba380735f358e512c69f98e26b3acb
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5/Y5fqatglZVtDtL:TID41vd5g5r+V
TLSH
T172B56B49B7D555A2E5634231886782A26F727C201F2193DF2390B23D5F337D0FA3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe$

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$
Size 2.4MB
SHA256 e14273de46251ab4bb24f620740b6b2538d93333643ca08cf42ce40cd3a1a243
MD5 c98d2360b4e7df43e5b7ce60d63e681d
SHA1 fc57891593fc66789638718caad1fd17594ce7ce
SHA512 f10de0fdcc9444e56b020db2fb0218477268d6b3feb98c84795ea9dca0b1e8388b15d72bf84dccad4c860e86d0b2e1f92939ea0b949fd6e0718ff367ae68a992
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5/Y5fqatglZVtDtLF:TID41vd5g5r+VF
TLSH
T11DB56B49B7D555A2E5634231886782A26F727C201F2193DF2390B23D5F337D0FA3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 2.4MB
SHA256 91834f0680377b463743f81da4fc5e0b3c602a147792059e406e5eb026125244
MD5 bbcea0f35defa9eb7bd783cfdaf0006f
SHA1 b115aeafd5bb4f06e60f2644c61110e7d1a5c08d
SHA512 04747b24748dec9c17f887a2b73e10907c2dc2482acd104656f8dbb4328645572555d5d670ee10830437c15a978586607dee7e08a2f3a67ddea6b32256b4d222
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5/Y5fqatglZVtDtLo:TID41vd5g5r+Vo
TLSH
T1A8B56B49B7D555A2E5634231886782A26F727C201F2193DF2390B23D5F337D0FA3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 2.4MB
SHA256 04c93708cf5a7820eae28fa61950d751ea01155dc0df74990b894adef8c21358
MD5 a62d6bad92605dce1d9585cc0833f367
SHA1 ad54ae40565ea0760216fb76c7eab0779df402d2
SHA512 344cdecc985e9d393a10d8048a511c79160c0018318e3edd8cf0618e09fc8453fdbae072ad2a221cb63c26149aa86ee6b3547f8f162f916b80a851b96c5a030a
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5/Y5fqatglZVtDtLg:TID41vd5g5r+Vg
TLSH
T1CDB56B49B7D555A2E5634231886782A26F727C201F2193DF2390B23D5F337D0FA3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe$

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe$
Size 2.8MB
SHA256 2abf1cc24cbba78be9ccff1e08e192456f8eafb39c9158776f74ecfea524d0b2
MD5 6233ecad06e5e0526228813172d69bde
SHA1 a67b1fa1fdde4551c98d5cb5398833168a6e4b71
SHA512 72bc0be206d455e8d2551d1190b6eaa2e007e63aaaebbd83a413bacaa18881b428c44fd26f4d95bc0a85ae7afba661efb0e00c9ee922e05b8e87529b74615680
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5/Y5fqatglZVtDtLLTd9CHKya6:TID41vd5g5r+VPCq6
TLSH
T140D56C59B7D555A2E573423188678292AE727C211F21D3DF2390B23D1F337D0EA3AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe$

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe$
Size 3.2MB
SHA256 3bf5adf8304d51b53d821a818afa717b0076a5fcb8b12640ebe5a176c7ef6576
MD5 e28d664e5c7887cce7a2e2884f047357
SHA1 908e5801c5a922a17489d57fc5d29c011f915c6e
SHA512 fe6ef774e9fa9599fe7a75f2a8581974d36f2be16a3f3915b138e92221cb5abd92b24ba97f2837136a3d8adc759059caa800a7bf01a8c494927d4715b4876381
SSDEEP 98304:TID41vd5g5r+VMMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVW:TuId5g5iVC
TLSH
T10AE57D49B7D595A2E5774231882782A26F72BC211F21939F2394B73D5F333C0BA36B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$
Size 2.4MB
SHA256 a176367fb2ee3ed6fc5e16ffc5d143b822dba35e869d9743c541fa5932c6fcd3
MD5 a85c83bb022d7c3fa8d8b01a58063286
SHA1 da5cb6e09b704bb3a8c0682a469c7d8ea8ec4dba
SHA512 26870d4024030f734b51499af643998499da824a57b52feb82b6abda18f055f486d2761829b494deba1c64a7163d1646a1c397c90a04d53383ed8887623a43b3
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5/Y5fqatglZVtDtLm:TID41vd5g5r+Vm
TLSH
T13EB56B49B7D555A2E5634231886782A26F727C201F2193DF2390B23D5F337D0FA3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
Size 2.4MB
SHA256 d51e3093a84d1bd653a68e82ce40872ca4fcfb2a5dd78b5c9b0368999a5b55eb
MD5 31f5dcd9c757d875b4e0ff4d8c9a8f97
SHA1 105207e831ccd7ad24277edfcc72e0e3c4e6ba36
SHA512 236929acdbf36e09430d2fe0e3b4836bc4d9048ffbd5d88f6d4052c28ff23900670c751373344d8f5965b72d1b9d04a52d8c2b6de63afd5895ff1fa3c6b5d244
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5/Y5fqatglZVtDtLe/:TID41vd5g5r+Ve/
TLSH
T1CFB56B49B7D555A2E5634231886782A26F727C201F2193DF2390B23D5F337D0FA3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe$

Path C:\Program Files\Java\jre-1.8\bin\pack200.exe$
Size 2.5MB
SHA256 74ce123e65a9eb6e739275c3d209b7209474c6b1125ce7c7280b011297d0ca03
MD5 241a8b058f635957299d644c55ba46a6
SHA1 8311b02020f5631656c395ddb6bcc1a1bfabacea
SHA512 122d6daf23dbf29ce626ca11d03bddcb1f6e0ffb42c6e5cbc6b2e6680b679c33e0b9de4a8f4e0a4e1641b2d113514ee247ec90e0d01e5d711ad3cd858100f490
SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5/Y5fqatglZVtDtL4:TID41vd5g5r+V4
TLSH
T14CC55A4977D555A2E5734231886682A2AF727C201F2193DF2390B23D5F337D0FA3AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads