5df16524ae0edb5093eaa7a65633f29643aa951bdc2b34184d0bd696b3d7ecf3

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_e415ecdc25ec4ea1293a1792ec153b52_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260629-nnnaysdy8p
SHA256 5df16524ae0edb5093eaa7a65633f29643aa951bdc2b34184d0bd696b3d7ecf3
MD5 e415ecdc25ec4ea1293a1792ec153b52
SHA1 abf849adc0be2e707e8220eb0e0e2cb807440d06
SHA512 0b91e009837a7b7f8bb9efffd21ee9b5d312ab7c6883966187578da731ba8a8966a6a6b01b307304d94f0f729cb043550754dff7f03217f0bfe5b9b3207ede7e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou6:0NA1Yakeer5+nsoX
TLSH
T1F105A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2346) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 23 IoCs

pid	Process
5324	BMR3gvSA8.exe
472	s7F3e9xdT.exe
4756	67C0SxaJBk.exe
1984	UkNpMLR.exe
4720	1hXBnGGy1.exe
4828	TCtxT.exe
3428	F85md5X7AwKMF16.exe
2944	XjNc3dPiI.exe
5816	KUlW205sv.exe
6280	oRkv9.exe
6540	CcUpJn.exe
6796	w9M09Lwi.exe
7052	1dzXWh5Tex.exe
588	EkoA00M.exe
7396	77gk3teo.exe
7652	VUP55Lj.exe
7908	BkqqL.exe
4576	bz4yIeCLsGGa5Cl.exe
8180	LlHssA3.exe
8148	umkcJpO0SYHmZ.exe
8452	JipiFgtV.exe
8712	PIc3R43q.exe
8976	2UuL0ZWOMNr.exe

Adds Run key to start application 2 TTPs 23 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCUPDATE = "C:\\Windows\\2UuL0ZWOMNr.exe"	PIc3R43q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCSCAN = "C:\\Windows\\BMR3gvSA8.exe"	2026-06-26_e415ecdc25ec4ea1293a1792ec153b52_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NOTSTART = "C:\\Windows\\67C0SxaJBk.exe"	s7F3e9xdT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ALERTSVC = "C:\\Windows\\UkNpMLR.exe"	67C0SxaJBk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IAMSERV = "C:\\Windows\\1hXBnGGy1.exe"	UkNpMLR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFGWIZ = "C:\\Windows\\1dzXWh5Tex.exe"	w9M09Lwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WGFE95 = "C:\\Windows\\VUP55Lj.exe"	77gk3teo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATWATCH = "C:\\Windows\\LlHssA3.exe"	bz4yIeCLsGGa5Cl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KAVDOS32 = "C:\\Windows\\JipiFgtV.exe"	umkcJpO0SYHmZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPROTECT = "C:\\Windows\\s7F3e9xdT.exe"	BMR3gvSA8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFWATCH = "C:\\Windows\\F85md5X7AwKMF16.exe"	TCtxT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WIMMUN32 = "C:\\Windows\\XjNc3dPiI.exe"	F85md5X7AwKMF16.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCA = "C:\\Windows\\KUlW205sv.exe"	XjNc3dPiI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EFPEADM = "C:\\Windows\\CcUpJn.exe"	oRkv9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-AGNT95 = "C:\\Windows\\w9M09Lwi.exe"	CcUpJn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RTVSCN95 = "C:\\Windows\\77gk3teo.exe"	EkoA00M.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSSTAT = "C:\\Windows\\bz4yIeCLsGGa5Cl.exe"	BkqqL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFWATCH = "C:\\Windows\\oRkv9.exe"	KUlW205sv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWEEPNET = "C:\\Windows\\TCtxT.exe"	1hXBnGGy1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFIADMIN = "C:\\Windows\\EkoA00M.exe"	1dzXWh5Tex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCSHIELD = "C:\\Windows\\BkqqL.exe"	VUP55Lj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFWATCH = "C:\\Windows\\umkcJpO0SYHmZ.exe"	LlHssA3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVAPSVC = "C:\\Windows\\PIc3R43q.exe"	JipiFgtV.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 46 IoCs

description	ioc	Process
File created	C:\Windows\BMR3gvSA8.exe	2026-06-26_e415ecdc25ec4ea1293a1792ec153b52_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\s7F3e9xdT.exe	BMR3gvSA8.exe
File created	C:\Windows\1hXBnGGy1.exe	UkNpMLR.exe
File created	C:\Windows\TCtxT.exe	1hXBnGGy1.exe
File opened for modification	C:\Windows\F85md5X7AwKMF16.exe	TCtxT.exe
File opened for modification	C:\Windows\JipiFgtV.exe	umkcJpO0SYHmZ.exe
File created	C:\Windows\s7F3e9xdT.exe	BMR3gvSA8.exe
File opened for modification	C:\Windows\67C0SxaJBk.exe	s7F3e9xdT.exe
File opened for modification	C:\Windows\1hXBnGGy1.exe	UkNpMLR.exe
File created	C:\Windows\KUlW205sv.exe	XjNc3dPiI.exe
File created	C:\Windows\CcUpJn.exe	oRkv9.exe
File created	C:\Windows\UkNpMLR.exe	67C0SxaJBk.exe
File opened for modification	C:\Windows\XjNc3dPiI.exe	F85md5X7AwKMF16.exe
File opened for modification	C:\Windows\77gk3teo.exe	EkoA00M.exe
File opened for modification	C:\Windows\umkcJpO0SYHmZ.exe	LlHssA3.exe
File opened for modification	C:\Windows\KUlW205sv.exe	XjNc3dPiI.exe
File opened for modification	C:\Windows\oRkv9.exe	KUlW205sv.exe
File created	C:\Windows\1dzXWh5Tex.exe	w9M09Lwi.exe
File created	C:\Windows\VUP55Lj.exe	77gk3teo.exe
File created	C:\Windows\BkqqL.exe	VUP55Lj.exe
File created	C:\Windows\67C0SxaJBk.exe	s7F3e9xdT.exe
File opened for modification	C:\Windows\1dzXWh5Tex.exe	w9M09Lwi.exe
File created	C:\Windows\bz4yIeCLsGGa5Cl.exe	BkqqL.exe
File opened for modification	C:\Windows\LlHssA3.exe	bz4yIeCLsGGa5Cl.exe
File opened for modification	C:\Windows\PIc3R43q.exe	JipiFgtV.exe
File opened for modification	C:\Windows\2UuL0ZWOMNr.exe	PIc3R43q.exe
File opened for modification	C:\Windows\BMR3gvSA8.exe	2026-06-26_e415ecdc25ec4ea1293a1792ec153b52_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\UkNpMLR.exe	67C0SxaJBk.exe
File opened for modification	C:\Windows\TCtxT.exe	1hXBnGGy1.exe
File opened for modification	C:\Windows\CcUpJn.exe	oRkv9.exe
File opened for modification	C:\Windows\w9M09Lwi.exe	CcUpJn.exe
File created	C:\Windows\EkoA00M.exe	1dzXWh5Tex.exe
File opened for modification	C:\Windows\VUP55Lj.exe	77gk3teo.exe
File created	C:\Windows\LlHssA3.exe	bz4yIeCLsGGa5Cl.exe
File opened for modification	C:\Windows\EkoA00M.exe	1dzXWh5Tex.exe
File created	C:\Windows\F85md5X7AwKMF16.exe	TCtxT.exe
File created	C:\Windows\XjNc3dPiI.exe	F85md5X7AwKMF16.exe
File created	C:\Windows\oRkv9.exe	KUlW205sv.exe
File opened for modification	C:\Windows\BkqqL.exe	VUP55Lj.exe
File opened for modification	C:\Windows\bz4yIeCLsGGa5Cl.exe	BkqqL.exe
File created	C:\Windows\umkcJpO0SYHmZ.exe	LlHssA3.exe
File created	C:\Windows\JipiFgtV.exe	umkcJpO0SYHmZ.exe
File created	C:\Windows\w9M09Lwi.exe	CcUpJn.exe
File created	C:\Windows\77gk3teo.exe	EkoA00M.exe
File created	C:\Windows\PIc3R43q.exe	JipiFgtV.exe
File created	C:\Windows\2UuL0ZWOMNr.exe	PIc3R43q.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
8160	7396	WerFault.exe	119
8352	4576	WerFault.exe	128
2320	6096	WerFault.exe	89
7416	7652	WerFault.exe	121
8368	8976	WerFault.exe	140
1580	1984	WerFault.exe	97
9184	7052	WerFault.exe	115
3812	588	WerFault.exe	117
7808	7908	WerFault.exe	123

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67C0SxaJBk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UkNpMLR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1hXBnGGy1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XjNc3dPiI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oRkv9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CcUpJn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VUP55Lj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LlHssA3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BMR3gvSA8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s7F3e9xdT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TCtxT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	umkcJpO0SYHmZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JipiFgtV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PIc3R43q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2UuL0ZWOMNr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F85md5X7AwKMF16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w9M09Lwi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_e415ecdc25ec4ea1293a1792ec153b52_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KUlW205sv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1dzXWh5Tex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EkoA00M.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77gk3teo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BkqqL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bz4yIeCLsGGa5Cl.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-26_e415ecdc25ec4ea1293a1792ec153b52_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_e415ecdc25ec4ea1293a1792ec153b52_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 2352
  2⤵
  - Program crash
  PID:2320

C:\Windows\BMR3gvSA8.exe
C:\Windows\BMR3gvSA8.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5324

C:\Windows\s7F3e9xdT.exe
C:\Windows\s7F3e9xdT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:472

C:\Windows\67C0SxaJBk.exe
C:\Windows\67C0SxaJBk.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4756

C:\Windows\UkNpMLR.exe
C:\Windows\UkNpMLR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 2376
  2⤵
  - Program crash
  PID:1580

C:\Windows\1hXBnGGy1.exe
C:\Windows\1hXBnGGy1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4720

C:\Windows\TCtxT.exe
C:\Windows\TCtxT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4828

C:\Windows\F85md5X7AwKMF16.exe
C:\Windows\F85md5X7AwKMF16.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3428

C:\Windows\XjNc3dPiI.exe
C:\Windows\XjNc3dPiI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2944

C:\Windows\KUlW205sv.exe
C:\Windows\KUlW205sv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5816

C:\Windows\oRkv9.exe
C:\Windows\oRkv9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6280

C:\Windows\CcUpJn.exe
C:\Windows\CcUpJn.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6540

C:\Windows\w9M09Lwi.exe
C:\Windows\w9M09Lwi.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6796

C:\Windows\1dzXWh5Tex.exe
C:\Windows\1dzXWh5Tex.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7052 -s 2296
  2⤵
  - Program crash
  PID:9184

C:\Windows\EkoA00M.exe
C:\Windows\EkoA00M.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 2396
  2⤵
  - Program crash
  PID:3812

C:\Windows\77gk3teo.exe
C:\Windows\77gk3teo.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 2080
  2⤵
  - Program crash
  PID:8160

C:\Windows\VUP55Lj.exe
C:\Windows\VUP55Lj.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7652 -s 2272
  2⤵
  - Program crash
  PID:7416

C:\Windows\BkqqL.exe
C:\Windows\BkqqL.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7908 -s 2384
  2⤵
  - Program crash
  PID:7808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 7396 -ip 7396
1⤵
PID:8140

C:\Windows\bz4yIeCLsGGa5Cl.exe
C:\Windows\bz4yIeCLsGGa5Cl.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 2080
  2⤵
  - Program crash
  PID:8352

C:\Windows\LlHssA3.exe
C:\Windows\LlHssA3.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8180

C:\Windows\umkcJpO0SYHmZ.exe
C:\Windows\umkcJpO0SYHmZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4576 -ip 4576
1⤵
PID:8332

C:\Windows\JipiFgtV.exe
C:\Windows\JipiFgtV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8452

C:\Windows\PIc3R43q.exe
C:\Windows\PIc3R43q.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8712

C:\Windows\2UuL0ZWOMNr.exe
C:\Windows\2UuL0ZWOMNr.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8976 -s 2096
  2⤵
  - Program crash
  PID:8368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6096 -ip 6096
1⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 7652 -ip 7652
1⤵
PID:9208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 8976 -ip 8976
1⤵
PID:8364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1984 -ip 1984
1⤵
PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 7052 -ip 7052
1⤵
PID:9148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 588 -ip 588
1⤵
PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 7908 -ip 7908
1⤵
PID:7376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1dzXWh5Tex.exe

Path C:\Windows\1dzXWh5Tex.exe
Size 804KB
SHA256 a32c539845dc71da507c491db24fc703902d45bdabc27747def8341858dde99a
MD5 e26b2376600362aa593d9d9ea1e8df68
SHA1 b6f803638a405151c67b0be5bad70ecd3011c056
SHA512 84047ad38951e5970a298628ee5f721e40f646ecaa1a117b69eb9229f10973c0227498a8d59943e1d7c9f3b1feb3824436ddd7fcffddcca6ff2f40a21a5746c5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou3:0NA1Yakeer5+nso6
TLSH
T11605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1hXBnGGy1.exe

Path C:\Windows\1hXBnGGy1.exe
Size 804KB
SHA256 afa760f8809d4d5ad91bb3c6935854bc630614f0780b55d74058545b1f7616fd
MD5 61f70c6680088842353b2c666f767619
SHA1 2b8850757ab682b52337a6ea5d9423c645594d76
SHA512 fc8c8d11248ebb792e7524fb122b9c2d440d9067b48441de34762e89b4f9a75f9b622fe6f75e8b40cad95f76e5d5ddce203014d26e0b4db6af5709bcf8529c26
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouo:0NA1Yakeer5+nso5
TLSH
T19B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2UuL0ZWOMNr.exe

Path C:\Windows\2UuL0ZWOMNr.exe
Size 804KB
SHA256 e6351def5f859502e0e70ec43cda759e1ce331138e178195a4b1184d64fd6691
MD5 666d38cd71ccbef4c4f79f5ade34e494
SHA1 6a4427d13357ad95105785700a049a480463cdc2
SHA512 1716161c7c679c5592a2be374a8fda23f3afd1fcb5297e8548b744a794a8539aa7e385ec7627d0668f609c9739fac9c72808afb827319ba6fee81e35d2c17e5c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nso9
TLSH
T18C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67C0SxaJBk.exe

Path C:\Windows\67C0SxaJBk.exe
Size 804KB
SHA256 bb69449b5fcb8166b35f5c21225d04819d47a7257a042332c25bc32793531af7
MD5 0fe9a0ddaca7be3eaab80422bee91354
SHA1 d36470d24e5d1447945cf56ec47822bf32957542
SHA512 6eb83ecd7ec5414ff3112eeb58bf2d4cfd5d7b3ded3a422e429fda8171309f6113db6d1e5697b1b8d5b0584ff7266546ba8e18d2c1d247780c426b4ff79f9c04
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nso6
TLSH
T1F005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77gk3teo.exe

Path C:\Windows\77gk3teo.exe
Size 804KB
SHA256 b42eb81a7039e7ed3f22c0ea2467d9e6999edb766d44b7b1fba226c2c98a0548
MD5 9d20b09e036d76826e1a0cf5d3bcf8d8
SHA1 740b1952ef3135c32d9ebab63e8f5947af48b1cc
SHA512 afcd999e303cab1a70fade83bd2122c78a5bd3d712b11a30b2104bce18259e96a306e401856c90a3d605c7c141ff36d3cfdd1b15ca503956a270d37f1b895060
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou0:0NA1Yakeer5+nsoJ
TLSH
T12105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BMR3gvSA8.exe

Path C:\Windows\BMR3gvSA8.exe
Size 804KB
SHA256 661ea5bb8aa92ba6b0667de0ec880d7e6db36fcfec8b8b94a510fc38796945b3
MD5 b8bb018497d5f6497aed3eed6649cf40
SHA1 155c44d0662869614a7812382fb0f2050c1e0e73
SHA512 3074fc06a3114b5c35652b4b26650bd47415335ae5a4664a78beba827894cc68d965d122532b2c2e4eb65e83a2b10916a10f85210653b7edf360d8b61ccb3c18
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouu:0NA1Yakeer5+nsoz
TLSH
T14605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BkqqL.exe

Path C:\Windows\BkqqL.exe
Size 804KB
SHA256 f35611dc862ff5175824b6f83b5a38143bc98726fe315311271a24d03120f491
MD5 67576a0884d8b12e7e132e14aff1998d
SHA1 f8113ecf556b9ee03be875b589ea946cbab8bf9f
SHA512 d8d7ff2018b4feeb050cc3c5cc40c5226e0784f73ae86c3babd308738bd2bbc257ed95682671a9fe9851ee0b5e2ca55e5485710b65cb21de00fb4585cd25e3f3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nsos
TLSH
T1FA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CcUpJn.exe

Path C:\Windows\CcUpJn.exe
Size 804KB
SHA256 21db8f5a983db3b9019ec1b2d153404cd4f3f8c8d950d9ddf8d0338ba194d96e
MD5 b36d4d1b0bc53d761aa80b8abedc1393
SHA1 762818bdbf3c6990b10deb2d28af6c46e9482394
SHA512 c36ad956ff9c99757a1eb6f340ebbad120924197230a292fcf64895d4af12e49496918d6b1d0839741c5f770d7bc51cf883c00afcc708b96474f25adcd916aa5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsos
TLSH
T17105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EkoA00M.exe

Path C:\Windows\EkoA00M.exe
Size 804KB
SHA256 e488a9cc62cc6748afde8eeac13d7262dbe57d3e2f42d7ca12cad5bedfbd3426
MD5 240df8c496233a9a7fb9c2190e1638b0
SHA1 56cfc72a88d541292936fbb57095016753aa654e
SHA512 935816505ee688a0e96e2d8407f8d7b49f7cfcef298e54dc5c270a720c70c8ca2eb8ad9268ed1c11a91e9a552158bd8bce96334b087a606a9191fecf1b47ad61
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouC:0NA1Yakeer5+nsoR
TLSH
T10A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F85md5X7AwKMF16.exe

Path C:\Windows\F85md5X7AwKMF16.exe
Size 804KB
SHA256 b57e1879f83fbed6e72b5b85978c5381f1d76b82cf12f406bdbee72a5a09bb4e
MD5 ae6d6b9814665cc9227153187fdef09f
SHA1 f4054a3e15759f66581b382b3df99f82a205547b
SHA512 9388a177060dd8fe9e950380a613a95075a9d286b9d1628a027a7b8ba71903e4d28cdc01e37d266c0199212879ca2cbf06e633a9743c208b7ce66f8ff5702999
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouB:0NA1Yakeer5+nsoO
TLSH
T14A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JipiFgtV.exe

Path C:\Windows\JipiFgtV.exe
Size 804KB
SHA256 a19702e0a1b176ccab6452a03db9b4f7c8175b27d76acf99f4fe706833706777
MD5 b2f7e6a92e683dc81b896dd31fc9d182
SHA1 4fd1209e51503a538320f52dcb0f5eae61cab534
SHA512 176089e4ad497e2de83881cb1832e6bfdf3b6258a0ad7db583f6472a513cd8be8533faff75f7f2fff6e581f9a3afcd78eca6dcfd1eb65b644507bedf43b9b65a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouv:0NA1Yakeer5+nsoi
TLSH
T1E805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KUlW205sv.exe

Path C:\Windows\KUlW205sv.exe
Size 804KB
SHA256 285ec187c79ccbefe351c31aa96d561f25a2bef8732c5010854054cf0215d055
MD5 46e7b1c616ad2e120cd02ea32d8f2b8a
SHA1 afc9462eecc5c600a4be9f767885211f8d870199
SHA512 4f34e470c142e1b45f5d2cd18a05928fe1e4590050d55553ba24e05cf808371d7bc1e68997eb831c3fdd34129c0e0d42b0f0be886e6ee6349a6f21cfb615187f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nsov
TLSH
T19205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LlHssA3.exe

Path C:\Windows\LlHssA3.exe
Size 804KB
SHA256 95e480e05d8293d8bca8c3c0d57f18d044d33e2b0c0a779a78ba3dacc2eaa2dc
MD5 eb1b23b2943d2b6281dacb46e2f46be1
SHA1 0cf2ff2b2e08530356682c5ef93a38ac209fa91c
SHA512 484e5be11671872ae781faba7e746b23576ff2558afe2a9d3280fb801bb0e86fdbad14159de39eb2f195aed7ef86ee4729bf402d2660a6f3eae0649b2105a4fc
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou4:0NA1Yakeer5+nsoF
TLSH
T1C205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PIc3R43q.exe

Path C:\Windows\PIc3R43q.exe
Size 804KB
SHA256 df4c8fa9ee0499b74442ba3a7c1a36f3a98336a73c28f7d48597312bb8acf6f1
MD5 144cb1a47ddc42dc34fee29baf42ffcb
SHA1 a3c8a635b488c8de3e1101c29dd817cd8673d600
SHA512 8018acc0c249c13f48d89220a7877f521c433bba753d3779bd10a3ff87f1ab39800afdf04bdbd22032ed22123a30a6fea70c92c9865132c7aa60f917d1fcc7f1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nsoW
TLSH
T14305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TCtxT.exe

Path C:\Windows\TCtxT.exe
Size 804KB
SHA256 503fdbef0010071a8211a6af0e0d9909d10e246d8623669ca73295face3cf091
MD5 c08172de9e3b8df7a373e764beb52d05
SHA1 5c2147f8b6b845a2ab8d61b694b9a4b119385cf2
SHA512 b05cd94a7ff7766ad2a61de983e8cc6696b61a935bf2d644f622792d38a476dacd1a97444e0aec41e7bf7261cb5dcfd9edaca83f99c2fac0349eab693eed01f6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFour:0NA1Yakeer5+nsoG
TLSH
T19405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UkNpMLR.exe

Path C:\Windows\UkNpMLR.exe
Size 804KB
SHA256 5de779e7fcfbdd4066d11d728e612c742b31d6da89f13a97d06d84bc60d8e613
MD5 ce98abe8fc84de70eda58533d46202be
SHA1 514fb536421fcd08e7f7c0ce6f70aacb66d7503f
SHA512 e49701655e0aab1b9310c32901aa0886fa37f2c53477b97b52a73007c1c0ab78535660d702211d4bb4e49cb3a54fe60f1d0036ee3a390401f4df8034e97e9192
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouV:0NA1Yakeer5+nsoC
TLSH
T15005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VUP55Lj.exe

Path C:\Windows\VUP55Lj.exe
Size 804KB
SHA256 038c960e066d3f6e02bab9ceb80521512bf66acbcef3fdebaced808a6fa76571
MD5 248b9352209ff44ecc581b423613e4c2
SHA1 ad84f6e2c2e451829d633ec445d88cbfd0e17474
SHA512 188745133135ea7d0b311471c33cc39cc709e29a6f02c4f603ad7d8c219bd86555bf227633e80650891d03c7fe6490a2c15e4c4a4e80f4f9ef720deadb705e16
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nso7
TLSH
T16A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XjNc3dPiI.exe

Path C:\Windows\XjNc3dPiI.exe
Size 804KB
SHA256 783b48447b49913e747f3cc5f75cd68b1428d5c8c58cf21815dff06ebf7fd012
MD5 639fef7f69cb7528b23bf2a166c7c0be
SHA1 1675a1a0df23a7c5a95512f761e79b31b4ce81d9
SHA512 4e0f478c5e4787c9559e1f5c5f1df7473890c237a6700cfdca4b2adb1da075e334a601b8d0e3976edf3db20e680f1337d90d93a66f8affc5ab1b084dedca8516
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nsoL
TLSH
T12E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bz4yIeCLsGGa5Cl.exe

Path C:\Windows\bz4yIeCLsGGa5Cl.exe
Size 804KB
SHA256 4069cced42ec15a98ead2e41915bd07d40e66b4a22df53c04c23280e4d890701
MD5 1eb81e62923a171643e2118d66101a79
SHA1 5d0e5bb79b9954033c32a92204cefc35f9945105
SHA512 24a4eb61749b6c9cb1f882e81c7e60c98ac80c5b0849c51ccc154b1cf6fa0d2f96400efda7c3c1c4ad817775c42040c01d87e60130ad8fc16ebcebd7e5e028f6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouc:0NA1Yakeer5+nsoz
TLSH
T16405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oRkv9.exe

Path C:\Windows\oRkv9.exe
Size 804KB
SHA256 4832193fa7b4fe617a7f09b8c7061d6aeb9e82442c4fbb5acbe3fcde88cff793
MD5 42a0680a86e949eb2a8e79dc34ed01c6
SHA1 707582e266c4cd12eefc64bd93d709540a389b21
SHA512 a9c98ef0b620bfc914f0993d744c0f1e2ac97310737a4354b21bf0f18287cc34434a728ca54e2b3ecb5d6b877f2be2da49f996922184567dccdb7d06c4c5366a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nsol
TLSH
T1A305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s7F3e9xdT.exe

Path C:\Windows\s7F3e9xdT.exe
Size 804KB
SHA256 9ebfcf5f6668358a3c8fdc046f54f571c591575513bb104dbd4f12c007db8389
MD5 796e49faae768a338c42d82101778312
SHA1 74aa8d6811255f8ea85b462eb72312bb4baf8353
SHA512 087b011f92b9c7a3bb3a4105781b9d4de81d37e1b976c9a9f6dd9aea4f7d9fc204e9cc6e60417c21e9c8a72259fc814aaa7fab2f175a076d5a0705af8af7a462
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nsoe
TLSH
T16805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umkcJpO0SYHmZ.exe

Path C:\Windows\umkcJpO0SYHmZ.exe
Size 804KB
SHA256 868655bfa03cd01a8d61e58080f8d0d97e3c5c9d1f686f2f3e48f2102e4f5a87
MD5 d7c689849c7a86839541e834bb3c0568
SHA1 658574102c62f4e51647f5e61d6ad64c6f5960c3
SHA512 283d129d619163a06136f8d316ddf9d5b4a59a7a2cc52b6e0360ec082cb05fd245f99e6a3bdbbfe190862d27613b72ef5e6d789d63e6966ada379f490a13f0ae
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou8:0NA1Yakeer5+nsoj
TLSH
T19D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w9M09Lwi.exe

Path C:\Windows\w9M09Lwi.exe
Size 804KB
SHA256 55097da0c3a37f8b229fa95b2449dd42028b0860ac16225d6348aa5c2992d57a
MD5 6ff05e9a079c092760fb7241fd2f8ab0
SHA1 4d9fbcb5edb4ea8773e8a19c002132ae392a2b12
SHA512 7271c1c9f59620bb5cc61992193a4ff2cd84fd9676c894e1b8e99636d44be27ff42474b276c9fbce3ffc15fc8b3816cafcc88e104fc272488384e827740f473d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou4:0NA1Yakeer5+nsoX
TLSH
T1A005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads