d94f22d439027ee3e0f8ab9008799f04da33d0edc6f5795c30293759e0c9d870

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_ba64134d557b3148dd1e730fada8e9cd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260729-vm5beabh34
SHA256 d94f22d439027ee3e0f8ab9008799f04da33d0edc6f5795c30293759e0c9d870
MD5 ba64134d557b3148dd1e730fada8e9cd
SHA1 00fd54611a4c22d7a86cb92463189e68cbba796b
SHA512 8a60100363b21e6973814b38aca838b0c3d8c97b933a31f3052aa439060df190a159aeca14cd028a9117e42bb616e5ade89dd61df092b4cac9d0bb7f13f5018c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouc:0NA1Yakeer5+nsoD
TLSH
T10505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2417) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 23 IoCs

pid	Process
988	vC07P33.exe
2708	vXugS.exe
6000	KMUjo3wja.exe
4508	cjZjA.exe
3416	C4GGNjkUO6PKm.exe
5956	qTjYcUH4Oa.exe
5100	jBFAw9ZVIh0oh.exe
5044	7bm9ltQNbpX.exe
2472	93t6jnKvxL.exe
5880	yGesNTP8s4NV.exe
5096	u83MeEbi5r8u2gn.exe
6328	sxwqyzYmb.exe
6576	71utJaL6x8eqQ.exe
6828	ZxS8OxvW.exe
5444	OqBcONV.exe
7300	p0RyCMAjm.exe
7548	wLSzoRNusM.exe
7828	DPaOXDiPO8K6E4.exe
8108	lYtYVveb.exe
5996	eQp6saba8E.exe
8464	ZvRAR.exe
8764	AR3DeRg3Wlrv6r.exe
9040	RpvUCMYz258.exe

Adds Run key to start application 2 TTPs 23 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ESAFE = "C:\\Windows\\93t6jnKvxL.exe"	7bm9ltQNbpX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ANTI-TROJAN = "C:\\Windows\\wLSzoRNusM.exe"	p0RyCMAjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NSCHED32 = "C:\\Windows\\OqBcONV.exe"	ZxS8OxvW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVW = "C:\\Windows\\lYtYVveb.exe"	DPaOXDiPO8K6E4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUSPT = "C:\\Windows\\AR3DeRg3Wlrv6r.exe"	ZvRAR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NUI = "C:\\Windows\\RpvUCMYz258.exe"	AR3DeRg3Wlrv6r.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NEOWATCHLOG = "C:\\Windows\\u83MeEbi5r8u2gn.exe"	yGesNTP8s4NV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOOKOUT = "C:\\Windows\\qTjYcUH4Oa.exe"	C4GGNjkUO6PKm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFWATCH = "C:\\Windows\\yGesNTP8s4NV.exe"	93t6jnKvxL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AMON9X = "C:\\Windows\\KMUjo3wja.exe"	vXugS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPCC = "C:\\Windows\\7bm9ltQNbpX.exe"	jBFAw9ZVIh0oh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GUARD = "C:\\Windows\\71utJaL6x8eqQ.exe"	sxwqyzYmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VIR-HELP = "C:\\Windows\\ZxS8OxvW.exe"	71utJaL6x8eqQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-STOPW = "C:\\Windows\\p0RyCMAjm.exe"	OqBcONV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCCIOMON = "C:\\Windows\\DPaOXDiPO8K6E4.exe"	wLSzoRNusM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CLEANER3 = "C:\\Windows\\eQp6saba8E.exe"	lYtYVveb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFALERT = "C:\\Windows\\ZvRAR.exe"	eQp6saba8E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CPDCLNT = "C:\\Windows\\sxwqyzYmb.exe"	u83MeEbi5r8u2gn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DVP95_0 = "C:\\Windows\\vC07P33.exe"	2026-07-29_ba64134d557b3148dd1e730fada8e9cd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PERSWF = "C:\\Windows\\vXugS.exe"	vC07P33.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NEOWATCHLOG = "C:\\Windows\\cjZjA.exe"	KMUjo3wja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGAVRTE = "C:\\Windows\\C4GGNjkUO6PKm.exe"	cjZjA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SAFEWEB = "C:\\Windows\\jBFAw9ZVIh0oh.exe"	qTjYcUH4Oa.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 46 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ZxS8OxvW.exe	71utJaL6x8eqQ.exe
File created	C:\Windows\vC07P33.exe	2026-07-29_ba64134d557b3148dd1e730fada8e9cd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\qTjYcUH4Oa.exe	C4GGNjkUO6PKm.exe
File opened for modification	C:\Windows\p0RyCMAjm.exe	OqBcONV.exe
File opened for modification	C:\Windows\lYtYVveb.exe	DPaOXDiPO8K6E4.exe
File created	C:\Windows\eQp6saba8E.exe	lYtYVveb.exe
File opened for modification	C:\Windows\eQp6saba8E.exe	lYtYVveb.exe
File created	C:\Windows\ZvRAR.exe	eQp6saba8E.exe
File opened for modification	C:\Windows\AR3DeRg3Wlrv6r.exe	ZvRAR.exe
File opened for modification	C:\Windows\RpvUCMYz258.exe	AR3DeRg3Wlrv6r.exe
File created	C:\Windows\jBFAw9ZVIh0oh.exe	qTjYcUH4Oa.exe
File created	C:\Windows\KMUjo3wja.exe	vXugS.exe
File created	C:\Windows\C4GGNjkUO6PKm.exe	cjZjA.exe
File created	C:\Windows\qTjYcUH4Oa.exe	C4GGNjkUO6PKm.exe
File created	C:\Windows\7bm9ltQNbpX.exe	jBFAw9ZVIh0oh.exe
File created	C:\Windows\OqBcONV.exe	ZxS8OxvW.exe
File created	C:\Windows\93t6jnKvxL.exe	7bm9ltQNbpX.exe
File created	C:\Windows\p0RyCMAjm.exe	OqBcONV.exe
File created	C:\Windows\wLSzoRNusM.exe	p0RyCMAjm.exe
File opened for modification	C:\Windows\DPaOXDiPO8K6E4.exe	wLSzoRNusM.exe
File created	C:\Windows\lYtYVveb.exe	DPaOXDiPO8K6E4.exe
File opened for modification	C:\Windows\vC07P33.exe	2026-07-29_ba64134d557b3148dd1e730fada8e9cd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\vXugS.exe	vC07P33.exe
File created	C:\Windows\yGesNTP8s4NV.exe	93t6jnKvxL.exe
File opened for modification	C:\Windows\sxwqyzYmb.exe	u83MeEbi5r8u2gn.exe
File opened for modification	C:\Windows\OqBcONV.exe	ZxS8OxvW.exe
File opened for modification	C:\Windows\wLSzoRNusM.exe	p0RyCMAjm.exe
File opened for modification	C:\Windows\ZvRAR.exe	eQp6saba8E.exe
File created	C:\Windows\AR3DeRg3Wlrv6r.exe	ZvRAR.exe
File opened for modification	C:\Windows\KMUjo3wja.exe	vXugS.exe
File created	C:\Windows\cjZjA.exe	KMUjo3wja.exe
File opened for modification	C:\Windows\cjZjA.exe	KMUjo3wja.exe
File opened for modification	C:\Windows\jBFAw9ZVIh0oh.exe	qTjYcUH4Oa.exe
File opened for modification	C:\Windows\7bm9ltQNbpX.exe	jBFAw9ZVIh0oh.exe
File created	C:\Windows\ZxS8OxvW.exe	71utJaL6x8eqQ.exe
File created	C:\Windows\RpvUCMYz258.exe	AR3DeRg3Wlrv6r.exe
File opened for modification	C:\Windows\C4GGNjkUO6PKm.exe	cjZjA.exe
File opened for modification	C:\Windows\u83MeEbi5r8u2gn.exe	yGesNTP8s4NV.exe
File created	C:\Windows\DPaOXDiPO8K6E4.exe	wLSzoRNusM.exe
File opened for modification	C:\Windows\vXugS.exe	vC07P33.exe
File opened for modification	C:\Windows\93t6jnKvxL.exe	7bm9ltQNbpX.exe
File opened for modification	C:\Windows\yGesNTP8s4NV.exe	93t6jnKvxL.exe
File created	C:\Windows\u83MeEbi5r8u2gn.exe	yGesNTP8s4NV.exe
File created	C:\Windows\sxwqyzYmb.exe	u83MeEbi5r8u2gn.exe
File created	C:\Windows\71utJaL6x8eqQ.exe	sxwqyzYmb.exe
File opened for modification	C:\Windows\71utJaL6x8eqQ.exe	sxwqyzYmb.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
3176	4508	WerFault.exe	96
2148	3416	WerFault.exe	98
9052	5044	WerFault.exe	109
1376	6828	WerFault.exe	121
2564	5444	WerFault.exe	123
8136	2708	WerFault.exe	92
6760	4200	WerFault.exe	87
3252	7300	WerFault.exe	125

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMUjo3wja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cjZjA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qTjYcUH4Oa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7bm9ltQNbpX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sxwqyzYmb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71utJaL6x8eqQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZvRAR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_ba64134d557b3148dd1e730fada8e9cd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vC07P33.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vXugS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C4GGNjkUO6PKm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	u83MeEbi5r8u2gn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZxS8OxvW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DPaOXDiPO8K6E4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jBFAw9ZVIh0oh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wLSzoRNusM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eQp6saba8E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RpvUCMYz258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93t6jnKvxL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yGesNTP8s4NV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OqBcONV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	p0RyCMAjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lYtYVveb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AR3DeRg3Wlrv6r.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_ba64134d557b3148dd1e730fada8e9cd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_ba64134d557b3148dd1e730fada8e9cd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 2484
  2⤵
  - Program crash
  PID:6760

C:\Windows\vC07P33.exe
C:\Windows\vC07P33.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:988

C:\Windows\vXugS.exe
C:\Windows\vXugS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 2308
  2⤵
  - Program crash
  PID:8136

C:\Windows\KMUjo3wja.exe
C:\Windows\KMUjo3wja.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6000

C:\Windows\cjZjA.exe
C:\Windows\cjZjA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 2096
  2⤵
  - Program crash
  PID:3176

C:\Windows\C4GGNjkUO6PKm.exe
C:\Windows\C4GGNjkUO6PKm.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 2092
  2⤵
  - Program crash
  PID:2148

C:\Windows\qTjYcUH4Oa.exe
C:\Windows\qTjYcUH4Oa.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4508 -ip 4508
1⤵
PID:4428

C:\Windows\jBFAw9ZVIh0oh.exe
C:\Windows\jBFAw9ZVIh0oh.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3416 -ip 3416
1⤵
PID:3540

C:\Windows\7bm9ltQNbpX.exe
C:\Windows\7bm9ltQNbpX.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 2196
  2⤵
  - Program crash
  PID:9052

C:\Windows\93t6jnKvxL.exe
C:\Windows\93t6jnKvxL.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2472

C:\Windows\yGesNTP8s4NV.exe
C:\Windows\yGesNTP8s4NV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5880

C:\Windows\u83MeEbi5r8u2gn.exe
C:\Windows\u83MeEbi5r8u2gn.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5096

C:\Windows\sxwqyzYmb.exe
C:\Windows\sxwqyzYmb.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6328

C:\Windows\71utJaL6x8eqQ.exe
C:\Windows\71utJaL6x8eqQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6576

C:\Windows\ZxS8OxvW.exe
C:\Windows\ZxS8OxvW.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6828 -s 2212
  2⤵
  - Program crash
  PID:1376

C:\Windows\OqBcONV.exe
C:\Windows\OqBcONV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 2200
  2⤵
  - Program crash
  PID:2564

C:\Windows\p0RyCMAjm.exe
C:\Windows\p0RyCMAjm.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7300 -s 2416
  2⤵
  - Program crash
  PID:3252

C:\Windows\wLSzoRNusM.exe
C:\Windows\wLSzoRNusM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7548

C:\Windows\DPaOXDiPO8K6E4.exe
C:\Windows\DPaOXDiPO8K6E4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7828

C:\Windows\lYtYVveb.exe
C:\Windows\lYtYVveb.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8108

C:\Windows\eQp6saba8E.exe
C:\Windows\eQp6saba8E.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5996

C:\Windows\ZvRAR.exe
C:\Windows\ZvRAR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8464

C:\Windows\AR3DeRg3Wlrv6r.exe
C:\Windows\AR3DeRg3Wlrv6r.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8764

C:\Windows\RpvUCMYz258.exe
C:\Windows\RpvUCMYz258.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:9040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5044 -ip 5044
1⤵
PID:9024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6828 -ip 6828
1⤵
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5444 -ip 5444
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2708 -ip 2708
1⤵
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4200 -ip 4200
1⤵
PID:7208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 7300 -ip 7300
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

71utJaL6x8eqQ.exe

Path C:\Windows\71utJaL6x8eqQ.exe
Size 804KB
SHA256 27fd213496f8eeebd19493dd6b4cf5665307c06230ebeecc7b3e0394025d0caf
MD5 cb5025a939a0f58c6aa81902b18d8e8a
SHA1 87479f8f16c43a5776eee9b727a150bde464b9bf
SHA512 ca7bbb173587035d9e0189d7c1a2b00641bcbfe722617096ccf4b445fddfcb713ef2563f4ad94f7a8563ffd3d9150a5e35462ff32fdc1fcbac7b260f874d611b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsoG
TLSH
T1FE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7bm9ltQNbpX.exe

Path C:\Windows\7bm9ltQNbpX.exe
Size 804KB
SHA256 2da03f905f43721fd45f2d266261efcd24b0da0cd6695db78974718aa8dddbe8
MD5 a1ef677b593abc1070541cd92f50a203
SHA1 f96b26d2472c2d48fe73428884d40a649c1894c5
SHA512 55b91d023a9926b50e3a35d52bb8d6a12b3093e790fb0ca2d646afa68f066e641203c33aa7421064a4ecb79b21f0a7a0669f270b1b80721f9648d067573c5623
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouu:0NA1Yakeer5+nsox
TLSH
T15E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93t6jnKvxL.exe

Path C:\Windows\93t6jnKvxL.exe
Size 804KB
SHA256 b2eac514c7097e54e37e9b2648e8a58b72c203863fd9358092a9dd45fdc841e9
MD5 4d9fd734f6cdfcec3fe1c889f9b5e5a8
SHA1 1ebb6a49c8c1e93071796916790ab5ec00060798
SHA512 eb7b5ff872aeb66b5c3ce0d6c982c3d390243dce0ebb33bbdedc1a792f185f2bca1939fe07da94bce753254d67063ace73852e90739676635c16ee55c9d79834
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nsox
TLSH
T12D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AR3DeRg3Wlrv6r.exe

Path C:\Windows\AR3DeRg3Wlrv6r.exe
Size 804KB
SHA256 5c4ea14b79ce60f10ee678cdb90e6d46e7ec550d53af042424dd7cf98f76d144
MD5 caf66a25f49d0016c1532ce31b7fadc2
SHA1 344d975ac22e2750188814cb7b3062773f101219
SHA512 5eaaa5c4e258395ac048c594cf8a62e4423b5c047fcb60802b0cce06bebcd6d329f57f3d9b0183a2de01c1a9102c8051396e6c26b7601bbf1e1cde6af89ccc70
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou1:0NA1Yakeer5+nsok
TLSH
T19005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C4GGNjkUO6PKm.exe

Path C:\Windows\C4GGNjkUO6PKm.exe
Size 804KB
SHA256 bece946762e5505f7e2173acf4eea945b28730b8d588c78ee9e25f24cb65b866
MD5 bbbb5225456dba0c74269e78ff3a1436
SHA1 cf88f4e848c91f7b96e064c9431796154dedefc0
SHA512 a3889ad7ee1b95453c7ee0260fb05a06498e762bfd1c3a79c7e57b105fb0e704b9fb1829de1dbac3fc140dcb3b0ae4d2e51a077b69581408ce95a1bbebad7032
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouu:0NA1Yakeer5+nsoL
TLSH
T13A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DPaOXDiPO8K6E4.exe

Path C:\Windows\DPaOXDiPO8K6E4.exe
Size 804KB
SHA256 39dfdb45677d5e1b48ac6692d0ef1637f92c1d5d3ac55d2f077bfce3a9652f53
MD5 be42979df87c9f9ab93d6ac44471f161
SHA1 4cc85c07d4c3bd636f3e3fc89fbe453d4d6be919
SHA512 ce23f50d9ba45b71beab19dd2ed11cdbf5e2d365b2f4eedd393d8455a4fdefb03f60bd68570b9cca25e1c6e4c7c4d489b53992b11898eaddd068e4895edd9f73
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouh:0NA1Yakeer5+nsoG
TLSH
T10105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMUjo3wja.exe

Path C:\Windows\KMUjo3wja.exe
Size 804KB
SHA256 993ddd15fdaf89d5c8d718cc154fa58f6a27c852529c9f3ac8db24e2af46faaa
MD5 97791725f729d736ee091be8f78ae2ea
SHA1 a31da8a15df56c45b94453a96330da33c3155706
SHA512 3f17f5778ec8ccb8043790ce00afb3c7370a550ec66daef1de2ca48d076c4fa7aef979a501b25174e9114a68e287a69e08662055c3a5dd3684e1f1217d8b3d97
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou:0NA1Yakeer5+nso
TLSH
T1A305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OqBcONV.exe

Path C:\Windows\OqBcONV.exe
Size 804KB
SHA256 032c0863c90a76edadbcf06314816210713dfe1d58bcf9a8f1c470261ae6148a
MD5 c67ce08cc958b9815ec39e4456c0c3e0
SHA1 935190a5c7347fb8e9ca6d753fc9a6b9e1768dc2
SHA512 7078428af0570340e4f9bd60b3cf0e070f411f20f46a145e6d8144bac26ee9083de20d4a1b5bc726423be65c391c36ece6ac45365d1a83279756d9cacace62cb
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nsoR
TLSH
T13405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RpvUCMYz258.exe

Path C:\Windows\RpvUCMYz258.exe
Size 804KB
SHA256 54a3259da069cb4724c208c87e9d12a7a5cc8453385452b538cd42b3ec6cbb1a
MD5 1e011b70f8ba4339d92b2527cf028a59
SHA1 7b38f992b2e9e78c796892b9d71bbb29b7097f17
SHA512 f65768dcc02f31ae688e53e155e29d4c4ac110acb283448fe97ccd2bced969d392442c46e4e58c19339e1b8e4dbd99851807b6f26e15f6ba9cb97d1ebf1cdace
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nsoD
TLSH
T1E805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZvRAR.exe

Path C:\Windows\ZvRAR.exe
Size 804KB
SHA256 130d223a6604b8a3b9c34b359918382907a330035b981370040fec21fc426338
MD5 0dc0d96142a5c514dad540019a676711
SHA1 851e43b10daba975352f4ff4b798a2abfd542749
SHA512 be3058a09f9c9a0d8b38048c20b91fa808e045a4d1d1d22a087e13a814ee1d7a0f731afa76e0777b6d6210cd462378aa0dc4e6067b45835f79f5440c3f7bca2a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsoM
TLSH
T14205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZxS8OxvW.exe

Path C:\Windows\ZxS8OxvW.exe
Size 804KB
SHA256 2cec00bf1dac44d6ef7af20e5c3578f2445ffba01a0b5c883047efa70254318b
MD5 dc394c4810f4fe681510b1faa24dc859
SHA1 056cd959705eeb17b01ddff68402922d40e34780
SHA512 ecdf5516b3475ea836a4060ed04f0d6c8dd18c35ce5de67ccffa9b66108ce6a97f95f8ce203ebb5b8f4757fc577714467f7644f99dbfbb2517a440de7f4e7e28
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nsoD
TLSH
T19205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cjZjA.exe

Path C:\Windows\cjZjA.exe
Size 804KB
SHA256 28ad0438c7690a6c06da3c79b7cf57bb994a4ca9efb81add6dfaeb0dd04b4a34
MD5 fa6bde717d03968b3f11a86d3f7f79e4
SHA1 c8f1b625fbb4bf12384a55d7ef3992047581fc00
SHA512 2b8d7c410b0be6ba2199a3dde5efc9c5b73f02f8102d528425039709fc88fd8126306f61c371e914fdfc448b1120ee208f3a725c5f130669057067e1e58c55e1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsoU
TLSH
T19705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eQp6saba8E.exe

Path C:\Windows\eQp6saba8E.exe
Size 804KB
SHA256 87685ab531a852ed5698e9920143de71aa46ff3d3759f0eba460799103c62c7a
MD5 cfa32b6eab94615d859767357d70b715
SHA1 d9b082eb1689a262dc18ba9b5dd7e6b088eff421
SHA512 4a7698490a537018f0356f6262468ea2d7f953d55721ae0a878e41eb4671719b64929422037f03304e1ea3cea6d405ac335f657cf5ad56f0c914092159914df9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouI:0NA1Yakeer5+nsoT
TLSH
T13205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jBFAw9ZVIh0oh.exe

Path C:\Windows\jBFAw9ZVIh0oh.exe
Size 804KB
SHA256 f548a6293feb6a08121c55669658463334c6813db989b478f59d4cbf1cfa699a
MD5 ef9be5bb062815d6286d1c07d7291fd0
SHA1 8b12c2b680a737c85b7a00669af37e60ff9604ed
SHA512 82688d7d798593cfc93edebee0e873671a21d04815ba7733421ea8deb3a5da6c8459eaad1aeda5c49b8ddb053580d2fd2dc9fffb784a058a04a183b145a30974
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsov
TLSH
T1AA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lYtYVveb.exe

Path C:\Windows\lYtYVveb.exe
Size 804KB
SHA256 ab95eaa252a1e5b3045d1ee872c45ebdb7ad497a226f2851d6381281b6bba81b
MD5 289d575013833b4a3e6b6d9363cf0271
SHA1 8c8391a46b291ed100e68735ad67e2db20bbf6c7
SHA512 4f80f819a0293983595c80b0f87e4e667f6d11ffad0a910ac49f2f5cba577e9337ccb60e6db66f31875244d6c6e9966fcb247eb1e29b1d237277029cee51bf1c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouk:0NA1Yakeer5+nsol
TLSH
T10F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p0RyCMAjm.exe

Path C:\Windows\p0RyCMAjm.exe
Size 804KB
SHA256 bb71b66f33400214bdb962485d48a007384e744d2adca1bfb6cd54b395f548a3
MD5 876ac5771945a22a2b034afa1c467a73
SHA1 53c140560a1889942fd92c032eda2d576d23845c
SHA512 522acf92f15bd43570f9f2cd5b4fec81262842c05edd1ad303c5a108f0d55a35f6e633cde25954a07eec68f457b21b17d6191c4de9fea94f52b377b0f6596ab5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsoy
TLSH
T17605A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qTjYcUH4Oa.exe

Path C:\Windows\qTjYcUH4Oa.exe
Size 804KB
SHA256 876e9f9fdfc6dc74fce966777f346328bdb81da379b2eb06fe9baa7d392e5511
MD5 5f1bef99144f3e947000f9938989e5a8
SHA1 63069bd750191e2ca65aa85ebec248e96a151094
SHA512 27f0edfe8dc55113e2bc74a8d7aa310a0ac23707a9ba4cc7e2991b9986b012cdb7df060e9933704248c54c856a991529086a1e8d6638239b59f31bd3cbf8f661
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nsoY
TLSH
T1DD05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sxwqyzYmb.exe

Path C:\Windows\sxwqyzYmb.exe
Size 804KB
SHA256 366ec047bd02964419e309aa5ecfa8161ec44a30b6ea3c5cbf1b77ad2e91d888
MD5 7cd0b852a98968c79cc2a06cf96be71a
SHA1 4b05cc5c369e46a94aa78b7ba36996617772e74e
SHA512 48de033892264b1d0ea5f1c7914e8dda170fce721dbf6d6e5ff0857426156e72cbbd21c99bb76728e959071fd64d0392c8e860b18324ef6c69b1ffc6ce1469fd
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouLl:0NA1Yakeer5+nsoQ
TLSH
T12805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

u83MeEbi5r8u2gn.exe

Path C:\Windows\u83MeEbi5r8u2gn.exe
Size 804KB
SHA256 85a6a1b20ff52576835d0a6bcb0ac82cbccd2c2893603341e885d9b7acdfedde
MD5 c877c6276a2035ff35eabe3640dd1227
SHA1 c9a9eab678eeee736bee17478f183bbb94449d2f
SHA512 a758d2b24810cd0bd7b18a71c9a1fdd069a1e2601fd60abc403564e449ad82fd81f2a4b169dabe56782128df3c1e1389c486d4c8f41af829edc2fb8d4d682e71
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nsoA
TLSH
T14805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vC07P33.exe

Path C:\Windows\vC07P33.exe
Size 804KB
SHA256 7df0cbd610391d06c263f1a6678c251165ba847d083c7cad230dd8f9b0b31d6f
MD5 a416cee398e00302dd1a5b94e0742f98
SHA1 6b8382440d136ccc987c5e2ff6d7e1a967073bc8
SHA512 73a307ef7688e447f0eef162a9c9acda3911eb3d1963262599f07c6ebb3583091686a73e0811c895f0dcda8752d5c4e144551b858606dc1c8c3af900903d3261
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nso0
TLSH
T1DC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vXugS.exe

Path C:\Windows\vXugS.exe
Size 804KB
SHA256 6c33f892a706b7bb4a1f3d8f07eb172f86e0a027f68457f8cf1e73f778afe8a2
MD5 df21f0e0e09f495c01d213d01eef03f0
SHA1 b86f82c4d9328c0013a9a37cec0988624e25d664
SHA512 206c205cf19b00453bc4f1fca840125efccebba51e3ee03a5ad1bfc38ab96dd62be1a8a274f67acfc788974d2a83a1c2b3afcace1d305471ae204e936f493992
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nsoX
TLSH
T18905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wLSzoRNusM.exe

Path C:\Windows\wLSzoRNusM.exe
Size 804KB
SHA256 9c7d7a1cfb1448209d5dbaefd9217cd5b6340bbfc4ee041fe973e5a53269cfdd
MD5 03fdead00d12bb56a6c60759422fb71e
SHA1 36e509d7f137a68e2153e822d92b5a848b4f2364
SHA512 cb8721605b2d31e3d9953d11179dddf1ec8f38e5f791c0139206fb8d51d1e3bc2dcb9b50cd6c1e637cb24782dbd3dbeeac65a53d0f2880752a7e9028c07f8880
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoue:0NA1Yakeer5+nsob
TLSH
T1A205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yGesNTP8s4NV.exe

Path C:\Windows\yGesNTP8s4NV.exe
Size 804KB
SHA256 f5db12295e1701c3693c385547facbcea66a955aa69800e925e2c74bc49f0745
MD5 917bf5e7c5f7f8086fa3ece769da4ef6
SHA1 3afb3b8895a3a9e18109818c93d4af6399e7e616
SHA512 5c17b97a1d122ef9097c34306e4fd71e35466c8013bc4f4e3a1584626f92c553004e12302cdde14f0c9c725d7738583ee3879d4b2d3066a36d66c0872dec6efc
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouc:0NA1Yakeer5+nsoN
TLSH
T1DA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads