10e290418a21de6ff5880f0600923e152b17b954d511acd87dd5bbb5891238c4

General

Target
2026-05-30_0245c49fc718a8340b8768b04279d939_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260530-l7v4sshx9x
SHA256 10e290418a21de6ff5880f0600923e152b17b954d511acd87dd5bbb5891238c4
MD5 0245c49fc718a8340b8768b04279d939
SHA1 a3e0cd60043a2fc178f0a467a2f9cccc918659b4
SHA512 f6a51da3bd62c3403647eb5eba6acca5f144daf936338211aca1e215670e75c9df1f60a0307fb1ffdb6107c02120195fe400db5571615fb46fd846031c573f9d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou8:0NA1Yakeer5+nsof
TLSH
T18105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (1025) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 8 IoCs

pid	Process
536	m4wWCDDQ.exe
2432	JRZDQwW.exe
3744	xqITmn56wHs.exe
3312	LGkz9op5ix.exe
568	I7srbde9d.exe
3544	Kr6xK.exe
4376	0Mi82U2Bk.exe
5400	1mAHQ2Fre8r.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSMAIN = "C:\\Windows\\xqITmn56wHs.exe"	JRZDQwW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPCC = "C:\\Windows\\LGkz9op5ix.exe"	xqITmn56wHs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCVSRTE = "C:\\Windows\\I7srbde9d.exe"	LGkz9op5ix.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ETRUSTCIPE = "C:\\Windows\\Kr6xK.exe"	I7srbde9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\REALMON = "C:\\Windows\\0Mi82U2Bk.exe"	Kr6xK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NETUTILS = "C:\\Windows\\1mAHQ2Fre8r.exe"	0Mi82U2Bk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IFACE = "C:\\Windows\\m4wWCDDQ.exe"	2026-05-30_0245c49fc718a8340b8768b04279d939_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATWATCH = "C:\\Windows\\JRZDQwW.exe"	m4wWCDDQ.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\m4wWCDDQ.exe	2026-05-30_0245c49fc718a8340b8768b04279d939_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\JRZDQwW.exe	m4wWCDDQ.exe
File created	C:\Windows\LGkz9op5ix.exe	xqITmn56wHs.exe
File created	C:\Windows\I7srbde9d.exe	LGkz9op5ix.exe
File created	C:\Windows\0Mi82U2Bk.exe	Kr6xK.exe
File opened for modification	C:\Windows\I7srbde9d.exe	LGkz9op5ix.exe
File created	C:\Windows\1mAHQ2Fre8r.exe	0Mi82U2Bk.exe
File created	C:\Windows\m4wWCDDQ.exe	2026-05-30_0245c49fc718a8340b8768b04279d939_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\JRZDQwW.exe	m4wWCDDQ.exe
File created	C:\Windows\xqITmn56wHs.exe	JRZDQwW.exe
File opened for modification	C:\Windows\LGkz9op5ix.exe	xqITmn56wHs.exe
File created	C:\Windows\Kr6xK.exe	I7srbde9d.exe
File opened for modification	C:\Windows\0Mi82U2Bk.exe	Kr6xK.exe
File opened for modification	C:\Windows\xqITmn56wHs.exe	JRZDQwW.exe
File opened for modification	C:\Windows\Kr6xK.exe	I7srbde9d.exe
File opened for modification	C:\Windows\1mAHQ2Fre8r.exe	0Mi82U2Bk.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2500	3744	WerFault.exe	95
4504	536	WerFault.exe	91
5360	568	WerFault.exe	99
4456	4376	WerFault.exe	105

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-30_0245c49fc718a8340b8768b04279d939_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m4wWCDDQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JRZDQwW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kr6xK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0Mi82U2Bk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1mAHQ2Fre8r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xqITmn56wHs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LGkz9op5ix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	I7srbde9d.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-30_0245c49fc718a8340b8768b04279d939_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-30_0245c49fc718a8340b8768b04279d939_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4704

C:\Windows\m4wWCDDQ.exe
C:\Windows\m4wWCDDQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 2324
  2⤵
  - Program crash
  PID:4504

C:\Windows\JRZDQwW.exe
C:\Windows\JRZDQwW.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2432

C:\Windows\xqITmn56wHs.exe
C:\Windows\xqITmn56wHs.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 2112
  2⤵
  - Program crash
  PID:2500

C:\Windows\LGkz9op5ix.exe
C:\Windows\LGkz9op5ix.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3312

C:\Windows\I7srbde9d.exe
C:\Windows\I7srbde9d.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 2328
  2⤵
  - Program crash
  PID:5360

C:\Windows\Kr6xK.exe
C:\Windows\Kr6xK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3544

C:\Windows\0Mi82U2Bk.exe
C:\Windows\0Mi82U2Bk.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 2324
  2⤵
  - Program crash
  PID:4456

C:\Windows\1mAHQ2Fre8r.exe
C:\Windows\1mAHQ2Fre8r.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3744 -ip 3744
1⤵
PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 536 -ip 536
1⤵
PID:5312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 568 -ip 568
1⤵
PID:5364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4376 -ip 4376
1⤵
PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0Mi82U2Bk.exe

Path C:\Windows\0Mi82U2Bk.exe
Size 804KB
SHA256 1bbfe13068a05573bcf20d40a3a8689d33dd644ee00b75ce7b58752b26a68e8a
MD5 2e2a7d26e785fe6a9009fdcc5b209d5b
SHA1 ce50597ca3dabc59f27e8fb0bb0d72755a5bfd0d
SHA512 5670a85957db312667972cf4554b0a7a2518e9853929d4658ab84598c3b2c0f710d442bbcaf5f57e32a31e98afe49debb1ec7cf82c94c3e72958337733f64678
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsoc
TLSH
T1B805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1mAHQ2Fre8r.exe

Path C:\Windows\1mAHQ2Fre8r.exe
Size 804KB
SHA256 5ed05c73558be1d308d5cfc5665d78eaccaa392e50c2da5cc0ac56cfbe965096
MD5 b566fe310c6e45b1cdffb252522c7bff
SHA1 ecc6a68c4f9a3ebc026810584b68ddfd130ac66f
SHA512 95aee1d846167d4af62120ec4e54eca43e9924e76c692519cce826911a3e5f2dc165f6414c7681920086ec50c128b66a1879435ab3cfcb66691f9e90e477f10e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouY:0NA1Yakeer5+nsoD
TLSH
T14905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

I7srbde9d.exe

Path C:\Windows\I7srbde9d.exe
Size 804KB
SHA256 211a607bc903621022ea18c751e7ef17179a9242544405721cb532bb373ab8f0
MD5 cc007c4922d817efeae270d782222a11
SHA1 0be40a9da1f8ff77d5709fb7def50a972fc08302
SHA512 a52cd47fb64f6917636d03a20bb9cf24f5e43054ce6242fcd894b6ed77b56475e53690a01bd12a0a525cff1421947c7571ef31648fbbb6eeadfe7dd0aa8235ef
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nso2
TLSH
T12D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JRZDQwW.exe

Path C:\Windows\JRZDQwW.exe
Size 804KB
SHA256 6aae5f354a0f2f78b5531e02727e2015e7d3c81f40349cd3f56b761f272e25ba
MD5 86b9c7d270c76d91211c73c9fdfe2ed0
SHA1 4336da6a3bc73ea13aaeecf1f2f1fe117bbbc5c7
SHA512 6ff8696035dd9d3e9335a00a302ca2467270768f537ff10cf789b25158b6a512e92bb91a11e129bf1b95ed91d55917a07d59df829386288fc8ed0f8c9b8e682c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouz:0NA1Yakeer5+nsoq
TLSH
T17605A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kr6xK.exe

Path C:\Windows\Kr6xK.exe
Size 804KB
SHA256 a278d1789fddd619d00fed27d2f8e071260d98e4f1894ea0a57f48066f2eb8a6
MD5 4921ed74833bb5f950e92423c441f768
SHA1 eb41cc234ffc37c4df5bbdf59fb0c35a5b37f779
SHA512 b1bbf540d151f15f4135518d8cd58da2d9b2e6edef4e5c267500a5396f7c8327424fbfb6139564d7de3fee7f15387e90b61c73a68cd301276704b98d4e1ae8bd
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nsoh
TLSH
T1B305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LGkz9op5ix.exe

Path C:\Windows\LGkz9op5ix.exe
Size 804KB
SHA256 0e6e9baf2ae4c068cdf57ccac67a67b0b6efad43a176bac430a1d79df90eeaf3
MD5 92062a46a358b7127bab40d12de61693
SHA1 7455a25a1c8d62abaef18ad020569860e459cc9f
SHA512 04d18abfad06af3b1f6a4eb8c0c6e0fbfeb9375dfa7fc9b9da4a990f279d430755a4df26f64f6d0a971f23f95c956c472f278ab330c9e0be756638ca4cdc2253
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nsoK
TLSH
T1E105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m4wWCDDQ.exe

Path C:\Windows\m4wWCDDQ.exe
Size 804KB
SHA256 977c65341c2fe707e36d474f0b0ad7321bb808d28e56156eaa765af017c13c7e
MD5 604496e7828e9efdf4725cd8a8f7e6ad
SHA1 4a7d4dcb5e2246459b8cf26f69872a185185bf5c
SHA512 9bdeb132b527a0aa11f04745332da4a37dd0aa91cafc7d10b5a8a92bc5008f18af933bf730823a1626aab368d38d7a121904c727e89b4ccd1078f67099820917
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nsoF
TLSH
T11D05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xqITmn56wHs.exe

Path C:\Windows\xqITmn56wHs.exe
Size 804KB
SHA256 8bfa4ea178aed30f7344264d84d739798c5b8422b44d769e4880a4e215dd0731
MD5 deec755c8b537cf3f1dbe212f93b823c
SHA1 9fba5b987f32676a575e21a705f75f47d9b5673f
SHA512 106f491ae33bc9ffa37e3c42022007ccef8da2d20c18bdef89b0b08662c76c759d90e90973b4a321258c8f9d6373c9cc0f6211ed9db593076995002e8e2c33e1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoul:0NA1Yakeer5+nsoe
TLSH
T1E805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads