05cb11f27e70c95ca6eee4dd48771c620cebaba304c5ec44ee09556542f3a624

General

Target
2026-07-27_7c46c98050ba7e83fa1c6ef5a9c7de72_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260727-hdqqfaan2t
SHA256 05cb11f27e70c95ca6eee4dd48771c620cebaba304c5ec44ee09556542f3a624
MD5 7c46c98050ba7e83fa1c6ef5a9c7de72
SHA1 48efc586b2460eeab808187dbdf4edc25d96df10
SHA512 90099380e24c125fe622093272d090a558520df768f49783861cfd4179ae4726d3d3ab5dd5ba9d51ea8e3ebf586a24498cb13c2df0484cd18247924de075b085
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouJ:0NA1Yakeer5+nsoe
TLSH
T14A05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (867) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 8 IoCs

pid	Process
2384	G09hIvWMpJ.exe
1556	aX7SXW4.exe
2912	IVxUKARPItG.exe
1720	HInOT824.exe
5148	twuMWNjj7DLtNB4.exe
3336	5WYQPc.exe
4628	N7cFrK2pzt2TO.exe
6004	3WKsAcOUE4xq.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VET32 = "C:\\Windows\\G09hIvWMpJ.exe"	2026-07-27_7c46c98050ba7e83fa1c6ef5a9c7de72_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VET95 = "C:\\Windows\\aX7SXW4.exe"	G09hIvWMpJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGAVRTCL = "C:\\Windows\\IVxUKARPItG.exe"	aX7SXW4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ALOGSERV = "C:\\Windows\\HInOT824.exe"	IVxUKARPItG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCVSSHLD = "C:\\Windows\\twuMWNjj7DLtNB4.exe"	HInOT824.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVAPW32 = "C:\\Windows\\5WYQPc.exe"	twuMWNjj7DLtNB4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NTXCONFIG = "C:\\Windows\\N7cFrK2pzt2TO.exe"	5WYQPc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NVC95 = "C:\\Windows\\3WKsAcOUE4xq.exe"	N7cFrK2pzt2TO.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\N7cFrK2pzt2TO.exe	5WYQPc.exe
File created	C:\Windows\G09hIvWMpJ.exe	2026-07-27_7c46c98050ba7e83fa1c6ef5a9c7de72_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\aX7SXW4.exe	G09hIvWMpJ.exe
File created	C:\Windows\twuMWNjj7DLtNB4.exe	HInOT824.exe
File opened for modification	C:\Windows\3WKsAcOUE4xq.exe	N7cFrK2pzt2TO.exe
File created	C:\Windows\5WYQPc.exe	twuMWNjj7DLtNB4.exe
File created	C:\Windows\N7cFrK2pzt2TO.exe	5WYQPc.exe
File created	C:\Windows\3WKsAcOUE4xq.exe	N7cFrK2pzt2TO.exe
File opened for modification	C:\Windows\aX7SXW4.exe	G09hIvWMpJ.exe
File opened for modification	C:\Windows\IVxUKARPItG.exe	aX7SXW4.exe
File created	C:\Windows\HInOT824.exe	IVxUKARPItG.exe
File opened for modification	C:\Windows\HInOT824.exe	IVxUKARPItG.exe
File opened for modification	C:\Windows\5WYQPc.exe	twuMWNjj7DLtNB4.exe
File opened for modification	C:\Windows\G09hIvWMpJ.exe	2026-07-27_7c46c98050ba7e83fa1c6ef5a9c7de72_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\IVxUKARPItG.exe	aX7SXW4.exe
File opened for modification	C:\Windows\twuMWNjj7DLtNB4.exe	HInOT824.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3224	1532	WerFault.exe	89
2796	5148	WerFault.exe	102
3444	3336	WerFault.exe	104
468	1556	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3WKsAcOUE4xq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HInOT824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5WYQPc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	N7cFrK2pzt2TO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_7c46c98050ba7e83fa1c6ef5a9c7de72_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G09hIvWMpJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aX7SXW4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IVxUKARPItG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	twuMWNjj7DLtNB4.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_7c46c98050ba7e83fa1c6ef5a9c7de72_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_7c46c98050ba7e83fa1c6ef5a9c7de72_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 2160
  2⤵
  - Program crash
  PID:3224

C:\Windows\G09hIvWMpJ.exe
C:\Windows\G09hIvWMpJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2384

C:\Windows\aX7SXW4.exe
C:\Windows\aX7SXW4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 2508
  2⤵
  - Program crash
  PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1532 -ip 1532
1⤵
PID:4784

C:\Windows\IVxUKARPItG.exe
C:\Windows\IVxUKARPItG.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2912

C:\Windows\HInOT824.exe
C:\Windows\HInOT824.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1720

C:\Windows\twuMWNjj7DLtNB4.exe
C:\Windows\twuMWNjj7DLtNB4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5148 -s 2292
  2⤵
  - Program crash
  PID:2796

C:\Windows\5WYQPc.exe
C:\Windows\5WYQPc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 2200
  2⤵
  - Program crash
  PID:3444

C:\Windows\N7cFrK2pzt2TO.exe
C:\Windows\N7cFrK2pzt2TO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4628

C:\Windows\3WKsAcOUE4xq.exe
C:\Windows\3WKsAcOUE4xq.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5148 -ip 5148
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3336 -ip 3336
1⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1556 -ip 1556
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3WKsAcOUE4xq.exe

Path C:\Windows\3WKsAcOUE4xq.exe
Size 804KB
SHA256 fe101fc3f92229989655ba746c5a29a9fe450c2ddc871b3f028d1ef030393343
MD5 4da55ecea9a62adaa53da8c69c4505f9
SHA1 b81e59bf9372e62e10ab760029a6aecaab848874
SHA512 93c4bd56431c7a9ce549a5c417ab17d6fd8908ae9b0b9bc1bc592ecac71806fd62577cd4b884d9dbd048a67636b096b327f845462302053950e4764dfe245c8c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub6:0NA1Yakeer5+nso+6
TLSH
T1E405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5WYQPc.exe

Path C:\Windows\5WYQPc.exe
Size 804KB
SHA256 d588a61c26f01d478c50139ea08d35b6c42cd281f75dd0d83092e585a3a5e7b8
MD5 a8a01380f601c4f043a9ab86cbd49d80
SHA1 997c5abfa0b62c7d32ead59b24f5d62f3af35234
SHA512 ea3392793cc23fc867e1fcd18659e728dab62a1e544592218df9dacc35ab73bc0d437569d726760fb8856c8aaaf62a8e02b77825126bda7e28d15d1ce72e7564
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQ:0NA1Yakeer5+nso/
TLSH
T16105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

G09hIvWMpJ.exe

Path C:\Windows\G09hIvWMpJ.exe
Size 804KB
SHA256 07ba92f3e69be38aa6fe181da48ddf4e17c833ef6fda47180908aa7a4538fb69
MD5 dfc63cf8017f6317eaa35ff5960ae917
SHA1 38297c98e332273c4f2fe48cd89487d58ee30ebc
SHA512 b6b2e39e13156ff7b14db836c094186748e0dfcc68a4ea90b1246d07757b14292438976f66b25f90c712e555b3f1faebad7015d9981d5df5754bffb08d58d804
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoug:0NA1Yakeer5+nsoV
TLSH
T17E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HInOT824.exe

Path C:\Windows\HInOT824.exe
Size 804KB
SHA256 1eda6b90607a85f286ac28a68fa5b4a6ae33994d4e4b1dcf28cdbb4334d5c21c
MD5 591f92d67b75c473135d626c10991b1f
SHA1 0cd45d8480285976192342117a345aac6074ab93
SHA512 1680ae8d2a4606a4172bcfb4acd9ae4c0cd1557f895b961b5401366bb21d12c70f472b47aed2430f9f2ebff29240744848b1af2720d32d9c44a00c0e7faf2c58
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsoS
TLSH
T1BB05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IVxUKARPItG.exe

Path C:\Windows\IVxUKARPItG.exe
Size 804KB
SHA256 ba0c89d910624f11576572d1617226017717d1108d0825d1a1214e01d50db29a
MD5 d73bdf4919eb11d020ed9b0941e665ff
SHA1 96552113bc46df0900f99c089843832328798ee9
SHA512 f66a78bf538ffe706cf697b89a462098358e643c492214c91bd33d3105fbeafa9792312d85d967cf26f02aad8a572cda20aa333a12d1e62c34829391b9428132
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nsoE
TLSH
T1C105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N7cFrK2pzt2TO.exe

Path C:\Windows\N7cFrK2pzt2TO.exe
Size 804KB
SHA256 94a633d9c4a99352cb19953c0508e04aef55589e692d02ef371a9a41d06831b2
MD5 12e1caa4dc8a4e8eb94c388416eb7132
SHA1 6d2f5c1468ab65088cb7b8ae1b4160a02f423937
SHA512 4ee7c370ef95764702b18e8b126067e124ba7bb6870080a3b3e4b0aec6b2181986af05dd5bfbbb1d8613e242fbc4c4e40773398a3914ba631851693de0aa0187
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoui:0NA1Yakeer5+nsoz
TLSH
T17C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aX7SXW4.exe

Path C:\Windows\aX7SXW4.exe
Size 804KB
SHA256 919f9af35388055b60fd518884248ebbff626d9ec917349897ee3d79ca79ed43
MD5 202ee11300ce968ebe3c38ced4330c2d
SHA1 fb16dca37141cd8b3a70851b4b039da0e40df619
SHA512 98771d6265330c399643938fa8eef544051f8bfe194a6c3e199d98ad178968f43b569d70247901bf46121b84339bdcf6bdc19243a6b1db07923905423ba8689e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFous:0NA1Yakeer5+nsob
TLSH
T15605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

twuMWNjj7DLtNB4.exe

Path C:\Windows\twuMWNjj7DLtNB4.exe
Size 804KB
SHA256 18e1916774fab3825903392e98771dae86de1186079d70cebf4017be0da368d4
MD5 037a63f2c97ea44657dee228aa386a21
SHA1 4a74aa40a7c13bccdae367ee99e6c6efba316c08
SHA512 1df1efe03d08884213ac98d2503228e18273a3bf122e768945808ce0842f639f497c1f77b6628084ad9ea1b7541f2eee89991f876eab91b17176efce57907948
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nsoV
TLSH
T18805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads