Overview

overview

9

Static

static

3

2026-07-03...at.exe

windows10-2004-x64

9

2026-07-03...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 02:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-03_85bd66b515581282084c10343fdcaf99_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
  • Size 804KB
  • Sample260703-dbs1kaft9p
  • SHA256 cbda30afa9a0101ad4f5d5445e3a9f6df636bb42c10bdb9f1b47e26569eebc5c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Contacts a large (2168) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 20 IoCs
  • Adds Run key to start application 2 TTPs 20 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 40 IoCs
  • Program crash 9 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 50 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_85bd66b515581282084c10343fdcaf99_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-03_85bd66b515581282084c10343fdcaf99_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:1996
  • C:\Windows\ZRkMj0qUE.exe
    C:\Windows\ZRkMj0qUE.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:3512
  • C:\Windows\9zjc5zodeY.exe
    C:\Windows\9zjc5zodeY.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:5032
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 2384
      2⤵
      • Program crash
      PID:8416
  • C:\Windows\ShovmNvd7.exe
    C:\Windows\ShovmNvd7.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:3632
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 2080
      2⤵
      • Program crash
      PID:2028
  • C:\Windows\J8syyJ.exe
    C:\Windows\J8syyJ.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:1004
  • C:\Windows\KscNUY.exe
    C:\Windows\KscNUY.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:3872
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 2404
      2⤵
      • Program crash
      PID:6248
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3632 -ip 3632
    1⤵
      PID:4316
    • C:\Windows\6v4nZ.exe
      C:\Windows\6v4nZ.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2488
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 2384
        2⤵
        • Program crash
        PID:3456
    • C:\Windows\ly4jA6Ml1N4Hj.exe
      C:\Windows\ly4jA6Ml1N4Hj.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:4856
    • C:\Windows\la7D7h.exe
      C:\Windows\la7D7h.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:5052
    • C:\Windows\lyBbnnrNRLEN54.exe
      C:\Windows\lyBbnnrNRLEN54.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1280
    • C:\Windows\tZMSVwQsHmWvV.exe
      C:\Windows\tZMSVwQsHmWvV.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:4216
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 2492
        2⤵
        • Program crash
        PID:7268
    • C:\Windows\Rqd9SBV4zQan1j.exe
      C:\Windows\Rqd9SBV4zQan1j.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:3428
    • C:\Windows\173LrlD3KA.exe
      C:\Windows\173LrlD3KA.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:6252
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 6252 -s 2312
        2⤵
        • Program crash
        PID:8124
    • C:\Windows\U5P40.exe
      C:\Windows\U5P40.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:6504
    • C:\Windows\6JKSA1TJ0a.exe
      C:\Windows\6JKSA1TJ0a.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:6748
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 6748 -s 2496
        2⤵
        • Program crash
        PID:836
    • C:\Windows\2u1klcJQavxNvFM.exe
      C:\Windows\2u1klcJQavxNvFM.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:7000
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 7000 -s 2080
        2⤵
        • Program crash
        PID:7572
    • C:\Windows\JliWEvQJ0HR.exe
      C:\Windows\JliWEvQJ0HR.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:6776
    • C:\Windows\BFVD3S3.exe
      C:\Windows\BFVD3S3.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:7360
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 7000 -ip 7000
      1⤵
        PID:7520
      • C:\Windows\g3VGo2FO1LZ5vU.exe
        C:\Windows\g3VGo2FO1LZ5vU.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:7664
      • C:\Windows\vQS7LpVY.exe
        C:\Windows\vQS7LpVY.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:7944
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 7944 -s 2196
          2⤵
          • Program crash
          PID:8380
      • C:\Windows\Bc6bMXdiUomEl.exe
        C:\Windows\Bc6bMXdiUomEl.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:7312
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:5944
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4704
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4676
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k GPSvcGroup
        1⤵
          PID:8696
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 7944 -ip 7944
          1⤵
            PID:8260
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5032 -ip 5032
            1⤵
              PID:8432
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2488 -ip 2488
              1⤵
                PID:8872
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6252 -ip 6252
                1⤵
                  PID:7964
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3872 -ip 3872
                  1⤵
                    PID:8512
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4216 -ip 4216
                    1⤵
                      PID:4668
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6748 -ip 6748
                      1⤵
                        PID:7356

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            prep_Activatable Class_Hermes_perf.cache
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                            • Size 603B
                            • SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            prep_Activatable Class_Hermes_perf.cache
                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                            • Size 599B
                            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            173LrlD3KA.exe
                            • Path C:\Windows\173LrlD3KA.exe
                            • Size 804KB
                            • SHA256 70190836e67e1dac0556398ffce2be6d4a4e0d66a3c154eea34c9548275e2e08
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            2u1klcJQavxNvFM.exe
                            • Path C:\Windows\2u1klcJQavxNvFM.exe
                            • Size 804KB
                            • SHA256 eeab0cb0b425c22326417d1d0ccbd7f2f8fae7e738fa65e6d52f66cf6a801096
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            6JKSA1TJ0a.exe
                            • Path C:\Windows\6JKSA1TJ0a.exe
                            • Size 804KB
                            • SHA256 5ad5237aa0dbc4443633fcf4aa63ce5a0aac539076369ed49ee75c3733884fc3
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            6v4nZ.exe
                            • Path C:\Windows\6v4nZ.exe
                            • Size 804KB
                            • SHA256 393ea9f1d1e3f85ffca6d4160d517aa9fd68d65fd2105b0df632e1d25c01a0a2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            9zjc5zodeY.exe
                            • Path C:\Windows\9zjc5zodeY.exe
                            • Size 804KB
                            • SHA256 0c069b69097e8ac2a338da10b4157bec2b265686f77b4f810e4d735e91952507
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            BFVD3S3.exe
                            • Path C:\Windows\BFVD3S3.exe
                            • Size 804KB
                            • SHA256 8b425cad68a69450c7ee63c2174cf91bbfb63b4cb4b08d176fdc5c0b53d8bdc0
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Bc6bMXdiUomEl.exe
                            • Path C:\Windows\Bc6bMXdiUomEl.exe
                            • Size 804KB
                            • SHA256 b934a6ad621b25b92b707e92d180ba323527b0e8e01d9bb10f10e9413554fa95
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            J8syyJ.exe
                            • Path C:\Windows\J8syyJ.exe
                            • Size 804KB
                            • SHA256 168a83efa62f4fea7cf9eaa10f8c9a7659584732e2d5923b26ce60de22e0890f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            JliWEvQJ0HR.exe
                            • Path C:\Windows\JliWEvQJ0HR.exe
                            • Size 804KB
                            • SHA256 f52d91b2a2eb5a0934a5f58a3d2a328f0c7377304c2646d1df138ac15491154b
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            KscNUY.exe
                            • Path C:\Windows\KscNUY.exe
                            • Size 804KB
                            • SHA256 8baaa68899db62c094bd557c4d4ebf0e2816619e25bcc93489ebdd2822179c62
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Rqd9SBV4zQan1j.exe
                            • Path C:\Windows\Rqd9SBV4zQan1j.exe
                            • Size 804KB
                            • SHA256 167fe284cd2d5522c034ff1f00736ef5cbcaaec0a1e2c6ef5b2aaea9e4da0ba8
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ShovmNvd7.exe
                            • Path C:\Windows\ShovmNvd7.exe
                            • Size 804KB
                            • SHA256 24c6665db056421d8d0580aae6256429d568bc859bb1b5b12c1ea22a0209e9ee
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            U5P40.exe
                            • Path C:\Windows\U5P40.exe
                            • Size 804KB
                            • SHA256 1952a54295e3ba94e33307ee6bd1cbf6f05bd0e6e5673c7d5eaf6719417092a9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ZRkMj0qUE.exe
                            • Path C:\Windows\ZRkMj0qUE.exe
                            • Size 804KB
                            • SHA256 9a4b99225a777a1327aebf8639a0c0ceb09b93b4478da213fbee8c89bcfb769c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            g3VGo2FO1LZ5vU.exe
                            • Path C:\Windows\g3VGo2FO1LZ5vU.exe
                            • Size 804KB
                            • SHA256 34d8da94cf40a3d82e74353e6e96edbb504c2acb348972970268ab352d63f873
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            la7D7h.exe
                            • Path C:\Windows\la7D7h.exe
                            • Size 804KB
                            • SHA256 dd1bc7825d531f225b7b033b6be9d073a1f5c6ef05492d2d9d4cfd9a5944b200
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ly4jA6Ml1N4Hj.exe
                            • Path C:\Windows\ly4jA6Ml1N4Hj.exe
                            • Size 804KB
                            • SHA256 bff892d1ea9818151a888de7e66c1fa59b444d4143c79e6ad32e43d58dc09e1f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            lyBbnnrNRLEN54.exe
                            • Path C:\Windows\lyBbnnrNRLEN54.exe
                            • Size 804KB
                            • SHA256 1b58ab6d2c90625bb3217f8f6f9f58ebc5deacea9f6053adfd35270a8eb05cb7
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            tZMSVwQsHmWvV.exe
                            • Path C:\Windows\tZMSVwQsHmWvV.exe
                            • Size 804KB
                            • SHA256 d0a993eb9947787ae3e76c19841be16b628d333d178af7ae708eaec5698dffb9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            vQS7LpVY.exe
                            • Path C:\Windows\vQS7LpVY.exe
                            • Size 804KB
                            • SHA256 effbee99a026a9628d0520fd981f03752aa00cc929afb69cd0c7a981b965da81
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            memory/4676-348-0x000001DF000C0000-0x000001DF0037C000-memory.dmp
                            Download

                            memory/4676-494-0x000001DF000C0000-0x000001DF0037C000-memory.dmp
                            Download

                            memory/4704-155-0x0000020E001E0000-0x0000020E002E0000-memory.dmp
                            Download

                            memory/4704-190-0x0000020E14220000-0x0000020E14240000-memory.dmp
                            Download

                            memory/4704-169-0x0000020E01E60000-0x0000020E01F60000-memory.dmp
                            Download

                            memory/4704-175-0x0000020E01D40000-0x0000020E01D60000-memory.dmp
                            Download

                            memory/4704-168-0x0000020E01B80000-0x0000020E01BA0000-memory.dmp
                            Download