3c4a80eb9253f404d08b605b3b643499344e9074c7f02d8ed39eb5be46f3b6ea

General

Target
2026-08-06_af706fdb8ee08a820353bde47166f380_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260806-2ntpmabp6x
SHA256 3c4a80eb9253f404d08b605b3b643499344e9074c7f02d8ed39eb5be46f3b6ea
MD5 af706fdb8ee08a820353bde47166f380
SHA1 17a6bc16c6435328a3785a0b972b4832a1c9470a
SHA512 0288e71fae171cd9d200b29830a474ab6a501b47749119cc0cfa2eaf5fc4f03dafb2eeb806aa4a394e2fde6e769a94b8340c9633e76923cd465686b1841ff186
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou8:0NA1Yakeer5+nsot
TLSH
T14605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (658) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 6 IoCs

pid	Process
1060	KMV6bSb.exe
4896	1sOqK.exe
2728	kczVJdE9Am.exe
3084	VNaUBdi3.exe
3224	Og5Ld8HhvO.exe
1412	EioTD43.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NETUTILS = "C:\\Windows\\kczVJdE9Am.exe"	1sOqK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PADMIN = "C:\\Windows\\VNaUBdi3.exe"	kczVJdE9Am.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FIH32 = "C:\\Windows\\Og5Ld8HhvO.exe"	VNaUBdi3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICMON = "C:\\Windows\\EioTD43.exe"	Og5Ld8HhvO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-PROT95 = "C:\\Windows\\KMV6bSb.exe"	2026-08-06_af706fdb8ee08a820353bde47166f380_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVXMONITORNT = "C:\\Windows\\1sOqK.exe"	KMV6bSb.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\VNaUBdi3.exe	kczVJdE9Am.exe
File created	C:\Windows\Og5Ld8HhvO.exe	VNaUBdi3.exe
File opened for modification	C:\Windows\Og5Ld8HhvO.exe	VNaUBdi3.exe
File created	C:\Windows\EioTD43.exe	Og5Ld8HhvO.exe
File created	C:\Windows\KMV6bSb.exe	2026-08-06_af706fdb8ee08a820353bde47166f380_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\1sOqK.exe	KMV6bSb.exe
File opened for modification	C:\Windows\VNaUBdi3.exe	kczVJdE9Am.exe
File opened for modification	C:\Windows\EioTD43.exe	Og5Ld8HhvO.exe
File opened for modification	C:\Windows\KMV6bSb.exe	2026-08-06_af706fdb8ee08a820353bde47166f380_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\1sOqK.exe	KMV6bSb.exe
File created	C:\Windows\kczVJdE9Am.exe	1sOqK.exe
File opened for modification	C:\Windows\kczVJdE9Am.exe	1sOqK.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4688	4896	WerFault.exe	91
2136	3084	WerFault.exe	95
2504	1060	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EioTD43.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_af706fdb8ee08a820353bde47166f380_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMV6bSb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1sOqK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kczVJdE9Am.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VNaUBdi3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Og5Ld8HhvO.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-06_af706fdb8ee08a820353bde47166f380_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_af706fdb8ee08a820353bde47166f380_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3452

C:\Windows\KMV6bSb.exe
C:\Windows\KMV6bSb.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 2400
  2⤵
  - Program crash
  PID:2504

C:\Windows\1sOqK.exe
C:\Windows\1sOqK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 2092
  2⤵
  - Program crash
  PID:4688

C:\Windows\kczVJdE9Am.exe
C:\Windows\kczVJdE9Am.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2728

C:\Windows\VNaUBdi3.exe
C:\Windows\VNaUBdi3.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 1420
  2⤵
  - Program crash
  PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4896 -ip 4896
1⤵
PID:5376

C:\Windows\Og5Ld8HhvO.exe
C:\Windows\Og5Ld8HhvO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3224

C:\Windows\EioTD43.exe
C:\Windows\EioTD43.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3084 -ip 3084
1⤵
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1060 -ip 1060
1⤵
PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1sOqK.exe

Path C:\Windows\1sOqK.exe
Size 804KB
SHA256 9840df026929d3b64528d670c5532f081c98716e10cce37a43d10df8c4588bc8
MD5 9cdd8300dc54e7dc7a1ee21eb3938ec9
SHA1 71595382593fc426da855759b154c18632145f71
SHA512 0278c64c8f4876dfe2f4ad8918b062f2db57f4d87f3c937be69537fc34e56c4f34eeb0e6ed90700e3ec0c20696d2109e3ef86bd8188e39abec709bd8f506cc6f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nso6
TLSH
T1A505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EioTD43.exe

Path C:\Windows\EioTD43.exe
Size 804KB
SHA256 8037eed3e50b12ffd2176ea722bcc0c5e9795c6356a210affea59680c9fb0451
MD5 930b024b7017c3c58a0f94b1cfa082b8
SHA1 1160b5fc29334e6f4d912d2b42fdc2044432c081
SHA512 fa5dccc96c247be9f037042a32d3f1c09c259d00d8d7ca1f5924b97c9a8cffcc4ef0fd397005b63862e032c23e5a23b6fd805a715683e6ef6dfff78de5d0d555
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nso7
TLSH
T19805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMV6bSb.exe

Path C:\Windows\KMV6bSb.exe
Size 804KB
SHA256 94581f14f196645b9e76c199b2aafd7811cc4ad07be23644743461015686fd37
MD5 2c225cd3516cba215b37d9d53f4b9236
SHA1 77a751c980575a95ca07a7a84f5df3bef2aa40cb
SHA512 016c378791293411b2dd6aefb98a27bc94727c0e895f73ef196a16da561323881248412be493ebad8743770b8af0dc7521ebb4a7090d981a0eb94d3bf025c206
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouu:0NA1Yakeer5+nso7
TLSH
T1EF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Og5Ld8HhvO.exe

Path C:\Windows\Og5Ld8HhvO.exe
Size 804KB
SHA256 7204fc9cb59c4dc62202689c7e11ec5f5bd5aa05a88aed709e67897c42dc7c29
MD5 06fd9c2775158efbefac98f5c2102f2c
SHA1 a0ee7ebe2fc96e2eba530a5d9d51ee42435bafb7
SHA512 baf76c2216c3eef09818460c1d0aeb6146fb58b6af4ce2e89bbfbfd9b6ba5b033b8e66af9672d43f7ca2a3cba0df556f6af611469742adf72682e6723633ef30
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouV:0NA1Yakeer5+nsoa
TLSH
T15A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VNaUBdi3.exe

Path C:\Windows\VNaUBdi3.exe
Size 804KB
SHA256 5fd944e54e8ebd220b573282261687207c7c162cbac84499e1c648134ba36c21
MD5 04d60865da1caff287f0238c53e7b820
SHA1 6f5440aa6bfba7878df51a0dea2ad3e82d3ebf53
SHA512 7db0aedc51227374b5a3128da380854b2dc857270e521a265bdd42b7a7c84d348c264b9396d9dd0ae08614ee0da6e557ae6de5de9338d3b6d2c22a0e11e0c3ec
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nsoh
TLSH
T10F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kczVJdE9Am.exe

Path C:\Windows\kczVJdE9Am.exe
Size 804KB
SHA256 53d0df1790d88d4624a04952d914c556d63c13327aaaf0ffe9902d804abcc778
MD5 05b1af37ac138fa9ca682e7d7bc1a4b5
SHA1 449ba9fc086fc10d5e9c76c5418b09053e06cbcb
SHA512 d809b95b3025d10a57eb1eaca4652cf8e72745b4541a645952cc20917c969553cfcadb0ebca79844af2afa542886d49a94fee5fcdf51cfd835fd1d39d4c307d5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouC:0NA1Yakeer5+nso/
TLSH
T18505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads