Analysis
- max time kernel
83s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 19:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 2.4MB
- Sample261024-yahtesdx4k
- SHA256 8f12563d53db00ca819dc05173b70c071c11a971c997645a8dabb5c783de2f2c
- MD5 1fffed70421c1a6c20dbcab301e4a702
- SHA1 c47f31e1f6b39e192e531c29034a43adaf0558e5
- SHA512 be6a8edd400e65dea2ed59dd65342fdd648c2d2395a73b8a79debbf468ec07c1d5c6f072cf753b7790f9ea7fd37381d731ba380735f358e512c69f98e26b3acb
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5/Y5fqatglZVtDtL:TID41vd5g5r+V
- TLSH T172B56B49B7D555A2E5634231886782A26F727C201F2193DF2390B23D5F337D0FA3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 15 IoCs
pid Process 3508 patcher.exe 3340 11.#.exe 2244 752.#.exe 3380 742.#.exe 2484 358.#.exe 5096 962.#.exe 1088 13.#.exe 4652 925.#.exe 6004 505.#.exe 5456 462.#.exe 3516 255.#.exe 5764 258.#.exe 3408 314.#.exe 3764 864.#.exe 3912 714.#.exe - Adds Run key to start application 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 314.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 11.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 358.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 962.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 462.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 255.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 864.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 13.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 505.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 714.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 752.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 742.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 925.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 258.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lb-LU\ 358.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\ 358.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VC\ 13.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ 742.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\ 925.#.exe File opened for modification C:\Program Files\7-Zip\Lang\ 11.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hu-HU\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\ 13.#.exe File opened for modification C:\Program Files\Internet Explorer\uk-UA\ 13.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\ 462.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\ 752.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ 962.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\ 505.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\ 742.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\ 462.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\gu-IN\ 258.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\ 752.#.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\ 11.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\ 742.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 752.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 505.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\ 358.#.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\ 11.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-RS\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-MX\ 462.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 358.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ 752.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 358.#.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\management\ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\ 925.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\af-ZA\ 752.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\gl-ES\ 13.#.exe File opened for modification C:\Program Files\dotnet\host\fxr\6.0.27\ 11.#.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Extensions\ 11.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\ 505.#.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\ 13.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 752.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\ 358.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\ 13.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ 462.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\ 752.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pa-IN\ 752.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ 925.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\ 2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\ 752.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\ 505.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 752.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ 11.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\ 925.#.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 752.#.exe File opened for modification C:\Program Files\Common Files\System\es-ES\ 962.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-BA\ 358.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\ 11.#.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\ 11.#.exe File opened for modification C:\Program Files\Microsoft Office\Office16\ 358.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\af-ZA\ 258.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tr-TR\ 752.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 752.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\am-ET\ 258.#.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 358.#.exe File opened for modification C:\Windows\:\systemlog.bak 13.#.exe File opened for modification C:\Windows\:\systemlog.bak 925.#.exe File opened for modification C:\Windows\:\systemlog.bak 462.#.exe File opened for modification C:\Windows\:\systemlog.bak 314.#.exe File opened for modification C:\Windows\:\systemlog.bak 864.#.exe File opened for modification C:\Windows\:\systemlog.bak 714.#.exe File opened for modification C:\Windows\:\systemlog.bak 752.#.exe File opened for modification C:\Windows\:\systemlog.bak 505.#.exe File opened for modification C:\Windows\:\systemlog.bak 258.#.exe - System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 752.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 962.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 925.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 714.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 742.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 255.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 864.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 505.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 462.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 358.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 314.#.exe - NTFS ADS 16 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 11.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 962.#.exe File opened for modification C:\Windows\:\systemlog.bak 505.#.exe File opened for modification C:\Windows\:\systemlog.bak 258.#.exe File opened for modification C:\Windows\:\systemlog.bak 714.#.exe File opened for modification C:\Windows\:\systemlog.bak 752.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 742.#.exe File opened for modification C:\Windows\:\systemlog.bak 13.#.exe File opened for modification C:\Windows\:\systemlog.bak 314.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File opened for modification C:\Windows\:\systemlog.bak 358.#.exe File opened for modification C:\Windows\:\systemlog.bak 925.#.exe File opened for modification C:\Windows\:\systemlog.bak 462.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 255.#.exe File opened for modification C:\Windows\:\systemlog.bak 864.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe - Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 3720 2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe 3508 patcher.exe 3340 11.#.exe 2244 752.#.exe 3380 742.#.exe 2484 358.#.exe 5096 962.#.exe 1088 13.#.exe 4652 925.#.exe 6004 505.#.exe 5456 462.#.exe 3516 255.#.exe 5764 258.#.exe 3408 314.#.exe 3764 864.#.exe 3912 714.#.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3720 wrote to memory of 3340 3720 2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe 91 PID 3508 wrote to memory of 2244 3508 patcher.exe 92 PID 3340 wrote to memory of 3380 3340 11.#.exe 93 PID 2244 wrote to memory of 2484 2244 752.#.exe 94 PID 3380 wrote to memory of 5096 3380 742.#.exe 95 PID 2484 wrote to memory of 1088 2484 358.#.exe 96 PID 1088 wrote to memory of 4652 1088 13.#.exe 97 PID 4652 wrote to memory of 6004 4652 925.#.exe 98 PID 6004 wrote to memory of 5456 6004 505.#.exe 100 PID 5096 wrote to memory of 3516 5096 962.#.exe 101 PID 5456 wrote to memory of 5764 5456 462.#.exe 102 PID 5764 wrote to memory of 3408 5764 258.#.exe 103 PID 3408 wrote to memory of 3764 3408 314.#.exe 104 PID 3764 wrote to memory of 3912 3764 864.#.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_1fffed70421c1a6c20dbcab301e4a702_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\11.#.exeC:\Users\Admin\AppData\Local\Temp\11.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\742.#.exeC:\Users\Admin\AppData\Local\Temp\742.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\962.#.exeC:\Users\Admin\AppData\Local\Temp\962.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\255.#.exeC:\Users\Admin\AppData\Local\Temp\255.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\950.#.exeC:\Users\Admin\AppData\Local\Temp\950.#.exe6⤵PID:1696
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\905c0769f9a06c95a24ddf945\752.#.exeC:\905c0769f9a06c95a24ddf945\752.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\905c0769f9a06c95a24ddf945\358.#.exeC:\905c0769f9a06c95a24ddf945\358.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\905c0769f9a06c95a24ddf945\13.#.exeC:\905c0769f9a06c95a24ddf945\13.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\905c0769f9a06c95a24ddf945\925.#.exeC:\905c0769f9a06c95a24ddf945\925.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\905c0769f9a06c95a24ddf945\505.#.exeC:\905c0769f9a06c95a24ddf945\505.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\905c0769f9a06c95a24ddf945\462.#.exeC:\905c0769f9a06c95a24ddf945\462.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\905c0769f9a06c95a24ddf945\258.#.exeC:\905c0769f9a06c95a24ddf945\258.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\905c0769f9a06c95a24ddf945\314.#.exeC:\905c0769f9a06c95a24ddf945\314.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\905c0769f9a06c95a24ddf945\864.#.exeC:\905c0769f9a06c95a24ddf945\864.#.exe10⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\905c0769f9a06c95a24ddf945\714.#.exeC:\905c0769f9a06c95a24ddf945\714.#.exe11⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3912 -
C:\905c0769f9a06c95a24ddf945\579.#.exeC:\905c0769f9a06c95a24ddf945\579.#.exe12⤵PID:5008
-
C:\905c0769f9a06c95a24ddf945\392.#.exeC:\905c0769f9a06c95a24ddf945\392.#.exe13⤵PID:3924
-
C:\905c0769f9a06c95a24ddf945\737.#.exeC:\905c0769f9a06c95a24ddf945\737.#.exe14⤵PID:3184
-
C:\905c0769f9a06c95a24ddf945\706.#.exeC:\905c0769f9a06c95a24ddf945\706.#.exe15⤵PID:2496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.4MB
- SHA256 8f12563d53db00ca819dc05173b70c071c11a971c997645a8dabb5c783de2f2c
- MD5 1fffed70421c1a6c20dbcab301e4a702
- SHA1 c47f31e1f6b39e192e531c29034a43adaf0558e5
- SHA512 be6a8edd400e65dea2ed59dd65342fdd648c2d2395a73b8a79debbf468ec07c1d5c6f072cf753b7790f9ea7fd37381d731ba380735f358e512c69f98e26b3acb
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5/Y5fqatglZVtDtL:TID41vd5g5r+V
- TLSH T172B56B49B7D555A2E5634231886782A26F727C201F2193DF2390B23D5F337D0FA3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$
- Size 2.4MB
- SHA256 332e62623131605d5e8ff0d6a686d57bb9272d9971eb4506f9a8b4ce2cb9e80e
- MD5 16d12f1412f2e075bc90a95ee0e7279a
- SHA1 fcdfbe1d0fa7196b3ea3a143b0521e82468dfc24
- SHA512 1480c27860f11c875758c1fe3a261dd22cf9e1c895ea21e77b2fe5b296727dc1fe4841c5571a4d14617676f75475ff2bb514db0c8dffd30c1bcecf4e68527d6f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5/Y5fqatglZVtDtLf:TID41vd5g5r+Vf
- TLSH T198B56B49B7D555A2E5634231886782A26F727C201F2193DF2390B23D5F337D0FA3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ktab.exe$
- Size 2.4MB
- SHA256 429255b27c441414bbea3f694a48f675aaa83f376d9a912ae402ca445fc96a85
- MD5 2252eb3c9fa5fbf51e5ef5a53113ba65
- SHA1 e57822581c14e024ab9abafb060cc9863878681f
- SHA512 1a768df2d5df44e02a3ff66055388113882ccd340f4575a178d7da97651ec90f043b26d4505dcbc201104b4276464e7158f46433d7058fcb85a7c9accab5ac92
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5/Y5fqatglZVtDtL3:TID41vd5g5r+V3
- TLSH T145B56B49B7D555A2E5634231886782A26F727C201F2193DF2390B23D5F337D0FA3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.4MB
- SHA256 4e8a9b644f53b8f36aa576b3146245f037348619cddb7de8a31188074db49372
- MD5 84d95526624bad472a856b76399668c8
- SHA1 7f4b119b259d285d33deeff3eb1dbabc1de31e3c
- SHA512 630a25f19a400a9d8b460f89baed1c7e39abe478e378cefaf7f5e82a47b5319eecc6a30b953340030831779e1df0627ec763ff1e5ce7b8f85d352a495a621f37
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluCC5/Y5fqatglZVtDtL/:TID41vd5g5r+V/
- TLSH T123C56B49B7D555A2E5634231886782A2BF7278201F2193DF2390B23D5F337D0FA3A766
- MD5 SHA1 SHA512 SSDEEP TLSH