97a620d7957041729d87f9b028dc425a1db9a5c93a05ee7a119a2431110cf8cc

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_ea4b59f0f0d6bc476dfdf790f98e073f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260706-v2pt9sd14n
SHA256 97a620d7957041729d87f9b028dc425a1db9a5c93a05ee7a119a2431110cf8cc
MD5 ea4b59f0f0d6bc476dfdf790f98e073f
SHA1 f18e3c3e5b918ef14346ba2472ceaa57f3419172
SHA512 ecc83f1dc0955e60a29905133c99447692990a48a67af57e151a2abb251724ebc6fb4cddc03a52053dcccebd9e5c620a2b4cfe26bd0f59de6b24d2e987e10f2b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoua:0NA1Yakeer5+nso7
TLSH
T17F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2019) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 20 IoCs

pid	Process
2392	OP4zrGwkaMxQY.exe
1836	OxgJYFKc7m4.exe
1792	VLUREmVwNl.exe
1460	zMI5ghG.exe
5784	85LjuqMGhIP9BSX.exe
3264	MH5lvd1.exe
5064	zsW0imERhaO.exe
1244	sQhRQeYqv9JC.exe
5416	LOZGDEVZeQXdwrP.exe
5912	JYFGyrBp.exe
1484	L3SICkmxrkrwNz.exe
2760	VJsnI.exe
6328	3ORMgNzkHmstc04.exe
6596	0XSFp.exe
6864	XqOqdaUIt5eWluG.exe
7120	SRma10v.exe
7176	Jv58ZehyQ.exe
7436	nssAgEWhvs4Cv2.exe
7696	OxNVooJvTjrmrH.exe
7996	5mMiXSaZ4uSi7K6.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUSPT = "C:\\Windows\\nssAgEWhvs4Cv2.exe"	Jv58ZehyQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MINILOG = "C:\\Windows\\OxgJYFKc7m4.exe"	OP4zrGwkaMxQY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IAMSERV = "C:\\Windows\\85LjuqMGhIP9BSX.exe"	zMI5ghG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVAPSVC = "C:\\Windows\\MH5lvd1.exe"	85LjuqMGhIP9BSX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVCONSOL = "C:\\Windows\\LOZGDEVZeQXdwrP.exe"	sQhRQeYqv9JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVGCC32 = "C:\\Windows\\Jv58ZehyQ.exe"	SRma10v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PROGRAMAUDITOR = "C:\\Windows\\L3SICkmxrkrwNz.exe"	JYFGyrBp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVENGNAVEX15 = "C:\\Windows\\zMI5ghG.exe"	VLUREmVwNl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMC = "C:\\Windows\\zsW0imERhaO.exe"	MH5lvd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOOKOUT = "C:\\Windows\\VJsnI.exe"	L3SICkmxrkrwNz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DVP95 = "C:\\Windows\\SRma10v.exe"	XqOqdaUIt5eWluG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TDS-3 = "C:\\Windows\\OxNVooJvTjrmrH.exe"	nssAgEWhvs4Cv2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCPXYSVC = "C:\\Windows\\5mMiXSaZ4uSi7K6.exe"	OxNVooJvTjrmrH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUSPT = "C:\\Windows\\OP4zrGwkaMxQY.exe"	2026-07-06_ea4b59f0f0d6bc476dfdf790f98e073f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFWATCH = "C:\\Windows\\VLUREmVwNl.exe"	OxgJYFKc7m4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVSCHED = "C:\\Windows\\sQhRQeYqv9JC.exe"	zsW0imERhaO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LDSCAN = "C:\\Windows\\JYFGyrBp.exe"	LOZGDEVZeQXdwrP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MONITOR = "C:\\Windows\\3ORMgNzkHmstc04.exe"	VJsnI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFALERT = "C:\\Windows\\0XSFp.exe"	3ORMgNzkHmstc04.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MOOLIVE = "C:\\Windows\\XqOqdaUIt5eWluG.exe"	0XSFp.exe

Drops file in Windows directory 40 IoCs

description	ioc	Process
File created	C:\Windows\85LjuqMGhIP9BSX.exe	zMI5ghG.exe
File opened for modification	C:\Windows\MH5lvd1.exe	85LjuqMGhIP9BSX.exe
File opened for modification	C:\Windows\zsW0imERhaO.exe	MH5lvd1.exe
File opened for modification	C:\Windows\L3SICkmxrkrwNz.exe	JYFGyrBp.exe
File opened for modification	C:\Windows\VLUREmVwNl.exe	OxgJYFKc7m4.exe
File created	C:\Windows\MH5lvd1.exe	85LjuqMGhIP9BSX.exe
File created	C:\Windows\zsW0imERhaO.exe	MH5lvd1.exe
File created	C:\Windows\SRma10v.exe	XqOqdaUIt5eWluG.exe
File created	C:\Windows\OP4zrGwkaMxQY.exe	2026-07-06_ea4b59f0f0d6bc476dfdf790f98e073f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\zMI5ghG.exe	VLUREmVwNl.exe
File opened for modification	C:\Windows\VJsnI.exe	L3SICkmxrkrwNz.exe
File created	C:\Windows\XqOqdaUIt5eWluG.exe	0XSFp.exe
File opened for modification	C:\Windows\Jv58ZehyQ.exe	SRma10v.exe
File created	C:\Windows\OxNVooJvTjrmrH.exe	nssAgEWhvs4Cv2.exe
File opened for modification	C:\Windows\OxgJYFKc7m4.exe	OP4zrGwkaMxQY.exe
File created	C:\Windows\zMI5ghG.exe	VLUREmVwNl.exe
File created	C:\Windows\L3SICkmxrkrwNz.exe	JYFGyrBp.exe
File opened for modification	C:\Windows\0XSFp.exe	3ORMgNzkHmstc04.exe
File opened for modification	C:\Windows\XqOqdaUIt5eWluG.exe	0XSFp.exe
File opened for modification	C:\Windows\SRma10v.exe	XqOqdaUIt5eWluG.exe
File created	C:\Windows\Jv58ZehyQ.exe	SRma10v.exe
File opened for modification	C:\Windows\nssAgEWhvs4Cv2.exe	Jv58ZehyQ.exe
File created	C:\Windows\OxgJYFKc7m4.exe	OP4zrGwkaMxQY.exe
File opened for modification	C:\Windows\sQhRQeYqv9JC.exe	zsW0imERhaO.exe
File created	C:\Windows\3ORMgNzkHmstc04.exe	VJsnI.exe
File opened for modification	C:\Windows\3ORMgNzkHmstc04.exe	VJsnI.exe
File opened for modification	C:\Windows\OP4zrGwkaMxQY.exe	2026-07-06_ea4b59f0f0d6bc476dfdf790f98e073f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\VLUREmVwNl.exe	OxgJYFKc7m4.exe
File created	C:\Windows\LOZGDEVZeQXdwrP.exe	sQhRQeYqv9JC.exe
File opened for modification	C:\Windows\LOZGDEVZeQXdwrP.exe	sQhRQeYqv9JC.exe
File opened for modification	C:\Windows\JYFGyrBp.exe	LOZGDEVZeQXdwrP.exe
File created	C:\Windows\VJsnI.exe	L3SICkmxrkrwNz.exe
File created	C:\Windows\0XSFp.exe	3ORMgNzkHmstc04.exe
File opened for modification	C:\Windows\85LjuqMGhIP9BSX.exe	zMI5ghG.exe
File created	C:\Windows\sQhRQeYqv9JC.exe	zsW0imERhaO.exe
File created	C:\Windows\nssAgEWhvs4Cv2.exe	Jv58ZehyQ.exe
File opened for modification	C:\Windows\OxNVooJvTjrmrH.exe	nssAgEWhvs4Cv2.exe
File opened for modification	C:\Windows\5mMiXSaZ4uSi7K6.exe	OxNVooJvTjrmrH.exe
File created	C:\Windows\JYFGyrBp.exe	LOZGDEVZeQXdwrP.exe
File created	C:\Windows\5mMiXSaZ4uSi7K6.exe	OxNVooJvTjrmrH.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
2988	5784	WerFault.exe	96
5704	3264	WerFault.exe	98
7900	7176	WerFault.exe	125
7424	7996	WerFault.exe	133
7948	3260	WerFault.exe	86
1996	1244	WerFault.exe	105
5896	6596	WerFault.exe	119
2772	7696	WerFault.exe	129
624	5912	WerFault.exe	111

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zMI5ghG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85LjuqMGhIP9BSX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MH5lvd1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VJsnI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ORMgNzkHmstc04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XqOqdaUIt5eWluG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nssAgEWhvs4Cv2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OP4zrGwkaMxQY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OxgJYFKc7m4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VLUREmVwNl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LOZGDEVZeQXdwrP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JYFGyrBp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SRma10v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jv58ZehyQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5mMiXSaZ4uSi7K6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zsW0imERhaO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sQhRQeYqv9JC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	L3SICkmxrkrwNz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0XSFp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OxNVooJvTjrmrH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_ea4b59f0f0d6bc476dfdf790f98e073f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-06_ea4b59f0f0d6bc476dfdf790f98e073f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_ea4b59f0f0d6bc476dfdf790f98e073f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 2464
  2⤵
  - Program crash
  PID:7948

C:\Windows\OP4zrGwkaMxQY.exe
C:\Windows\OP4zrGwkaMxQY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2392

C:\Windows\OxgJYFKc7m4.exe
C:\Windows\OxgJYFKc7m4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1836

C:\Windows\VLUREmVwNl.exe
C:\Windows\VLUREmVwNl.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1792

C:\Windows\zMI5ghG.exe
C:\Windows\zMI5ghG.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1460

C:\Windows\85LjuqMGhIP9BSX.exe
C:\Windows\85LjuqMGhIP9BSX.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 2084
  2⤵
  - Program crash
  PID:2988

C:\Windows\MH5lvd1.exe
C:\Windows\MH5lvd1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 2080
  2⤵
  - Program crash
  PID:5704

C:\Windows\zsW0imERhaO.exe
C:\Windows\zsW0imERhaO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5784 -ip 5784
1⤵
PID:3596

C:\Windows\sQhRQeYqv9JC.exe
C:\Windows\sQhRQeYqv9JC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 2384
  2⤵
  - Program crash
  PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3264 -ip 3264
1⤵
PID:5712

C:\Windows\LOZGDEVZeQXdwrP.exe
C:\Windows\LOZGDEVZeQXdwrP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5416

C:\Windows\JYFGyrBp.exe
C:\Windows\JYFGyrBp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 2492
  2⤵
  - Program crash
  PID:624

C:\Windows\L3SICkmxrkrwNz.exe
C:\Windows\L3SICkmxrkrwNz.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1484

C:\Windows\VJsnI.exe
C:\Windows\VJsnI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2760

C:\Windows\3ORMgNzkHmstc04.exe
C:\Windows\3ORMgNzkHmstc04.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6328

C:\Windows\0XSFp.exe
C:\Windows\0XSFp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 2296
  2⤵
  - Program crash
  PID:5896

C:\Windows\XqOqdaUIt5eWluG.exe
C:\Windows\XqOqdaUIt5eWluG.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6864

C:\Windows\SRma10v.exe
C:\Windows\SRma10v.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7120

C:\Windows\Jv58ZehyQ.exe
C:\Windows\Jv58ZehyQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7176 -s 2080
  2⤵
  - Program crash
  PID:7900

C:\Windows\nssAgEWhvs4Cv2.exe
C:\Windows\nssAgEWhvs4Cv2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7436

C:\Windows\OxNVooJvTjrmrH.exe
C:\Windows\OxNVooJvTjrmrH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7696 -s 2384
  2⤵
  - Program crash
  PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 7176 -ip 7176
1⤵
PID:7880

C:\Windows\5mMiXSaZ4uSi7K6.exe
C:\Windows\5mMiXSaZ4uSi7K6.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7996 -s 1980
  2⤵
  - Program crash
  PID:7424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 7996 -ip 7996
1⤵
PID:7204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3260 -ip 3260
1⤵
PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1244 -ip 1244
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6596 -ip 6596
1⤵
PID:7196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 7696 -ip 7696
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5912 -ip 5912
1⤵
PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0XSFp.exe

Path C:\Windows\0XSFp.exe
Size 804KB
SHA256 5b4ed0da6d8625fe1939a7d5943b9e1e45af700ffcc493e5591a103114315b3f
MD5 d2f40a05a1c7bcfb925435c02288e985
SHA1 5a102f5e3f5d65a3a68699645ff5f99ea09db5d9
SHA512 ea5663d786124cc47138f3d9e84bafdce6b702154be861fdd61abb317fdf9b8c8c61eac6e9cafbf23ce236b19afa5107abd28c01c334557c97cafe25c72e97a9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nso2
TLSH
T1C405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ORMgNzkHmstc04.exe

Path C:\Windows\3ORMgNzkHmstc04.exe
Size 804KB
SHA256 3b965cb39d68319ae098f6cd9b1ac1f97068e3cf1b21b81c9969aa82bddb7f08
MD5 59b23e46267953b3f373d5415c5d32f9
SHA1 bb4ce39065990a335481aceb42b77bef09537243
SHA512 e9a7e385729cff70d18e6cc9121bac7feb4860abe91eb981c9a1b3de5d6889f680367e0845f030815ee6689598d3acdf4f0391ceabc0879296c612925bac9f84
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouI:0NA1Yakeer5+nso1
TLSH
T1BE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5mMiXSaZ4uSi7K6.exe

Path C:\Windows\5mMiXSaZ4uSi7K6.exe
Size 804KB
SHA256 b4c5487fc2418459f504b02f1f90d3489d2e7a0e416e1d2ab121616b6d2c37c9
MD5 18387d33a1fd2a0f60d36ede270982b1
SHA1 1b4faa3d5ce5a4909b63bb17390cfac46b2df81b
SHA512 e0e6665ebc75a3784b9ab3a635f517968ed3a1b66aa8098bcf3141082af2c7eb19c85a6ce4529ee11ff5ea92ffdc9e589f6ac66c44cdcbd8d35a6a41dc22222d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouS:0NA1Yakeer5+nsoX
TLSH
T1CF05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85LjuqMGhIP9BSX.exe

Path C:\Windows\85LjuqMGhIP9BSX.exe
Size 804KB
SHA256 2e0cc80affb69f3f8fe4550d28bd9a36a18dc0e4b5f1981b179cc85abb7993ab
MD5 7ab95650538f17191c206889a7ceedf9
SHA1 560d220eaa40e821f2df95b6ebe7445081f154cd
SHA512 21d7208349bb76d1f07c75f1677540f1edfc13d0a5fa1f4b5e811b0a09e691351e720e1a4b1f9f789f9b9a3bab1733fb8ef80b290f4e570327679b16418b7f24
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nsof
TLSH
T1B005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JYFGyrBp.exe

Path C:\Windows\JYFGyrBp.exe
Size 804KB
SHA256 1fe0eb3349f11e91c4182f42f12efe5dfece59898891a35d6012672d5270fd9c
MD5 1054a1e876b43e98a253a82d07b761fd
SHA1 aea0591a1f675c61cfb2674c9e2eab31bcf81171
SHA512 765c7dea5eba731b8900dcad2b0d2a72674d5dd97b84fefdfb540195e7965872691092791f0d4c7a116df4b656f81017c44acab382f42f5e9f954c537be85f3b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQ:0NA1Yakeer5+nsoL
TLSH
T10905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jv58ZehyQ.exe

Path C:\Windows\Jv58ZehyQ.exe
Size 804KB
SHA256 e9c43913ec65604b88da96a31ebf70a295323b999460d646f5b74e8172a95890
MD5 92b530a13fa1aa8471a2711c92e275a4
SHA1 0860bd4590bef3d5dbaabb6fa3792089ce31e7b4
SHA512 4c35b19af9704ad1c0095c97c08422e0934ab892d18b4ee7ea5bbfd5197d045559f9838fb16b851d937cfd7908ebd80d138c8ce5ff69d66f5c9f81833d336958
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nsoj
TLSH
T1D105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

L3SICkmxrkrwNz.exe

Path C:\Windows\L3SICkmxrkrwNz.exe
Size 804KB
SHA256 207e1d069d5e6c05737b00f3ef10141ead82cbbf4daffcce376b13e791eb92e0
MD5 a6104bc15769767993527e1c6fc97cab
SHA1 2b5c241d16176b9c78054b4c31405b366b59a0f6
SHA512 09863aed81d714a02e17dbcfe4f1d25875b325884150688d30d1d6a27c3c50731e427d8d64c23b01b43f954e62f5a792f7a867296a2f8c38c5db575a3c8ba9cd
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nsoA
TLSH
T14105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOZGDEVZeQXdwrP.exe

Path C:\Windows\LOZGDEVZeQXdwrP.exe
Size 804KB
SHA256 41e3a9731100993a8dfc62e8eb8c751bfab5739541f86d293ad9e030b43640bb
MD5 4ca2b82b2881847d6c6619e5ac841a36
SHA1 bc4d8c0de856a94705284204d11c6157bcba029a
SHA512 0d55b116f12d4e08b69332fd9c4d9e1a7d9d5d1eaf45589ad02a52e2aca779fbac4d9d8ed20937b2f35b3c9e94f40ef055459fe35d1383de4ba45845e0e171f3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nso8
TLSH
T12305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MH5lvd1.exe

Path C:\Windows\MH5lvd1.exe
Size 804KB
SHA256 cba56038e6a4a7b1234e8fefade5f58203e2011b459e88ec722f71c4b47041ed
MD5 9ea280709e0084cfabd078a168d23409
SHA1 62122dc98a1af280ef9acfa5f613d8db8ed6654a
SHA512 6fbeed6cb4c34c385f06f1ed28a0aa9fd36d87bb01a809802f8cb5cc761265bed1f3cdb1fa431f9a0a41134764c91aa36db1145e51393e73cf355c60094932c2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nso5
TLSH
T10805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OP4zrGwkaMxQY.exe

Path C:\Windows\OP4zrGwkaMxQY.exe
Size 804KB
SHA256 d8933d8dcb16546090d2398398c56478bcebfbb9299555b2c44f7ca146ae8b5e
MD5 a6d8e74575a7b0a74e91c22e6a113f5b
SHA1 0e68c2a647dc27f6278a73f1779c731a319df427
SHA512 3b90c0dd6c290dd9561d482269d6aa42aa99dd39193f9148a5cac64f5ac3075ebd899130b05eef25256ec04977f7325ff7a369eadf68bd343b3466e225ab5ade
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoup:0NA1Yakeer5+nsoM
TLSH
T15105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OxNVooJvTjrmrH.exe

Path C:\Windows\OxNVooJvTjrmrH.exe
Size 804KB
SHA256 b7c286f21b9cbf4b67573df22107644b912b6d4f8115646c666875ea9d90e8be
MD5 27ec78cd9f73452180c308434010c6bd
SHA1 7cf5b0d0e4eb9fe3eb7c717b786f1774df0d9965
SHA512 e17996bfb96b78a9d48e36393e28185a4a3a5dc895fad77fd0494df5fb1c9b2c9a22ee13e7a7b6f21972058ac4fcc303e196065dd6aac8fbd2958e3775cd3fb7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou5:0NA1Yakeer5+nso2
TLSH
T10105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OxgJYFKc7m4.exe

Path C:\Windows\OxgJYFKc7m4.exe
Size 804KB
SHA256 85aee99563599bc6e76f166ae0aab821e769c4bd80da1900c3dbaf2213817dd9
MD5 ae626db485c7139bc468f9da6413982e
SHA1 d6d2831cd06e7ff38d259fea52c7a8573313790f
SHA512 8dfd142cb486d2d27454fe8c819d8eee38bb66c3116b6f3f8ddbe6bce5960c0d511596f36e73608911538c3e3ed0163ca5e72d022a3722ecf6b52ea4d8b901e5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nsop
TLSH
T18A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SRma10v.exe

Path C:\Windows\SRma10v.exe
Size 804KB
SHA256 721d08c485aac6eb03cebd75089269d05d63146eed753c362d9894d40d356717
MD5 d655fe259964a8734cd184dbaeab0c41
SHA1 0f61129c8306391090f65a296eeb7e1892b8110b
SHA512 3c548595c289fef358a5a34c264e41742e27cc34d83c36a46a9239ac6ec20e828f6655faf14e0dca5f77434bde4118a11bb1a86ff990abb5939f258f7dbf191d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFour:0NA1Yakeer5+nsoi
TLSH
T1BE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VJsnI.exe

Path C:\Windows\VJsnI.exe
Size 804KB
SHA256 1247e74fc08d1134a1615d2d40b53d03e91e31fbf40ebcd849db972ea7f948ea
MD5 5480e822de5b7ab0217d49a40fc9c424
SHA1 0349c77207476a0614f104898e5e5b9e1ad8022a
SHA512 6bfe5901b393bd39d0db13695b5f60e7af1d00ee7eb7fa08772f2a1fde45c53b10d91ba8914c0732b989fcaba7a4ba455c0e5042d8cebf9d19b5b9d94feacf6b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou3:0NA1Yakeer5+nsog
TLSH
T15705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VLUREmVwNl.exe

Path C:\Windows\VLUREmVwNl.exe
Size 804KB
SHA256 d3c5d36a4092bf5102d48fe34926abf814161ce62344ec88e2879444bfdc8f43
MD5 b26012566641fb031cf968fb5f814d2a
SHA1 9d76b632aaa12324da15f8d51167c5e575141605
SHA512 ea9ae0943579ead27f27008504c85d68b1352709212d83360b90f13a93f040d8885a09334758242d98c08f436edfdb2efd228991aec196a1a35cef397d866aba
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou1:0NA1Yakeer5+nsoA
TLSH
T1AC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XqOqdaUIt5eWluG.exe

Path C:\Windows\XqOqdaUIt5eWluG.exe
Size 804KB
SHA256 2a8ef8b50d2629373504267037cb8a9531451de3e09c5465c82ef9f66ef1e548
MD5 a907efa7e75beca9dc1e7bb4bd8546be
SHA1 e99701846600a3a93985afeaa37b546ecbb0c3be
SHA512 e04cb8099a86029a1ee0a99299b537c5011d538f577a28ca508e9a68163bcac09d00a23a03ae9afbfbc1d1b549b27234be1069f152e4a55fa94b51f2c348a5a5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouG:0NA1Yakeer5+nso3
TLSH
T1DD05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nssAgEWhvs4Cv2.exe

Path C:\Windows\nssAgEWhvs4Cv2.exe
Size 804KB
SHA256 222e541bb9a04387f402bb7ea881f40896c7b9f7c8092ba695173981e9e44ec4
MD5 5afa810befa3741d7f404439f2ae3f8f
SHA1 8ae44073d8ed2809a1a5a09eedf62bb33deff360
SHA512 6e141b118ca7b02c6d11a55ee933e1bdbed4073aad47ed4d22cbc6a0535266d4425190527a117e900c9a8451de6eff4e29d942e0c28217108bec03f3004fd42b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsoK
TLSH
T1AB05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sQhRQeYqv9JC.exe

Path C:\Windows\sQhRQeYqv9JC.exe
Size 804KB
SHA256 fa7a97de64d85f03fdb78868a31f089ae56e506ae51422117a9bb5d9cf3b7e7d
MD5 03f72e2178f8c5aaf06ed2abeb48eea3
SHA1 c034a1ab8879c36d8ca292039943b5a6ce9dc921
SHA512 d4b1cc06c666ac60d21c724afbe505c5ae058cfd0f52a632e40076b81600689b0a0d333ba701b92e2dc3e123436a574a9218e17e6fe73ef26d0d10ffd129ec68
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouk:0NA1Yakeer5+nso/
TLSH
T16F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zMI5ghG.exe

Path C:\Windows\zMI5ghG.exe
Size 804KB
SHA256 da7764b645a73bc168b5467a32b1e5ab12643b6eee957b0f203fa1a50dd3bd94
MD5 16f76674a57ab80eb518f977ee7f7317
SHA1 dda251de306e762aa73985a13bc0c49037781cb5
SHA512 d11cdd0835be766d255b158da2efa03e5529197880a6887893411edc2f1a40d6d419e9dc4ba33978c7e204c6821b53f7f45103de5fb63cef15fe17b87cb8b4b6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsom
TLSH
T1CA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zsW0imERhaO.exe

Path C:\Windows\zsW0imERhaO.exe
Size 804KB
SHA256 4afcff1b86764e9ea2edf8b3ea25d269b45762bdf481748c55448885eae0213a
MD5 e63634f0b93844b7954f4d5fd2f86039
SHA1 ba3979e3a0fd5507740ec5f2756bcfe5960d1a58
SHA512 785ae7afa3eb358fe589a228049cf582e2397c4f769b129bcf28ceec7cd52c76a117b23d8c926885aa2fdf630d9e4748ceae95f895dfab12a0bedb373e6ebce4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nsob
TLSH
T1C305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads