1731281b0b17bb558453edefbf11c0aba94d758ecde609146b904170955b8844

General

Target
2026-07-30_67e921b27fb30085b3a06cb9c84a0926_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260730-hp74vswwcv
SHA256 1731281b0b17bb558453edefbf11c0aba94d758ecde609146b904170955b8844
MD5 67e921b27fb30085b3a06cb9c84a0926
SHA1 cdfdb3d328b627e125ac1c57f8e24705859dbff8
SHA512 d22b28b99f9ee2c1b644542ac8a57b92eadbce49a506646ef6582f93c9cbc21cbaac7abba1d4c86a8d8a8b52990130299d4934f7de36732eafa1043ccae6adae
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouv:0NA1Yakeer5+nsoI
TLSH
T19905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (508) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 4 IoCs

pid	Process
2896	TJEsFQ.exe
4784	xxge5q8vu12g.exe
5636	SS1pQLQbSs.exe
2736	3qKcy2cJZQSH.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVP = "C:\\Windows\\xxge5q8vu12g.exe"	TJEsFQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VPC32 = "C:\\Windows\\SS1pQLQbSs.exe"	xxge5q8vu12g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FINDVIRU = "C:\\Windows\\3qKcy2cJZQSH.exe"	SS1pQLQbSs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCAN95 = "C:\\Windows\\TJEsFQ.exe"	2026-07-30_67e921b27fb30085b3a06cb9c84a0926_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\TJEsFQ.exe	2026-07-30_67e921b27fb30085b3a06cb9c84a0926_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\xxge5q8vu12g.exe	TJEsFQ.exe
File opened for modification	C:\Windows\SS1pQLQbSs.exe	xxge5q8vu12g.exe
File created	C:\Windows\3qKcy2cJZQSH.exe	SS1pQLQbSs.exe
File opened for modification	C:\Windows\3qKcy2cJZQSH.exe	SS1pQLQbSs.exe
File created	C:\Windows\TJEsFQ.exe	2026-07-30_67e921b27fb30085b3a06cb9c84a0926_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\xxge5q8vu12g.exe	TJEsFQ.exe
File created	C:\Windows\SS1pQLQbSs.exe	xxge5q8vu12g.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4964	5636	WerFault.exe	94
5480	4592	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SS1pQLQbSs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3qKcy2cJZQSH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_67e921b27fb30085b3a06cb9c84a0926_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TJEsFQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xxge5q8vu12g.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_67e921b27fb30085b3a06cb9c84a0926_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_67e921b27fb30085b3a06cb9c84a0926_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 2464
  2⤵
  - Program crash
  PID:5480

C:\Windows\TJEsFQ.exe
C:\Windows\TJEsFQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2896

C:\Windows\xxge5q8vu12g.exe
C:\Windows\xxge5q8vu12g.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4784

C:\Windows\SS1pQLQbSs.exe
C:\Windows\SS1pQLQbSs.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 2200
  2⤵
  - Program crash
  PID:4964

C:\Windows\3qKcy2cJZQSH.exe
C:\Windows\3qKcy2cJZQSH.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5636 -ip 5636
1⤵
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4592 -ip 4592
1⤵
PID:3064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3qKcy2cJZQSH.exe

Path C:\Windows\3qKcy2cJZQSH.exe
Size 804KB
SHA256 e383a82894224ae4074aeb4eb19870182f2d9089155f854520122db33f521d77
MD5 bbd93ce39597f75806b5a13cf35a77c8
SHA1 a100177231d7249349f8219dd4c573233ed641fa
SHA512 95a7fba24f85006e515348a6f632a0f0bbce77e7e78c057c3d62af2c4787b68ca7beb0412cf222cdd909b326ad85e5b036ca6a5a7d0bf21b969885d6257d5a93
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nso2
TLSH
T10F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SS1pQLQbSs.exe

Path C:\Windows\SS1pQLQbSs.exe
Size 804KB
SHA256 9ba970789d7664c8d2ce1c1cb22d4f4a57152ec9c4875be09b99c9579291212d
MD5 8db8c836bc9b72058f130bc317e1e5b1
SHA1 f07ab7f93b3b43b0d22c4bfb59ce2d694e33733f
SHA512 fc2bf10aee11aa40ccc761506384286416a4cc5048f7a264feeab685ad6343346875a091b28963bb6d205b88d6bb9a885a12b15368685e9ae973493ffa3d43b5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoue:0NA1Yakeer5+nsoN
TLSH
T1B105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TJEsFQ.exe

Path C:\Windows\TJEsFQ.exe
Size 804KB
SHA256 c15e8e761c0a13234fb944879f7bde3ea382f224609e2c22286b87585e5a17ad
MD5 d20bd3a9c59331975812e1ddb5840a2b
SHA1 0380fd72a1978deafb40d90ecd4ed436b8110086
SHA512 5fbebe6ff2158fa31679c96ebce39b133d020c42137b9bcf9e722a067be43dfb56e8f4c1d83f63bdee1408f91530e1af91930f25c56663bbc87207531bb87c58
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+K:0NA1Yakeer5+nsoZK
TLSH
T1C105A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxge5q8vu12g.exe

Path C:\Windows\xxge5q8vu12g.exe
Size 804KB
SHA256 920538cdb23ba62211efd4ff13727d1480c2db3a06be6e33464cc0e1971d5a77
MD5 85761c63f5de28aa8855d42c17fd5314
SHA1 d8872b5a55712467dc387a677780b8c3665c4eb0
SHA512 55d2f2f4259d590851c7c5fcd62b74f20f1b29dba7eeec521149fb381e01155e8017cd3ff1898745e1c1641c313f26ab1f9da316bfa5a4565be6b7a01b848463
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nso1
TLSH
T1B705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads