Overview

overview

9

Static

static

3

2026-07-06...at.exe

windows10-2004-x64

7

2026-07-06...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 22:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_09bdf306df246f888fc3905d39aa7c1c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
  • Size 804KB
  • Sample260706-2pw65sc15x
  • SHA256 53e1a1249dd48ab1c7d99cd81514fc95f2e7667354a6d6dd2513a9f0571e780f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwarediscoverypersistencespyware

Malware Config

Signatures

  • Contacts a large (2292) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 22 IoCs
  • Adds Run key to start application 2 TTPs 22 IoCs
    persistence
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 44 IoCs
  • Program crash 7 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_09bdf306df246f888fc3905d39aa7c1c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_09bdf306df246f888fc3905d39aa7c1c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:2552
  • C:\Windows\7a44dX7Rjvha0Z.exe
    C:\Windows\7a44dX7Rjvha0Z.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:1532
  • C:\Windows\9AElt.exe
    C:\Windows\9AElt.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:6056
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 2080
      2⤵
      • Program crash
      PID:4384
  • C:\Windows\ZIRbb34bWKH.exe
    C:\Windows\ZIRbb34bWKH.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:1788
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 2268
      2⤵
      • Program crash
      PID:9088
  • C:\Windows\J6xhBevBo.exe
    C:\Windows\J6xhBevBo.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:4640
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 6056 -ip 6056
    1⤵
      PID:4868
    • C:\Windows\aVagNuL.exe
      C:\Windows\aVagNuL.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:5300
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5300 -s 2268
        2⤵
        • Program crash
        PID:9160
    • C:\Windows\9Td2mDT0P9AsI9P.exe
      C:\Windows\9Td2mDT0P9AsI9P.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:3480
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 2268
        2⤵
        • Program crash
        PID:8160
    • C:\Windows\Xy7bP9as24iO.exe
      C:\Windows\Xy7bP9as24iO.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2920
    • C:\Windows\uQKzFayMqR.exe
      C:\Windows\uQKzFayMqR.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2872
    • C:\Windows\axbRem6w.exe
      C:\Windows\axbRem6w.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:3020
    • C:\Windows\dKor1XNCpqiF1q.exe
      C:\Windows\dKor1XNCpqiF1q.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:832
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 2272
        2⤵
        • Program crash
        PID:8720
    • C:\Windows\x7zwZExLLqJm.exe
      C:\Windows\x7zwZExLLqJm.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:3624
    • C:\Windows\RlhkZgvuPv7Pg5b.exe
      C:\Windows\RlhkZgvuPv7Pg5b.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:6244
    • C:\Windows\Rvgvb8AQrkvXy.exe
      C:\Windows\Rvgvb8AQrkvXy.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:6492
    • C:\Windows\5BaL5na66rB.exe
      C:\Windows\5BaL5na66rB.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:6748
    • C:\Windows\rHv7Gv3UxGFnSV.exe
      C:\Windows\rHv7Gv3UxGFnSV.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:6996
    • C:\Windows\SvQotVyWWyv54em.exe
      C:\Windows\SvQotVyWWyv54em.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:6760
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 2268
        2⤵
        • Program crash
        PID:8956
    • C:\Windows\IudiN.exe
      C:\Windows\IudiN.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:7368
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 7368 -s 2296
        2⤵
        • Program crash
        PID:4328
    • C:\Windows\wqEoHAtWbi5P.exe
      C:\Windows\wqEoHAtWbi5P.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:7620
    • C:\Windows\gFrXK47QG6OQAk.exe
      C:\Windows\gFrXK47QG6OQAk.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:7880
    • C:\Windows\Axva6dBCqiAuVn.exe
      C:\Windows\Axva6dBCqiAuVn.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:8132
    • C:\Windows\RYvorceSM8Q.exe
      C:\Windows\RYvorceSM8Q.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:8260
    • C:\Windows\LXQ32SDJQJmQE.exe
      C:\Windows\LXQ32SDJQJmQE.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:8516
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1788 -ip 1788
      1⤵
        PID:9068
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5300 -ip 5300
        1⤵
          PID:9140
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3480 -ip 3480
          1⤵
            PID:9200
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 832 -ip 832
            1⤵
              PID:8700
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 6760 -ip 6760
              1⤵
                PID:1992
              • C:\Windows\system32\sihost.exe
                sihost.exe
                1⤵
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:1464
                • C:\Windows\explorer.exe
                  explorer.exe /LOADSAVEDWINDOWS
                  2⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:9124
              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:4076
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:4784
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 7368 -ip 7368
                1⤵
                  PID:4892

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      prep_Activatable Class_Hermes_perf.cache
                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                      • Size 599B
                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      5BaL5na66rB.exe
                      • Path C:\Windows\5BaL5na66rB.exe
                      • Size 804KB
                      • SHA256 b83516922ca8d7a15738048d7153afa6762f240ba55de6f2dba63c18f381e479
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      7a44dX7Rjvha0Z.exe
                      • Path C:\Windows\7a44dX7Rjvha0Z.exe
                      • Size 804KB
                      • SHA256 6bf5a9d256815cfea7f1be3f28de9f5b9970f648ba7e653f9aac0dda50d7c879
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      9AElt.exe
                      • Path C:\Windows\9AElt.exe
                      • Size 804KB
                      • SHA256 85303230939824ad5309dedbf2aec0a70ccbed60e9b38be19b82d691ad86633f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      9Td2mDT0P9AsI9P.exe
                      • Path C:\Windows\9Td2mDT0P9AsI9P.exe
                      • Size 804KB
                      • SHA256 1157173345791645c385b09addbef804eb3a2680780432a3677dc1f4ad9723e3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Axva6dBCqiAuVn.exe
                      • Path C:\Windows\Axva6dBCqiAuVn.exe
                      • Size 804KB
                      • SHA256 d3fc2d21df334023218fa2913157ed533719a4f432c9922c07730c54637df799
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      IudiN.exe
                      • Path C:\Windows\IudiN.exe
                      • Size 804KB
                      • SHA256 88686b5c38c363a7ab26aadd4edd4f9c00a4d75112b367373a59669fc5a9ed3d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      J6xhBevBo.exe
                      • Path C:\Windows\J6xhBevBo.exe
                      • Size 804KB
                      • SHA256 55925ce842579ec04b699ee9901ec57fdab20847053ccbc5f5e8bbab4fac205c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      LXQ32SDJQJmQE.exe
                      • Path C:\Windows\LXQ32SDJQJmQE.exe
                      • Size 804KB
                      • SHA256 647522bdf713a317b291c91a45b68058f6b21556c79490cec7f8d9cbb8485026
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      RYvorceSM8Q.exe
                      • Path C:\Windows\RYvorceSM8Q.exe
                      • Size 804KB
                      • SHA256 c90e1c1fb0de906ba364cad6b5d14f5daa40d56c13ec84e297913cbb82c2ed4b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      RlhkZgvuPv7Pg5b.exe
                      • Path C:\Windows\RlhkZgvuPv7Pg5b.exe
                      • Size 804KB
                      • SHA256 74b94035a5a9d1c38feeed027b4d10439e8d8c37bb24610d3b70f18d91003452
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Rvgvb8AQrkvXy.exe
                      • Path C:\Windows\Rvgvb8AQrkvXy.exe
                      • Size 804KB
                      • SHA256 4e5a099574a89baabb0312c89c7ef99b2642cfc4c7bf1095bb43b6a805549389
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      SvQotVyWWyv54em.exe
                      • Path C:\Windows\SvQotVyWWyv54em.exe
                      • Size 804KB
                      • SHA256 5a78869ac4d0f9a179459244d2118a99706ca892ee10a829c321906a17a161a0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Xy7bP9as24iO.exe
                      • Path C:\Windows\Xy7bP9as24iO.exe
                      • Size 804KB
                      • SHA256 23a1ba1bdfed66e9765c187acbfc9d8cc99b94ff1e637f26f03069082c8dd620
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ZIRbb34bWKH.exe
                      • Path C:\Windows\ZIRbb34bWKH.exe
                      • Size 804KB
                      • SHA256 92c10ad3e1b1eb15fb9df118ef8cd16563dffc5069cb3c81f8ce0b80fcb30f3a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      aVagNuL.exe
                      • Path C:\Windows\aVagNuL.exe
                      • Size 804KB
                      • SHA256 79e510b56365ec7cc470e3126d130c9a8488e46676d4b89cd6295b9b641f4cbd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      axbRem6w.exe
                      • Path C:\Windows\axbRem6w.exe
                      • Size 804KB
                      • SHA256 7c9d78391dd9d15d3c038323d5977dac2c363b80ada26aa426557ff25008cfae
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      dKor1XNCpqiF1q.exe
                      • Path C:\Windows\dKor1XNCpqiF1q.exe
                      • Size 804KB
                      • SHA256 c6265b080e11c2b3f7485c922d46f5ac6523329baf40a091f500ad6d3ad07c44
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      gFrXK47QG6OQAk.exe
                      • Path C:\Windows\gFrXK47QG6OQAk.exe
                      • Size 804KB
                      • SHA256 ee380b5741eba4dc7ce3a5e205f5e3eec5dac7e5fac64476d1f6c4d70be5020c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      rHv7Gv3UxGFnSV.exe
                      • Path C:\Windows\rHv7Gv3UxGFnSV.exe
                      • Size 804KB
                      • SHA256 82eb645ed12ad5fcc77d1f438dc4b978889be6ac5681718aba1134c53000d115
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      uQKzFayMqR.exe
                      • Path C:\Windows\uQKzFayMqR.exe
                      • Size 804KB
                      • SHA256 2090dd053bf7c88a67a4f5debe6b80d6087c1a7afe125e2a899bbd72f53d024a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wqEoHAtWbi5P.exe
                      • Path C:\Windows\wqEoHAtWbi5P.exe
                      • Size 804KB
                      • SHA256 4560d80d0d730bf94cf1830864172256d7a3ed65e401f06b6629fcfc9dc44ad4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      x7zwZExLLqJm.exe
                      • Path C:\Windows\x7zwZExLLqJm.exe
                      • Size 804KB
                      • SHA256 9d2d133bdf59036f819ceb91f2212e8a6e5432503c88cba37130ecc59eedea1a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/4076-199-0x000001E5801E0000-0x000001E5802E0000-memory.dmp
                      Download

                      memory/4076-225-0x000001E581990000-0x000001E5819B0000-memory.dmp
                      Download

                      memory/4076-243-0x000001E581D60000-0x000001E581D80000-memory.dmp
                      Download

                      memory/4076-226-0x000001E581DC0000-0x000001E581EC0000-memory.dmp
                      Download

                      memory/4076-264-0x000001E5841E0000-0x000001E584200000-memory.dmp
                      Download

                      memory/9124-391-0x000000000D780000-0x000000000D7C2000-memory.dmp
                      Download