d4a8cade6a003ab427bd064021cb0d414e392d4d4e8d9d842d0f656d2594fb61

General

Target
2026-08-03_74f5206bb9a3b106dd67b7fb5a6cda86_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 934KB
Sample260803-frgctacl8x
SHA256 d4a8cade6a003ab427bd064021cb0d414e392d4d4e8d9d842d0f656d2594fb61
MD5 74f5206bb9a3b106dd67b7fb5a6cda86
SHA1 07be96fd208a2c6c06b1e2fdbfed4a84f4c1e593
SHA512 c05e8f1243b0d0bd77ec15df5b0b91550a786f96ec7f65f9e0440871c8780c4c8c65bd8a3b439505566340c3ee389e4c84b6c942f971b0452618a28695908702
SSDEEP 12288:lMer5+nZoHA1Yjmer5+nIwaJZer5+nIer5+ni:lgQAuZ
TLSH
T1ED153957E6814EEAD7D94576DF14C120932AF12EABFB1230785C1208EE47787BF25A38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1420	C9hySTIpPodm9pz.exe
3696	jovrG3K3wA.exe
1244	BTq9ByYh.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SYMTRAY = "C:\\Windows\\C9hySTIpPodm9pz.exe"	2026-08-03_74f5206bb9a3b106dd67b7fb5a6cda86_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSSTAT = "C:\\Windows\\jovrG3K3wA.exe"	C9hySTIpPodm9pz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EVPN = "C:\\Windows\\BTq9ByYh.exe"	jovrG3K3wA.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\BTq9ByYh.exe	jovrG3K3wA.exe
File opened for modification	C:\Windows\BTq9ByYh.exe	jovrG3K3wA.exe
File created	C:\Windows\C9hySTIpPodm9pz.exe	2026-08-03_74f5206bb9a3b106dd67b7fb5a6cda86_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\C9hySTIpPodm9pz.exe	2026-08-03_74f5206bb9a3b106dd67b7fb5a6cda86_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\jovrG3K3wA.exe	C9hySTIpPodm9pz.exe
File opened for modification	C:\Windows\jovrG3K3wA.exe	C9hySTIpPodm9pz.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2576	1420	WerFault.exe	90
2028	3696	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_74f5206bb9a3b106dd67b7fb5a6cda86_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C9hySTIpPodm9pz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jovrG3K3wA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BTq9ByYh.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_74f5206bb9a3b106dd67b7fb5a6cda86_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_74f5206bb9a3b106dd67b7fb5a6cda86_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2136

C:\Windows\C9hySTIpPodm9pz.exe
C:\Windows\C9hySTIpPodm9pz.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 2100
  2⤵
  - Program crash
  PID:2576

C:\Windows\jovrG3K3wA.exe
C:\Windows\jovrG3K3wA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 2284
  2⤵
  - Program crash
  PID:2028

C:\Windows\BTq9ByYh.exe
C:\Windows\BTq9ByYh.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1420 -ip 1420
1⤵
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3696 -ip 3696
1⤵
PID:3396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BTq9ByYh.exe

Path C:\Windows\BTq9ByYh.exe
Size 934KB
SHA256 249e67b02d29b0470a0ff651c1a479f8551d000e8bcc062dd18ac1533ce56ef4
MD5 b273c602447339448f8dab3e4a015526
SHA1 f234b12193f08ab8e44f4a50027e265f8eb14e82
SHA512 6a076579941d2cbedaf4d0061f16a3dd0914fc97d0d63d43b91c8a97d426475ed64721bb50a3600a12aed9af225242b6a26cc052aaf66a6cb6f5f2241b3d9e08
SSDEEP 12288:lMer5+nZoHA1Yjmer5+nIwaJZer5+nIer5+nF:lgQAum
TLSH
T10A153957E6814EEAD7D94576DF14C120932AF12EABFB1230785C1208EE47787BF25A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C9hySTIpPodm9pz.exe

Path C:\Windows\C9hySTIpPodm9pz.exe
Size 934KB
SHA256 743188f9607c2834ad6170ad0e188380d515b7759b8e377639c82aae0fbe55fa
MD5 243909e0905974c5f8e5023eee6840f3
SHA1 323c849de362a80630e2f08f45c2b67329f9b3dc
SHA512 e9671e683fec2b839eb08f93c043eb4e60862c90649f6f3eda00b0f0b25b0a613cc19df61f43491f5f16c3d1b2f55ee1e56073ed36fdbe0e3d6dc91599f9b876
SSDEEP 12288:lMer5+nZoHA1Yjmer5+nIwaJZer5+nIer5+nV:lgQAuQ
TLSH
T12E153957E6814EEAD7D94576DF14C120932AF12EABFB1230785C1208EE47787BF25A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jovrG3K3wA.exe

Path C:\Windows\jovrG3K3wA.exe
Size 934KB
SHA256 b8f3f1591dc2780286198798e26a3ab6095a0f27e0f8d7cbdf893a1952c306f9
MD5 a4e214f01bebea038f1c13d22a7b9926
SHA1 31c42fef66eafd37fe2461c3d45b84083e0f96e2
SHA512 faf4c2ccbf921b26646762fddbce2dc5a0070a1b038ed062044c6bb8f77e7285e7847b70007d41decd74d3c12eb97120a3bf20a7d7b05b4a8e64399622d97b4d
SSDEEP 12288:lMer5+nZoHA1Yjmer5+nIwaJZer5+nIer5+ng:lgQAub
TLSH
T135153957E6814EEAD7D94576DF14C120932AF12EABFB1230785C1208EE47787BF25A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads