Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 22:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-03_440c11b17b7332eb800d10396269fbb9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-03_440c11b17b7332eb800d10396269fbb9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-11-03_440c11b17b7332eb800d10396269fbb9_amadey_elex_glassworm_remcos_vidar_wannacry.exe
- Size 1.4MB
- Sample261104-19c4bsvxe1
- SHA256 58cae7baed4b0a508973dc934ea8fda0e5a3a31635289452d096aa5ae530f945
- MD5 440c11b17b7332eb800d10396269fbb9
- SHA1 5c3b657423c288147435f28d3010f2885a401d14
- SHA512 05c0196dacb1db400205f58ebab7826a518815d625242e95a5c3f9bd321664641121c7a088ad46155024cc964179f5dded133c1e7555739234523962eef9b36e
- SSDEEP 24576:FV2fPi1dJU43I98U7nYYJ2tHhADSANLHgWExqatgl8bOkxqatgj45jcAkSYqyE:W/4MnYYJ2ZhqSGLHyqatglYqatgKpYq
- TLSH T108656C52F7608672D0738176C99766A6BB7238110F2187CB2384A77C2F337D1AA36776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 21 IoCs
pid Process 5376 patcher.exe 4940 660.#.exe 4556 105.#.exe 3136 330.#.exe 1628 136.#.exe 2436 52.#.exe 5188 779.#.exe 1560 751.#.exe 628 0.#.exe 2868 61.#.exe 5640 958.#.exe 5408 632.#.exe 992 295.#.exe 5564 946.#.exe 5216 470.#.exe 4496 848.#.exe 2244 117.#.exe 4648 959.#.exe 1316 749.#.exe 6064 996.#.exe 1432 619.#.exe - Adds Run key to start application 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-11-03_440c11b17b7332eb800d10396269fbb9_amadey_elex_glassworm_remcos_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 61.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 958.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 632.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 751.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 295.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 848.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 619.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 660.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 52.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 0.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 946.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 117.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 959.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 749.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 105.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 330.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 136.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 779.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 470.#.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 996.#.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\ 779.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\kn-IN\ 660.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hy-AM\ 751.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 779.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\ 632.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lo-LA\ 848.#.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\ 52.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tt-RU\ 958.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\ 779.#.exe File opened for modification C:\Program Files\dotnet\swidtag\ 136.#.exe File opened for modification C:\Program Files\Internet Explorer\ 61.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\af-ZA\ 632.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ 0.#.exe File opened for modification C:\Program Files\dotnet\shared\ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 105.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ 136.#.exe File opened for modification C:\Program Files\Google\ 136.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 632.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ 959.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hr-HR\ 105.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 632.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ 848.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\ 779.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\ 2026-11-03_440c11b17b7332eb800d10396269fbb9_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\ 0.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ 0.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bg-BG\ 61.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bn-IN\ 660.#.exe File opened for modification C:\Program Files\Common Files\System\ado\ 61.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ 660.#.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 0.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 779.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\chr-CHER-US\ 848.#.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\ 105.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\ 946.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\az-Latn-AZ\ 959.#.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 52.#.exe File opened for modification C:\Program Files\7-Zip\7z.exe 61.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\ 0.#.exe File opened for modification C:\Program Files\dotnet\ 779.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\kk-KZ\ 958.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\ 0.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\ 105.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ 946.#.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\ 660.#.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 779.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 779.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\ 136.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\ 105.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fil-PH\ 660.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\ 0.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\ 632.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\eu-ES\ 0.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\ 779.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lo-LA\ 330.#.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\ 0.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ga-IE\ 2026-11-03_440c11b17b7332eb800d10396269fbb9_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nl-NL\ 295.#.exe File opened for modification C:\Program Files\Internet Explorer\en-US\ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ 958.#.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ 61.#.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\ 751.#.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\:\systemlog.bak 779.#.exe File opened for modification C:\Windows\:\systemlog.bak 0.#.exe File opened for modification C:\Windows\:\systemlog.bak 632.#.exe File opened for modification C:\Windows\:\systemlog.bak 295.#.exe File opened for modification C:\Windows\:\systemlog.bak 946.#.exe File opened for modification C:\Windows\:\systemlog.bak 959.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Windows\:\systemlog.bak 136.#.exe File opened for modification C:\Windows\:\systemlog.bak 61.#.exe File opened for modification C:\Windows\:\systemlog.bak 848.#.exe File opened for modification C:\Windows\:\systemlog.bak 117.#.exe File opened for modification C:\Windows\:\systemlog.bak 996.#.exe File opened for modification C:\Windows\:\systemlog.bak 619.#.exe File opened for modification C:\Windows\:\systemlog.bak 105.#.exe - System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-03_440c11b17b7332eb800d10396269fbb9_amadey_elex_glassworm_remcos_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 660.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 779.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 958.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 848.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 330.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 632.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 117.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 996.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 619.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 136.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 295.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 946.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 959.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 105.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 751.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61.#.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 470.#.exe - NTFS ADS 22 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 2026-11-03_440c11b17b7332eb800d10396269fbb9_amadey_elex_glassworm_remcos_vidar_wannacry.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 52.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 751.#.exe File opened for modification C:\Windows\:\systemlog.bak 295.#.exe File opened for modification C:\Windows\:\systemlog.bak 105.#.exe File opened for modification C:\Windows\:\systemlog.bak 136.#.exe File opened for modification C:\Windows\:\systemlog.bak 848.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 749.#.exe File opened for modification C:\Windows\:\systemlog.bak 996.#.exe File opened for modification C:\Windows\:\systemlog.bak 619.#.exe File opened for modification C:\Windows\:\systemlog.bak patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 330.#.exe File opened for modification C:\Windows\:\systemlog.bak 0.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 958.#.exe File opened for modification C:\Windows\:\systemlog.bak 946.#.exe File opened for modification C:\Windows\:\systemlog.bak 117.#.exe File opened for modification C:\Windows\:\systemlog.bak 959.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 660.#.exe File opened for modification C:\Windows\:\systemlog.bak 779.#.exe File opened for modification C:\Windows\:\systemlog.bak 61.#.exe File opened for modification C:\Windows\:\systemlog.bak 632.#.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\systemlog.bak 470.#.exe - Suspicious use of SetWindowsHookEx 22 IoCs
pid Process 5476 2026-11-03_440c11b17b7332eb800d10396269fbb9_amadey_elex_glassworm_remcos_vidar_wannacry.exe 5376 patcher.exe 4940 660.#.exe 4556 105.#.exe 3136 330.#.exe 1628 136.#.exe 2436 52.#.exe 5188 779.#.exe 1560 751.#.exe 628 0.#.exe 2868 61.#.exe 5640 958.#.exe 5408 632.#.exe 992 295.#.exe 5564 946.#.exe 5216 470.#.exe 4496 848.#.exe 2244 117.#.exe 4648 959.#.exe 1316 749.#.exe 6064 996.#.exe 1432 619.#.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 5476 wrote to memory of 4940 5476 2026-11-03_440c11b17b7332eb800d10396269fbb9_amadey_elex_glassworm_remcos_vidar_wannacry.exe 92 PID 5376 wrote to memory of 4556 5376 patcher.exe 93 PID 4940 wrote to memory of 3136 4940 660.#.exe 94 PID 4556 wrote to memory of 1628 4556 105.#.exe 95 PID 3136 wrote to memory of 2436 3136 330.#.exe 96 PID 1628 wrote to memory of 5188 1628 136.#.exe 97 PID 2436 wrote to memory of 1560 2436 52.#.exe 98 PID 5188 wrote to memory of 628 5188 779.#.exe 99 PID 628 wrote to memory of 2868 628 0.#.exe 100 PID 1560 wrote to memory of 5640 1560 751.#.exe 101 PID 2868 wrote to memory of 5408 2868 61.#.exe 102 PID 5408 wrote to memory of 992 5408 632.#.exe 103 PID 992 wrote to memory of 5564 992 295.#.exe 105 PID 5640 wrote to memory of 5216 5640 958.#.exe 106 PID 5564 wrote to memory of 4496 5564 946.#.exe 107 PID 4496 wrote to memory of 2244 4496 848.#.exe 108 PID 2244 wrote to memory of 4648 2244 117.#.exe 109 PID 5216 wrote to memory of 1316 5216 470.#.exe 110 PID 4648 wrote to memory of 6064 4648 959.#.exe 111 PID 6064 wrote to memory of 1432 6064 996.#.exe 112 PID 1432 wrote to memory of 836 1432 619.#.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_440c11b17b7332eb800d10396269fbb9_amadey_elex_glassworm_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_440c11b17b7332eb800d10396269fbb9_amadey_elex_glassworm_remcos_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\660.#.exeC:\Users\Admin\AppData\Local\Temp\660.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\330.#.exeC:\Users\Admin\AppData\Local\Temp\330.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\52.#.exeC:\Users\Admin\AppData\Local\Temp\52.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\751.#.exeC:\Users\Admin\AppData\Local\Temp\751.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\958.#.exeC:\Users\Admin\AppData\Local\Temp\958.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\470.#.exeC:\Users\Admin\AppData\Local\Temp\470.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\749.#.exeC:\Users\Admin\AppData\Local\Temp\749.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\864.#.exeC:\Users\Admin\AppData\Local\Temp\864.#.exe9⤵PID:4580
-
-
-
-
-
-
-
-
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\905c0769f9a06c95a24ddf945\105.#.exeC:\905c0769f9a06c95a24ddf945\105.#.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\905c0769f9a06c95a24ddf945\136.#.exeC:\905c0769f9a06c95a24ddf945\136.#.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\905c0769f9a06c95a24ddf945\779.#.exeC:\905c0769f9a06c95a24ddf945\779.#.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\905c0769f9a06c95a24ddf945\0.#.exeC:\905c0769f9a06c95a24ddf945\0.#.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628 -
C:\905c0769f9a06c95a24ddf945\61.#.exeC:\905c0769f9a06c95a24ddf945\61.#.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\905c0769f9a06c95a24ddf945\632.#.exeC:\905c0769f9a06c95a24ddf945\632.#.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\905c0769f9a06c95a24ddf945\295.#.exeC:\905c0769f9a06c95a24ddf945\295.#.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992 -
C:\905c0769f9a06c95a24ddf945\946.#.exeC:\905c0769f9a06c95a24ddf945\946.#.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\905c0769f9a06c95a24ddf945\848.#.exeC:\905c0769f9a06c95a24ddf945\848.#.exe10⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\905c0769f9a06c95a24ddf945\117.#.exeC:\905c0769f9a06c95a24ddf945\117.#.exe11⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\905c0769f9a06c95a24ddf945\959.#.exeC:\905c0769f9a06c95a24ddf945\959.#.exe12⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\905c0769f9a06c95a24ddf945\996.#.exeC:\905c0769f9a06c95a24ddf945\996.#.exe13⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\905c0769f9a06c95a24ddf945\619.#.exeC:\905c0769f9a06c95a24ddf945\619.#.exe14⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\905c0769f9a06c95a24ddf945\965.#.exeC:\905c0769f9a06c95a24ddf945\965.#.exe15⤵PID:836
-
C:\905c0769f9a06c95a24ddf945\66.#.exeC:\905c0769f9a06c95a24ddf945\66.#.exe16⤵PID:1076
-
C:\905c0769f9a06c95a24ddf945\24.#.exeC:\905c0769f9a06c95a24ddf945\24.#.exe17⤵PID:5372
-
C:\905c0769f9a06c95a24ddf945\444.#.exeC:\905c0769f9a06c95a24ddf945\444.#.exe18⤵PID:720
-
C:\905c0769f9a06c95a24ddf945\299.#.exeC:\905c0769f9a06c95a24ddf945\299.#.exe19⤵PID:5708
-
C:\905c0769f9a06c95a24ddf945\8.#.exeC:\905c0769f9a06c95a24ddf945\8.#.exe20⤵PID:1440
-
C:\905c0769f9a06c95a24ddf945\44.#.exeC:\905c0769f9a06c95a24ddf945\44.#.exe21⤵PID:4340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 58cae7baed4b0a508973dc934ea8fda0e5a3a31635289452d096aa5ae530f945
- MD5 440c11b17b7332eb800d10396269fbb9
- SHA1 5c3b657423c288147435f28d3010f2885a401d14
- SHA512 05c0196dacb1db400205f58ebab7826a518815d625242e95a5c3f9bd321664641121c7a088ad46155024cc964179f5dded133c1e7555739234523962eef9b36e
- SSDEEP 24576:FV2fPi1dJU43I98U7nYYJ2tHhADSANLHgWExqatgl8bOkxqatgj45jcAkSYqyE:W/4MnYYJ2ZhqSGLHyqatglYqatgKpYq
- TLSH T108656C52F7608672D0738176C99766A6BB7238110F2187CB2384A77C2F337D1AA36776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 64f139f084ae9e8a3cd3276bc974d095611ce9946433925abce9c2c809001c9b
- MD5 6026276854c7575a4cb4cbd7c1f7fd01
- SHA1 fb0b647a713c43fa19e2e0c40834a9f090c0f8d6
- SHA512 ac8d2f70a88c51e74995bc380e1d89c80319aef53e95067ea30db6c3cbc210ea91b35f8adef161219c0e0f134f3e9397e0eb0c9cf4272556127a5786a5daea78
- SSDEEP 24576:FV2fPi1dJU43I98U7nYYJ2tHhADSANLHgWExqatgl8bOkxqatgj45jcAkSYqyEs6:W/4MnYYJ2ZhqSGLHyqatglYqatgKpYqL
- TLSH T191656C52F7A08672D0638176C9976696FB7238110F2187CB2384A77C2F337D1AA36776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$
- Size 1.4MB
- SHA256 0cbbdff07d6705d0f952687649bd21989cdac415ea24f03646dcfb2ce32b322c
- MD5 e25581b6c4bfd3aedf679211fec96a9e
- SHA1 d22d175a05912244729ec26630ddc1c40495b5f5
- SHA512 d37af0029daf511a68ff8b7436a06fe07ed2962de4fc08680d828256e234f8a6b0a061fbe81e45ded1c03e3d954fa9a45dd302e49d604c508aec1f5d3b4e9e0d
- SSDEEP 24576:FV2fPi1dJU43I98U7nYYJ2tHhADSANLHgWExqatgl8bOkxqatgj45jcAkSYqyERc:W/4MnYYJ2ZhqSGLHyqatglYqatgKpYqu
- TLSH T1ED656C52F7A08672D0638176C9976696FB7238110F2187CB2384A77C2F337D1AA36776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 1.4MB
- SHA256 b3945561b44130ab0c40ea1ec91ee3a7f7d2db32f72438d37d3a98ffeb0e2eb3
- MD5 41a8cc81bbceeea68704c778dfdb15b5
- SHA1 83ec453ef4b06f583a660a79c8e94ee919509bfd
- SHA512 2329c600bb5006ff2e2e1bb498725963142a3a274e0a148f99d35c1ca303d382b09e0b6fb3f8dd97458b2b396053de7009b93faaf086f9de0c82bf900c7f9b1f
- SSDEEP 24576:FV2fPi1dJU43I98U7nYYJ2tHhADSANLHgWExqatgl8bOkxqatgj45jcAkSYqyEJC:W/4MnYYJ2ZhqSGLHyqatglYqatgKpYqg
- TLSH T184657C52F7A08672D0638176C9976696FB7238110F2187CB2385A77C2F333D1AA36776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 1.4MB
- SHA256 6491c822e80e87d275a9fb0a29aa00ed517c006d7c4425e16838a5ab0fcc26b1
- MD5 442d51fc704d56f98b997a28a4e8a321
- SHA1 803af9fd648b4c40b03d7c7a9886513ed105cf8b
- SHA512 a2bf4d7844c980a8ec57d3f066332d98b2ed21b520ba832206f925a9b736a35806c9473b8748d22a01d5d348df048f23069a159e6e1626af336070d11a6d63b2
- SSDEEP 24576:FV2fPi1dJU43I98U7nYYJ2tHhADSANLHgWExqatgl8bOkxqatgj45jcAkSYqyEQA:W/4MnYYJ2ZhqSGLHyqatglYqatgKpYq5
- TLSH T135656C52F7A08672D0638176C9976696FB7238110F2187CB2384A77C2F337D1AA36776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 1.4MB
- SHA256 60123830a55ff71633c42c071faf4d2c058897880f86cc0bda105b501c34c86e
- MD5 27fee113acbb1055f9ce6e38afe8e6db
- SHA1 f9317d9d466a650cfe20b9457aa9d6b5613525cd
- SHA512 f5e471dc6067ee057d0afa66f13005ae1550898d6a70f0e8433b480701bac90426792871bbdb2f839ad11ae6b35503887bc4cead6337f0bc9ef9d7763ed0e2e4
- SSDEEP 24576:FV2fPi1dJU43I98U7nYYJ2tHhADSANLHgWExqatgl8bOkxqatgj45jcAkSYqyEQo:W/4MnYYJ2ZhqSGLHyqatglYqatgKpYqX
- TLSH T163657C52F7A08672D0638176C9976696FB7238110F2187CB2384A77C2F337D1AA36776
- MD5 SHA1 SHA512 SSDEEP TLSH