10e290418a21de6ff5880f0600923e152b17b954d511acd87dd5bbb5891238c4

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 10:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-30_0245c49fc718a8340b8768b04279d939_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260530-l7v4sshx9x
SHA256 10e290418a21de6ff5880f0600923e152b17b954d511acd87dd5bbb5891238c4
MD5 0245c49fc718a8340b8768b04279d939
SHA1 a3e0cd60043a2fc178f0a467a2f9cccc918659b4
SHA512 f6a51da3bd62c3403647eb5eba6acca5f144daf936338211aca1e215670e75c9df1f60a0307fb1ffdb6107c02120195fe400db5571615fb46fd846031c573f9d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou8:0NA1Yakeer5+nsof
TLSH
T18105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (1364) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 12 IoCs

pid	Process
3196	CTewGbY5ScMbDg.exe
4040	z2UNGLSC.exe
3060	NPBIqUg8aaOngVM.exe
1680	FAZjw8W.exe
2688	n8i14v.exe
4352	05amNzBZcoSY.exe
4424	6AZkkHFrBKO5.exe
4620	D5k5bunU1DdtI.exe
5288	UlKT45jc2p.exe
5528	QsSURD.exe
5772	FqAIyQXS.exe
6120	vEk4QXasPwFi6p.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ECENGINE = "C:\\Windows\\UlKT45jc2p.exe"	D5k5bunU1DdtI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPFSERVICE = "C:\\Windows\\QsSURD.exe"	UlKT45jc2p.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PORTMONITOR = "C:\\Windows\\FqAIyQXS.exe"	QsSURD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSGK32 = "C:\\Windows\\CTewGbY5ScMbDg.exe"	2026-05-30_0245c49fc718a8340b8768b04279d939_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFALERT = "C:\\Windows\\n8i14v.exe"	FAZjw8W.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVSYNMGR = "C:\\Windows\\6AZkkHFrBKO5.exe"	05amNzBZcoSY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCUPDATE = "C:\\Windows\\vEk4QXasPwFi6p.exe"	FqAIyQXS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SPHINX = "C:\\Windows\\z2UNGLSC.exe"	CTewGbY5ScMbDg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NETUTILS = "C:\\Windows\\NPBIqUg8aaOngVM.exe"	z2UNGLSC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZONEALARM = "C:\\Windows\\FAZjw8W.exe"	NPBIqUg8aaOngVM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVNT = "C:\\Windows\\05amNzBZcoSY.exe"	n8i14v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGHTML = "C:\\Windows\\D5k5bunU1DdtI.exe"	6AZkkHFrBKO5.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\z2UNGLSC.exe	CTewGbY5ScMbDg.exe
File opened for modification	C:\Windows\05amNzBZcoSY.exe	n8i14v.exe
File created	C:\Windows\UlKT45jc2p.exe	D5k5bunU1DdtI.exe
File created	C:\Windows\QsSURD.exe	UlKT45jc2p.exe
File created	C:\Windows\vEk4QXasPwFi6p.exe	FqAIyQXS.exe
File opened for modification	C:\Windows\vEk4QXasPwFi6p.exe	FqAIyQXS.exe
File created	C:\Windows\CTewGbY5ScMbDg.exe	2026-05-30_0245c49fc718a8340b8768b04279d939_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\NPBIqUg8aaOngVM.exe	z2UNGLSC.exe
File opened for modification	C:\Windows\UlKT45jc2p.exe	D5k5bunU1DdtI.exe
File opened for modification	C:\Windows\QsSURD.exe	UlKT45jc2p.exe
File created	C:\Windows\NPBIqUg8aaOngVM.exe	z2UNGLSC.exe
File created	C:\Windows\FAZjw8W.exe	NPBIqUg8aaOngVM.exe
File opened for modification	C:\Windows\FAZjw8W.exe	NPBIqUg8aaOngVM.exe
File created	C:\Windows\n8i14v.exe	FAZjw8W.exe
File opened for modification	C:\Windows\n8i14v.exe	FAZjw8W.exe
File created	C:\Windows\z2UNGLSC.exe	CTewGbY5ScMbDg.exe
File created	C:\Windows\05amNzBZcoSY.exe	n8i14v.exe
File created	C:\Windows\6AZkkHFrBKO5.exe	05amNzBZcoSY.exe
File opened for modification	C:\Windows\6AZkkHFrBKO5.exe	05amNzBZcoSY.exe
File created	C:\Windows\D5k5bunU1DdtI.exe	6AZkkHFrBKO5.exe
File opened for modification	C:\Windows\D5k5bunU1DdtI.exe	6AZkkHFrBKO5.exe
File created	C:\Windows\FqAIyQXS.exe	QsSURD.exe
File opened for modification	C:\Windows\FqAIyQXS.exe	QsSURD.exe
File opened for modification	C:\Windows\CTewGbY5ScMbDg.exe	2026-05-30_0245c49fc718a8340b8768b04279d939_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
6020	5288	WerFault.exe	99
6028	5528	WerFault.exe	101
5692	1048	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	z2UNGLSC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FAZjw8W.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	n8i14v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D5k5bunU1DdtI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UlKT45jc2p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QsSURD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FqAIyQXS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vEk4QXasPwFi6p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-30_0245c49fc718a8340b8768b04279d939_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTewGbY5ScMbDg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NPBIqUg8aaOngVM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05amNzBZcoSY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6AZkkHFrBKO5.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-30_0245c49fc718a8340b8768b04279d939_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-30_0245c49fc718a8340b8768b04279d939_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 2536
  2⤵
  - Program crash
  PID:5692

C:\Windows\CTewGbY5ScMbDg.exe
C:\Windows\CTewGbY5ScMbDg.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3196

C:\Windows\z2UNGLSC.exe
C:\Windows\z2UNGLSC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4040

C:\Windows\NPBIqUg8aaOngVM.exe
C:\Windows\NPBIqUg8aaOngVM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3060

C:\Windows\FAZjw8W.exe
C:\Windows\FAZjw8W.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1680

C:\Windows\n8i14v.exe
C:\Windows\n8i14v.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2688

C:\Windows\05amNzBZcoSY.exe
C:\Windows\05amNzBZcoSY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4352

C:\Windows\6AZkkHFrBKO5.exe
C:\Windows\6AZkkHFrBKO5.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4424

C:\Windows\D5k5bunU1DdtI.exe
C:\Windows\D5k5bunU1DdtI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4620

C:\Windows\UlKT45jc2p.exe
C:\Windows\UlKT45jc2p.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 2040
  2⤵
  - Program crash
  PID:6020

C:\Windows\QsSURD.exe
C:\Windows\QsSURD.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5528 -s 2036
  2⤵
  - Program crash
  PID:6028

C:\Windows\FqAIyQXS.exe
C:\Windows\FqAIyQXS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5288 -ip 5288
1⤵
PID:5996

C:\Windows\vEk4QXasPwFi6p.exe
C:\Windows\vEk4QXasPwFi6p.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5528 -ip 5528
1⤵
PID:6036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1048 -ip 1048
1⤵
PID:6112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

05amNzBZcoSY.exe

Path C:\Windows\05amNzBZcoSY.exe
Size 804KB
SHA256 9ece3452d0542e59a58342be9870d18b95666ddf941568fdbb584c5175dcd935
MD5 ff8252480a5cebe7d564a3a0cd0dccd3
SHA1 feac04791cbd632b84ccc380368edc5ec9a7ca5a
SHA512 cd61220a891ff736b839a59f1e9f70d10a2d08b286806a7a45b11ecf84bea7f88990226d922424e3a0f622efb9189a29c02656e65b159c5f9571cd09fdbfafac
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsoy
TLSH
T1B805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6AZkkHFrBKO5.exe

Path C:\Windows\6AZkkHFrBKO5.exe
Size 804KB
SHA256 5dd81a3a829c7b22ac80f8f3e118a39366d9e24e7fb676099bfd9270131062d1
MD5 0f9cefdb47ab078f1dc0e19962636382
SHA1 d5946fba6e93a2d97aefa1a45aacec0e441f5585
SHA512 b5827d99d0fcedf847d3d1d6df467373670acbbae6b790abd083141021d0f2e301ab8faf9bdccd4a91359b1a8e8add8ea7344fcf5de160c66534ccff68031e65
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nsoU
TLSH
T12305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTewGbY5ScMbDg.exe

Path C:\Windows\CTewGbY5ScMbDg.exe
Size 804KB
SHA256 cbe583a4abdb76ee2d1863778f46affb7ac311009a2f57767c171f78dc803cb1
MD5 3f06364ace732b499da77776c1204d61
SHA1 729ecbb232936462462bdf1aa1c52b24ec08cd81
SHA512 a9ca478498e0f9448b04725b2b0a5c6ef24bd9783470c8f9c7c7d5c4650660e6c349ee3b2ee7c578ced94350887efab23234424e5e78d5500c4893fb07ed3f34
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou1:0NA1Yakeer5+nso2
TLSH
T16A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D5k5bunU1DdtI.exe

Path C:\Windows\D5k5bunU1DdtI.exe
Size 804KB
SHA256 a37798f6f0c577c1fe1d3f387c2e4f691ad73c6bc4fb669ddc3c7fd9a79a5e5d
MD5 07282751b49fdb09a1c1e44f1a87fb38
SHA1 e54ca30ef0891dbb85df2964711875702e13ced6
SHA512 3ec966da267d1b3f7d2eb4aa26644701e9e1e9aebbe9fcce63506c7a5933d98af70ab9257b5807680ceba2e3594abd1266bc64cf46a43ebff4d3195cc9890ebc
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nsob
TLSH
T1F005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FAZjw8W.exe

Path C:\Windows\FAZjw8W.exe
Size 804KB
SHA256 d5865b42430067ffd21995618bc5d31bf8ce7ef1807a60076de90f84660958bf
MD5 08f7c3d6ed7de10424890897e02b6ddf
SHA1 e75a3703ad60c686d3a2db60a6587b79c622c658
SHA512 37b893d79b5ed4a29ce133d950888082968142e00495699b5c9a3c262ed3a644f1a032669344258f899033958479dba131211469c0f8fe71eb553aba4544c6f2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoue:0NA1Yakeer5+nsoZ
TLSH
T1EF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FqAIyQXS.exe

Path C:\Windows\FqAIyQXS.exe
Size 804KB
SHA256 071b524608f6ac0ee60540f27e820d45adf45b0d5e357b37679c738fcc6a5176
MD5 1b771f80296f49d94813b9f516261c2b
SHA1 89bb5546bfa38d53bba15b0fb9e832caa43f8976
SHA512 d9f590088fe1f972d069a839c30be70ce4e9dd0cba94594620d27237552591a65d86db973ae3b4d7a29d8ce210412065a9629e178bf11b38ae19b05659c2379a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nsox
TLSH
T1B805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NPBIqUg8aaOngVM.exe

Path C:\Windows\NPBIqUg8aaOngVM.exe
Size 804KB
SHA256 f3eec0d344cc1b7341aa01cdb4e0aa31f12f8a280d439612b9b2591988d797a8
MD5 cf52943996471be77efa65436d362c7d
SHA1 7e148d1e9741a98599e75bc4b0e8a9292edb6719
SHA512 985fe14385330e3364982d184729825d646fcd7e900b186eea468cec1dede66caff56861ec6b82dfdad77393848486951abe69c742b38a040923507e9cee259b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouh:0NA1Yakeer5+nso6
TLSH
T15905A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QsSURD.exe

Path C:\Windows\QsSURD.exe
Size 804KB
SHA256 6c502f8d5b86e98b94b4f9463172a7ebd3be7ebf3a60d8cb08aafa6169b7ab85
MD5 d022f1e406a4011e0035ae9243e52dc3
SHA1 ead8184a686d3132af4ebb277d6d0107a43e0404
SHA512 6ee769ba90c8d2c8047b25ccf139d7f38f7d072053aa9db11f4243047ab1b004632400bf21828fb3672f4fc76be7915f35fab7616ca91dcaa10718c7b8af35c1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou3:0NA1Yakeer5+nsoY
TLSH
T16D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UlKT45jc2p.exe

Path C:\Windows\UlKT45jc2p.exe
Size 804KB
SHA256 083ec1f33ad4c258d6c85a2c3966c572858996958fc1390ea7fe265678c4d5d0
MD5 541c5541ed5fd3b25f7920a69c9b5192
SHA1 b30f27e98262e18b3d00bd7a393c692cc3e33ed1
SHA512 993ce0bfcbfa73dfeaeabab5e2a15fb4009567566da6cc2e6ec04c6849a03fd06e4f5e96db810fa21e60e07774a3e4bb4f9a4f3b06d952dd0add84ae24571713
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoul:0NA1Yakeer5+nsoS
TLSH
T1E905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

n8i14v.exe

Path C:\Windows\n8i14v.exe
Size 804KB
SHA256 75d483ae03987e19b1feb6b20ef91b5ec1027acbdd5d41426b056d5c318398ce
MD5 7ca26ab1edfc8db8a6e3f0552aaf22e2
SHA1 1c8bb69450eecc3847ab536429a6cabeed500855
SHA512 ea422ff208430c11c01cb6f1100eb47d1fd1929949d0af4cdb1b37ee70a7cba6d41d5d904aa719aaab17ccc95014651d210a9f714fe85fb4741cceba1c001c7e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO6:0NA1Yakeer5+nsoH6
TLSH
T1D405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vEk4QXasPwFi6p.exe

Path C:\Windows\vEk4QXasPwFi6p.exe
Size 804KB
SHA256 547d67b48f06523331bf4f14a536f3f9c692d782197f56c3dc106b2dbda13daf
MD5 422540ce7cd145e66d749936da98637a
SHA1 6667ec5f96af6e221d0f4e42674e63fd3376ac3c
SHA512 afebe1f788a73fcea2a96f6b808515158a569e6e7e272e4c53553851500ed1a765fb63b81128e2695a514cc6c3c6766b4d4f049610999aa1a670fc8ca6984e97
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsoo
TLSH
T1A705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

z2UNGLSC.exe

Path C:\Windows\z2UNGLSC.exe
Size 804KB
SHA256 001dae9800d179e19e2dc2ff6e71229024e5445ba474be6d861c921cfdefbb2b
MD5 0bc27e62a5f1f18bd42a67e074bd3955
SHA1 63be188307d3b5f555d70450f7ef177c78adbaf5
SHA512 6c9105b1894d04a2e94080cdea0c33b940dfcd8791f3939cf62d1630bc51b45642f1667400dfe2753012deaca24b3e80cb8792a68848bdd2d5cd3436328bf4cb
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouF:0NA1Yakeer5+nso2
TLSH
T15105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads