e8451659b40a91f99ffc514f97cb8459774368deec3eea4a03ac8e9d6f8d0fd8

General

Target
2026-08-06_c0d3d3254863b655eded412213b1e196_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260806-blql3sbl4w
SHA256 e8451659b40a91f99ffc514f97cb8459774368deec3eea4a03ac8e9d6f8d0fd8
MD5 c0d3d3254863b655eded412213b1e196
SHA1 c5153c81b7ca93871687b592ea2fb6550eb50730
SHA512 98abee9977724e849da51d18411f7ff1482bfe31fab4379dc7eb755ad79ed7f37f5a9e75f8c74d5ff25d4937977537068dfa82a39dcde228074e86248babdd0e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouu:0NA1Yakeer5+nsoh
TLSH
T12F05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (716) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 7 IoCs

pid	Process
4340	ew7iM.exe
5036	WRwDdG6x2.exe
5956	7p8QU.exe
2488	qK3GvZr.exe
5000	zv4AcOolCzlxOa.exe
1820	7bele5nKqOkQ.exe
4188	t1uoF2jb3Y.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WATCHDOG = "C:\\Windows\\ew7iM.exe"	2026-08-06_c0d3d3254863b655eded412213b1e196_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ADVXDWIN = "C:\\Windows\\WRwDdG6x2.exe"	ew7iM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVCL = "C:\\Windows\\7p8QU.exe"	WRwDdG6x2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTRL = "C:\\Windows\\qK3GvZr.exe"	7p8QU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ALOGSERV = "C:\\Windows\\zv4AcOolCzlxOa.exe"	qK3GvZr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGENTW = "C:\\Windows\\7bele5nKqOkQ.exe"	zv4AcOolCzlxOa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NWTOOL16 = "C:\\Windows\\t1uoF2jb3Y.exe"	7bele5nKqOkQ.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ew7iM.exe	2026-08-06_c0d3d3254863b655eded412213b1e196_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\WRwDdG6x2.exe	ew7iM.exe
File opened for modification	C:\Windows\WRwDdG6x2.exe	ew7iM.exe
File created	C:\Windows\7bele5nKqOkQ.exe	zv4AcOolCzlxOa.exe
File opened for modification	C:\Windows\t1uoF2jb3Y.exe	7bele5nKqOkQ.exe
File created	C:\Windows\7p8QU.exe	WRwDdG6x2.exe
File opened for modification	C:\Windows\7p8QU.exe	WRwDdG6x2.exe
File created	C:\Windows\qK3GvZr.exe	7p8QU.exe
File opened for modification	C:\Windows\qK3GvZr.exe	7p8QU.exe
File created	C:\Windows\zv4AcOolCzlxOa.exe	qK3GvZr.exe
File opened for modification	C:\Windows\zv4AcOolCzlxOa.exe	qK3GvZr.exe
File opened for modification	C:\Windows\7bele5nKqOkQ.exe	zv4AcOolCzlxOa.exe
File created	C:\Windows\t1uoF2jb3Y.exe	7bele5nKqOkQ.exe
File created	C:\Windows\ew7iM.exe	2026-08-06_c0d3d3254863b655eded412213b1e196_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5432	5956	WerFault.exe	95
3396	2488	WerFault.exe	97
3812	4248	WerFault.exe	88
4728	1820	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_c0d3d3254863b655eded412213b1e196_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ew7iM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WRwDdG6x2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qK3GvZr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zv4AcOolCzlxOa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t1uoF2jb3Y.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7p8QU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7bele5nKqOkQ.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-06_c0d3d3254863b655eded412213b1e196_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_c0d3d3254863b655eded412213b1e196_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 2376
  2⤵
  - Program crash
  PID:3812

C:\Windows\ew7iM.exe
C:\Windows\ew7iM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4340

C:\Windows\WRwDdG6x2.exe
C:\Windows\WRwDdG6x2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5036

C:\Windows\7p8QU.exe
C:\Windows\7p8QU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 2072
  2⤵
  - Program crash
  PID:5432

C:\Windows\qK3GvZr.exe
C:\Windows\qK3GvZr.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 2076
  2⤵
  - Program crash
  PID:3396

C:\Windows\zv4AcOolCzlxOa.exe
C:\Windows\zv4AcOolCzlxOa.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5956 -ip 5956
1⤵
PID:1304

C:\Windows\7bele5nKqOkQ.exe
C:\Windows\7bele5nKqOkQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 2312
  2⤵
  - Program crash
  PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2488 -ip 2488
1⤵
PID:4540

C:\Windows\t1uoF2jb3Y.exe
C:\Windows\t1uoF2jb3Y.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4248 -ip 4248
1⤵
PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1820 -ip 1820
1⤵
PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7bele5nKqOkQ.exe

Path C:\Windows\7bele5nKqOkQ.exe
Size 804KB
SHA256 35a52d50b6355734bf377305c2feab7a3fbc2f432a0dabee0518bcb2ee769ca1
MD5 fc18e8e2a772b865af4289476983f985
SHA1 04e3f19bf8ca76025175714021e1423dfd4ae6a4
SHA512 3aa98f169eebefcb87d166574ee2f4648db4890631f153984473cbc1b65ca1f1d1f258b2ebb1f37e9a99f72c9ca3047ff44ecd0465d64088da766216c95ded76
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou5:0NA1Yakeer5+nso8
TLSH
T16705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7p8QU.exe

Path C:\Windows\7p8QU.exe
Size 804KB
SHA256 8bac0fd5814a2810b645e16c7e945f6e9e6a36a4278dcf99f91ec65499dfaf84
MD5 9d48d2367765e39727eabb127e2cc1b1
SHA1 414d69ffbeddc2db65277283d01d531df964178f
SHA512 465715005ef8fcd0a242f320856aaaa736d8a734651a4f47d0e6c178b5f54367ff9984dd9e61b702c616f702a54ed2a143f610009049f73b4a116787a8ef3180
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nsoz
TLSH
T18F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WRwDdG6x2.exe

Path C:\Windows\WRwDdG6x2.exe
Size 804KB
SHA256 8f6360e186ffc40b58d0c2a1161d215f9baa64a73caf8f9cda01a736b862351e
MD5 9bdaa57ad53fd5eabaae2f231085a26a
SHA1 29b41711b989dd7fda582fc23a6118f88ac78ad8
SHA512 4d70d577dd2c19af166ddbd8ee93f2bc13372515c8b3f6bf17822be3742c6eebeb147cc1757ac28ab0d397fa82b9d1abe83f60d4bd937e6807ef036c98da5d84
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nsoV
TLSH
T1B605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ew7iM.exe

Path C:\Windows\ew7iM.exe
Size 804KB
SHA256 1dd01767a141260144580196c00493989e3bbfa575cac3047326cfbaa07c8434
MD5 ce7f5ba425c1925925c07defd814fe1e
SHA1 bfe8fb85b7b01a956a384089a9d555e3819e75e1
SHA512 7d59c56c4090cdaa710827f4e23218b8aa2dd066c1329752e95911728d98084378a031d8ca4175ff30093be1352a2bdb974be9cf6d11382318a11bdbdc03b5da
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nsow
TLSH
T15B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qK3GvZr.exe

Path C:\Windows\qK3GvZr.exe
Size 804KB
SHA256 2935b7cc6d363bd3f8bbdb2b9a916bfb5e2fa9d3da1a2818ad12584d2e335dbe
MD5 618107112a2320958396c1c7489bbbb1
SHA1 a95e89fe3a470e3851a658777db65952f7b76784
SHA512 109ee6cb89faf16c88ea6d3cb346c7948871158d87b0c8941a0667a72c9a259d8d0d5ebf05c6dd0ec754ac304cd6f79ce72fa3873cf5cf2029705f4cfb6cc71a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou5:0NA1Yakeer5+nsoQ
TLSH
T10005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t1uoF2jb3Y.exe

Path C:\Windows\t1uoF2jb3Y.exe
Size 804KB
SHA256 2d369ad843fade371e05487a5269126cecee7043f189c4a799efd2cc25aa3f38
MD5 73b19a22348013a79d9967b7dd494545
SHA1 5340953154df6ad499e2ffca132461cfaa5106ad
SHA512 0414f86cba5fb00d03c21a1b78d21e63d97eceacdc61ec6a1a82b7257787f8c76c02f7a4c0d48d16744e6a6c46a72bebe80973fc4b4e9f9533699f3dff44d6a2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouE:0NA1Yakeer5+nsoJ
TLSH
T10705A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zv4AcOolCzlxOa.exe

Path C:\Windows\zv4AcOolCzlxOa.exe
Size 804KB
SHA256 2f5c86bd6b44cdfd0d468e2eeed4b6e48809f542a780d7806a6fd59ebbedb4b7
MD5 539e42c67ad523a8199d05196e562795
SHA1 85356c1dea0b8ed222021f13b6ea04144584ae57
SHA512 d4a524e7f913b0dca38b534a4d946f0e9dbda6c1fc3311e196597c4c10e8a6912af15725ef982ec741d6ce5c8d5fd53cc541bf1c73c3491b45ec8bd47a344783
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoui:0NA1Yakeer5+nsoJ
TLSH
T16D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads