6c6e8661e3ba07775a516847e4e4cb7606de674d22a60a2e445d9d2a546216fe

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_031a23142b10542c70a1d9b137edfc80_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260802-eavy7scf63
SHA256 6c6e8661e3ba07775a516847e4e4cb7606de674d22a60a2e445d9d2a546216fe
MD5 031a23142b10542c70a1d9b137edfc80
SHA1 76632cf212edb0f2ee5a06e3cb2b447f216a4760
SHA512 a178d45824fb39b031017d1bf74adf4dc559e13cb95c62f2901c83ee6ba488c0d7ef8ee9c03d724e37d9f2501b88e074fc92989bc455cd597cef43157da9912d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou5:0NA1Yakeer5+nso0
TLSH
T16C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2299) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 23 IoCs

pid	Process
3476	W6YDpIRE2BCiV.exe
1256	uavU7Ztn.exe
2400	IeqJDsL5D.exe
1576	gIU4y5bQI8Y.exe
3344	9gGVswDWWwa48A9.exe
5056	hQrK3uIP45.exe
2384	J5olelwiXpQ4E.exe
4848	5yKN3m.exe
1200	Um6cCugvE0v.exe
5292	01uLR.exe
5532	xWudMjUw.exe
5776	C9aNa5.exe
6020	HYBz3XZ8pBNB4S.exe
4964	BYTDP9.exe
5788	Ha3OJT.exe
6276	Ksa78ek.exe
6520	UYKnl6jEgRLk.exe
6760	d1IlwsP.exe
7008	bjpWB3PeK6Lz3qW.exe
6532	oR45ch9.exe
7332	TgnRG3.exe
7628	4p00RjIaq.exe
7872	8N3LT9Fv0.exe

Adds Run key to start application 2 TTPs 23 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NWTOOL16 = "C:\\Windows\\5yKN3m.exe"	J5olelwiXpQ4E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CLAW95CF = "C:\\Windows\\UYKnl6jEgRLk.exe"	Ksa78ek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LDNETMON = "C:\\Windows\\TgnRG3.exe"	oR45ch9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NTRTSCAN = "C:\\Windows\\W6YDpIRE2BCiV.exe"	2026-08-02_031a23142b10542c70a1d9b137edfc80_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NDD32 = "C:\\Windows\\hQrK3uIP45.exe"	9gGVswDWWwa48A9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVGW = "C:\\Windows\\J5olelwiXpQ4E.exe"	hQrK3uIP45.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFGWIZ = "C:\\Windows\\Um6cCugvE0v.exe"	5yKN3m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCA = "C:\\Windows\\xWudMjUw.exe"	01uLR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPTC32 = "C:\\Windows\\HYBz3XZ8pBNB4S.exe"	C9aNa5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVCL = "C:\\Windows\\8N3LT9Fv0.exe"	4p00RjIaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PROCESSMONITOR = "C:\\Windows\\uavU7Ztn.exe"	W6YDpIRE2BCiV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-PROT95 = "C:\\Windows\\01uLR.exe"	Um6cCugvE0v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPFTRAY = "C:\\Windows\\Ksa78ek.exe"	Ha3OJT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCAFEE = "C:\\Windows\\bjpWB3PeK6Lz3qW.exe"	d1IlwsP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCAFEE = "C:\\Windows\\IeqJDsL5D.exe"	uavU7Ztn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NMAIN = "C:\\Windows\\9gGVswDWWwa48A9.exe"	gIU4y5bQI8Y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NISSERV = "C:\\Windows\\C9aNa5.exe"	xWudMjUw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CLEANER3 = "C:\\Windows\\BYTDP9.exe"	HYBz3XZ8pBNB4S.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PERSWF = "C:\\Windows\\Ha3OJT.exe"	BYTDP9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZAPRO = "C:\\Windows\\d1IlwsP.exe"	UYKnl6jEgRLk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVSCHED = "C:\\Windows\\oR45ch9.exe"	bjpWB3PeK6Lz3qW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMC = "C:\\Windows\\4p00RjIaq.exe"	TgnRG3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPM = "C:\\Windows\\gIU4y5bQI8Y.exe"	IeqJDsL5D.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 46 IoCs

description	ioc	Process
File opened for modification	C:\Windows\C9aNa5.exe	xWudMjUw.exe
File created	C:\Windows\W6YDpIRE2BCiV.exe	2026-08-02_031a23142b10542c70a1d9b137edfc80_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\IeqJDsL5D.exe	uavU7Ztn.exe
File opened for modification	C:\Windows\gIU4y5bQI8Y.exe	IeqJDsL5D.exe
File created	C:\Windows\J5olelwiXpQ4E.exe	hQrK3uIP45.exe
File opened for modification	C:\Windows\J5olelwiXpQ4E.exe	hQrK3uIP45.exe
File opened for modification	C:\Windows\Ksa78ek.exe	Ha3OJT.exe
File created	C:\Windows\UYKnl6jEgRLk.exe	Ksa78ek.exe
File created	C:\Windows\IeqJDsL5D.exe	uavU7Ztn.exe
File created	C:\Windows\hQrK3uIP45.exe	9gGVswDWWwa48A9.exe
File created	C:\Windows\5yKN3m.exe	J5olelwiXpQ4E.exe
File opened for modification	C:\Windows\xWudMjUw.exe	01uLR.exe
File opened for modification	C:\Windows\UYKnl6jEgRLk.exe	Ksa78ek.exe
File opened for modification	C:\Windows\d1IlwsP.exe	UYKnl6jEgRLk.exe
File created	C:\Windows\TgnRG3.exe	oR45ch9.exe
File created	C:\Windows\8N3LT9Fv0.exe	4p00RjIaq.exe
File created	C:\Windows\uavU7Ztn.exe	W6YDpIRE2BCiV.exe
File opened for modification	C:\Windows\uavU7Ztn.exe	W6YDpIRE2BCiV.exe
File opened for modification	C:\Windows\9gGVswDWWwa48A9.exe	gIU4y5bQI8Y.exe
File opened for modification	C:\Windows\BYTDP9.exe	HYBz3XZ8pBNB4S.exe
File created	C:\Windows\gIU4y5bQI8Y.exe	IeqJDsL5D.exe
File created	C:\Windows\01uLR.exe	Um6cCugvE0v.exe
File created	C:\Windows\HYBz3XZ8pBNB4S.exe	C9aNa5.exe
File opened for modification	C:\Windows\Ha3OJT.exe	BYTDP9.exe
File created	C:\Windows\d1IlwsP.exe	UYKnl6jEgRLk.exe
File opened for modification	C:\Windows\W6YDpIRE2BCiV.exe	2026-08-02_031a23142b10542c70a1d9b137edfc80_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\Um6cCugvE0v.exe	5yKN3m.exe
File created	C:\Windows\xWudMjUw.exe	01uLR.exe
File created	C:\Windows\Ksa78ek.exe	Ha3OJT.exe
File opened for modification	C:\Windows\HYBz3XZ8pBNB4S.exe	C9aNa5.exe
File created	C:\Windows\9gGVswDWWwa48A9.exe	gIU4y5bQI8Y.exe
File opened for modification	C:\Windows\hQrK3uIP45.exe	9gGVswDWWwa48A9.exe
File opened for modification	C:\Windows\01uLR.exe	Um6cCugvE0v.exe
File created	C:\Windows\C9aNa5.exe	xWudMjUw.exe
File opened for modification	C:\Windows\bjpWB3PeK6Lz3qW.exe	d1IlwsP.exe
File opened for modification	C:\Windows\TgnRG3.exe	oR45ch9.exe
File opened for modification	C:\Windows\4p00RjIaq.exe	TgnRG3.exe
File opened for modification	C:\Windows\5yKN3m.exe	J5olelwiXpQ4E.exe
File created	C:\Windows\Um6cCugvE0v.exe	5yKN3m.exe
File created	C:\Windows\oR45ch9.exe	bjpWB3PeK6Lz3qW.exe
File opened for modification	C:\Windows\oR45ch9.exe	bjpWB3PeK6Lz3qW.exe
File created	C:\Windows\4p00RjIaq.exe	TgnRG3.exe
File opened for modification	C:\Windows\8N3LT9Fv0.exe	4p00RjIaq.exe
File created	C:\Windows\BYTDP9.exe	HYBz3XZ8pBNB4S.exe
File created	C:\Windows\Ha3OJT.exe	BYTDP9.exe
File created	C:\Windows\bjpWB3PeK6Lz3qW.exe	d1IlwsP.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
764	2804	WerFault.exe	84
5204	2384	WerFault.exe	102
7536	7008	WerFault.exe	128
8036	7332	WerFault.exe	132
7136	1200	WerFault.exe	106
5528	6520	WerFault.exe	124
8144	5776	WerFault.exe	114
6476	1256	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_031a23142b10542c70a1d9b137edfc80_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	J5olelwiXpQ4E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UYKnl6jEgRLk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8N3LT9Fv0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	W6YDpIRE2BCiV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uavU7Ztn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9gGVswDWWwa48A9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C9aNa5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HYBz3XZ8pBNB4S.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ha3OJT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ksa78ek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1IlwsP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IeqJDsL5D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gIU4y5bQI8Y.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hQrK3uIP45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Um6cCugvE0v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01uLR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xWudMjUw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oR45ch9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TgnRG3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5yKN3m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BYTDP9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bjpWB3PeK6Lz3qW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4p00RjIaq.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_031a23142b10542c70a1d9b137edfc80_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_031a23142b10542c70a1d9b137edfc80_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 2160
  2⤵
  - Program crash
  PID:764

C:\Windows\W6YDpIRE2BCiV.exe
C:\Windows\W6YDpIRE2BCiV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3476

C:\Windows\uavU7Ztn.exe
C:\Windows\uavU7Ztn.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 2328
  2⤵
  - Program crash
  PID:6476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2804 -ip 2804
1⤵
PID:948

C:\Windows\IeqJDsL5D.exe
C:\Windows\IeqJDsL5D.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2400

C:\Windows\gIU4y5bQI8Y.exe
C:\Windows\gIU4y5bQI8Y.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1576

C:\Windows\9gGVswDWWwa48A9.exe
C:\Windows\9gGVswDWWwa48A9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3344

C:\Windows\hQrK3uIP45.exe
C:\Windows\hQrK3uIP45.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5056

C:\Windows\J5olelwiXpQ4E.exe
C:\Windows\J5olelwiXpQ4E.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1984
  2⤵
  - Program crash
  PID:5204

C:\Windows\5yKN3m.exe
C:\Windows\5yKN3m.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4848

C:\Windows\Um6cCugvE0v.exe
C:\Windows\Um6cCugvE0v.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 2096
  2⤵
  - Program crash
  PID:7136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2384 -ip 2384
1⤵
PID:2820

C:\Windows\01uLR.exe
C:\Windows\01uLR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5292

C:\Windows\xWudMjUw.exe
C:\Windows\xWudMjUw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5532

C:\Windows\C9aNa5.exe
C:\Windows\C9aNa5.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 2212
  2⤵
  - Program crash
  PID:8144

C:\Windows\HYBz3XZ8pBNB4S.exe
C:\Windows\HYBz3XZ8pBNB4S.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6020

C:\Windows\BYTDP9.exe
C:\Windows\BYTDP9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4964

C:\Windows\Ha3OJT.exe
C:\Windows\Ha3OJT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5788

C:\Windows\Ksa78ek.exe
C:\Windows\Ksa78ek.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6276

C:\Windows\UYKnl6jEgRLk.exe
C:\Windows\UYKnl6jEgRLk.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6520 -s 2100
  2⤵
  - Program crash
  PID:5528

C:\Windows\d1IlwsP.exe
C:\Windows\d1IlwsP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6760

C:\Windows\bjpWB3PeK6Lz3qW.exe
C:\Windows\bjpWB3PeK6Lz3qW.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 1968
  2⤵
  - Program crash
  PID:7536

C:\Windows\oR45ch9.exe
C:\Windows\oR45ch9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6532

C:\Windows\TgnRG3.exe
C:\Windows\TgnRG3.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7332 -s 1972
  2⤵
  - Program crash
  PID:8036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 7008 -ip 7008
1⤵
PID:7516

C:\Windows\4p00RjIaq.exe
C:\Windows\4p00RjIaq.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7628

C:\Windows\8N3LT9Fv0.exe
C:\Windows\8N3LT9Fv0.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 7332 -ip 7332
1⤵
PID:7880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1200 -ip 1200
1⤵
PID:6996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6520 -ip 6520
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5776 -ip 5776
1⤵
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1256 -ip 1256
1⤵
PID:6500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

01uLR.exe

Path C:\Windows\01uLR.exe
Size 804KB
SHA256 b7a4c271e5aaa25d447798659d0000adf51cacce4d28ebeb163e8a6c35842cdf
MD5 cfbbd2398f11d9b58913e28e6ff37d55
SHA1 19c5994764fbc66d8d80729d204df3816491c9b3
SHA512 d66c96767033350c7e2a34d24f730f06f1cd79a38cf1b302b3e16a04eb2eb60cb709f9f36964e2dc7e5739d1e648d4380ebaae41d448c1edd1d875cbb31f039c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsoa
TLSH
T18005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4p00RjIaq.exe

Path C:\Windows\4p00RjIaq.exe
Size 804KB
SHA256 e1b4a9e0cbdd2a667f83d9a1af61c70eb9b3ee4f7d329443f74eca135434e2c6
MD5 3e6e3d18fa80e0426da9c3b26cb8db4c
SHA1 89296551ef6d918d5c4f42ee33207f9d6bfd3db7
SHA512 134ad1ee404f9e8464589afbd2517b7721159e3541f17602106850674fe17b434afaaae138dd33f4d316a741145f3c87a5a1e5a42912de95385d97b0e05b77ae
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoue:0NA1Yakeer5+nso/
TLSH
T1F605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5yKN3m.exe

Path C:\Windows\5yKN3m.exe
Size 804KB
SHA256 131e668e572c052806e644141a10e222ce91c493f2da0174ee7ebc12677a2b2d
MD5 6fd3c51d16191cc1bc9b5a9e480eefd3
SHA1 3976d09e0e47ba605facfd1512488660e1e8e7fd
SHA512 b1224b0be00164d31cbff708306fac3910236a13e83a61353139690e591cd6e5f9dc82562bc2af49dd351460fe32071a580f525c3277a836fbfe3a39bd792f48
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsoX
TLSH
T12105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8N3LT9Fv0.exe

Path C:\Windows\8N3LT9Fv0.exe
Size 804KB
SHA256 0a6116bab7a755d338d15cbc296de7fb22a35e3bec2c49b40e835860daa998c5
MD5 f1cd418abbdd7281e5e5dd6077873c10
SHA1 5a04b7285de07528a36a0dae2923e830a3064747
SHA512 5b83fb4359ca2dcd3b65013e541d9203ffd9a13582ac67c91fa0d146767b4a7ea6683905a1526cf5014011650db76372375c0759e53a1e539429804015e7253f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nsog
TLSH
T19505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9gGVswDWWwa48A9.exe

Path C:\Windows\9gGVswDWWwa48A9.exe
Size 804KB
SHA256 3f09575483d75848e17385e5e28c193cbdbee7d553e2c1234972c2b25b8722a6
MD5 7291e024a54e07f61c262608fa76e0a7
SHA1 64bfaa017b24220469f23519872971346b4c695b
SHA512 14674e68136ec351076ceb99fcd4cda08a636e0b897fd443aed418e8dc2ebbd8182854863d38b3f5641d8b8a8a3de5be8357c8978660f93d395bbec9a00b53f0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFour:0NA1Yakeer5+nsoA
TLSH
T13305A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BYTDP9.exe

Path C:\Windows\BYTDP9.exe
Size 804KB
SHA256 0d5e2695aea021e586106de59f1afc22d52871b26e5cad29d2fdc4d2f59df73f
MD5 a622c67c05af4303e55e8f20fd18af5f
SHA1 317a17714b43ccb70be88b56eb57a33cd47ea3c5
SHA512 e5141f8e9333c5455e65c15f08fc8bd5b0e59dcfab0b8bfc843f3f6ffbd9a0c1520f0b39c4776fb495f0a27af4917a3f1fb5c94d08bda64b8b957a066e23ede6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoui:0NA1Yakeer5+nsoP
TLSH
T16105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C9aNa5.exe

Path C:\Windows\C9aNa5.exe
Size 804KB
SHA256 9b2524464400b8608fc11ef169b27267a429880a687fd251445675e2f970a1bd
MD5 73ddee161a5aaf6432d4f13389aef467
SHA1 9284f5b6226c9984f540142754cbf2ed9bccfc1c
SHA512 6da71c16f32bdd48d15ef06afd2ea93c11bf76f28bc8b12ae2fe32653e40628dd3900e68d7b714d6e2a804a7be6efa9b90b8575d5ff394b93efe7922d005d4a0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nso8
TLSH
T1D905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HYBz3XZ8pBNB4S.exe

Path C:\Windows\HYBz3XZ8pBNB4S.exe
Size 804KB
SHA256 8e775f8bcb937071c51d366d16baf508b8f1713cd66a1feb36208ed6b254b08b
MD5 b3a4be62e14546e4121e5c093119e078
SHA1 975a8597ae82fdfd22ced03be12c1154a020195c
SHA512 01332a4b40d8de972474b8ed14475908be90fd5be7a34e0d74f8d853524718ef5b5f6c05ffc95a46c23128cf1bf31af217659542fd780c15ff9b3fd9f067aa60
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouK:0NA1Yakeer5+nsof
TLSH
T1D005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ha3OJT.exe

Path C:\Windows\Ha3OJT.exe
Size 804KB
SHA256 467f8865570492ca1293d2ebc14d8ce2eb3c85e03172bd630f26be773ada54fd
MD5 9a84335fab7f6738f31844867388ed28
SHA1 9127e3ddada3229c2642670ebc12e85094ecba53
SHA512 c5050a933542ce86b6962bbfe12ff1978b5ae7af23c541edc9ff62fd4682d127cfd20391aac7508b072e570151046afc4fd9f2d705dece1b9b974954916ebd96
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouf:0NA1Yakeer5+nsoY
TLSH
T18D05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IeqJDsL5D.exe

Path C:\Windows\IeqJDsL5D.exe
Size 804KB
SHA256 88984c929a141535ef682f84de651aeba0211cd92c26dec659e7b6b0374acd47
MD5 43dfb579bc463c420abc1322fb65e041
SHA1 dfb80079e08adfc3c27a98e18a54df20351c0bc8
SHA512 407a384634bf15109bbdb94b321cffe157bf7ecf86d8f291dfceed1a9f2b58c2ad78bdf0263208789161b4842f9f5dff5fd466c89f389efa6b24bb91300c06b9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouK:0NA1Yakeer5+nsoR
TLSH
T1C205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

J5olelwiXpQ4E.exe

Path C:\Windows\J5olelwiXpQ4E.exe
Size 804KB
SHA256 b1d3235ae82a608c492aec84c9a1c5ce95677c9ee1a939145b3a95cb931fef3b
MD5 6f5933f719a36d0e9cde24d4c8d6bd66
SHA1 c39e76e943e4d5acfecc27475f671abf1184f5f2
SHA512 a933f5097d2cad1f27f9ebb62aa0d7fabeb92f749f2e6e07b25fe14b40fec608213294ccf2d976717cd7a725369559500f5323cc140703e176122f413769b04f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouY:0NA1Yakeer5+nsop
TLSH
T10405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ksa78ek.exe

Path C:\Windows\Ksa78ek.exe
Size 804KB
SHA256 aff400e315e41c9fdd896ec00c84f79279798daa707e88dae6ec8ebae3d8f229
MD5 167f3a006ed54e4e645ce66782884f7f
SHA1 637bef933fea14b2b6b0c01843a7604fdaf280d6
SHA512 30af3f1cc59db2f96f32172efc8d2491107f81ffb20fc95ceb2add5753f24e723e4a8568d97285b186e0317ced9dc8ed433255f0790b60240bc7abb30734d1dc
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nso+
TLSH
T11105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TgnRG3.exe

Path C:\Windows\TgnRG3.exe
Size 804KB
SHA256 0ba28cfe3761bf9a71c7f273fc93b52984982ef7633f54eb80d2798c588ffc28
MD5 5ffb49a87e019100448f19e16aa9b5ad
SHA1 f0800f70ae24e4b0abe4a839324e39a1c3780122
SHA512 f8bfaf80d4ec7811a773fae79429e6c7d18037d35b52fad71aeb0753c0c5e6b19d52498a4a658a8529b052742aa5a75784e86f384c96fd81e3ba5d642edc22b7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nsoo
TLSH
T12A05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UYKnl6jEgRLk.exe

Path C:\Windows\UYKnl6jEgRLk.exe
Size 804KB
SHA256 c6cffd1b82e2e14d22b152e4b98196f6e9dfbf691ea17fddf8d22f0b6be4c345
MD5 7232da08e491e5610bf7832cacc5c0ae
SHA1 c3c507c3c0117639060c3cede7bf28510a89e33c
SHA512 159d4a2fa3b649b1d150f30de21ebd2d0369effc744360f3d773086feeb51a1b06a6e89dcea4686dec81614f5c663855ef117911184caaed25f3d1d98f9ec431
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouk:0NA1Yakeer5+nsob
TLSH
T1F505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Um6cCugvE0v.exe

Path C:\Windows\Um6cCugvE0v.exe
Size 804KB
SHA256 6c2d7d61733b29761d0eec2f854f82766a71eb40b376fd390ca33ec707af4847
MD5 fadfac557ed239e7bafb633930a4e122
SHA1 ee4cc2c4f34356a0a81f3fbf396fe4821f974f7e
SHA512 577d30163f221494963b492d2c43236346df17d4c43ed7e2fd21459f48098163d70e7c564415d34da41d6198562d84781c5f65288ad6fd44d159b4923e181995
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouu:0NA1Yakeer5+nsoL
TLSH
T15605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W6YDpIRE2BCiV.exe

Path C:\Windows\W6YDpIRE2BCiV.exe
Size 804KB
SHA256 e2ed97e99b790a827b01fa68a9fd2329282e1124614b7e24b0252a5ca35bfbe8
MD5 c307a960563895a50b997b137a9bc4ed
SHA1 e0e271c0f285793508d0100c925671ac8615efe6
SHA512 a1972f1d4914c0fed4eeb39cb4db9f21cb83382c072871e51e3c20c5c8998b45f80ca15c0b407e37271290d3f5bedee7d3215446e058431a9ce4e51f7df91f35
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouo:0NA1Yakeer5+nsoF
TLSH
T19605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bjpWB3PeK6Lz3qW.exe

Path C:\Windows\bjpWB3PeK6Lz3qW.exe
Size 804KB
SHA256 df8893fe9b03ece1f675cf8e0b1f4a30f7192b0a7e5c2b45cdcfa3d7237ae0a7
MD5 ee1b615797e72f25de06ff6ed481c94b
SHA1 ff4bd5e15d366a33c138920a32015d1513ad504c
SHA512 8ab13be12ed99fbcce9566bb3b17f2afa8c8d961df6022f31431029ee526d6597123bc424a2432f55f8871a7fd782c0248817e3ffd79acb27ac203016adfe216
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsom
TLSH
T1B905A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1IlwsP.exe

Path C:\Windows\d1IlwsP.exe
Size 804KB
SHA256 3278cd8134ac4c9b69d236496f8f5309f73c58cca98382221915c2172db77ac6
MD5 e5dc51a97597e66add8410ebd137918f
SHA1 39ffe019bd3b45a7c684da07542691338e9deb95
SHA512 604dd94ddffa0d4e0173e94e7b8cf61d1328305f08af818aa63f64a7754bcca88898f5a38c3322bc740a41285bd616ec8948b0bfba22f8a0abf1b8f0a4dd7616
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nsoD
TLSH
T17B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gIU4y5bQI8Y.exe

Path C:\Windows\gIU4y5bQI8Y.exe
Size 804KB
SHA256 9ca92e749923df0846402eaff5fb5cd6cd5fddb617688a6087b52ce0411f7674
MD5 fbc8180c9122498e0e9c39970346cae6
SHA1 8b8998cc46207acc074593abd3c48541d9d69ca7
SHA512 9ae87d26c72312fd36fc23d3d10f2c6d7b8b2d13754cdeab6fc80debed5e6738d8d57c3bfe4fcd9cc28d537e96d40e351fc834dcbc01c993e386fa8b40ffdaa4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouU:0NA1Yakeer5+nsoJ
TLSH
T17505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hQrK3uIP45.exe

Path C:\Windows\hQrK3uIP45.exe
Size 804KB
SHA256 1a6a426e081e2f105caa1a857857eecc03b898c13733755519ecc9f2b124c3af
MD5 cc876cf831fd4cb46808eff9e09fc04d
SHA1 202085858130c157119ab6a53380b54ea95853e0
SHA512 2b57de92505015cb2863a8f8be69501ad84c1f1cf4d1df13d26064f498c9d7a26eb6722a228fa6a2ffe73c48051c43fea95da0080695736a99b92e79dd30515b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoup:0NA1Yakeer5+nsoY
TLSH
T19705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oR45ch9.exe

Path C:\Windows\oR45ch9.exe
Size 804KB
SHA256 836ffc0d985bc8064bfa1026569119a1912a5cefdcd60beb12f77ad32aa2a77b
MD5 ae7cc31eba7ece033197644dc0475de4
SHA1 67842bd9b63ae0e35316b0e901b7bb8db28e1a91
SHA512 5036361d8fafc56dc336340ec27a012928656f2f566620656bb076241d203ff3ef50792433ced5424cc52c2a38b2521b79e7e50a03357e8af35c800b8b20d73a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nso+
TLSH
T11D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uavU7Ztn.exe

Path C:\Windows\uavU7Ztn.exe
Size 804KB
SHA256 8a55770f636693788c2b9b6533fdfcece4d7c4fb00189898a86b18d101b48fcf
MD5 a60d481fa5f6d030ccb21d0422265f6b
SHA1 9ecdbf18127cdd60f5caf03349257217761c2fca
SHA512 3425ebc80ea24bb45b40bdb72d96fc10810f7f07fb976b188cb63376d98aff4b054b40515ddbd436b65d3a7b6092e9daa47a41421232a596d6ebe322b728276e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou8:0NA1Yakeer5+nso5
TLSH
T11D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xWudMjUw.exe

Path C:\Windows\xWudMjUw.exe
Size 804KB
SHA256 3f000939e04e1364c75ed8251363cd475c6a0e85b4c7a6ffb30e20ce717ddc30
MD5 13547ee583fa3b52f374c02f0e8813f2
SHA1 46e44606b6f99af5c41fff0d48db60798ce0a2a9
SHA512 76ed3012c8df63e68013d6a10b2850adb3989773258b57e87045fcf64324db709f8cd65d7f2f90106d63ae5029ae40f39af6fe533c2e68ff245c13c4da4ce429
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nsoG
TLSH
T12705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads