2e04306a2a7697d9addc1e88b6d00d7c2a70c3beaf00d514557794cfc83bb7b6

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_c2831cf1088ad516d5a7c7c2ded29840_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260720-rhn7vaex3t
SHA256 2e04306a2a7697d9addc1e88b6d00d7c2a70c3beaf00d514557794cfc83bb7b6
MD5 c2831cf1088ad516d5a7c7c2ded29840
SHA1 40ea229e34ece933beb8204c81bb5370da632831
SHA512 a35aa3a3f8e7c8b465b929ebced9f57f393d67b7d4bc9da7182c91dd8a6bfbe19e91fe72e243b544f9f1680f37ab448d90a92edf53b874cabe585d178e463f0b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouZ:0NA1Yakeer5+nso2
TLSH
T14405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (949) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 9 IoCs

pid	Process
4444	JppYq.exe
5464	JgNDyLD8Vvh6GG3.exe
3408	QsTbnPd6wJTVnA.exe
2136	GtQF9Czz.exe
1692	GthV6.exe
4384	2E128timI3bL.exe
1760	0sAbvZn.exe
5992	gwyo86j.exe
5820	mVsn4Mv14U0.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCEVTMGR = "C:\\Windows\\JppYq.exe"	2026-07-20_c2831cf1088ad516d5a7c7c2ded29840_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NETUTILS = "C:\\Windows\\JgNDyLD8Vvh6GG3.exe"	JppYq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZONEALARM = "C:\\Windows\\QsTbnPd6wJTVnA.exe"	JgNDyLD8Vvh6GG3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TDS2-98 = "C:\\Windows\\GthV6.exe"	GtQF9Czz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TDS2-NT = "C:\\Windows\\gwyo86j.exe"	0sAbvZn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CLAW95 = "C:\\Windows\\mVsn4Mv14U0.exe"	gwyo86j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SPHINX = "C:\\Windows\\GtQF9Czz.exe"	QsTbnPd6wJTVnA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVLU32 = "C:\\Windows\\2E128timI3bL.exe"	GthV6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFIADMIN = "C:\\Windows\\0sAbvZn.exe"	2E128timI3bL.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\GtQF9Czz.exe	QsTbnPd6wJTVnA.exe
File created	C:\Windows\0sAbvZn.exe	2E128timI3bL.exe
File opened for modification	C:\Windows\0sAbvZn.exe	2E128timI3bL.exe
File created	C:\Windows\gwyo86j.exe	0sAbvZn.exe
File created	C:\Windows\mVsn4Mv14U0.exe	gwyo86j.exe
File opened for modification	C:\Windows\JgNDyLD8Vvh6GG3.exe	JppYq.exe
File created	C:\Windows\GthV6.exe	GtQF9Czz.exe
File created	C:\Windows\2E128timI3bL.exe	GthV6.exe
File opened for modification	C:\Windows\gwyo86j.exe	0sAbvZn.exe
File created	C:\Windows\QsTbnPd6wJTVnA.exe	JgNDyLD8Vvh6GG3.exe
File opened for modification	C:\Windows\2E128timI3bL.exe	GthV6.exe
File opened for modification	C:\Windows\mVsn4Mv14U0.exe	gwyo86j.exe
File created	C:\Windows\JppYq.exe	2026-07-20_c2831cf1088ad516d5a7c7c2ded29840_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\JppYq.exe	2026-07-20_c2831cf1088ad516d5a7c7c2ded29840_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\JgNDyLD8Vvh6GG3.exe	JppYq.exe
File opened for modification	C:\Windows\QsTbnPd6wJTVnA.exe	JgNDyLD8Vvh6GG3.exe
File created	C:\Windows\GtQF9Czz.exe	QsTbnPd6wJTVnA.exe
File opened for modification	C:\Windows\GthV6.exe	GtQF9Czz.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
4940	4448	WerFault.exe	88
4680	1692	WerFault.exe	101
2492	4384	WerFault.exe	103
1540	5464	WerFault.exe	92
1128	1760	WerFault.exe	105

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0sAbvZn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gwyo86j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mVsn4Mv14U0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_c2831cf1088ad516d5a7c7c2ded29840_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JgNDyLD8Vvh6GG3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JppYq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QsTbnPd6wJTVnA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GtQF9Czz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GthV6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2E128timI3bL.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-20_c2831cf1088ad516d5a7c7c2ded29840_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_c2831cf1088ad516d5a7c7c2ded29840_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 2164
  2⤵
  - Program crash
  PID:4940

C:\Windows\JppYq.exe
C:\Windows\JppYq.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4444

C:\Windows\JgNDyLD8Vvh6GG3.exe
C:\Windows\JgNDyLD8Vvh6GG3.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 2308
  2⤵
  - Program crash
  PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4448 -ip 4448
1⤵
PID:1276

C:\Windows\QsTbnPd6wJTVnA.exe
C:\Windows\QsTbnPd6wJTVnA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3408

C:\Windows\GtQF9Czz.exe
C:\Windows\GtQF9Czz.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2136

C:\Windows\GthV6.exe
C:\Windows\GthV6.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 548
  2⤵
  - Program crash
  PID:4680

C:\Windows\2E128timI3bL.exe
C:\Windows\2E128timI3bL.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 2212
  2⤵
  - Program crash
  PID:2492

C:\Windows\0sAbvZn.exe
C:\Windows\0sAbvZn.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 2420
  2⤵
  - Program crash
  PID:1128

C:\Windows\gwyo86j.exe
C:\Windows\gwyo86j.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5992

C:\Windows\mVsn4Mv14U0.exe
C:\Windows\mVsn4Mv14U0.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1692 -ip 1692
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4384 -ip 4384
1⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5464 -ip 5464
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1760 -ip 1760
1⤵
PID:5620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0sAbvZn.exe

Path C:\Windows\0sAbvZn.exe
Size 804KB
SHA256 414360eeefe9aa25d39ea8aecacd0409166856fce5f66c80ff998cd806e7bb65
MD5 a6c7f335b557d53913fc697a487b265d
SHA1 463dc62f53cf917d82c08eb5e903ecac1804efd0
SHA512 024ba0a2f854c75b083ddea8875304dc445a7829a992bc3736a803ebb8e84e0e210b2dd9285408c28f4617aae3509789247b00e9a89d82991cd9b710ebff1d38
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nso8
TLSH
T10905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2E128timI3bL.exe

Path C:\Windows\2E128timI3bL.exe
Size 804KB
SHA256 627806d347c3959db47fbcc67bf39ed1e3604001a56113c1464ccfadf617320d
MD5 eab6235fa97d5a4c5cda506994ee7b7b
SHA1 cb19be8bce26056224bb20f1f16edf69617f8724
SHA512 5848b008a3cdb3960d040519dee036fbc07d4e0340d9c9a875b5c71a46dff17373b5d159f2a9039f57059bbdac37ba4443754fd18658fe1e02daa296142b71d9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou5m:0NA1Yakeer5+nso7
TLSH
T1A605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GtQF9Czz.exe

Path C:\Windows\GtQF9Czz.exe
Size 804KB
SHA256 4a69295f1a3f4a9ee51bcbbe165210c7ca4f9b181605668f06ba4e912848ebf9
MD5 a72d322fc22d032edf3d4ed542d0532c
SHA1 1a4abb5025a43d40c2b01cba97140cb07f4b597b
SHA512 ea2f418ed1a69bf1b58d6cfa49a56f862236c48d2849e99aed6a061dfed26399539cf3ca8f90bd59f9dfae651eec42f34cf5e140e2f217464ee4e97f96a2af32
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nsoL
TLSH
T13A05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GthV6.exe

Path C:\Windows\GthV6.exe
Size 804KB
SHA256 3f46e4f3f222394b3b243f9ce165b0f3fedffde0a40be608c9b2a093b3750b5b
MD5 43f77ac869fe5ee6804e414bc500c05e
SHA1 ed20757d0a07c925f8240de5932bd91d9dbd8975
SHA512 afbd71fcb9d8017ffe0fc4ba3994f57cff35b5facb6f37d72421963291c03777a48633e36af5ecbd68b269293f3902abaa770801969d7b630b9675e21c167c77
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFous:0NA1Yakeer5+nso/
TLSH
T15E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JgNDyLD8Vvh6GG3.exe

Path C:\Windows\JgNDyLD8Vvh6GG3.exe
Size 804KB
SHA256 80d2fa97de72a5fc542673dc5e4d63e5fd9828cefb304bd8b798993cbfcc0c29
MD5 b076d990241fb753a13e1156dbe20afb
SHA1 c0a234196e2162a755a2c39666c05f4c975044e8
SHA512 a2899975fbeb9d8e721a0f03d1dc1ff00b428c4c6319d4bd1db13d94c26614d4d506f683359d888d8bd9804fe1788e5a850dc69736df5f55e76369d80d8fdf3d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsoS
TLSH
T19B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JppYq.exe

Path C:\Windows\JppYq.exe
Size 804KB
SHA256 39442bd740a6a68485efacf72b9bad01bab189a60877038df3b7fa727495d647
MD5 d615a9cd792f26addb8aaebf6d947500
SHA1 4dfa783cb6087f92e3381f8bfba617ed3cc9b44c
SHA512 00fe3fb83a49c15772e526bdae06ccd4706201c3ec4937e71e7cee33938dc63a4aa9840769bf6f956a95b8c3d05cdb10145f18c7603a967649d868613d082458
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouY:0NA1Yakeer5+nsol
TLSH
T11105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QsTbnPd6wJTVnA.exe

Path C:\Windows\QsTbnPd6wJTVnA.exe
Size 804KB
SHA256 8b0f4e681fea80b8f733faccabda730bc20f38f46ad0ff523ace54931971af51
MD5 0e901e5ab8a2f446b6c08c8fed7b5bbb
SHA1 c09b0220421a904001092ec9380be30f7cb0edd1
SHA512 a60de4a60a822f845bad02e64a577ef76e2dc4257e39529bc2ff29bb2d89fa9b0d0111297036cdd072711b63578ae191d5ae29ff6eadf3919dca61774522f6a9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou0:0NA1Yakeer5+nsoB
TLSH
T14105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gwyo86j.exe

Path C:\Windows\gwyo86j.exe
Size 804KB
SHA256 f2cb6356623de667d4d33e06768a02dfe2449abaa6f882aeb23aa9b24e325133
MD5 0405a8105bbc8915054277542ad53b0c
SHA1 7a34eff8d3ba503be4d16f0a9789e7996ef0abdd
SHA512 2a75c5c1a636f3d7f36056333dba77837bad1e3f97de8e273bb579569443015ab79e5c22674b1c39e8ad9a9be70064b3a3be4773beb7d68cab35ade8f44dff47
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nsoC
TLSH
T13205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mVsn4Mv14U0.exe

Path C:\Windows\mVsn4Mv14U0.exe
Size 804KB
SHA256 29c67cb561dd63e2e82a869ad8f2f0ceea6ae5cd67e45388e4fc058377919326
MD5 615f9240553370099368279f90b8ab31
SHA1 3b00eb112b217adc5dcb72b0a7cc08eef7a3fd19
SHA512 347ca354aeb881cb1b0bc7fab3ff96fdabbb81e40f7ecb059adecadc049a4db91e0d6f5b63dc20e04281ced3d3462e1184e1a60f3a332d6258113d5b1afdbf76
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nsor
TLSH
T1EC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads