32bc72a6a336662b05beca2e60927d2e1a95cf621e4b199c9645535bef7578ee

General

Target
2026-08-02_ea7dad76498e0c96dea63f0e8feb1a0c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260802-ts67hscf29
SHA256 32bc72a6a336662b05beca2e60927d2e1a95cf621e4b199c9645535bef7578ee
MD5 ea7dad76498e0c96dea63f0e8feb1a0c
SHA1 c7ea649c38b26d20d53a4dcdc67eb1b27e209e48
SHA512 1bedf8d1a9c8335f608761f3c33529afe2fecdf42afd3c28b4db2e79b0d9539cad34339f7d686a48e806ddf08c71154f99f6ab003e08d62b21f5e733f7fc064f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouv:0NA1Yakeer5+nso4
TLSH
T1B305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (684) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 7 IoCs

pid	Process
3128	jvItq1h71eCWW1.exe
4312	vDtXg.exe
1172	z47Q9HvMHsqcU.exe
2420	Xe1UCqW4GEpKOC.exe
556	vTRqLtvjKaI.exe
540	FRCN0UqLp.exe
5524	W6JAZdZb5d.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFINET = "C:\\Windows\\jvItq1h71eCWW1.exe"	2026-08-02_ea7dad76498e0c96dea63f0e8feb1a0c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ISRV95 = "C:\\Windows\\vDtXg.exe"	jvItq1h71eCWW1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TAUMON = "C:\\Windows\\z47Q9HvMHsqcU.exe"	vDtXg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCMNHDLR = "C:\\Windows\\Xe1UCqW4GEpKOC.exe"	z47Q9HvMHsqcU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKPOP = "C:\\Windows\\vTRqLtvjKaI.exe"	Xe1UCqW4GEpKOC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BLACKICE = "C:\\Windows\\FRCN0UqLp.exe"	vTRqLtvjKaI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NUI = "C:\\Windows\\W6JAZdZb5d.exe"	FRCN0UqLp.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Xe1UCqW4GEpKOC.exe	z47Q9HvMHsqcU.exe
File opened for modification	C:\Windows\Xe1UCqW4GEpKOC.exe	z47Q9HvMHsqcU.exe
File created	C:\Windows\vTRqLtvjKaI.exe	Xe1UCqW4GEpKOC.exe
File opened for modification	C:\Windows\vTRqLtvjKaI.exe	Xe1UCqW4GEpKOC.exe
File created	C:\Windows\W6JAZdZb5d.exe	FRCN0UqLp.exe
File created	C:\Windows\jvItq1h71eCWW1.exe	2026-08-02_ea7dad76498e0c96dea63f0e8feb1a0c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\vDtXg.exe	jvItq1h71eCWW1.exe
File opened for modification	C:\Windows\z47Q9HvMHsqcU.exe	vDtXg.exe
File created	C:\Windows\FRCN0UqLp.exe	vTRqLtvjKaI.exe
File opened for modification	C:\Windows\FRCN0UqLp.exe	vTRqLtvjKaI.exe
File opened for modification	C:\Windows\W6JAZdZb5d.exe	FRCN0UqLp.exe
File opened for modification	C:\Windows\jvItq1h71eCWW1.exe	2026-08-02_ea7dad76498e0c96dea63f0e8feb1a0c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\vDtXg.exe	jvItq1h71eCWW1.exe
File created	C:\Windows\z47Q9HvMHsqcU.exe	vDtXg.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
6124	5524	WerFault.exe	102
2672	2420	WerFault.exe	96
5604	556	WerFault.exe	98
4228	4560	WerFault.exe	87
5596	3128	WerFault.exe	90
3472	540	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	W6JAZdZb5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_ea7dad76498e0c96dea63f0e8feb1a0c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vTRqLtvjKaI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FRCN0UqLp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jvItq1h71eCWW1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vDtXg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	z47Q9HvMHsqcU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xe1UCqW4GEpKOC.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_ea7dad76498e0c96dea63f0e8feb1a0c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_ea7dad76498e0c96dea63f0e8feb1a0c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 2376
  2⤵
  - Program crash
  PID:4228

C:\Windows\jvItq1h71eCWW1.exe
C:\Windows\jvItq1h71eCWW1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 2316
  2⤵
  - Program crash
  PID:5596

C:\Windows\vDtXg.exe
C:\Windows\vDtXg.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4312

C:\Windows\z47Q9HvMHsqcU.exe
C:\Windows\z47Q9HvMHsqcU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1172

C:\Windows\Xe1UCqW4GEpKOC.exe
C:\Windows\Xe1UCqW4GEpKOC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 2212
  2⤵
  - Program crash
  PID:2672

C:\Windows\vTRqLtvjKaI.exe
C:\Windows\vTRqLtvjKaI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 2196
  2⤵
  - Program crash
  PID:5604

C:\Windows\FRCN0UqLp.exe
C:\Windows\FRCN0UqLp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 2508
  2⤵
  - Program crash
  PID:3472

C:\Windows\W6JAZdZb5d.exe
C:\Windows\W6JAZdZb5d.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 1980
  2⤵
  - Program crash
  PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 5524 -ip 5524
1⤵
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2420 -ip 2420
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 556 -ip 556
1⤵
PID:5496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4560 -ip 4560
1⤵
PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3128 -ip 3128
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 540 -ip 540
1⤵
PID:1428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FRCN0UqLp.exe

Path C:\Windows\FRCN0UqLp.exe
Size 804KB
SHA256 f5483905575143c6efb8b443b658118d6a916acc7028b6b4271bf38a7a92e618
MD5 bd8f1cf19ae7cdd051fad6af53aac300
SHA1 197a92a6c538688d7c6893b543682ae6c22de779
SHA512 e70fbd54362e7caf04e2082cdfe87e84329917f05ffaecb7b0b9800db1ae3a67a8884abbbbd602c52f7b03a4beffd0cfed93cfb463716e64091b7e217e267b28
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou0G:0NA1Yakeer5+nsoO
TLSH
T1FF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W6JAZdZb5d.exe

Path C:\Windows\W6JAZdZb5d.exe
Size 804KB
SHA256 ae53fc0d527ffcdff3ca2284bed67871564b00c0bdbe842ca8585d46df31b35c
MD5 9f3406204ce08bc5b75c55ee59c5b489
SHA1 2f6002d4d122560d103a1e2c3ff3695c05ff578c
SHA512 af8e5b9ff1f3b85cf9989ba9499c894a97cab2a520e4ec481c6c50f8ba324a3f1aebb0f1ebbd13d3ce00bc1457ca520ef10f9fa177b2bc57797894bc0494dce4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou4:0NA1Yakeer5+nsoZ
TLSH
T16605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xe1UCqW4GEpKOC.exe

Path C:\Windows\Xe1UCqW4GEpKOC.exe
Size 804KB
SHA256 4f7289b58b869e7fc40a3e797a5cb9a6c6178a7806dff734293085c85a606450
MD5 255bb52a393b39b888d269caf4b4ce47
SHA1 634153e6e3626392acabac5c049c763f70930ab2
SHA512 ae4a106c71a7398c3dfd059620feb86ba4859ab1ab7666304c72167f42e48004beb086d0f16868f8eebb6a659326ae72cf588bba541e0c28c7268a98f2c9ca5d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouS:0NA1Yakeer5+nso3
TLSH
T12105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvItq1h71eCWW1.exe

Path C:\Windows\jvItq1h71eCWW1.exe
Size 804KB
SHA256 c6410d417d873eadf579d4bf2abc8ead8eb6811adc1fe937c144d88e031c25ca
MD5 3b6d0c75bbde7b56bb3be7b8c7103fcf
SHA1 dc016b918d317f4164ded0178dbdce1ceddbf5b2
SHA512 3e652442e9b04b966e1c32165d5164de7a0cf127ed724a2d8e2154a42604182d5eb4e46e775e81ba73584d9a26cae48958acf33be5579d56cd115128363cd375
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouI:0NA1Yakeer5+nsot
TLSH
T1B805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vDtXg.exe

Path C:\Windows\vDtXg.exe
Size 804KB
SHA256 3db7eb42f61c6b96f3f173dd47624ca8a94576b65d1ba7e737fdfde4ebe775dd
MD5 cc1cdf76cfa14879d20ed5ec90f956cb
SHA1 bbb04d1cd096c4c40ab7cd73572216488f6e1579
SHA512 da7660747ec7f91864c19211208fefadf7feb87b688cc825742b44f430141829f329a36847c74f301c61495778b14d6500486cccf593dcf952a0fe74e7c162f7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoubE:0NA1Yakeer5+nso+E
TLSH
T1F005A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vTRqLtvjKaI.exe

Path C:\Windows\vTRqLtvjKaI.exe
Size 804KB
SHA256 1e16fac1e42e14f8142026cde49e891949f0fef5d308d8f1b1d5d4229c28a70a
MD5 a4917531fbedd9ed8492cb9bccc5abd6
SHA1 714af73dea2ba75411f3c03decc323971279a6e3
SHA512 77a2aee7fe8ed77082b6460e84bf3b6570cf8f8a41d8e88417eed8c083033a90fc5911d2aa9ff8da088e855b2bd5d6b3e61094c50253e0e814d84be7454922c2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoui:0NA1Yakeer5+nsov
TLSH
T16705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

z47Q9HvMHsqcU.exe

Path C:\Windows\z47Q9HvMHsqcU.exe
Size 804KB
SHA256 56bdfef7591efc9fc5b4e2bf0250887f31922940b5bcc83104c1e8ec5dcbc75a
MD5 b424ba3c411606f2512eb44476309cac
SHA1 352acab2e91cd9312b63962110aa9817ddf03bcb
SHA512 c25995d4bc72091091ad354ff30fd0a3ab4808c252139fffc69f4c35992d2d6baac6055dd6044d117598f144f742181ae8734f35053727c7eefa41883acecbf0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nso9
TLSH
T13405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads