07c3a83b3655d888923f0e446e8cee91db886ab6ea534bfd0e3587fc09d243f9

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_c94cb4493ca121cff04b08b4279e1e17_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260709-tzk8maev2w
SHA256 07c3a83b3655d888923f0e446e8cee91db886ab6ea534bfd0e3587fc09d243f9
MD5 c94cb4493ca121cff04b08b4279e1e17
SHA1 9fbb1c794ecd22330039897a460cd53bea7a4149
SHA512 05c8d828b41cd3ea6a61d6ce1cb2c284ced68b753295db1eea04a19747ad9c52c9e353644ecfa47da4ab3ab4fec4ac3f2e5deaad244d22428cf78e439fdb347a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nson
TLSH
T11505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2728) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 28 IoCs

pid	Process
5680	MZK2FpgAp.exe
1784	ZjboNLX6hv.exe
5620	TG2auKN.exe
5472	o9MrraMD9d.exe
4444	6sp8PBqqvIi8I.exe
5500	Rg3WbZev.exe
4508	66zcZppgp.exe
3492	2PUyIg.exe
3744	pugPBCEUMJd2.exe
6276	jj7WCEcqo5BU.exe
6532	cgzWb1GaspT.exe
6784	NKlQnDgA.exe
7044	5AMQUPLrAClEjH.exe
1336	67dkNIIjN8P2rZ.exe
7376	OpQvmZI0263eHJ.exe
7624	sZw7JkxNhRvZ.exe
7880	dcKyBzT.exe
8140	pun7IUUZ.exe
8304	i54zlr.exe
8644	YptGc9.exe
8908	wduBiP.exe
9160	bqFQ5Xsl.exe
8016	DCEZiJr6ZXI2m.exe
8004	FTitmbL.exe
9476	y66vBZuEX.exe
9728	cLEUeEnyQ.exe
9972	Bk4jKLPebHzAmP0.exe
10224	PTAaqbw1MdRe1.exe

Adds Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\POP3TRAP = "C:\\Windows\\MZK2FpgAp.exe"	2026-07-09_c94cb4493ca121cff04b08b4279e1e17_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IOMON98 = "C:\\Windows\\OpQvmZI0263eHJ.exe"	67dkNIIjN8P2rZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GBMENU = "C:\\Windows\\sZw7JkxNhRvZ.exe"	OpQvmZI0263eHJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IAMSTATS = "C:\\Windows\\bqFQ5Xsl.exe"	wduBiP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKPOP = "C:\\Windows\\DCEZiJr6ZXI2m.exe"	bqFQ5Xsl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SPHINX = "C:\\Windows\\cLEUeEnyQ.exe"	y66vBZuEX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPSSVC = "C:\\Windows\\Bk4jKLPebHzAmP0.exe"	cLEUeEnyQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VPC32 = "C:\\Windows\\ZjboNLX6hv.exe"	MZK2FpgAp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VPC32 = "C:\\Windows\\2PUyIg.exe"	66zcZppgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVXMONITOR9X = "C:\\Windows\\67dkNIIjN8P2rZ.exe"	5AMQUPLrAClEjH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCAGENT = "C:\\Windows\\dcKyBzT.exe"	sZw7JkxNhRvZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCMNHDLR = "C:\\Windows\\wduBiP.exe"	YptGc9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCVSSHLD = "C:\\Windows\\TG2auKN.exe"	ZjboNLX6hv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NMAIN = "C:\\Windows\\o9MrraMD9d.exe"	TG2auKN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVGSERV = "C:\\Windows\\6sp8PBqqvIi8I.exe"	o9MrraMD9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVNT = "C:\\Windows\\Rg3WbZev.exe"	6sp8PBqqvIi8I.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVXMONITOR9X = "C:\\Windows\\5AMQUPLrAClEjH.exe"	NKlQnDgA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EVPN = "C:\\Windows\\YptGc9.exe"	i54zlr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKWCTL9 = "C:\\Windows\\FTitmbL.exe"	DCEZiJr6ZXI2m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SPYXX = "C:\\Windows\\PTAaqbw1MdRe1.exe"	Bk4jKLPebHzAmP0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GUARDDOG = "C:\\Windows\\66zcZppgp.exe"	Rg3WbZev.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSMAIN = "C:\\Windows\\pugPBCEUMJd2.exe"	2PUyIg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCAPP = "C:\\Windows\\jj7WCEcqo5BU.exe"	pugPBCEUMJd2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUCOMSERVE = "C:\\Windows\\cgzWb1GaspT.exe"	jj7WCEcqo5BU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVSCHED = "C:\\Windows\\NKlQnDgA.exe"	cgzWb1GaspT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUCOMSERVE = "C:\\Windows\\pun7IUUZ.exe"	dcKyBzT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DVP95 = "C:\\Windows\\i54zlr.exe"	pun7IUUZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NSCHED32 = "C:\\Windows\\y66vBZuEX.exe"	FTitmbL.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\FTitmbL.exe	DCEZiJr6ZXI2m.exe
File created	C:\Windows\ZjboNLX6hv.exe	MZK2FpgAp.exe
File created	C:\Windows\o9MrraMD9d.exe	TG2auKN.exe
File created	C:\Windows\6sp8PBqqvIi8I.exe	o9MrraMD9d.exe
File opened for modification	C:\Windows\Rg3WbZev.exe	6sp8PBqqvIi8I.exe
File opened for modification	C:\Windows\2PUyIg.exe	66zcZppgp.exe
File created	C:\Windows\bqFQ5Xsl.exe	wduBiP.exe
File opened for modification	C:\Windows\DCEZiJr6ZXI2m.exe	bqFQ5Xsl.exe
File created	C:\Windows\Bk4jKLPebHzAmP0.exe	cLEUeEnyQ.exe
File opened for modification	C:\Windows\ZjboNLX6hv.exe	MZK2FpgAp.exe
File created	C:\Windows\pugPBCEUMJd2.exe	2PUyIg.exe
File created	C:\Windows\cgzWb1GaspT.exe	jj7WCEcqo5BU.exe
File created	C:\Windows\OpQvmZI0263eHJ.exe	67dkNIIjN8P2rZ.exe
File opened for modification	C:\Windows\sZw7JkxNhRvZ.exe	OpQvmZI0263eHJ.exe
File opened for modification	C:\Windows\dcKyBzT.exe	sZw7JkxNhRvZ.exe
File opened for modification	C:\Windows\pun7IUUZ.exe	dcKyBzT.exe
File opened for modification	C:\Windows\wduBiP.exe	YptGc9.exe
File created	C:\Windows\Rg3WbZev.exe	6sp8PBqqvIi8I.exe
File created	C:\Windows\jj7WCEcqo5BU.exe	pugPBCEUMJd2.exe
File opened for modification	C:\Windows\jj7WCEcqo5BU.exe	pugPBCEUMJd2.exe
File opened for modification	C:\Windows\5AMQUPLrAClEjH.exe	NKlQnDgA.exe
File created	C:\Windows\dcKyBzT.exe	sZw7JkxNhRvZ.exe
File created	C:\Windows\pun7IUUZ.exe	dcKyBzT.exe
File opened for modification	C:\Windows\bqFQ5Xsl.exe	wduBiP.exe
File opened for modification	C:\Windows\cLEUeEnyQ.exe	y66vBZuEX.exe
File created	C:\Windows\TG2auKN.exe	ZjboNLX6hv.exe
File opened for modification	C:\Windows\6sp8PBqqvIi8I.exe	o9MrraMD9d.exe
File opened for modification	C:\Windows\NKlQnDgA.exe	cgzWb1GaspT.exe
File created	C:\Windows\67dkNIIjN8P2rZ.exe	5AMQUPLrAClEjH.exe
File opened for modification	C:\Windows\OpQvmZI0263eHJ.exe	67dkNIIjN8P2rZ.exe
File created	C:\Windows\sZw7JkxNhRvZ.exe	OpQvmZI0263eHJ.exe
File created	C:\Windows\DCEZiJr6ZXI2m.exe	bqFQ5Xsl.exe
File created	C:\Windows\y66vBZuEX.exe	FTitmbL.exe
File created	C:\Windows\5AMQUPLrAClEjH.exe	NKlQnDgA.exe
File opened for modification	C:\Windows\67dkNIIjN8P2rZ.exe	5AMQUPLrAClEjH.exe
File opened for modification	C:\Windows\i54zlr.exe	pun7IUUZ.exe
File created	C:\Windows\YptGc9.exe	i54zlr.exe
File created	C:\Windows\cLEUeEnyQ.exe	y66vBZuEX.exe
File opened for modification	C:\Windows\Bk4jKLPebHzAmP0.exe	cLEUeEnyQ.exe
File created	C:\Windows\MZK2FpgAp.exe	2026-07-09_c94cb4493ca121cff04b08b4279e1e17_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\MZK2FpgAp.exe	2026-07-09_c94cb4493ca121cff04b08b4279e1e17_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\TG2auKN.exe	ZjboNLX6hv.exe
File opened for modification	C:\Windows\o9MrraMD9d.exe	TG2auKN.exe
File created	C:\Windows\66zcZppgp.exe	Rg3WbZev.exe
File created	C:\Windows\2PUyIg.exe	66zcZppgp.exe
File opened for modification	C:\Windows\pugPBCEUMJd2.exe	2PUyIg.exe
File created	C:\Windows\NKlQnDgA.exe	cgzWb1GaspT.exe
File created	C:\Windows\i54zlr.exe	pun7IUUZ.exe
File opened for modification	C:\Windows\YptGc9.exe	i54zlr.exe
File created	C:\Windows\FTitmbL.exe	DCEZiJr6ZXI2m.exe
File opened for modification	C:\Windows\y66vBZuEX.exe	FTitmbL.exe
File created	C:\Windows\PTAaqbw1MdRe1.exe	Bk4jKLPebHzAmP0.exe
File opened for modification	C:\Windows\PTAaqbw1MdRe1.exe	Bk4jKLPebHzAmP0.exe
File opened for modification	C:\Windows\66zcZppgp.exe	Rg3WbZev.exe
File opened for modification	C:\Windows\cgzWb1GaspT.exe	jj7WCEcqo5BU.exe
File created	C:\Windows\wduBiP.exe	YptGc9.exe

Program crash 10 IoCs

pid	pid_target	Process	procid_target
8560	7880	WerFault.exe	120
10320	9972	WerFault.exe	143
10652	5680	WerFault.exe	88
10716	5620	WerFault.exe	92
10784	4444	WerFault.exe	96
10880	3744	WerFault.exe	104
10964	6784	WerFault.exe	110
10028	5472	WerFault.exe	94
9912	6276	WerFault.exe	106
5668	9476	WerFault.exe	139

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cgzWb1GaspT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67dkNIIjN8P2rZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YptGc9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MZK2FpgAp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZjboNLX6hv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o9MrraMD9d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6sp8PBqqvIi8I.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2PUyIg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpQvmZI0263eHJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcKyBzT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PTAaqbw1MdRe1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cLEUeEnyQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bk4jKLPebHzAmP0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sZw7JkxNhRvZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pun7IUUZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wduBiP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i54zlr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_c94cb4493ca121cff04b08b4279e1e17_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FTitmbL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y66vBZuEX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TG2auKN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rg3WbZev.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jj7WCEcqo5BU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCEZiJr6ZXI2m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5AMQUPLrAClEjH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bqFQ5Xsl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66zcZppgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pugPBCEUMJd2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NKlQnDgA.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-09_c94cb4493ca121cff04b08b4279e1e17_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_c94cb4493ca121cff04b08b4279e1e17_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5452

C:\Windows\MZK2FpgAp.exe
C:\Windows\MZK2FpgAp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 2196
  2⤵
  - Program crash
  PID:10652

C:\Windows\ZjboNLX6hv.exe
C:\Windows\ZjboNLX6hv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1784

C:\Windows\TG2auKN.exe
C:\Windows\TG2auKN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 2196
  2⤵
  - Program crash
  PID:10716

C:\Windows\o9MrraMD9d.exe
C:\Windows\o9MrraMD9d.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 2308
  2⤵
  - Program crash
  PID:10028

C:\Windows\6sp8PBqqvIi8I.exe
C:\Windows\6sp8PBqqvIi8I.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 2200
  2⤵
  - Program crash
  PID:10784

C:\Windows\Rg3WbZev.exe
C:\Windows\Rg3WbZev.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5500

C:\Windows\66zcZppgp.exe
C:\Windows\66zcZppgp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4508

C:\Windows\2PUyIg.exe
C:\Windows\2PUyIg.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3492

C:\Windows\pugPBCEUMJd2.exe
C:\Windows\pugPBCEUMJd2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 2212
  2⤵
  - Program crash
  PID:10880

C:\Windows\jj7WCEcqo5BU.exe
C:\Windows\jj7WCEcqo5BU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6276 -s 2308
  2⤵
  - Program crash
  PID:9912

C:\Windows\cgzWb1GaspT.exe
C:\Windows\cgzWb1GaspT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6532

C:\Windows\NKlQnDgA.exe
C:\Windows\NKlQnDgA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 2196
  2⤵
  - Program crash
  PID:10964

C:\Windows\5AMQUPLrAClEjH.exe
C:\Windows\5AMQUPLrAClEjH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7044

C:\Windows\67dkNIIjN8P2rZ.exe
C:\Windows\67dkNIIjN8P2rZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1336

C:\Windows\OpQvmZI0263eHJ.exe
C:\Windows\OpQvmZI0263eHJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7376

C:\Windows\sZw7JkxNhRvZ.exe
C:\Windows\sZw7JkxNhRvZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7624

C:\Windows\dcKyBzT.exe
C:\Windows\dcKyBzT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7880 -s 2068
  2⤵
  - Program crash
  PID:8560

C:\Windows\pun7IUUZ.exe
C:\Windows\pun7IUUZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8140

C:\Windows\i54zlr.exe
C:\Windows\i54zlr.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7880 -ip 7880
1⤵
PID:8532

C:\Windows\YptGc9.exe
C:\Windows\YptGc9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8644

C:\Windows\wduBiP.exe
C:\Windows\wduBiP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8908

C:\Windows\bqFQ5Xsl.exe
C:\Windows\bqFQ5Xsl.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9160

C:\Windows\DCEZiJr6ZXI2m.exe
C:\Windows\DCEZiJr6ZXI2m.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8016

C:\Windows\FTitmbL.exe
C:\Windows\FTitmbL.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8004

C:\Windows\y66vBZuEX.exe
C:\Windows\y66vBZuEX.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9476 -s 2308
  2⤵
  - Program crash
  PID:5668

C:\Windows\cLEUeEnyQ.exe
C:\Windows\cLEUeEnyQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9728

C:\Windows\Bk4jKLPebHzAmP0.exe
C:\Windows\Bk4jKLPebHzAmP0.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9972 -s 2088
  2⤵
  - Program crash
  PID:10320

C:\Windows\PTAaqbw1MdRe1.exe
C:\Windows\PTAaqbw1MdRe1.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:10224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 9972 -ip 9972
1⤵
PID:10296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5680 -ip 5680
1⤵
PID:10632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5620 -ip 5620
1⤵
PID:10696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4444 -ip 4444
1⤵
PID:10764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3744 -ip 3744
1⤵
PID:10860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 6784 -ip 6784
1⤵
PID:10940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5472 -ip 5472
1⤵
PID:10148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6276 -ip 6276
1⤵
PID:10016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 9476 -ip 9476
1⤵
PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2PUyIg.exe

Path C:\Windows\2PUyIg.exe
Size 804KB
SHA256 ef93ef2d9ec9c5dd9cba626ef7d334100db810ecab533f3c9fb0ea972014d5ad
MD5 3174ff5f4e90d6f039df11bf39222718
SHA1 53efa606c0ba229ae0f188a125bacce620f88bdd
SHA512 ce060b03ae38f55eb3bc74f16548430a27bb78a71d7502d8acc240e760efe75d078aa8ad935d0ba3e3f72d96c6a3271910b2a22307711a432b16c57e07e31a6f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouH:0NA1Yakeer5+nsoU
TLSH
T19705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5AMQUPLrAClEjH.exe

Path C:\Windows\5AMQUPLrAClEjH.exe
Size 804KB
SHA256 13ee600bceda001f9d4b84f617369a690d5c57923fb26b2c5ae10cd95335f20f
MD5 c9c2c4bc6b3d7e66a44500d6b60778ae
SHA1 5a05848b0287f64d4958eddcb56cdfa4b6aa51a9
SHA512 9af4e1a612b9b472f1419e3d735970deaf7839fc72ebd0e69cf6fafcefad0a1ba1adc939e3dc8d64364de8171a44ed0e5423e986916be8b799f2c8cb5871a4c8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouG:0NA1Yakeer5+nsoN
TLSH
T1E705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66zcZppgp.exe

Path C:\Windows\66zcZppgp.exe
Size 804KB
SHA256 d2e6eadb4aab0d775a5e98012545f013e5fd67de7f5c4b3cbfef2b62bb80c059
MD5 ee065e431075b9ff9e7567e514f86c2b
SHA1 0774be0e6494deeed265d1c4cd0b8db5d85e438c
SHA512 f58e8260828009801c8d19deb197908cec61575da978770c642eceeb6a130c59928937622a9ce746339cd0e3fa815696ad658261297f96c4c926bb017c79e391
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoui:0NA1Yakeer5+nso9
TLSH
T1EC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67dkNIIjN8P2rZ.exe

Path C:\Windows\67dkNIIjN8P2rZ.exe
Size 804KB
SHA256 7c653fd47083f8a6bb167d04629b1370b9b2259291cf2f946e4398cfbf2d635c
MD5 1b870ac56b0b1da74a5c82931496616b
SHA1 2d0f9d930f86a9b3f1a57996c956f79d56881a23
SHA512 82d85b49c6328ef173878c848be757512484d37a064fa23c3dbedb4cdab5ce44d978501b11cff3be83d6ad9b91aae26c75492fc9c230a5901ef0640fc9f9a1eb
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsoA
TLSH
T19405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6sp8PBqqvIi8I.exe

Path C:\Windows\6sp8PBqqvIi8I.exe
Size 804KB
SHA256 ae46b913f5760dbce5bee5541304879b51fd0751eaa9cd81f33746c896b3cdea
MD5 43cf7438f27786122e7f5afc5f8a2982
SHA1 1e00c3bfce4259d2c61269934614b7e9eeac18c8
SHA512 b19a73f1ac814ceadfd2f75f9d9117f7b9b92b5c6c2610eadc3a1fefda8b27bba5c26e55ba4c11b823c8a09d0d6c8795cbfd36ec197fa1b704ed6c24c0fbde47
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsok
TLSH
T18805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bk4jKLPebHzAmP0.exe

Path C:\Windows\Bk4jKLPebHzAmP0.exe
Size 804KB
SHA256 17af39791ba7281bbc157a26a3f265ff6bcc25d52e50f3716aafac0ffbf5b809
MD5 303e488f92b931c294b86fcf8ebe1fe8
SHA1 b2d8d185c9adda43d69326e7bf515165758c9a54
SHA512 795c2c77623d0f221be0af08557fc58b3f2409159c962222abaa4769979bbe7115c9ae7669722c43ff8c199423749721b6df1e6a5e63dc8a33cd6559f7aef138
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou0:0NA1Yakeer5+nsoN
TLSH
T1A905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DCEZiJr6ZXI2m.exe

Path C:\Windows\DCEZiJr6ZXI2m.exe
Size 804KB
SHA256 b3ed5d2e5b868b52cd83dbbd83717d43283cc50970dc2bf4dbf55f7698db1c27
MD5 d0eb00cdc00d99f2c184d751fb714267
SHA1 0fdcd055de038c05b3d33f841ff55d75d523068b
SHA512 522d9e0b6112597a6f93e2a6d57ee07b71698602ebccd78b59e8766da0ea57870c22f23e9a1c0e8006046473419379d684841acff425efa1851f7a2bb0892b70
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouk:0NA1Yakeer5+nso1
TLSH
T1DD05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FTitmbL.exe

Path C:\Windows\FTitmbL.exe
Size 804KB
SHA256 c5b7d972bf9fe2d68b4de6ae0f9c216f66d5063860a4eecafa1f175173a3f613
MD5 16fa43c70ca0aa3ac2b43fbd84a72976
SHA1 2648e7eca672530b19bee534f258ee9d46bb6426
SHA512 174742b1cc9be496a5100b9683621554fa3054e7ea5818e19b30814f016cb95b7091b30e8765a6cc013b0e6ad7474b51cbb918e7bba870199a60ed8f6a9e08f3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoua:0NA1Yakeer5+nsov
TLSH
T1A105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MZK2FpgAp.exe

Path C:\Windows\MZK2FpgAp.exe
Size 804KB
SHA256 5dfabaf40dce10256358e76fbecdbe9d2c1958bc8263359e83d0a13a791c562f
MD5 fcbd4aeb1572ebb57f0e86a3ec5bb0cb
SHA1 3dae564ac0dc0f486871504753eda6ca8c0cd937
SHA512 6ed40d7c73fba771af6b3b01665a224b9c173e9a7c17c12322a41b67b614a7c7fa3e2b63282ab6c19aabccd2ff58b3cef38997608624e5191e98051cd1483842
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsoX
TLSH
T1C505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NKlQnDgA.exe

Path C:\Windows\NKlQnDgA.exe
Size 804KB
SHA256 b31fbea6a3b10db6956fe53f8ae489912f30e100a2566d475148b59e4d5dac84
MD5 8b3184de0802f74c14d5369deeeebd8b
SHA1 a7562ea803ff1fc629f9ced96a1abc0e2390f488
SHA512 dc053db0499503fa30f648816b84d466f0bd32ceecf080322faf0c80551775933f8a8cad00b83f9eb60220b1f72cd00f7075d17d75c6fc9a5c416394e697843a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouI:0NA1Yakeer5+nsoJ
TLSH
T1A205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpQvmZI0263eHJ.exe

Path C:\Windows\OpQvmZI0263eHJ.exe
Size 804KB
SHA256 98d36542a98ac6695b0a25172176588496e7817fbd40d8d79d62e495c15aa8f7
MD5 0afe55e9d11516d86bbbf54d56d45b85
SHA1 892164da9e167439feb150fd930186073ff5d86e
SHA512 0267c8c78f46117cc2ae62f1e376ef1d2bc560e9932402e919eaadbde95dc7bf1a1739944cfcfe456f4eb1694bc0d32eef82dfdc478a0e230bbe7982be0b0765
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFous:0NA1Yakeer5+nsoT
TLSH
T1EA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PTAaqbw1MdRe1.exe

Path C:\Windows\PTAaqbw1MdRe1.exe
Size 804KB
SHA256 c2e9a75dbd004e33f97a95cc3fa9a36688706e7ba06a83cf75185383c469d294
MD5 ab70646168a1ac00391655b620d56841
SHA1 ef7055ad0096f2ecca7ff3ac9cfb4c1803aa4f0f
SHA512 d504c53cf58dee4779bfc6b24a8f15adb42199bf9e8aa61a1c943c73fcbe8dc99a19ff7d4377fc62a5a2d29ec74e6400cd988cf0f48e82a24fa044d6c16b5a29
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nsoq
TLSH
T10005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rg3WbZev.exe

Path C:\Windows\Rg3WbZev.exe
Size 804KB
SHA256 e38ed8d217967b53d797270786e56d5658bec8793d97a6b73867d544555d350d
MD5 54fd6ad6ae0e646b5af5654889f2b2ad
SHA1 d7dd03baf95f24abad644413ba5c8272ae171926
SHA512 0050747e415ca5953e6d7bda0e9b315220b705f7f2a3d3a2b2014f2a80a6546e645d3fa5a33d44593a8e2e342e150c85086202b2e055c24c2db51e3e1225de6d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouY:0NA1Yakeer5+nsoH
TLSH
T1C705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TG2auKN.exe

Path C:\Windows\TG2auKN.exe
Size 804KB
SHA256 9cd5c0bcfad9ab0638172589b948f4889396ac0b293d73e9b16b869d9dac2cd5
MD5 ce3386164ad4e6302332b1408e5f2f42
SHA1 ab8dbcc1ff6ae365de82ddb259b7ba152ee6e0ed
SHA512 3ff61a27a33d991cc2b1c2dcbc68b53b3fd90cf60bedf2f28d19697fb88b3ddf46d2450bd5faccd022b56a3fae7f129b4f34c38f403b168aaf7b375491d59d3e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nsoh
TLSH
T1FD05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YptGc9.exe

Path C:\Windows\YptGc9.exe
Size 804KB
SHA256 aefb5fae7e5c78d530bc8c588db7844e272a856206b3316a7934048e24b4f2af
MD5 fd9210fa20966ec9c235d93cc939f320
SHA1 040149a6fa796135cf624795e3db2715c166829c
SHA512 16ed520056ed4cf932e6d8c7ccc95755227832d6cb87046a85626efc5a96fcf93a2be5e7b84b093a2fd94c95dc99fd66738b90bf436be80f22131dba634923de
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFour:0NA1Yakeer5+nsow
TLSH
T19305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZjboNLX6hv.exe

Path C:\Windows\ZjboNLX6hv.exe
Size 804KB
SHA256 18e4b1d845d360c1042a2ba8f71f41353a3ed3a5ce669cfc4e84637fb2db945d
MD5 937c27eb7dd1e051b45bb26c247eeecd
SHA1 7ecb175186ad6df8402fe73168294c78f0a401c3
SHA512 2600dcac8c2f606a010e63c2f0b13192f6938ce6384511d22bb5d7d9c9ddbc70aa7ecd9b543a2c81b24dbeadf9704b36580e975ba8d051ad9353cb37ae1e3ff7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouH:0NA1Yakeer5+nsoK
TLSH
T14605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bqFQ5Xsl.exe

Path C:\Windows\bqFQ5Xsl.exe
Size 804KB
SHA256 44fe6e7b1b0b5b85c87027855e56f377412b2e10be6c409a6ea56cb40da4eab0
MD5 93024456f1593c31459ed1196dc73bdc
SHA1 4996ec44585bc2ecded7f9425a3ec351f6bacf7e
SHA512 790a17afe08d612b9ac82f743f2ce6db684fbccfaac67467972cd7c2b83f9c2c87e9c5ce3e29119e2fff46962dcbcc8a38848494b8ef6a7ee977e2d48924e70c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsok
TLSH
T12005A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cLEUeEnyQ.exe

Path C:\Windows\cLEUeEnyQ.exe
Size 804KB
SHA256 2a862f3a8376e9451c97f612dcd98c14bca9c50fd5cdbc9440a71dd23a7938c1
MD5 2d5ae399e1d73a9c8735c1cb66328788
SHA1 433260268581e497d783c6ae782fe1257c2d3268
SHA512 d852be54e94b00dab65fc18facb1fed2b69ae122a410dbdacded1e3d7658c3a80c57bcfa5c868e6d15e0cb5635f7575cc2203f48544de9ea2a533280c0c34355
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouH:0NA1Yakeer5+nsoM
TLSH
T17B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cgzWb1GaspT.exe

Path C:\Windows\cgzWb1GaspT.exe
Size 804KB
SHA256 1f66c23d4c4e887cffcfc560a04ba8c692b8cee1ca5aad72d5f8cf8ad6db47f8
MD5 dfc7edd0ddc2eb62cc4dbf732831f1d4
SHA1 75f377beaf64769eebec249b50895b065836212b
SHA512 9e30b56a8491befee58cac1a42534aac8ff629dc7d4ad87e8942f26e04869e1a209de1b7886df8448d7e9021cc14de98a7055b62bf9d424e33ea3e0d601f78b0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoui:0NA1Yakeer5+nsob
TLSH
T1EF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcKyBzT.exe

Path C:\Windows\dcKyBzT.exe
Size 804KB
SHA256 7a062f085c387ce3c8d5a9371298b028e34d8bc8026b2d23b405171323b61070
MD5 1c3209f32c159982fc38f27958f0c326
SHA1 711ee168ac4fe4c9d25352906f8c18cdc2a30703
SHA512 c772d2fc5dd74253cb38c107db1466b8905876f640e1d1002aa1745a48e388a605c2b4a6862d0a3f4d5ecbd229d3aaa5e41dc711e726b00226d62bc39c796a5d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nsoR
TLSH
T17C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i54zlr.exe

Path C:\Windows\i54zlr.exe
Size 804KB
SHA256 42252b7795d344ac1f06f5768c32dfb98a6c2ed1277fb945a257edbf0b321408
MD5 aa7ffe02402505bd5f2bb3f445216629
SHA1 6201106a18d124d79db672a864423189bc6d95c5
SHA512 73a479670308cf77e078b3768c2ea2c955e86e654aa2a93631c3a0f1b9819e54ff8ab69afd420c8ddd4612ffc50c8ee80175f2f697a7a9762f40bc8d4e6c0324
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoup:0NA1Yakeer5+nsou
TLSH
T18305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jj7WCEcqo5BU.exe

Path C:\Windows\jj7WCEcqo5BU.exe
Size 804KB
SHA256 1df70ae66a1e0ec418c50d021436b3bef9aadf20620e3ee313abff8cc67f2a48
MD5 29bcb66c30e7ad914dac22754289c738
SHA1 898fa674eec29b890bf1781f32817b931c5a8683
SHA512 5b3606429bd594fe2bfb7341fc2a5af588786d5b3eedefb38ed7bf0fef8a52f5f2362fc73db8939ecf172696ecaa840472432863c75ff937ed05aca446348a87
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouI:0NA1Yakeer5+nson
TLSH
T16705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o9MrraMD9d.exe

Path C:\Windows\o9MrraMD9d.exe
Size 804KB
SHA256 22141c67348128fb2b5b09ee3ab9af8a776966e4ac3898e9fbe0af7b8fa4465d
MD5 0d8bcd8d4b0877666dbc608e4479c181
SHA1 ac955ca01b837a06af034a7af1354356178fd320
SHA512 97633a9faedc593395505040191dddc5274e3019aba04e01b304419977e15c8d336737ded2051dd8d45bc8b2b1352079f82b30164a0acdf27b99743c16c1f3bd
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsog
TLSH
T12605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pugPBCEUMJd2.exe

Path C:\Windows\pugPBCEUMJd2.exe
Size 804KB
SHA256 ae9d0034baa0bba68dece040c0127aee36ad3702ec57b59443311e961278ca7f
MD5 90e014cd2f537a8a29aa0bf69d6f036b
SHA1 51793ae50613bdad18562697a50df7d42ce6e7bf
SHA512 0a07f2271039ac2d050ba160dee57e05c00a7ac0fec963c6170cad65c38cdace3344fb4d225ceee0775b9510f730fe97adea17cdea6da87fdcf58e1d18ecc0e7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nson
TLSH
T16005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pun7IUUZ.exe

Path C:\Windows\pun7IUUZ.exe
Size 804KB
SHA256 e50bb4cab7174d9f12f31a121c81219fe5e08aae40e4a42a5942b2c7b83767ba
MD5 f783e7ea34526a6397f2708d3f8624ea
SHA1 d2b4ceb52eff1cbefb2a445542042d48a803aab7
SHA512 e232d21eb57985678670f3586ebb4057f414599a53d49fc5c14c673bca1550b3a3ce072aa93e228517282b28a86da6122ee416914b0fbfe2ae3cf8809b820dab
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nso/
TLSH
T14E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sZw7JkxNhRvZ.exe

Path C:\Windows\sZw7JkxNhRvZ.exe
Size 804KB
SHA256 c3611d579d05894502e1e9405843edb8963401e9c2700704969bd1942ce62fab
MD5 57e37b7e222c2854b0094e3909033ac0
SHA1 9e266a8dc10bc1179e45abc38be55f2d95f82ff9
SHA512 b647b440212701011d93c20170531b9143c7329d168fa74924672d725d4d9f953d45b052fe652e3d90ca495ac7ab955a99932938123795929829fbeb35ff9d65
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouS:0NA1Yakeer5+nsop
TLSH
T1A305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wduBiP.exe

Path C:\Windows\wduBiP.exe
Size 804KB
SHA256 c8843d1e606441a8177d9955f59b03a9ea4892c43789cee205c6676464b388d5
MD5 8bba227b9a1d4d7c010e1a10a4c409e3
SHA1 aac953eb98126f9a7d9eaa2b2da7f97f7a1e03ff
SHA512 e48b9614ac1813371dab1c52c9aec6dbbb4608e30dbf0e67af0ea5dc1412f35da1133134f846a489601d024e81e69435fe6e40215d2c93033e012a553479b519
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou0:0NA1Yakeer5+nsoP
TLSH
T1BE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

y66vBZuEX.exe

Path C:\Windows\y66vBZuEX.exe
Size 804KB
SHA256 0c5ceaf379c6b1b8e2815078c2361d74b46763cff9038248ffd6b30b2d2c20d1
MD5 cd177b2a60c7215af34b38bfc1b1ae77
SHA1 dde9fb50b6beb4438e40c35e3959c80a8e9564cd
SHA512 48e1f38133936cd025842990b70ef71275bb50dfd901f5e75b5215ae0e22fe726b7bab22c2a9205feeaaff6178d8a17aa367d4a03c8e3a34cb413c04c1763276
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouU:0NA1Yakeer5+nsoP
TLSH
T12405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads