2992136c7bf8c0b44ae284a0a592f362730714bd09cf130b9a5e6d2c2257a885

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_8d909744d336e7c19b055e442fe87b66_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260803-dspdpsxfnb
SHA256 2992136c7bf8c0b44ae284a0a592f362730714bd09cf130b9a5e6d2c2257a885
MD5 8d909744d336e7c19b055e442fe87b66
SHA1 005a815fbb7d9ae703f60c0edbed7058ea8df5e6
SHA512 8675f1cfc73a291fbe8e9162a8487f9009898c5cb571971aaba85c829443e98990ae8ee8374d3f23379592ec5ad23f252c170587ae8817a86eda68cb63e40620
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou8:0NA1Yakeer5+nsoF
TLSH
T15905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2193) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 22 IoCs

pid	Process
4640	5jM3xtmrv.exe
5468	iUA8M8aklAzQ.exe
5848	xwHERS4g3dvyE.exe
4192	Zkl2owvA.exe
3600	rbrpE.exe
2780	rqy4Wv.exe
4764	OYnTMzHc.exe
2480	g7Xb76F0JTkccO.exe
1340	4Sdv0mcztYiZ2k.exe
204	OhUKCLN.exe
4212	Ddzbvo7l.exe
6396	G4qho3sHgg5jzrV.exe
6648	lrOD8qKVaw.exe
6900	gbGbnAyYUIjA.exe
7156	ap8tK.exe
7292	b6Okv5hp4Iqre.exe
7532	XDkHVTehxUV.exe
7780	Vq7RhgLYqb3d7z.exe
8032	F8Jp7dDEcUamzM.exe
7984	qP6SCOa.exe
8420	nMY9UslIVDBmw.exe
8672	W5S5tsIuZK1zGa.exe

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PROGRAMAUDITOR = "C:\\Windows\\rbrpE.exe"	Zkl2owvA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTRL = "C:\\Windows\\rqy4Wv.exe"	rbrpE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FINDVIRU = "C:\\Windows\\OYnTMzHc.exe"	rqy4Wv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WEBTRAP = "C:\\Windows\\4Sdv0mcztYiZ2k.exe"	g7Xb76F0JTkccO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SPYXX = "C:\\Windows\\Ddzbvo7l.exe"	OhUKCLN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SYMPROXYSVC = "C:\\Windows\\qP6SCOa.exe"	F8Jp7dDEcUamzM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CLEANER3 = "C:\\Windows\\W5S5tsIuZK1zGa.exe"	nMY9UslIVDBmw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKWCTL9 = "C:\\Windows\\Zkl2owvA.exe"	xwHERS4g3dvyE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKPOP = "C:\\Windows\\g7Xb76F0JTkccO.exe"	OYnTMzHc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NWTOOL16 = "C:\\Windows\\G4qho3sHgg5jzrV.exe"	Ddzbvo7l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATWATCH = "C:\\Windows\\nMY9UslIVDBmw.exe"	qP6SCOa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NWSERVICE = "C:\\Windows\\OhUKCLN.exe"	4Sdv0mcztYiZ2k.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFINET = "C:\\Windows\\lrOD8qKVaw.exe"	G4qho3sHgg5jzrV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCSHIELD = "C:\\Windows\\F8Jp7dDEcUamzM.exe"	Vq7RhgLYqb3d7z.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCCIOMON = "C:\\Windows\\5jM3xtmrv.exe"	2026-08-02_8d909744d336e7c19b055e442fe87b66_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CPDCLNT = "C:\\Windows\\iUA8M8aklAzQ.exe"	5jM3xtmrv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GUARD = "C:\\Windows\\xwHERS4g3dvyE.exe"	iUA8M8aklAzQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOCKDOWN = "C:\\Windows\\gbGbnAyYUIjA.exe"	lrOD8qKVaw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKWCTL9 = "C:\\Windows\\ap8tK.exe"	gbGbnAyYUIjA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MWATCH = "C:\\Windows\\b6Okv5hp4Iqre.exe"	ap8tK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GUARDDOG = "C:\\Windows\\XDkHVTehxUV.exe"	b6Okv5hp4Iqre.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAV7WIN = "C:\\Windows\\Vq7RhgLYqb3d7z.exe"	XDkHVTehxUV.exe

Drops file in Windows directory 44 IoCs

description	ioc	Process
File created	C:\Windows\OhUKCLN.exe	4Sdv0mcztYiZ2k.exe
File opened for modification	C:\Windows\G4qho3sHgg5jzrV.exe	Ddzbvo7l.exe
File created	C:\Windows\lrOD8qKVaw.exe	G4qho3sHgg5jzrV.exe
File opened for modification	C:\Windows\qP6SCOa.exe	F8Jp7dDEcUamzM.exe
File opened for modification	C:\Windows\iUA8M8aklAzQ.exe	5jM3xtmrv.exe
File opened for modification	C:\Windows\Zkl2owvA.exe	xwHERS4g3dvyE.exe
File created	C:\Windows\ap8tK.exe	gbGbnAyYUIjA.exe
File opened for modification	C:\Windows\b6Okv5hp4Iqre.exe	ap8tK.exe
File created	C:\Windows\F8Jp7dDEcUamzM.exe	Vq7RhgLYqb3d7z.exe
File created	C:\Windows\5jM3xtmrv.exe	2026-08-02_8d909744d336e7c19b055e442fe87b66_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\rqy4Wv.exe	rbrpE.exe
File opened for modification	C:\Windows\OhUKCLN.exe	4Sdv0mcztYiZ2k.exe
File created	C:\Windows\gbGbnAyYUIjA.exe	lrOD8qKVaw.exe
File opened for modification	C:\Windows\gbGbnAyYUIjA.exe	lrOD8qKVaw.exe
File created	C:\Windows\nMY9UslIVDBmw.exe	qP6SCOa.exe
File created	C:\Windows\Ddzbvo7l.exe	OhUKCLN.exe
File created	C:\Windows\b6Okv5hp4Iqre.exe	ap8tK.exe
File created	C:\Windows\XDkHVTehxUV.exe	b6Okv5hp4Iqre.exe
File opened for modification	C:\Windows\Vq7RhgLYqb3d7z.exe	XDkHVTehxUV.exe
File opened for modification	C:\Windows\F8Jp7dDEcUamzM.exe	Vq7RhgLYqb3d7z.exe
File created	C:\Windows\xwHERS4g3dvyE.exe	iUA8M8aklAzQ.exe
File opened for modification	C:\Windows\rbrpE.exe	Zkl2owvA.exe
File opened for modification	C:\Windows\Ddzbvo7l.exe	OhUKCLN.exe
File opened for modification	C:\Windows\W5S5tsIuZK1zGa.exe	nMY9UslIVDBmw.exe
File created	C:\Windows\Zkl2owvA.exe	xwHERS4g3dvyE.exe
File opened for modification	C:\Windows\rqy4Wv.exe	rbrpE.exe
File created	C:\Windows\OYnTMzHc.exe	rqy4Wv.exe
File opened for modification	C:\Windows\g7Xb76F0JTkccO.exe	OYnTMzHc.exe
File created	C:\Windows\W5S5tsIuZK1zGa.exe	nMY9UslIVDBmw.exe
File created	C:\Windows\g7Xb76F0JTkccO.exe	OYnTMzHc.exe
File created	C:\Windows\G4qho3sHgg5jzrV.exe	Ddzbvo7l.exe
File opened for modification	C:\Windows\XDkHVTehxUV.exe	b6Okv5hp4Iqre.exe
File created	C:\Windows\Vq7RhgLYqb3d7z.exe	XDkHVTehxUV.exe
File opened for modification	C:\Windows\nMY9UslIVDBmw.exe	qP6SCOa.exe
File opened for modification	C:\Windows\5jM3xtmrv.exe	2026-08-02_8d909744d336e7c19b055e442fe87b66_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\iUA8M8aklAzQ.exe	5jM3xtmrv.exe
File opened for modification	C:\Windows\OYnTMzHc.exe	rqy4Wv.exe
File created	C:\Windows\4Sdv0mcztYiZ2k.exe	g7Xb76F0JTkccO.exe
File opened for modification	C:\Windows\4Sdv0mcztYiZ2k.exe	g7Xb76F0JTkccO.exe
File opened for modification	C:\Windows\lrOD8qKVaw.exe	G4qho3sHgg5jzrV.exe
File opened for modification	C:\Windows\ap8tK.exe	gbGbnAyYUIjA.exe
File created	C:\Windows\qP6SCOa.exe	F8Jp7dDEcUamzM.exe
File opened for modification	C:\Windows\xwHERS4g3dvyE.exe	iUA8M8aklAzQ.exe
File created	C:\Windows\rbrpE.exe	Zkl2owvA.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
3388	5468	WerFault.exe	92
4832	2780	WerFault.exe	103
9156	5848	WerFault.exe	94
8060	3600	WerFault.exe	101
8880	4212	WerFault.exe	115
1244	5724	WerFault.exe	88
3504	1340	WerFault.exe	111
8372	204	WerFault.exe	113
3060	6648	WerFault.exe	119

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lrOD8qKVaw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ap8tK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F8Jp7dDEcUamzM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5jM3xtmrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iUA8M8aklAzQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rqy4Wv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g7Xb76F0JTkccO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OhUKCLN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddzbvo7l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XDkHVTehxUV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nMY9UslIVDBmw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4Sdv0mcztYiZ2k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbGbnAyYUIjA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6Okv5hp4Iqre.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OYnTMzHc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vq7RhgLYqb3d7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qP6SCOa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	W5S5tsIuZK1zGa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_8d909744d336e7c19b055e442fe87b66_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xwHERS4g3dvyE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zkl2owvA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rbrpE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G4qho3sHgg5jzrV.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_8d909744d336e7c19b055e442fe87b66_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_8d909744d336e7c19b055e442fe87b66_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5724 -s 2460
  2⤵
  - Program crash
  PID:1244

C:\Windows\5jM3xtmrv.exe
C:\Windows\5jM3xtmrv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4640

C:\Windows\iUA8M8aklAzQ.exe
C:\Windows\iUA8M8aklAzQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 2092
  2⤵
  - Program crash
  PID:3388

C:\Windows\xwHERS4g3dvyE.exe
C:\Windows\xwHERS4g3dvyE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5848 -s 2196
  2⤵
  - Program crash
  PID:9156

C:\Windows\Zkl2owvA.exe
C:\Windows\Zkl2owvA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5468 -ip 5468
1⤵
PID:1484

C:\Windows\rbrpE.exe
C:\Windows\rbrpE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 2196
  2⤵
  - Program crash
  PID:8060

C:\Windows\rqy4Wv.exe
C:\Windows\rqy4Wv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 2100
  2⤵
  - Program crash
  PID:4832

C:\Windows\OYnTMzHc.exe
C:\Windows\OYnTMzHc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4764

C:\Windows\g7Xb76F0JTkccO.exe
C:\Windows\g7Xb76F0JTkccO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2780 -ip 2780
1⤵
PID:4464

C:\Windows\4Sdv0mcztYiZ2k.exe
C:\Windows\4Sdv0mcztYiZ2k.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 2308
  2⤵
  - Program crash
  PID:3504

C:\Windows\OhUKCLN.exe
C:\Windows\OhUKCLN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 204 -s 2316
  2⤵
  - Program crash
  PID:8372

C:\Windows\Ddzbvo7l.exe
C:\Windows\Ddzbvo7l.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 2216
  2⤵
  - Program crash
  PID:8880

C:\Windows\G4qho3sHgg5jzrV.exe
C:\Windows\G4qho3sHgg5jzrV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6396

C:\Windows\lrOD8qKVaw.exe
C:\Windows\lrOD8qKVaw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6648 -s 2396
  2⤵
  - Program crash
  PID:3060

C:\Windows\gbGbnAyYUIjA.exe
C:\Windows\gbGbnAyYUIjA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6900

C:\Windows\ap8tK.exe
C:\Windows\ap8tK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7156

C:\Windows\b6Okv5hp4Iqre.exe
C:\Windows\b6Okv5hp4Iqre.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7292

C:\Windows\XDkHVTehxUV.exe
C:\Windows\XDkHVTehxUV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7532

C:\Windows\Vq7RhgLYqb3d7z.exe
C:\Windows\Vq7RhgLYqb3d7z.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7780

C:\Windows\F8Jp7dDEcUamzM.exe
C:\Windows\F8Jp7dDEcUamzM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8032

C:\Windows\qP6SCOa.exe
C:\Windows\qP6SCOa.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7984

C:\Windows\nMY9UslIVDBmw.exe
C:\Windows\nMY9UslIVDBmw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8420

C:\Windows\W5S5tsIuZK1zGa.exe
C:\Windows\W5S5tsIuZK1zGa.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5848 -ip 5848
1⤵
PID:9136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3600 -ip 3600
1⤵
PID:9204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4212 -ip 4212
1⤵
PID:8860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5724 -ip 5724
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1340 -ip 1340
1⤵
PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 204 -ip 204
1⤵
PID:9212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6648 -ip 6648
1⤵
PID:4000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4Sdv0mcztYiZ2k.exe

Path C:\Windows\4Sdv0mcztYiZ2k.exe
Size 804KB
SHA256 ada735c6f944290ed8838998b83de6e9d5e688cfcf0e1d5fdebdad80446bb73a
MD5 a4a9dd6b028db2ebd75a8fcf3ccb35d0
SHA1 3d7c0a45ddc30c8f0aafedd95bc2b9d277322969
SHA512 6573a2ce524b45cc3ecd1f3abf8c859b8a81e62cb72fc97c8998816c39b4b2fdd317b33b123dcc36d53fbb1ad94e1a96e31f950cffb92aef37bcc3de9d6b2934
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nson
TLSH
T1C605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5jM3xtmrv.exe

Path C:\Windows\5jM3xtmrv.exe
Size 804KB
SHA256 29606403520ca8e04e1fcbd535ae2cee4dbfa4b50d7f092b9643255bce03c59a
MD5 77a49a7b2b6f0aec6820c031f4e7e1d1
SHA1 de8037c7f261c9fd7d1bccf22ecc71cc7b94b0b7
SHA512 be01dd168e298506f572fe69094e3b38b2ba4b10a945bd86a4c9a80642fc3625cfbedbdffeb0b9a7986401488c308e946fb412c65c8ad828554e50b635b2083d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouS:0NA1Yakeer5+nsoj
TLSH
T10A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ddzbvo7l.exe

Path C:\Windows\Ddzbvo7l.exe
Size 804KB
SHA256 dbd69827e1c218bc50e6add76ad72d812ce6e798d1bf59e14285a96488b88646
MD5 5f7d7e706990a05a16ed43b0d0d5707b
SHA1 b40d8c6e2c33eee3c5f017ad4edb199b3724a482
SHA512 2e058b3adf263c44620f083e9cd2f6609baf8c923755a6c12fba91514ca1f4529fe854c89fe7a5732e190db48f36c5e294e635476a2d887e8b7da5a8c9740a75
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nso2
TLSH
T1BC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F8Jp7dDEcUamzM.exe

Path C:\Windows\F8Jp7dDEcUamzM.exe
Size 804KB
SHA256 c04f14be024dc12c3f487b7340a0a31b792631db054f1c17da12f6482dda5c9e
MD5 49c8cc9c0ab25f427a27f3dea7bc206c
SHA1 706a090cd9bf9f870eb6931a987aed1ea290ee35
SHA512 a17638e6881997bed34be1a6b24b32c2f586e9759c4da69d03d2b63b17842b7624fd66e05397df0c566173322602334d96f7e2679b6117e95b30ad4795c728ec
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoua:0NA1Yakeer5+nsoX
TLSH
T1CF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

G4qho3sHgg5jzrV.exe

Path C:\Windows\G4qho3sHgg5jzrV.exe
Size 804KB
SHA256 b719f0c8570b96fbcdcec743b200e23a70329ca0473a805feaf074ac1d5d6400
MD5 338c2fc06f258bd1256155e549488091
SHA1 070ea75af202f35f4c1a818624a3cc14a74036ca
SHA512 2aec4f6a3499b018a207e3e793eab69674ad2aa116f9395057f2c2808a6f9765c99144c47e4cb645d0aaa75c21a4f09a66def2c13c833f6c2977b3984efd9872
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsoi
TLSH
T18005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OYnTMzHc.exe

Path C:\Windows\OYnTMzHc.exe
Size 804KB
SHA256 19e035a593aa4267485d45a414465366dd452b289967b162800b39e010c25aca
MD5 c108787bc698d0239d41223623237f6f
SHA1 c1674e3bd8f5754235a4c3942d3c02d8f64924dd
SHA512 ff8b9456de1513e93c70d3df1cd25dbf4be7264fa391c652619ba5bc576e33475bac966f8abef675500a059a3afcae5823e5d264bf837dcf31e3ed99b859182f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouk:0NA1Yakeer5+nso9
TLSH
T13C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OhUKCLN.exe

Path C:\Windows\OhUKCLN.exe
Size 804KB
SHA256 a9b360b33523dcb96eb75652ab6ada6f6e9667680b8c823a6bd2309cc9fc27a2
MD5 de091640dad793d0de71b173c61b241c
SHA1 6485400f8df2ec70316bc88e030bf46e65c65113
SHA512 161e7df07a6772e9adef0a34a53407ac0717b49c83a695f5ace14e8bed57d43d9ed216d049aef067fc53f120b1cc61078ce90ed2dc2ee7eafaa2a643c83cd678
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoueH:0NA1Yakeer5+nso7
TLSH
T10105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vq7RhgLYqb3d7z.exe

Path C:\Windows\Vq7RhgLYqb3d7z.exe
Size 804KB
SHA256 b0b9e5019be67b85f0644effabfe057af3cd119403167900b8fd0f5037645a88
MD5 2ef52679a4967b07d7f578eddca5adbe
SHA1 af05975e5f60a94fa57f96f47c65d0bb9f8bddf2
SHA512 76dc32d113a4b684ef908ec3306024c572029fafa309e389ecce602799922c8e92fe10da53554522a66bb1ef0b288b10702cd48cef736d8e22ebbb31ac6ba8cd
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoua:0NA1Yakeer5+nso5
TLSH
T19F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W5S5tsIuZK1zGa.exe

Path C:\Windows\W5S5tsIuZK1zGa.exe
Size 804KB
SHA256 ee9c58f0af8076de60c8b7c18b78c140793aa3bc07d3aa69990bb131dda9e77d
MD5 9b07bcc9f71fc110c515b7c7fac321cc
SHA1 e796004f55f6ffd0aaf3c8a23804aca6996dfa2d
SHA512 5eaff9451bb85186530c3d254b8674e6d46daad3e44181fab8560bff29ec776d7be6b7a14578d6314b796d27b7a7dffbc9624e270e26978b7622984f0d642f49
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFour:0NA1Yakeer5+nsoO
TLSH
T12A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XDkHVTehxUV.exe

Path C:\Windows\XDkHVTehxUV.exe
Size 804KB
SHA256 97131639f92d71ca8b6c9d7ebe6c1f047aa4d9c08e8808057489e94b4f22914e
MD5 631135190d169f3d536c7bacda00f360
SHA1 d6ec572a9e682873280308dba7bfe17b6ce86c3a
SHA512 c134f47e1eec38e5a20c247df61609b70e56a75f9bd1b55656ec644597bfbc0a6704b4bb1c0456de34daa212580acf39f0c4f87fe6bb83365a3dddf909a7b495
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoua:0NA1Yakeer5+nsoX
TLSH
T14B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Zkl2owvA.exe

Path C:\Windows\Zkl2owvA.exe
Size 804KB
SHA256 c438e42e9d44e18a64b04d5f61249c55147e852edeb4552dc89e2d3ca40e18b0
MD5 6213aca187ae2c639529c603ae8f7214
SHA1 8ee0e791491720a15a982c69b39048d99ed44bbc
SHA512 c4ec4323f15259e50fe58d976c1ac05fa51da832d7f9dbdfc4d5fe2507b575d1e70cc66addf3248cdc8d2ec8c06afa8670af92505e7b81b365165d691dd13396
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsoI
TLSH
T10005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ap8tK.exe

Path C:\Windows\ap8tK.exe
Size 804KB
SHA256 594e736131c922a3a08cd9988cc5e357cb1020b123821a68b1dc9de53e3036c0
MD5 29ba0ca3fee957be737b9c84e230e354
SHA1 7825fb862072da9a1b239527e22ff9bf5d9a0360
SHA512 90c093ee7cbf8c10cc1a492af90ec117250a84df840ae7143360de93bf59fa9cfbe06068b0a606d55718a65c38956c29d825bac1e6d9db7c636e3ad8fdcce565
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsoH
TLSH
T1C905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6Okv5hp4Iqre.exe

Path C:\Windows\b6Okv5hp4Iqre.exe
Size 804KB
SHA256 3edbc24ad81785543ea86293e83af81a419735e9f5ab5cd635d5a254f6f9a4fc
MD5 59a4d163efc3fd3604af0c9f1e6ef737
SHA1 97b5a15045cfc496c9490d48ed5799bd75b497f5
SHA512 b5aa18fe9d7ea3e7163e0da976c1c7fa7da641444463b92d6724162274b778c2515e61a31fd136df2637dbcc0011fd22bb9da532ae8df66b9d83f7894ce7b12f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouRt:0NA1Yakeer5+nso8t
TLSH
T1E205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g7Xb76F0JTkccO.exe

Path C:\Windows\g7Xb76F0JTkccO.exe
Size 804KB
SHA256 4ee4be375ceedcc950536dd2bfee5368aca2bdb1b66a16a0c7cb03f9c8fdc25f
MD5 85a011a3e634e42a0fd128327df116c1
SHA1 d45a93405f8fc62e2c7c5e3f3481da084b661eb3
SHA512 f21dcfe84b00a1188b468a877cd578e4ee2eb405c70c5532f99939a7cfc3da7f1d11ff25539800a4613c2cc1a02b90e1af5bfef5cf8c7bab096a7e8edddf22f5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nsok
TLSH
T18205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbGbnAyYUIjA.exe

Path C:\Windows\gbGbnAyYUIjA.exe
Size 804KB
SHA256 839f508e5713bce9c5f9be68f22b441879126ed0ef6b1392963262940c0c2df2
MD5 9cbef1e0c9c2a6c56dc4bbbad98d766e
SHA1 7ce60480063fd35dda069824d53384aa97e88970
SHA512 1b13bd4c8dbc3cac6a2361bac3bb87480444040241779eef4df53e22f9085318162c78cf22bb05aeaacd8abd5639469b5ff92be18fb45c3e3a2c3e567b426dd0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nsoe
TLSH
T1A605A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iUA8M8aklAzQ.exe

Path C:\Windows\iUA8M8aklAzQ.exe
Size 804KB
SHA256 3857b70701d41fd7cf80ace6871990120d75b38bcf618423b6b7eebf62f1952b
MD5 772b5e9ef09bd88b925474ec5a9f8c15
SHA1 0fa9805d43ad3958be17cd14c7dfba3907b6743c
SHA512 90293c00bb8e069e291c851e930e88c51af9f7b46a9da7a5cf2b9fd9a5dc3e76186bc4b829846d2357453949c8b67dd9478ea563bdece954c099cbeb6ad9fa30
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou1:0NA1Yakeer5+nsoC
TLSH
T14605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lrOD8qKVaw.exe

Path C:\Windows\lrOD8qKVaw.exe
Size 804KB
SHA256 2211365369ffc497eee708bee4a93d7f15d7fd0cd2d0168c9866e64b47a07646
MD5 d3e7d90913019a58c5edb7ed881bde38
SHA1 86db1c5f0168b824a5c694db37a66bbbc90d1518
SHA512 a6ff65daf4c80ba68b9488fc316db6971bbfc98f899007c04b8b5889f2e2b328e05fd62ea36836a9b11b6fc1a0d9632279f53446f191fa7891fb1160b8e05492
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nsoz
TLSH
T17605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nMY9UslIVDBmw.exe

Path C:\Windows\nMY9UslIVDBmw.exe
Size 804KB
SHA256 4cbbe67f9b655faabeb3c47a26be7841aa440c7919d9e03ecca9b53d094d98de
MD5 affbfe6784aef2ac02b23c0fc3b72034
SHA1 30ff5356a7b9bc3947e1eb423719f16d6f434574
SHA512 2925d5d8fe766ffd95d89099a251f790e2ff82ea9e15379582ec0409bea28a22c937cde1bc2d316da62d92050ff234b1be3f13a8c29e6b8388f56cb48dcc1acb
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nsoX
TLSH
T18105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qP6SCOa.exe

Path C:\Windows\qP6SCOa.exe
Size 804KB
SHA256 236dc3527151cdf4593642f412960ba3311757d1f1a93d0b5b990eacfb078a5f
MD5 671f6aebf1f69058635aa4f48e30a8b3
SHA1 3bee4f00e7346a16ecbe84ac129736fe7e880e49
SHA512 4fd551d222ad834719e2e7a0b53db83c1d87708c11985c67c4ea73058af0c0329751a4aeb958065d57d992cd6204090f858c30997ee950297be2becf2231abce
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou7:0NA1Yakeer5+nsom
TLSH
T10A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rbrpE.exe

Path C:\Windows\rbrpE.exe
Size 804KB
SHA256 36932febd067e8817719007459708d43f27c5d1048fcd67d0c0510e2b2f5e7de
MD5 738fb00d186bc64c47a0996788ddf2ea
SHA1 3a7fc3f2c67666ffca2667141a64c4e3180030f9
SHA512 15396f614fff0435ff851ebc69eab0989e77a6d71c9e2882f15c4aac257524d582b78c2df0f64b140416d1b499f048379f1a374bb8be4d338d6f9bea9d7f25da
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nsoE
TLSH
T10105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rqy4Wv.exe

Path C:\Windows\rqy4Wv.exe
Size 804KB
SHA256 fd83d298677c15e661d4f017d9d90b766eb816f206913592fd36e9fb694a965f
MD5 64af406b4242ebf798aae5d68f537741
SHA1 a900707c18bea6aaf4a1ffa1252722e20fbb7fb3
SHA512 8a28fad09e5f9ab34c2bb1b9c1f08fb9e8fd40a89b09c40efb7f96798193e3138df59e78d8d5faccc80a73f022ad75d18f6c0dc8de9e30b55704807107678a6b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsok
TLSH
T1E505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xwHERS4g3dvyE.exe

Path C:\Windows\xwHERS4g3dvyE.exe
Size 804KB
SHA256 7a904965ebbc1ab5ac9ef7da83959b8e4fee1f3ba47986924b863680febde914
MD5 71517f469dd2b1023e6126fbc9d392f8
SHA1 53ea1596fc4667cb7bed73f787bd2cfebb7a6583
SHA512 fce6ec0bbdd64a6d1b7f67f099f9c111b762395651c51de23e7bf0a4e706f61a7f2e0990072a5b7e5f8dcd80d4894bb37400d495877abba319c8ce1c31208835
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou8:0NA1Yakeer5+nsol
TLSH
T17805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads