0f324f514f466b865d4e30101e9cd23af971e628754a13cb9dd5f6c8b58ce4b8

General

Target
2026-07-27_736d80bdc67639b138dee83e65e1b4bc_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260727-rxgfjsvxaw
SHA256 0f324f514f466b865d4e30101e9cd23af971e628754a13cb9dd5f6c8b58ce4b8
MD5 736d80bdc67639b138dee83e65e1b4bc
SHA1 11e3954c93040a39fd39ec732ee2fe9f8e2f188e
SHA512 dea69beae0d973b0b2d20625f0ea0c4945b25c44059b46d40b85b816fccc4216ed66ed80b488e9bf152d4da3eb1fa949b23b2d0b8166de2c7a7506c0058c9459
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nsoi
TLSH
T12505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (624) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 5 IoCs

pid	Process
5684	d9Z1rKDtW5.exe
776	8vaEFn.exe
2896	CWUEYR.exe
1180	9JX4WgQhZFGo3x.exe
1400	nnsKp78tosY9GC.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NWSERVICE = "C:\\Windows\\nnsKp78tosY9GC.exe"	9JX4WgQhZFGo3x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IAMSERV = "C:\\Windows\\d9Z1rKDtW5.exe"	2026-07-27_736d80bdc67639b138dee83e65e1b4bc_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CLAW95CF = "C:\\Windows\\8vaEFn.exe"	d9Z1rKDtW5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUALL = "C:\\Windows\\CWUEYR.exe"	8vaEFn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPFTRAY = "C:\\Windows\\9JX4WgQhZFGo3x.exe"	CWUEYR.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\d9Z1rKDtW5.exe	2026-07-27_736d80bdc67639b138dee83e65e1b4bc_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\d9Z1rKDtW5.exe	2026-07-27_736d80bdc67639b138dee83e65e1b4bc_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\8vaEFn.exe	d9Z1rKDtW5.exe
File opened for modification	C:\Windows\8vaEFn.exe	d9Z1rKDtW5.exe
File created	C:\Windows\9JX4WgQhZFGo3x.exe	CWUEYR.exe
File opened for modification	C:\Windows\nnsKp78tosY9GC.exe	9JX4WgQhZFGo3x.exe
File created	C:\Windows\CWUEYR.exe	8vaEFn.exe
File opened for modification	C:\Windows\CWUEYR.exe	8vaEFn.exe
File opened for modification	C:\Windows\9JX4WgQhZFGo3x.exe	CWUEYR.exe
File created	C:\Windows\nnsKp78tosY9GC.exe	9JX4WgQhZFGo3x.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2852	5684	WerFault.exe	89
2532	2896	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nnsKp78tosY9GC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_736d80bdc67639b138dee83e65e1b4bc_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9Z1rKDtW5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8vaEFn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CWUEYR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9JX4WgQhZFGo3x.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_736d80bdc67639b138dee83e65e1b4bc_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_736d80bdc67639b138dee83e65e1b4bc_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3676

C:\Windows\d9Z1rKDtW5.exe
C:\Windows\d9Z1rKDtW5.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 2084
  2⤵
  - Program crash
  PID:2852

C:\Windows\8vaEFn.exe
C:\Windows\8vaEFn.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:776

C:\Windows\CWUEYR.exe
C:\Windows\CWUEYR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 2508
  2⤵
  - Program crash
  PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5684 -ip 5684
1⤵
PID:5836

C:\Windows\9JX4WgQhZFGo3x.exe
C:\Windows\9JX4WgQhZFGo3x.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1180

C:\Windows\nnsKp78tosY9GC.exe
C:\Windows\nnsKp78tosY9GC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2896 -ip 2896
1⤵
PID:5652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8vaEFn.exe

Path C:\Windows\8vaEFn.exe
Size 804KB
SHA256 6548be70a226283cc79b884816ac1b26008ff712baf89f23c99ce9e2562bd333
MD5 a4fe662add6ae9b8c02f8b27372dbeed
SHA1 9503dc82d4771e78ee20914b1b3946b314aa5091
SHA512 375438e7eb47014458b6fb08289ef74840b72e80437497ae0fa55774b705822d785687af5d1f42bfabba231f107e478ac559e5378ca5d0e82643e66aadefd0d8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nsoJ
TLSH
T1D605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9JX4WgQhZFGo3x.exe

Path C:\Windows\9JX4WgQhZFGo3x.exe
Size 804KB
SHA256 5a466be2f6dc49b77f7305648481214a267eff72242296b2e4a9e6e7d25ca862
MD5 ebdd672a5d1db0e427b863fb99a6422c
SHA1 673ce08da4f9b28bd5c64ffffd2ec4b28c45b845
SHA512 10ec52166d70a257111f6a85a4ba46caf1289d68e83632621b06b586f5fc565afae69af60ebd2ec4573aa1d502880c71a6e13a3efa4fff3105b172d5a8c9658b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nsoP
TLSH
T14105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CWUEYR.exe

Path C:\Windows\CWUEYR.exe
Size 804KB
SHA256 a492d0f8adc9ea81cf61ffcea4b6679fd67b87e75531b102bef6cf24f01bec0e
MD5 ab4d3a668965b3bcc446d29eda14cca5
SHA1 1ade7f68e6d051153707bbace56168bcf48ad51d
SHA512 71bae6ff7757aef2ea050c7bc20833d2a281d0b246ce32077b6a606c61eef7a2d5f24e27b237798ea4eba392b7808db18f074b4cdbe25a0ebd82854c123042cc
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouC:0NA1Yakeer5+nso/
TLSH
T13B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9Z1rKDtW5.exe

Path C:\Windows\d9Z1rKDtW5.exe
Size 804KB
SHA256 1d4b1d1524baf3b67c5255193c334ff9b84691f05d9df14f95bd9741fb4d98a4
MD5 e92ff69d6497c451aa152c901b5a5451
SHA1 3c799b0578b6c06a3324d5de7a3d4a5e210c5d1e
SHA512 9ae86b1ea68bb84db5bc8a4e00cec3993554188571b372ace1987a2e34854632c68ad6efbcd36379d577d26f556fedab47a1cde0697631ba211e34e3aeecf101
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nso3
TLSH
T1E805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nnsKp78tosY9GC.exe

Path C:\Windows\nnsKp78tosY9GC.exe
Size 804KB
SHA256 8ee6f06504fb3bb02ba0706e7d3be932a59d37857011a107eff210c96750434e
MD5 2d1ff9d7e047b293388926df687a9817
SHA1 8f49e563a686372c2edf954c330567feb2d3c68d
SHA512 78d46ecc16aba75055c0504709a0b8afa68d83a0262975d822a4c357ee7d5acc39216d150ac3c92eedcb5a1331e969a9f68ec84565c7cd7f2544a248a1822347
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou4:0NA1Yakeer5+nso/
TLSH
T1F105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads