65556eec7c1e65c1f55fa8a5ae9745e2e77eaa1e6bc159633405c554975adabd

General

Target
2026-08-07_a829b95b278cabd37e7dd4bddb318f86_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260807-nfvp3afe38
SHA256 65556eec7c1e65c1f55fa8a5ae9745e2e77eaa1e6bc159633405c554975adabd
MD5 a829b95b278cabd37e7dd4bddb318f86
SHA1 c5dc598c83b17bdcfda74517b8adfbf0eb8f8e9d
SHA512 7e188c36dca10d1c0d6d8a116aead88cc4fafd2a325cd4ae93f5f848438c0c6e44adac2d5dfcd4be980989f4cd6474246ea2eb1863d7f73f9d17d3d1b9202656
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFour:0NA1Yakeer5+nsok
TLSH
T1E105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (990) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 8 IoCs

pid	Process
6116	NqQKlXtZOwiW.exe
968	wRiSDSsBTFg63.exe
3976	VCznvv.exe
4296	7pn46.exe
5824	u3co3ZAmiyb29pF.exe
3472	cQLZJx1G85.exe
3344	OdQ1asrdG.exe
6064	9SStpb.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVE32 = "C:\\Windows\\cQLZJx1G85.exe"	u3co3ZAmiyb29pF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATWATCH = "C:\\Windows\\OdQ1asrdG.exe"	cQLZJx1G85.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LDNETMON = "C:\\Windows\\9SStpb.exe"	OdQ1asrdG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NVC95 = "C:\\Windows\\NqQKlXtZOwiW.exe"	2026-08-07_a829b95b278cabd37e7dd4bddb318f86_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WEBTRAP = "C:\\Windows\\wRiSDSsBTFg63.exe"	NqQKlXtZOwiW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LDPROMEN = "C:\\Windows\\VCznvv.exe"	wRiSDSsBTFg63.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCAN95 = "C:\\Windows\\7pn46.exe"	VCznvv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOCKDOWN = "C:\\Windows\\u3co3ZAmiyb29pF.exe"	7pn46.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\7pn46.exe	VCznvv.exe
File created	C:\Windows\NqQKlXtZOwiW.exe	2026-08-07_a829b95b278cabd37e7dd4bddb318f86_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\wRiSDSsBTFg63.exe	NqQKlXtZOwiW.exe
File created	C:\Windows\u3co3ZAmiyb29pF.exe	7pn46.exe
File created	C:\Windows\cQLZJx1G85.exe	u3co3ZAmiyb29pF.exe
File created	C:\Windows\OdQ1asrdG.exe	cQLZJx1G85.exe
File created	C:\Windows\9SStpb.exe	OdQ1asrdG.exe
File opened for modification	C:\Windows\NqQKlXtZOwiW.exe	2026-08-07_a829b95b278cabd37e7dd4bddb318f86_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\VCznvv.exe	wRiSDSsBTFg63.exe
File opened for modification	C:\Windows\cQLZJx1G85.exe	u3co3ZAmiyb29pF.exe
File opened for modification	C:\Windows\OdQ1asrdG.exe	cQLZJx1G85.exe
File opened for modification	C:\Windows\wRiSDSsBTFg63.exe	NqQKlXtZOwiW.exe
File opened for modification	C:\Windows\VCznvv.exe	wRiSDSsBTFg63.exe
File created	C:\Windows\7pn46.exe	VCznvv.exe
File opened for modification	C:\Windows\u3co3ZAmiyb29pF.exe	7pn46.exe
File opened for modification	C:\Windows\9SStpb.exe	OdQ1asrdG.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3952	3472	WerFault.exe	100
1016	968	WerFault.exe	92
4944	6064	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VCznvv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	u3co3ZAmiyb29pF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cQLZJx1G85.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9SStpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_a829b95b278cabd37e7dd4bddb318f86_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NqQKlXtZOwiW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7pn46.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OdQ1asrdG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wRiSDSsBTFg63.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_a829b95b278cabd37e7dd4bddb318f86_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_a829b95b278cabd37e7dd4bddb318f86_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4676

C:\Windows\NqQKlXtZOwiW.exe
C:\Windows\NqQKlXtZOwiW.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6116

C:\Windows\wRiSDSsBTFg63.exe
C:\Windows\wRiSDSsBTFg63.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 2308
  2⤵
  - Program crash
  PID:1016

C:\Windows\VCznvv.exe
C:\Windows\VCznvv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3976

C:\Windows\7pn46.exe
C:\Windows\7pn46.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4296

C:\Windows\u3co3ZAmiyb29pF.exe
C:\Windows\u3co3ZAmiyb29pF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5824

C:\Windows\cQLZJx1G85.exe
C:\Windows\cQLZJx1G85.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 2288
  2⤵
  - Program crash
  PID:3952

C:\Windows\OdQ1asrdG.exe
C:\Windows\OdQ1asrdG.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3344

C:\Windows\9SStpb.exe
C:\Windows\9SStpb.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6064 -s 2320
  2⤵
  - Program crash
  PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3472 -ip 3472
1⤵
PID:5464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 968 -ip 968
1⤵
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6064 -ip 6064
1⤵
PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7pn46.exe

Path C:\Windows\7pn46.exe
Size 804KB
SHA256 fd04bc2d77c274f7da4baa0e8da642a2dd714a72380d6b89d6c5b618a181df7f
MD5 c9039baf022abd720f09e0eb6305dbcf
SHA1 df269195993e3e960f6ac7a9e6be2b33d00f5e8f
SHA512 388fb22993ca6f2c3312725f16d77f363d7c8a8387225a12ecca95cce7716ed8fab47c0ea2eff090d16b4eed2a55d2f1a14295775b58915d89a226d915322759
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFous:0NA1Yakeer5+nsoF
TLSH
T1F405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9SStpb.exe

Path C:\Windows\9SStpb.exe
Size 804KB
SHA256 57ec8eff9e29b870c1e95881185cebf4736cd93f203abc0079a6188f20864c36
MD5 04c2e71efecbb6d0095829e97e746765
SHA1 ce46acdbea0d79632980ada36fff181eb0286990
SHA512 9c908d2a02caf95d295c4ee20b254e0f8552564bf722087f1e479a789ded25ac1355abef01918872341b635514a34dd19949d901f31c9fb67951198f196dd595
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou3:0NA1Yakeer5+nsoe
TLSH
T18905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NqQKlXtZOwiW.exe

Path C:\Windows\NqQKlXtZOwiW.exe
Size 804KB
SHA256 aa7eabb04f5672488b2e2daa28f68332676b94c76f9fe66199e34591eed4bd94
MD5 c0a9141bd19b20201767db4507b0e96f
SHA1 606eb56bb02faf6f20f4db4baa0d085130c7b815
SHA512 44b2a8fddb23693df1d8dc53157580038dcc543bd6f7f35bee27272fd791364eb9d642e6e8cb07d879c5b65bcdc18d7a69437ec201560fba1a1f1089605de4ae
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoue:0NA1Yakeer5+nsoB
TLSH
T17205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OdQ1asrdG.exe

Path C:\Windows\OdQ1asrdG.exe
Size 804KB
SHA256 a7471df969ce4625310a7b0da51eb8aa9debda3c54cb12298257e36ef8e22632
MD5 86e9f26bf450fdf5ea0b806fae26707f
SHA1 fcede6b0f83e3583f02ee92fe040838db2678a8c
SHA512 66ed5f51495017b62c98e4701cb0153a96e4a5c70b52bd77ad95785461ade5eb1ea3adec4371640f642cee10c020a86a3e649f7c1c785782c7ef08ba06bed462
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoug:0NA1Yakeer5+nsoN
TLSH
T1CB05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCznvv.exe

Path C:\Windows\VCznvv.exe
Size 804KB
SHA256 62028ef0bcde33982564c6f2a122e92cd56418fe3c2b0dde8df534a748d3e66b
MD5 84db879494ce8040f1e82efc6380f88c
SHA1 016fdacafe7a25822ebf49d211110bbd214c0d48
SHA512 1cad6db9fa4b4b9c8cf28a9b63e803e67ffb5d761a771016070b7b51798e42b7d258c006851462c3071dcbb1abf4a418acba1a70a80ef58c185c1bac48307814
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouJ:0NA1Yakeer5+nsoa
TLSH
T12005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cQLZJx1G85.exe

Path C:\Windows\cQLZJx1G85.exe
Size 804KB
SHA256 1bf591e5b832d8c3d7522606f6ef18df828eeef2ac9220520c5f293145793e55
MD5 847fc412443552d3ad303e0f6e6dd919
SHA1 5dd73558ab4e0cfc12bfc81d6aa51a2345e3efc4
SHA512 f49c97211bd43e4db7688952ed0ebb75330f5e3890062be03ea61e329e98c7941442c7ec102af14bb720cc34813f6e1013b9bd644f282de90ac41415f6f25af3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nso6
TLSH
T13C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

u3co3ZAmiyb29pF.exe

Path C:\Windows\u3co3ZAmiyb29pF.exe
Size 804KB
SHA256 cae807dce66b227f0ffac8d3d3d40556dad9dc3f0eb9ef1b88047d03ae73655c
MD5 e50f5186be4bb8e27982bc93bea0340f
SHA1 5bace7e9357fc23113c132c8254a0d9d465070cd
SHA512 6af3fe28cb8e1874cf340dfc1a3884674297753799f59527fb4c5397a11d5c1cc2b4529219ec43de75860a59178d9a021d0341284b11f8fe43b1613bd7abb5e3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou1:0NA1Yakeer5+nsoo
TLSH
T15805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wRiSDSsBTFg63.exe

Path C:\Windows\wRiSDSsBTFg63.exe
Size 804KB
SHA256 27de90f33dfc41da54f270c6fd6e4b5793f8de7bd3478d5ec6b84e06cb13573f
MD5 749df9fd23a4e0b63e318e44fdea3712
SHA1 c33e112327323cf8a60e9acdc09fbe37e175c50c
SHA512 636abc7d9acf5e64a279f1c23f08d0e05b562c9ff10ba1d9c74a66e46caf65b8bf9ccb99156f1e3c98737855a0d7c29840a2b8700d80b93ff5affaeb1011aea9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouE:0NA1Yakeer5+nso7
TLSH
T13205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads