d309937b3b6389bb92a20a2061622377a61cd5ac1884f3600fea7e4304f08244

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_e60e50d9d5ea9669e6f952032927f82c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260803-t4vb4avzbs
SHA256 d309937b3b6389bb92a20a2061622377a61cd5ac1884f3600fea7e4304f08244
MD5 e60e50d9d5ea9669e6f952032927f82c
SHA1 b555a705ddde72b130eb65dcde7ab45cb2189e2d
SHA512 2d6414ee6e484f5cc58f7d342140d65a854b63ad57a49b5c3c808e9e10aa2fdd900495b545ac58a432607435bf59470879546813e923e8c3e447ff216f466431
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsov
TLSH
T10205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2088) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 20 IoCs

pid	Process
4640	JrthMKvHLWomY9x.exe
3572	Xu3vodCcwpyJ.exe
4656	QMJTvm4zhUv.exe
5980	jn4xui0UlrF.exe
3428	BVGusQSF4veGQ.exe
5260	462uU9ZgPUT.exe
1852	3p24BkAvEc.exe
3252	erOMIhn5GBpBPer.exe
848	NViMQY.exe
6168	yB0yLXEDe.exe
6416	jegJ3GayRzw.exe
6664	pc4W0wy.exe
6916	U4bAj4a0NK1vm.exe
7164	PCGikw2mLNs.exe
7420	wzviVNmbEnU.exe
7684	21tRgSplGqFwvnH.exe
8028	erpcene.exe
1876	I4UW31X5Hi.exe
7120	q6jy6VTJrbvwswR.exe
8448	enjwZpiuNE73Jud.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCCWIN98 = "C:\\Windows\\BVGusQSF4veGQ.exe"	jn4xui0UlrF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUALL = "C:\\Windows\\NViMQY.exe"	erOMIhn5GBpBPer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATUPDATER = "C:\\Windows\\yB0yLXEDe.exe"	NViMQY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CONNECTIONMONITOR = "C:\\Windows\\jegJ3GayRzw.exe"	yB0yLXEDe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUCOMSERVE = "C:\\Windows\\U4bAj4a0NK1vm.exe"	pc4W0wy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZAPRO = "C:\\Windows\\jn4xui0UlrF.exe"	QMJTvm4zhUv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EVPN = "C:\\Windows\\3p24BkAvEc.exe"	462uU9ZgPUT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NISSERV = "C:\\Windows\\erOMIhn5GBpBPer.exe"	3p24BkAvEc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NOTSTART = "C:\\Windows\\wzviVNmbEnU.exe"	PCGikw2mLNs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGENTW = "C:\\Windows\\I4UW31X5Hi.exe"	erpcene.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVLU32 = "C:\\Windows\\enjwZpiuNE73Jud.exe"	q6jy6VTJrbvwswR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DOORS = "C:\\Windows\\462uU9ZgPUT.exe"	BVGusQSF4veGQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PVIEW95 = "C:\\Windows\\pc4W0wy.exe"	jegJ3GayRzw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFALERT = "C:\\Windows\\PCGikw2mLNs.exe"	U4bAj4a0NK1vm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCVSRTE = "C:\\Windows\\21tRgSplGqFwvnH.exe"	wzviVNmbEnU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATCON = "C:\\Windows\\erpcene.exe"	21tRgSplGqFwvnH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EXPERT = "C:\\Windows\\q6jy6VTJrbvwswR.exe"	I4UW31X5Hi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVNT = "C:\\Windows\\JrthMKvHLWomY9x.exe"	2026-08-03_e60e50d9d5ea9669e6f952032927f82c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFSCANGUI = "C:\\Windows\\Xu3vodCcwpyJ.exe"	JrthMKvHLWomY9x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IAMSERV = "C:\\Windows\\QMJTvm4zhUv.exe"	Xu3vodCcwpyJ.exe

Drops file in Windows directory 40 IoCs

description	ioc	Process
File created	C:\Windows\JrthMKvHLWomY9x.exe	2026-08-03_e60e50d9d5ea9669e6f952032927f82c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\jegJ3GayRzw.exe	yB0yLXEDe.exe
File opened for modification	C:\Windows\pc4W0wy.exe	jegJ3GayRzw.exe
File opened for modification	C:\Windows\21tRgSplGqFwvnH.exe	wzviVNmbEnU.exe
File opened for modification	C:\Windows\enjwZpiuNE73Jud.exe	q6jy6VTJrbvwswR.exe
File opened for modification	C:\Windows\JrthMKvHLWomY9x.exe	2026-08-03_e60e50d9d5ea9669e6f952032927f82c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\Xu3vodCcwpyJ.exe	JrthMKvHLWomY9x.exe
File opened for modification	C:\Windows\Xu3vodCcwpyJ.exe	JrthMKvHLWomY9x.exe
File created	C:\Windows\3p24BkAvEc.exe	462uU9ZgPUT.exe
File created	C:\Windows\pc4W0wy.exe	jegJ3GayRzw.exe
File created	C:\Windows\U4bAj4a0NK1vm.exe	pc4W0wy.exe
File opened for modification	C:\Windows\PCGikw2mLNs.exe	U4bAj4a0NK1vm.exe
File created	C:\Windows\21tRgSplGqFwvnH.exe	wzviVNmbEnU.exe
File created	C:\Windows\jn4xui0UlrF.exe	QMJTvm4zhUv.exe
File opened for modification	C:\Windows\BVGusQSF4veGQ.exe	jn4xui0UlrF.exe
File opened for modification	C:\Windows\462uU9ZgPUT.exe	BVGusQSF4veGQ.exe
File opened for modification	C:\Windows\3p24BkAvEc.exe	462uU9ZgPUT.exe
File opened for modification	C:\Windows\NViMQY.exe	erOMIhn5GBpBPer.exe
File opened for modification	C:\Windows\jegJ3GayRzw.exe	yB0yLXEDe.exe
File created	C:\Windows\PCGikw2mLNs.exe	U4bAj4a0NK1vm.exe
File opened for modification	C:\Windows\I4UW31X5Hi.exe	erpcene.exe
File created	C:\Windows\BVGusQSF4veGQ.exe	jn4xui0UlrF.exe
File created	C:\Windows\NViMQY.exe	erOMIhn5GBpBPer.exe
File opened for modification	C:\Windows\U4bAj4a0NK1vm.exe	pc4W0wy.exe
File opened for modification	C:\Windows\erpcene.exe	21tRgSplGqFwvnH.exe
File opened for modification	C:\Windows\QMJTvm4zhUv.exe	Xu3vodCcwpyJ.exe
File opened for modification	C:\Windows\jn4xui0UlrF.exe	QMJTvm4zhUv.exe
File opened for modification	C:\Windows\erOMIhn5GBpBPer.exe	3p24BkAvEc.exe
File created	C:\Windows\QMJTvm4zhUv.exe	Xu3vodCcwpyJ.exe
File created	C:\Windows\wzviVNmbEnU.exe	PCGikw2mLNs.exe
File opened for modification	C:\Windows\wzviVNmbEnU.exe	PCGikw2mLNs.exe
File created	C:\Windows\I4UW31X5Hi.exe	erpcene.exe
File created	C:\Windows\462uU9ZgPUT.exe	BVGusQSF4veGQ.exe
File created	C:\Windows\erOMIhn5GBpBPer.exe	3p24BkAvEc.exe
File created	C:\Windows\erpcene.exe	21tRgSplGqFwvnH.exe
File created	C:\Windows\enjwZpiuNE73Jud.exe	q6jy6VTJrbvwswR.exe
File created	C:\Windows\yB0yLXEDe.exe	NViMQY.exe
File opened for modification	C:\Windows\yB0yLXEDe.exe	NViMQY.exe
File created	C:\Windows\q6jy6VTJrbvwswR.exe	I4UW31X5Hi.exe
File opened for modification	C:\Windows\q6jy6VTJrbvwswR.exe	I4UW31X5Hi.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
7964	7164	WerFault.exe	116
8968	4820	WerFault.exe	87
9020	4640	WerFault.exe	90
9108	5980	WerFault.exe	96
8756	8448	WerFault.exe	131
2088	3252	WerFault.exe	104
432	6916	WerFault.exe	114
3900	7684	WerFault.exe	120

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JrthMKvHLWomY9x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xu3vodCcwpyJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3p24BkAvEc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jegJ3GayRzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	U4bAj4a0NK1vm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wzviVNmbEnU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21tRgSplGqFwvnH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QMJTvm4zhUv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BVGusQSF4veGQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NViMQY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	erpcene.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_e60e50d9d5ea9669e6f952032927f82c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	erOMIhn5GBpBPer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	I4UW31X5Hi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	enjwZpiuNE73Jud.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jn4xui0UlrF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	462uU9ZgPUT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yB0yLXEDe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pc4W0wy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PCGikw2mLNs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	q6jy6VTJrbvwswR.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_e60e50d9d5ea9669e6f952032927f82c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_e60e50d9d5ea9669e6f952032927f82c_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 2272
  2⤵
  - Program crash
  PID:8968

C:\Windows\JrthMKvHLWomY9x.exe
C:\Windows\JrthMKvHLWomY9x.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 2284
  2⤵
  - Program crash
  PID:9020

C:\Windows\Xu3vodCcwpyJ.exe
C:\Windows\Xu3vodCcwpyJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3572

C:\Windows\QMJTvm4zhUv.exe
C:\Windows\QMJTvm4zhUv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4656

C:\Windows\jn4xui0UlrF.exe
C:\Windows\jn4xui0UlrF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 2196
  2⤵
  - Program crash
  PID:9108

C:\Windows\BVGusQSF4veGQ.exe
C:\Windows\BVGusQSF4veGQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3428

C:\Windows\462uU9ZgPUT.exe
C:\Windows\462uU9ZgPUT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5260

C:\Windows\3p24BkAvEc.exe
C:\Windows\3p24BkAvEc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1852

C:\Windows\erOMIhn5GBpBPer.exe
C:\Windows\erOMIhn5GBpBPer.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 2308
  2⤵
  - Program crash
  PID:2088

C:\Windows\NViMQY.exe
C:\Windows\NViMQY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:848

C:\Windows\yB0yLXEDe.exe
C:\Windows\yB0yLXEDe.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6168

C:\Windows\jegJ3GayRzw.exe
C:\Windows\jegJ3GayRzw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6416

C:\Windows\pc4W0wy.exe
C:\Windows\pc4W0wy.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6664

C:\Windows\U4bAj4a0NK1vm.exe
C:\Windows\U4bAj4a0NK1vm.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6916 -s 2324
  2⤵
  - Program crash
  PID:432

C:\Windows\PCGikw2mLNs.exe
C:\Windows\PCGikw2mLNs.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7164 -s 2092
  2⤵
  - Program crash
  PID:7964

C:\Windows\wzviVNmbEnU.exe
C:\Windows\wzviVNmbEnU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7420

C:\Windows\21tRgSplGqFwvnH.exe
C:\Windows\21tRgSplGqFwvnH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7684 -s 2308
  2⤵
  - Program crash
  PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 7164 -ip 7164
1⤵
PID:7916

C:\Windows\erpcene.exe
C:\Windows\erpcene.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8028

C:\Windows\I4UW31X5Hi.exe
C:\Windows\I4UW31X5Hi.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1876

C:\Windows\q6jy6VTJrbvwswR.exe
C:\Windows\q6jy6VTJrbvwswR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7120

C:\Windows\enjwZpiuNE73Jud.exe
C:\Windows\enjwZpiuNE73Jud.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8448 -s 2116
  2⤵
  - Program crash
  PID:8756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4820 -ip 4820
1⤵
PID:8948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4640 -ip 4640
1⤵
PID:9000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5980 -ip 5980
1⤵
PID:9092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 8448 -ip 8448
1⤵
PID:8732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3252 -ip 3252
1⤵
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6916 -ip 6916
1⤵
PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7684 -ip 7684
1⤵
PID:9032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

21tRgSplGqFwvnH.exe

Path C:\Windows\21tRgSplGqFwvnH.exe
Size 804KB
SHA256 6dfdfd94b4a94131872d5dae340ff6fb14041aefd509225fe62da3f3420a757f
MD5 068c60d8d410f71e9f6b212b7b325649
SHA1 f0f4f71aed76cba098177a1c28fff1b6b84ea3ef
SHA512 44ecb4b30bfec3013bd42b91c55b2c17f8b46b9f800a16ddb933134435a4f2c07dcf54f356ef83037d7a5118017c1a64f21ab56f215dcb7110a8bf614a8d0aa5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouo:0NA1Yakeer5+nsoh
TLSH
T16C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3p24BkAvEc.exe

Path C:\Windows\3p24BkAvEc.exe
Size 804KB
SHA256 01fe02d6d6cfff7ce7f8949a37eadd1fad3c542e63ddad810575c2bc4125050e
MD5 10e50b1aba849083cef985816f4dbc1d
SHA1 153dbe717b23d8d19901704d88a41d99f228ff54
SHA512 668d1b5aad29b60754a6b78a3a3d4ba1e74ad714c32f4d5a2f97ec0e303200295e3506aaa85f3bbc598cd771bf090d6b39c79f63bbc1522840f784508f52f958
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouI:0NA1Yakeer5+nsoz
TLSH
T1EE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

462uU9ZgPUT.exe

Path C:\Windows\462uU9ZgPUT.exe
Size 804KB
SHA256 74037a714f87b5804da3e4ae2fa95033e3f5cfdb95414ca05eb31daf5f881634
MD5 7687328caec2a05dfd4562bf8cb84757
SHA1 9d3e86c89103850bcb55d1ca36b8ec75026655c2
SHA512 6e8d4768cbd223c88d243a6ce42d9363421304c9020f48895c5963ad44def698efe920404ea02a52cd1e9655499ddb2d55c31c62d031ffb5c62477f768b62b8f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nsok
TLSH
T18D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BVGusQSF4veGQ.exe

Path C:\Windows\BVGusQSF4veGQ.exe
Size 804KB
SHA256 cbfcbbb520c6d140a858bfb7c3ffc76c70b406e7c28c1014a7908b52458f275c
MD5 87e2ce9aac9078994561f072ce0c9faf
SHA1 07a29afa9e2f2cde12b243656a634d36c2e767ff
SHA512 32b865676557cf81a5c39444b118a29a4ec1dfd238349ec0f2a12fd618f3e3ce5094df9618ed2fe874462514d263de3dc6086676dbeb179f04bdeb9454a1d0b3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou7:0NA1Yakeer5+nsoE
TLSH
T15705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

I4UW31X5Hi.exe

Path C:\Windows\I4UW31X5Hi.exe
Size 804KB
SHA256 585d8565d9f5009430e1a065fe5f46f52e21ca44b72c1b51131ff0201cff28c5
MD5 f8c91cd46a53cf3ccf8050d042049fe4
SHA1 950400a70d24f3073fabb23088f32099dea28a12
SHA512 a55c74628541c38a204a258a82d0449a70d0bcb2ef6f1dd7e5983bcaaed1add742d759a849bab427071aa806942f2ce1f16326d76c849dafb137db5c03c5fd0b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouz:0NA1Yakeer5+nsoK
TLSH
T1E405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JrthMKvHLWomY9x.exe

Path C:\Windows\JrthMKvHLWomY9x.exe
Size 804KB
SHA256 87e4ff6ec8ca2f835e88a1c66f5a61e3418ae2642a15078db0fd43b2c9bcd27c
MD5 712c2a24e03f9c733e483cc8d5726432
SHA1 961408c3213c5e9bf01da0350f47ae80ddce0697
SHA512 398aca3ce4018c3cb0093c3d6a6d246c7da776a1cd0bfe989c02e15d35df5d593080b38595bde411b40cd46372f14a2db3ff3605be91ee3464a8c757f5f245c9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouu:0NA1Yakeer5+nsop
TLSH
T10605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NViMQY.exe

Path C:\Windows\NViMQY.exe
Size 804KB
SHA256 c4ef9a0c92957d0a366b20197a7992c37cf8703deaea26701c4869a3eaafd0b5
MD5 dd27406a429e88954999f7a1ebcfee40
SHA1 59be1d04d724d082c76ff1bb9a859f71703c748e
SHA512 9ba3e8f2a1e70098c9156673337ede78783263a980c138e7faae98911902bae7a4a3ef651a7e40a68490a7a5a42ee67f054c0e1b01584ef8cb70d9b00bcf5d2a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouK:0NA1Yakeer5+nsov
TLSH
T1F505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCGikw2mLNs.exe

Path C:\Windows\PCGikw2mLNs.exe
Size 804KB
SHA256 01b447140ff041a3331ab4e414940b4fa8000a77caa1b63f0cbc634a1ed520ff
MD5 3a488b824d383348f08aef6a50521890
SHA1 409cf3607e973e96d537aab2e0d8d0241b8f7f34
SHA512 ec35d231ca35469ea539905253ba69307861d44eb06f91df71b249ee6d55042524470972a6a3aaf5fa57948e7a42e12d291a1d26223582fc345ad7c158dad295
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoue:0NA1Yakeer5+nsoh
TLSH
T1FE05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QMJTvm4zhUv.exe

Path C:\Windows\QMJTvm4zhUv.exe
Size 804KB
SHA256 8ef34b6486e53fc51dd5fae82267b804170cca4f335a91a3ab997f0f5531948b
MD5 a7681d4db29990bce643a051ace7d58a
SHA1 e783993072fc2ea05320d5a0f63fe3218d0720de
SHA512 dbc5c11f58740211e41ab48a6b19d5dbd9e869182da33eee5f574ff223133b72f30f7851c952f0160038a5efa9f940dda05aa6c88f36d61f004d69360e77a74a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoue:0NA1Yakeer5+nsod
TLSH
T1B405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

U4bAj4a0NK1vm.exe

Path C:\Windows\U4bAj4a0NK1vm.exe
Size 804KB
SHA256 e4db91a8adbf58b6398094431bd57d5c24956b3c139eb6c9b12817cba5ceb375
MD5 e0bcc7f5cae52f98c65a263810d1c458
SHA1 b0e4e86d8905f1ba7fb2ec51d10aa4dafdb317cf
SHA512 8ce84c761ae37667f0c17697b3a6a3c0b8792dd500a73f7df1bf7a04333e564bbee374d8b38789022db7b17a42ed0c28b609cb47fb3d97510d8d40175541f020
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouC:0NA1Yakeer5+nsof
TLSH
T12E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xu3vodCcwpyJ.exe

Path C:\Windows\Xu3vodCcwpyJ.exe
Size 804KB
SHA256 d259401afb492b6d054f68aaaaaf46f5dc22c81995679f23df2a1d393bc3fb4e
MD5 4d96bbd7a0016b7792baa5820a4a70c6
SHA1 b82c8dedbd8277a082684940670b5fc044d79879
SHA512 dc456887c17a41d7327f63f4648513b42f96e566d64b82e5a956dcc4853ff337169aff33dc913012d8e3356bec13d44402619ed9dc9286eef0f8b04401b2773b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQ:0NA1Yakeer5+nsoF
TLSH
T19705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

enjwZpiuNE73Jud.exe

Path C:\Windows\enjwZpiuNE73Jud.exe
Size 804KB
SHA256 7eddd743b0064c7c5acc8e60607695a9793f01dbbf59059a053659f04b0fd906
MD5 9c81cd15c723d49aeec98d97ce145a1d
SHA1 d6a03811ee71e1b6a0f8188f71d70ee7b3f35fab
SHA512 4e2438e9b98d9f6dfe70b8c9bf1c97a129f2566e5f037efed91fbcb3542e0272b7527c83fcc07d5bdd5b08a78b2aa29be95c9caf111c3ac2cc7e16c329fb0063
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouc:0NA1Yakeer5+nsot
TLSH
T15F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

erOMIhn5GBpBPer.exe

Path C:\Windows\erOMIhn5GBpBPer.exe
Size 804KB
SHA256 5ca9b9e7e5846360bea0490ae7b65019b10285ff73aebab4c072ad86a65a7257
MD5 90d080af853a3d8168163508b0140e1e
SHA1 b1fe918a90cc620152d9890c0b6a51eb4c1efc0f
SHA512 c22356910d4fea20c58a6a05ac87abaa91d25c3e40d34e9ecd8202d46a87d328c5f6bcfd194d1343b9341c4d706bdefbf34922a8c876da13a7930b6a480ab7e1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou7:0NA1Yakeer5+nso+
TLSH
T1D005A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

erpcene.exe

Path C:\Windows\erpcene.exe
Size 804KB
SHA256 d90d8c50b6442dcc57fcd6944c784b253bfcb29f903cf47ec1e3d9fd7a5b5292
MD5 0595fa34037620384dd8cb0906a7f398
SHA1 98e17a28f6d0b607cece245198f0d1360f245986
SHA512 88393c3f25d18050953a3a24574032fb17b1aaa298df13f6b0588850e365937d41bff8b5028a996ab138d83ae4043228974c8d61aca6078c61a68e54ac313161
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nsom
TLSH
T1DC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jegJ3GayRzw.exe

Path C:\Windows\jegJ3GayRzw.exe
Size 804KB
SHA256 84a91cb77492943dd431d6fe0011bc6ae51eafee4d61b88734a379070efe10df
MD5 2d532b785cc4a8539f7e6c3edb6cc593
SHA1 7d8f14dc2915c11ca9f15510b0348fd40f73fe3c
SHA512 660168a21e28d0b4740773536f5575d6ed5fe3679b6194d182d7ae3e79209e1b5b945ffdf5cdd739408eafa919f1ad02acb6b6a2f1c743f18be3cc57822dd81b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nso4
TLSH
T16105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jn4xui0UlrF.exe

Path C:\Windows\jn4xui0UlrF.exe
Size 804KB
SHA256 34996b27e80090185d072753ed4600e05f137bbac8c4c7316b17bc2c8238de24
MD5 b6f6cb5e59da05e87d4b7db3dcb0fc6d
SHA1 f52ac25130e4c10f036de93473517d85dc41ad8d
SHA512 cc68d6d1dcbadc4fb5e0808b19c70ea408befaa6bc0bb02a0310dbd8f59055e099a51f5fe6888fcf00a5477104e9595a6067f99178ad4d428254284c785b6ae1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nsoL
TLSH
T17E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pc4W0wy.exe

Path C:\Windows\pc4W0wy.exe
Size 804KB
SHA256 77a948dfa5170fecf722faf2b18078f63754bd7f0415a80ab22a02ab855c06d5
MD5 4abb8535344101b0a27d19fe67f68aab
SHA1 d75e85cba0ff29d45454aea828630c2f538c9b31
SHA512 dc0cb10222cce22470f5acbf0a188c11eeb35ca441d8efb8899da36340a0d5cd6261b505ed0dce120d72178ef62d5d68a5a3dda5a0bee51ef1cf1ce623f16593
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouB:0NA1Yakeer5+nsoe
TLSH
T11705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

q6jy6VTJrbvwswR.exe

Path C:\Windows\q6jy6VTJrbvwswR.exe
Size 804KB
SHA256 734f7235d2cf2fde6482158986417dc32865ffbb5d6675f07c4974044b0da589
MD5 47afe4b3df017931f463c451bbacd74a
SHA1 512ecde1da3ce3eee6f36f04e446886586d373e2
SHA512 ecad065cc93360eb0c0ccb48d5e92d72769d9ed812f2edc0d37aaa2118f5b72ec12733b0b4b25a7832868101fae5227b2e5b4816a6df5dd0599f39f8d0bfc246
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoua:0NA1Yakeer5+nsot
TLSH
T18805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wzviVNmbEnU.exe

Path C:\Windows\wzviVNmbEnU.exe
Size 804KB
SHA256 c5530c2e2906421c04c94c036c8ae2d0fa83f333634f1d6d5c75b650981a130a
MD5 66df55aa50f5155cb917abee8499ed70
SHA1 0b806df521816bc08c6f93aa1b49ba15d8cb763d
SHA512 1646589b4f4e9cdb8af73aa9e503024bfdeaf51bbcea6e6e83390b0c50c5b03b1f98056021c0d00f7b2c6d5b0616196bf11f9c6eb4f30d2e42915a67f46ba7a5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nsol
TLSH
T15005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yB0yLXEDe.exe

Path C:\Windows\yB0yLXEDe.exe
Size 804KB
SHA256 b27dae29c23460f3498c4b3a72871433e4bbf461b19a8d956dffeaceca45ed3d
MD5 d101331fbdca483b8c67080c941863c0
SHA1 5c3b4b4be4ddb7e15662b34b0d1174512b99a533
SHA512 8fec283708091641bb1fd930dbe79d6db9cb24560c6d7cf998e5c19e327ffabb8c09b04021a6b32193da485050b1cb758d1345569d788308d80e56cb560c7b0c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nsom
TLSH
T10E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads