8eb187d2565ee1b25e4534daccbe3be3880bb99d12ad7c0de8a9be081b1bd124

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_804c5c9064275a2b85574a00553a5acd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260806-2xravssdph
SHA256 8eb187d2565ee1b25e4534daccbe3be3880bb99d12ad7c0de8a9be081b1bd124
MD5 804c5c9064275a2b85574a00553a5acd
SHA1 8f12faeaad75f0db724bad127a480b5702e492f4
SHA512 6a46121a4a35df0ddd1e094aece358bd67dd073cbca8b4fb4d919c4c2741d9d557aa9c5198e215427a2544e9113e533332feb1c12f5335125ff2eb001bdf5b76
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nsob
TLSH
T16805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (1451) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 13 IoCs

pid	Process
7076	CzhgghR.exe
4516	6KB2rw.exe
5460	5uTsDe3mRaCrlD1.exe
2800	vYr59n0qEg0RL2v.exe
5772	jm1JtQURt.exe
5776	CU1CX.exe
2932	IDSlmc6RvGqHM.exe
2432	B9jZml2vyMZ4v.exe
6116	tBVn3gtr.exe
5896	uzAM5.exe
3160	xjXeYjO6Mb1xZ.exe
7128	HQaZ4d5nCbQQTQ.exe
5600	g4Ujg9Hzt.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MONITOR = "C:\\Windows\\g4Ujg9Hzt.exe"	HQaZ4d5nCbQQTQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFIADMIN = "C:\\Windows\\CzhgghR.exe"	2026-08-06_804c5c9064275a2b85574a00553a5acd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SAFEWEB = "C:\\Windows\\jm1JtQURt.exe"	vYr59n0qEg0RL2v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFWATCH = "C:\\Windows\\CU1CX.exe"	jm1JtQURt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSAV32 = "C:\\Windows\\B9jZml2vyMZ4v.exe"	IDSlmc6RvGqHM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWNETSUP = "C:\\Windows\\uzAM5.exe"	tBVn3gtr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NDD32 = "C:\\Windows\\xjXeYjO6Mb1xZ.exe"	uzAM5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FRW = "C:\\Windows\\HQaZ4d5nCbQQTQ.exe"	xjXeYjO6Mb1xZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPFAGENT = "C:\\Windows\\6KB2rw.exe"	CzhgghR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICSUPP95 = "C:\\Windows\\5uTsDe3mRaCrlD1.exe"	6KB2rw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WGFE95 = "C:\\Windows\\vYr59n0qEg0RL2v.exe"	5uTsDe3mRaCrlD1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAV AUTO-PROTECT = "C:\\Windows\\IDSlmc6RvGqHM.exe"	CU1CX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IAMAPP = "C:\\Windows\\tBVn3gtr.exe"	B9jZml2vyMZ4v.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\uzAM5.exe	tBVn3gtr.exe
File created	C:\Windows\xjXeYjO6Mb1xZ.exe	uzAM5.exe
File opened for modification	C:\Windows\xjXeYjO6Mb1xZ.exe	uzAM5.exe
File opened for modification	C:\Windows\HQaZ4d5nCbQQTQ.exe	xjXeYjO6Mb1xZ.exe
File opened for modification	C:\Windows\6KB2rw.exe	CzhgghR.exe
File created	C:\Windows\vYr59n0qEg0RL2v.exe	5uTsDe3mRaCrlD1.exe
File created	C:\Windows\jm1JtQURt.exe	vYr59n0qEg0RL2v.exe
File created	C:\Windows\CU1CX.exe	jm1JtQURt.exe
File opened for modification	C:\Windows\CU1CX.exe	jm1JtQURt.exe
File opened for modification	C:\Windows\IDSlmc6RvGqHM.exe	CU1CX.exe
File created	C:\Windows\g4Ujg9Hzt.exe	HQaZ4d5nCbQQTQ.exe
File opened for modification	C:\Windows\g4Ujg9Hzt.exe	HQaZ4d5nCbQQTQ.exe
File opened for modification	C:\Windows\CzhgghR.exe	2026-08-06_804c5c9064275a2b85574a00553a5acd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\6KB2rw.exe	CzhgghR.exe
File opened for modification	C:\Windows\vYr59n0qEg0RL2v.exe	5uTsDe3mRaCrlD1.exe
File opened for modification	C:\Windows\jm1JtQURt.exe	vYr59n0qEg0RL2v.exe
File opened for modification	C:\Windows\tBVn3gtr.exe	B9jZml2vyMZ4v.exe
File created	C:\Windows\5uTsDe3mRaCrlD1.exe	6KB2rw.exe
File opened for modification	C:\Windows\5uTsDe3mRaCrlD1.exe	6KB2rw.exe
File created	C:\Windows\B9jZml2vyMZ4v.exe	IDSlmc6RvGqHM.exe
File created	C:\Windows\uzAM5.exe	tBVn3gtr.exe
File created	C:\Windows\HQaZ4d5nCbQQTQ.exe	xjXeYjO6Mb1xZ.exe
File created	C:\Windows\CzhgghR.exe	2026-08-06_804c5c9064275a2b85574a00553a5acd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\IDSlmc6RvGqHM.exe	CU1CX.exe
File opened for modification	C:\Windows\B9jZml2vyMZ4v.exe	IDSlmc6RvGqHM.exe
File created	C:\Windows\tBVn3gtr.exe	B9jZml2vyMZ4v.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5928	4516	WerFault.exe	92
7280	3160	WerFault.exe	113
7620	5460	WerFault.exe	94
7088	2932	WerFault.exe	105

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_804c5c9064275a2b85574a00553a5acd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CzhgghR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6KB2rw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CU1CX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDSlmc6RvGqHM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B9jZml2vyMZ4v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xjXeYjO6Mb1xZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HQaZ4d5nCbQQTQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5uTsDe3mRaCrlD1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vYr59n0qEg0RL2v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jm1JtQURt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tBVn3gtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uzAM5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g4Ujg9Hzt.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-06_804c5c9064275a2b85574a00553a5acd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_804c5c9064275a2b85574a00553a5acd_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1412

C:\Windows\CzhgghR.exe
C:\Windows\CzhgghR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2620

C:\Windows\6KB2rw.exe
C:\Windows\6KB2rw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 2092
  2⤵
  - Program crash
  PID:5928

C:\Windows\5uTsDe3mRaCrlD1.exe
C:\Windows\5uTsDe3mRaCrlD1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 2212
  2⤵
  - Program crash
  PID:7620

C:\Windows\vYr59n0qEg0RL2v.exe
C:\Windows\vYr59n0qEg0RL2v.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4516 -ip 4516
1⤵
PID:1088

C:\Windows\jm1JtQURt.exe
C:\Windows\jm1JtQURt.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5772

C:\Windows\CU1CX.exe
C:\Windows\CU1CX.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5776

C:\Windows\IDSlmc6RvGqHM.exe
C:\Windows\IDSlmc6RvGqHM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 2512
  2⤵
  - Program crash
  PID:7088

C:\Windows\B9jZml2vyMZ4v.exe
C:\Windows\B9jZml2vyMZ4v.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2432

C:\Windows\tBVn3gtr.exe
C:\Windows\tBVn3gtr.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6116

C:\Windows\uzAM5.exe
C:\Windows\uzAM5.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5896

C:\Windows\xjXeYjO6Mb1xZ.exe
C:\Windows\xjXeYjO6Mb1xZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 2104
  2⤵
  - Program crash
  PID:7280

C:\Windows\HQaZ4d5nCbQQTQ.exe
C:\Windows\HQaZ4d5nCbQQTQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7128

C:\Windows\g4Ujg9Hzt.exe
C:\Windows\g4Ujg9Hzt.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3160 -ip 3160
1⤵
PID:7260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5460 -ip 5460
1⤵
PID:7600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2932 -ip 2932
1⤵
PID:6452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5uTsDe3mRaCrlD1.exe

Path C:\Windows\5uTsDe3mRaCrlD1.exe
Size 804KB
SHA256 0ad14c3b0e525db2e556eaa4489f5161eb815e951d66da4152d2f6f28b105459
MD5 b765f160a16e47bd67e2cbcf3862cecd
SHA1 db28f44a278c9a503301c481f0c6dea20490cd66
SHA512 20169e6cb96f3fc9d3c11031c054704be603b85e992c798c3e69bdb105cf701c6b0337c1b580a6cc7c0df65d67447045a0f9f2990548b511f5dfb1a138d3abc1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nso9
TLSH
T1DE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6KB2rw.exe

Path C:\Windows\6KB2rw.exe
Size 804KB
SHA256 65e7e038d0c05c80d665f9a6ca512a71465552dc832666e885d6269fd7af2ca5
MD5 ce2ac1f672d7755ba28cfa2e656d7fae
SHA1 8ac7fc9f4d0862847347701c2ed85222557f7a7a
SHA512 3787c615cb6c9537cd8b371582939c60edd33b04d7954f97264e4afa86b90426f29119794285fbbff8f5a9cfb5060094394142c2cbb65111f070532ae6a15245
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nsoq
TLSH
T1A105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B9jZml2vyMZ4v.exe

Path C:\Windows\B9jZml2vyMZ4v.exe
Size 804KB
SHA256 c9519634db153a4b725d67ca6e6bd2c7dcb93113c64d0391f0ffa825afc25578
MD5 05f87bbae02e1abd5b3ff6f9b396c6e7
SHA1 bd0bf1508aa4bebcbf4f4285d908bc7338b0b33d
SHA512 0663f966a1b2c316250a12955aab85ac1d8080fc81c3f8e222651216c2579056a456e6c15a3e6f27539d217c39f5a87d00043f3321b0dd565de12c516352e329
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou6:0NA1Yakeer5+nsor
TLSH
T19B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CU1CX.exe

Path C:\Windows\CU1CX.exe
Size 804KB
SHA256 aea701d240457a2ab5a4912c2f47ba35a9d79d37a59857b26045051e9afb7296
MD5 ab2c709abe5e69a577fd7608138fa2da
SHA1 ed997dd286831bc3f8ac0cfcd0832e767df77705
SHA512 e851d7b88d2bbf8410e6b1b9a797f7b9105d5de71564894ee593db3e55bfc23eb86e2ac57c6704559bb80fc5f5fbb24f80f718371bce6975d4e69daeb8c3f90b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nsop
TLSH
T11205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CzhgghR.exe

Path C:\Windows\CzhgghR.exe
Size 804KB
SHA256 44045cd81585b1a453beedd01533d864e0c9febc1ab0f5eb92d3cc3f0185a8e4
MD5 348054bc01f8dba0616050e649d6d233
SHA1 e2b31a4b768696ef0f322f1617161d8df2eb334e
SHA512 a0af6f2a0a6dd446c11aced70c4207afe1b17688ff5728aaeecaa36146b40f03474dc86e9a4e6854ab573065fb42ebedf96a0acab5491070d12021538072e316
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nsoI
TLSH
T18005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HQaZ4d5nCbQQTQ.exe

Path C:\Windows\HQaZ4d5nCbQQTQ.exe
Size 804KB
SHA256 f8df5a222735807a924f3ab59459d0bfb256a31e0fed08b477e5721a618ab431
MD5 2089e0b2553d34ee91fd3297720cf2b7
SHA1 ec9b7f0ae4721251721eea2ab643fae5e6d04c6b
SHA512 29c783ace45e1e76bc6e2e2c59fb6f0af24c53d5f875676236c9a245c041f3fbb041f30d172048f5b2f0a10ae960ebe2d8b7874b5e83c49e6585ad93da2716ff
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouc:0NA1Yakeer5+nsol
TLSH
T14A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IDSlmc6RvGqHM.exe

Path C:\Windows\IDSlmc6RvGqHM.exe
Size 804KB
SHA256 7baecc5fc3dae35e29d170ef52a8896609b30c379df7e3259f8f37d86f2080c7
MD5 43ebc9504c34c93d27d888cf5ff38b77
SHA1 eb86a97597c0effa9271dc3ec8cecf4c070a8cc7
SHA512 876fac1ea8c75dc128255f1f9ac258f063cb1e584552b5db8b755cdfa85998e7606320d76777f312ece9a75045735e36d49a44b04b87d344c04330ff639c11e6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nsox
TLSH
T1DF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g4Ujg9Hzt.exe

Path C:\Windows\g4Ujg9Hzt.exe
Size 804KB
SHA256 a339e25943cb4dfed8b4d6a07e3c036971a1d0b425610f34c893a11627b2c012
MD5 5970aa2f2ae9b524ef393deab3eb40e7
SHA1 f07d90bfdab1f892c253efb707369db1de1c02b1
SHA512 ce075bafa8da2af0e282de9d5b2ffae26e59e0f6318b075f9c7dbcf1b4324c33eac4e70f84eadfc15b8102bc9f65b6636056eb0d654c3f7a29ff2ec73e016058
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nsoH
TLSH
T1AE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jm1JtQURt.exe

Path C:\Windows\jm1JtQURt.exe
Size 804KB
SHA256 ee41e741ba41934800c0d6a6dee94e3cb5d33c61d1baf4f757fe9225fce2adc3
MD5 0811d7fa466c5113022c9dfb34e49640
SHA1 55cefe90e5c3a0f653d3c12239ec2f365a22786e
SHA512 d6a342181d4d9bee5653fea20719dc9dea709169ad96d331c8f3b643ddb3852451eb2f4ff4bbe533aa9e12251095cc2b12b989d97e016099d3150680afcb290f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouz:0NA1Yakeer5+nsoI
TLSH
T15C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tBVn3gtr.exe

Path C:\Windows\tBVn3gtr.exe
Size 804KB
SHA256 f52360bee41cb96cc982ff2000a4cb829b8fb3bc9ee9b321d280c4a1f887e915
MD5 6d559219aba0234c7206251ae7529279
SHA1 089823c44955df0bad398abacf2ec8eafcd5c766
SHA512 5f069ebcf54bd967b216906aa0d06794324f109adf49408dc6474bb2c982001cc8ee67f1793d8728636434a9b92e9369a8e1d3eb6e21507232a9091c0a1c3527
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouE:0NA1Yakeer5+nsoP
TLSH
T12F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uzAM5.exe

Path C:\Windows\uzAM5.exe
Size 804KB
SHA256 182c4c929aaabe5d61e597c93c718e169a991a8a663bef29c9ca28337d0b0f57
MD5 c7f3577087aecab0a72df9f1a0ac48a9
SHA1 f875b932775d91b78ead08cc36276a1ae549bf7c
SHA512 e9e235b7d6c626cecf8c1a89650983d3ac6929ea194d7fcb046afb2e9fc39c862813afa660a75ae0b2e9f990fcb3d80e6a8f38363ad72a525c9bfa0c03648a89
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nso/
TLSH
T1B405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vYr59n0qEg0RL2v.exe

Path C:\Windows\vYr59n0qEg0RL2v.exe
Size 804KB
SHA256 d0b97b9f0a3b1807d9808d46965c771b453ca7de856111bff4333b667056116d
MD5 53c54ff1921a86aac9d67aa084953ca8
SHA1 2cf58b15bde9c839516182f0dcd5cbb6e5a11f9b
SHA512 cf2885e69087b210ee17d329e9a139084795d6cc15b4057fc546501d5ad799e1c4197ff2f1b91ebdc24b8b48cf2f1145d53ce1b06ff083f08837c55e49b704b9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nso1
TLSH
T17805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjXeYjO6Mb1xZ.exe

Path C:\Windows\xjXeYjO6Mb1xZ.exe
Size 804KB
SHA256 2994f04e7e873bad5f3c55e591b035f03053c14dd1bd82e5e065cb03e851fa13
MD5 a4d372c9c071fc3dc895f61adadf92bc
SHA1 166c60d351ef8f1aee87f67356a43930c18f2850
SHA512 935f8a7a3a8f7084ca8863f86914219322224b18da6fe4e03045994753223695a69c12b0fda9c70a41a58a61ef5a823d93e208ab022e5a95f4d34ca4b0025807
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nsoO
TLSH
T17E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads