dcf5aa631a81d6f009cd692a1c909940b1cda356997d637c830fb75273295d90

General

Target
2026-06-27_dd33183fee9fcb22d2a7e2643d952ffd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260629-cmwp6ab19k
SHA256 dcf5aa631a81d6f009cd692a1c909940b1cda356997d637c830fb75273295d90
MD5 dd33183fee9fcb22d2a7e2643d952ffd
SHA1 8e56d04446885fd59e4fd188363e788dda59d075
SHA512 da51916573e3d479ebfae75485a11947ea9a8534893cc87fdebf604e7858d5a7bb5c7120876485a4a29334af95b07a6b6af1f95a913e16685044ef1cb5688769
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouf:0NA1Yakeer5+nsoA
TLSH
T1BD05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (714) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 6 IoCs

pid	Process
5440	PMAcD.exe
6360	vXvvKqj12.exe
3884	ulNkYOeW1hrs.exe
6724	CVakCXsuXnPUwka.exe
2588	DAbYKITL.exe
5852	XE8lvpvqcBsoK.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCANPM = "C:\\Windows\\PMAcD.exe"	2026-06-27_dd33183fee9fcb22d2a7e2643d952ffd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFIAUDIT = "C:\\Windows\\vXvvKqj12.exe"	PMAcD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPSSVC = "C:\\Windows\\ulNkYOeW1hrs.exe"	vXvvKqj12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RTVSCN95 = "C:\\Windows\\CVakCXsuXnPUwka.exe"	ulNkYOeW1hrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVCL = "C:\\Windows\\DAbYKITL.exe"	CVakCXsuXnPUwka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SAFEWEB = "C:\\Windows\\XE8lvpvqcBsoK.exe"	DAbYKITL.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\vXvvKqj12.exe	PMAcD.exe
File created	C:\Windows\ulNkYOeW1hrs.exe	vXvvKqj12.exe
File created	C:\Windows\CVakCXsuXnPUwka.exe	ulNkYOeW1hrs.exe
File created	C:\Windows\DAbYKITL.exe	CVakCXsuXnPUwka.exe
File opened for modification	C:\Windows\DAbYKITL.exe	CVakCXsuXnPUwka.exe
File created	C:\Windows\XE8lvpvqcBsoK.exe	DAbYKITL.exe
File created	C:\Windows\PMAcD.exe	2026-06-27_dd33183fee9fcb22d2a7e2643d952ffd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\ulNkYOeW1hrs.exe	vXvvKqj12.exe
File opened for modification	C:\Windows\CVakCXsuXnPUwka.exe	ulNkYOeW1hrs.exe
File opened for modification	C:\Windows\XE8lvpvqcBsoK.exe	DAbYKITL.exe
File opened for modification	C:\Windows\PMAcD.exe	2026-06-27_dd33183fee9fcb22d2a7e2643d952ffd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\vXvvKqj12.exe	PMAcD.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5900	3884	WerFault.exe	95
1828	5852	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vXvvKqj12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ulNkYOeW1hrs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CVakCXsuXnPUwka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DAbYKITL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XE8lvpvqcBsoK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_dd33183fee9fcb22d2a7e2643d952ffd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PMAcD.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_dd33183fee9fcb22d2a7e2643d952ffd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_dd33183fee9fcb22d2a7e2643d952ffd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4068

C:\Windows\PMAcD.exe
C:\Windows\PMAcD.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5440

C:\Windows\vXvvKqj12.exe
C:\Windows\vXvvKqj12.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6360

C:\Windows\ulNkYOeW1hrs.exe
C:\Windows\ulNkYOeW1hrs.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 2080
  2⤵
  - Program crash
  PID:5900

C:\Windows\CVakCXsuXnPUwka.exe
C:\Windows\CVakCXsuXnPUwka.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6724

C:\Windows\DAbYKITL.exe
C:\Windows\DAbYKITL.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3884 -ip 3884
1⤵
PID:5520

C:\Windows\XE8lvpvqcBsoK.exe
C:\Windows\XE8lvpvqcBsoK.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 2204
  2⤵
  - Program crash
  PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5852 -ip 5852
1⤵
PID:7116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CVakCXsuXnPUwka.exe

Path C:\Windows\CVakCXsuXnPUwka.exe
Size 804KB
SHA256 e1cf626e96075d6fc247a94f6504d6307d397cccebe16b0d41a1a00874065a09
MD5 0f6c8cb4396bd9986fd63b4837c4df17
SHA1 655f08184d96c53a55bc93fd4c786af620bbc91f
SHA512 2f1f2e6f5b0b9287c08149472f97884a403ff1203d05065adc962a95c37a1f927fcab1fadec1baaec3b93b51a0cf207ec472f0928dc71fd9ad43a22022bbb00d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nsov
TLSH
T1E905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DAbYKITL.exe

Path C:\Windows\DAbYKITL.exe
Size 804KB
SHA256 3fb79633c96dfb41882178db2803f4b70e2693e8305da40de7f8f94cc195e396
MD5 2fe53fd06ded01bdddcd2c9427943971
SHA1 44fc437d2afee92d58b999acec4f75e04e7b9a6b
SHA512 5104aa8feb28fc65bd2a5683b3df39bab6b381d42bcb54ae6087f82a7c014befba37f774ecf8fe900380e01c149b4d226604619ffea1266a662b67fe57a500f3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsoe
TLSH
T1A105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PMAcD.exe

Path C:\Windows\PMAcD.exe
Size 804KB
SHA256 4713937f7a7ecf1d27e8e4a019b94236725ecc82309427e9e80ad9e71d5b435a
MD5 5131f842bad283e0853e5fb5c9dcc714
SHA1 bfa3681bd1330dc9eb18768b0b58393ebb815d88
SHA512 42590341c1066d44b0459e86aaaececccc8babfaf218677efa21d673077003a151a388c7b5160afc40c0c65c0ee761c3487ccff1379e152694940a5d986added
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQ:0NA1Yakeer5+nsot
TLSH
T17905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XE8lvpvqcBsoK.exe

Path C:\Windows\XE8lvpvqcBsoK.exe
Size 804KB
SHA256 95becf767c6e62a89edfb404776a10d3be70b52bc440865608b7f7ce60fc0ebb
MD5 2eb88a9d501a1a7520f1128f3bf0310c
SHA1 4b33f78cb9d7dc81a7d10a3e728f34165f467004
SHA512 f0923fc129f61306a861bf0f0fccd01c21f40448b512185fccecb631f2579a30c9683f14e364a95abb051d598041e46c40fe3e74c139fb1d05323d8e8da01e77
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsoU
TLSH
T10905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ulNkYOeW1hrs.exe

Path C:\Windows\ulNkYOeW1hrs.exe
Size 804KB
SHA256 7e9660b3368e08ae8b7c93fef4ac1089cbf986383541ec651261acaadcef244d
MD5 39f8d9e03d7beb51537c2a7e8a256c4e
SHA1 369a19d5e98ade1478f677057a1a09c2f72b2aee
SHA512 6984b261b1531210aa7497bff80e4fece6f436c68a7d4b5ce0d54f4eda5967e541d4b3fef6535a0cba3c7f0161d779236048dca830cac2035770b92907fea12a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsoq
TLSH
T10805A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vXvvKqj12.exe

Path C:\Windows\vXvvKqj12.exe
Size 804KB
SHA256 cccd555a151a77eda4eec52d1dd571def576a5159f6c39d20a0ba6d6017f0af9
MD5 eb3c7f0151d7f6b0f71113cb5d8b3181
SHA1 bd010c223979382fa7d2069fed00edf1d4bac6f8
SHA512 bbb3cd19d14f628b6b076f5c6eb266130788e2cfe267e6bbbb1fe300d6efac66c8dc2f7d94e4c24d2ce1dd23ffbba9b48daeab6f8e4e653496c2ed7ac145f4e0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou0:0NA1Yakeer5+nsoh
TLSH
T1D905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads