a6b9e3e25a8a5a099c9bfe24eceaffe9784d72ba774114624e3858fc6f5bb958

General

Target
2026-08-07_5a0c1cf7f39f035ef0c0366d2b27f22b_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260807-ntgqcsfe76
SHA256 a6b9e3e25a8a5a099c9bfe24eceaffe9784d72ba774114624e3858fc6f5bb958
MD5 5a0c1cf7f39f035ef0c0366d2b27f22b
SHA1 271b94f6c351bfa178d1d62646d7ef8b65f1541b
SHA512 b02493f8acf35beda27a3d0653e8921c42aa48451f9c8c8d673a7818b2722575aeafae8a51e550d6f5b4d9b1048f18b1128290a11ca8a5dd89736ec2e241bba1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsoY
TLSH
T12805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (837) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 7 IoCs

pid	Process
2508	4kSoK.exe
784	iAL89VMhVJDdm4.exe
2792	35pUAeNhrTP.exe
4716	SVOaDHg0zz.exe
5172	gCMzYqWKxqlA.exe
1604	Xlnrv4CAbnz.exe
1588	1eSrcwCFzvBUhYZ.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCAGENT = "C:\\Windows\\SVOaDHg0zz.exe"	35pUAeNhrTP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ETRUSTCIPE = "C:\\Windows\\gCMzYqWKxqlA.exe"	SVOaDHg0zz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAV7 = "C:\\Windows\\Xlnrv4CAbnz.exe"	gCMzYqWKxqlA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CLEANER3 = "C:\\Windows\\1eSrcwCFzvBUhYZ.exe"	Xlnrv4CAbnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VET32 = "C:\\Windows\\4kSoK.exe"	2026-08-07_5a0c1cf7f39f035ef0c0366d2b27f22b_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ALERTSVC = "C:\\Windows\\iAL89VMhVJDdm4.exe"	4kSoK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATUPDATER = "C:\\Windows\\35pUAeNhrTP.exe"	iAL89VMhVJDdm4.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\gCMzYqWKxqlA.exe	SVOaDHg0zz.exe
File opened for modification	C:\Windows\Xlnrv4CAbnz.exe	gCMzYqWKxqlA.exe
File created	C:\Windows\1eSrcwCFzvBUhYZ.exe	Xlnrv4CAbnz.exe
File opened for modification	C:\Windows\1eSrcwCFzvBUhYZ.exe	Xlnrv4CAbnz.exe
File created	C:\Windows\4kSoK.exe	2026-08-07_5a0c1cf7f39f035ef0c0366d2b27f22b_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\4kSoK.exe	2026-08-07_5a0c1cf7f39f035ef0c0366d2b27f22b_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\iAL89VMhVJDdm4.exe	4kSoK.exe
File opened for modification	C:\Windows\iAL89VMhVJDdm4.exe	4kSoK.exe
File opened for modification	C:\Windows\SVOaDHg0zz.exe	35pUAeNhrTP.exe
File created	C:\Windows\gCMzYqWKxqlA.exe	SVOaDHg0zz.exe
File created	C:\Windows\Xlnrv4CAbnz.exe	gCMzYqWKxqlA.exe
File created	C:\Windows\35pUAeNhrTP.exe	iAL89VMhVJDdm4.exe
File opened for modification	C:\Windows\35pUAeNhrTP.exe	iAL89VMhVJDdm4.exe
File created	C:\Windows\SVOaDHg0zz.exe	35pUAeNhrTP.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3436	5172	WerFault.exe	98
3336	2508	WerFault.exe	90
4068	4624	WerFault.exe	87
4560	784	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_5a0c1cf7f39f035ef0c0366d2b27f22b_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35pUAeNhrTP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gCMzYqWKxqlA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4kSoK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iAL89VMhVJDdm4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SVOaDHg0zz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xlnrv4CAbnz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1eSrcwCFzvBUhYZ.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_5a0c1cf7f39f035ef0c0366d2b27f22b_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_5a0c1cf7f39f035ef0c0366d2b27f22b_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 2492
  2⤵
  - Program crash
  PID:4068

C:\Windows\4kSoK.exe
C:\Windows\4kSoK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 2308
  2⤵
  - Program crash
  PID:3336

C:\Windows\iAL89VMhVJDdm4.exe
C:\Windows\iAL89VMhVJDdm4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 2420
  2⤵
  - Program crash
  PID:4560

C:\Windows\35pUAeNhrTP.exe
C:\Windows\35pUAeNhrTP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2792

C:\Windows\SVOaDHg0zz.exe
C:\Windows\SVOaDHg0zz.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4716

C:\Windows\gCMzYqWKxqlA.exe
C:\Windows\gCMzYqWKxqlA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 2076
  2⤵
  - Program crash
  PID:3436

C:\Windows\Xlnrv4CAbnz.exe
C:\Windows\Xlnrv4CAbnz.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1604

C:\Windows\1eSrcwCFzvBUhYZ.exe
C:\Windows\1eSrcwCFzvBUhYZ.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5172 -ip 5172
1⤵
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2508 -ip 2508
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4624 -ip 4624
1⤵
PID:5864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 784 -ip 784
1⤵
PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1eSrcwCFzvBUhYZ.exe

Path C:\Windows\1eSrcwCFzvBUhYZ.exe
Size 804KB
SHA256 15f313f434d9af2716f8801f4a7dd2ebacf36b835eba815663d1847967431edb
MD5 e8e58293849b98ec8b944e789acd8e23
SHA1 29bc2c1cb27de57d1c9dfd0a150bfd854548ae3b
SHA512 bac32bd7c9ff51aea88e5991f715bec23952358e5a7d408874e53f65190e2aa7de3be03b41b33bc3bcb04ae03c3b10400495dd0cfa23deb4faaec62c3d5c366f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouG:0NA1Yakeer5+nsoP
TLSH
T14205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35pUAeNhrTP.exe

Path C:\Windows\35pUAeNhrTP.exe
Size 804KB
SHA256 6efe92092bc7717e77e0368ff04c6b2b570dd9d369c13b45561d6b4ede79a7b5
MD5 8dc91608ec6ef62858b637ba43843b07
SHA1 2c3b49d2741d105877cd899debd78be23caebc72
SHA512 9d07c1de53588f6232792085503f575b15a4d46433d022c98d194a8c0c579324020d48257f0c10284199cce5bce583a47ff3ba991d4ddbbc2d1dd3082fdcc629
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouh:0NA1Yakeer5+nsoI
TLSH
T15C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4kSoK.exe

Path C:\Windows\4kSoK.exe
Size 804KB
SHA256 4de7acd0a151ac29b21d9831f38f853f26264db00a10eb01492bd8585c57f39c
MD5 e9089ae4d19199a357d579e7bdcef9a3
SHA1 da61a69e9c69d8aa77b1c9fc6b67bcd57cfa021d
SHA512 e25423dd7973a35b8cc9f4d9ada81998919cbe4b18075086b66ae35c8136dc5fb05a859ff37514f11f661dbc4e5391135dec17bb0c37eea18751bac9ec16e4ca
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouZ:0NA1Yakeer5+nsoy
TLSH
T1FF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVOaDHg0zz.exe

Path C:\Windows\SVOaDHg0zz.exe
Size 804KB
SHA256 9919931dc46d301336818da8c7dcdd3f1b4a76b523cf03a01c78911b3400a692
MD5 6723ce98cf4ff7c93a25df5d9bc92514
SHA1 7f44b69e935cc817c6e57c3f9ff4599d3a98c512
SHA512 3e893f62babd2e73d59557f455c377ae1dfe28a03cda0482c54990910d5c39e974d9f56834cfe84d8d7511b26d40c7d175d2b29264bfa5da4663049893ae0cdc
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nso7
TLSH
T10C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xlnrv4CAbnz.exe

Path C:\Windows\Xlnrv4CAbnz.exe
Size 804KB
SHA256 1b4dffe229deb53bae34c0893ff87421cf0f2f2dda8fcf4b3553fb5c5f6530df
MD5 f19bfb7dbde9c6249f89b25f4c84bb88
SHA1 5adae05fa08c6dbbd1ed88a7ffbb2af5cbec84cf
SHA512 a7c7a03f794827ceef69bd866406231c0e83cf23b85b037840a7b9e3bba6abd91a90ffe068d64acc89b1aa48bc6f486c51da50e5231a0c22156fcd1a760fd333
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsoi
TLSH
T14105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gCMzYqWKxqlA.exe

Path C:\Windows\gCMzYqWKxqlA.exe
Size 804KB
SHA256 e7867d63131ac1da4ab5abeda27bb20612ffdf7bc33573f48e5e12cdfcac9a35
MD5 cc9019c563d9d491fc4e5a5dbe962cc7
SHA1 11690222b836e34693262891647d16200c4532f0
SHA512 dc8da8b140b4768deb70f116ceab4cb23e52651eb1af1288637b1546144820c5de0a9d8afed4a9c60ce9bd7fbbf78c7103d1b34127ea20de1286aaf3446bd665
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsoH
TLSH
T15E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iAL89VMhVJDdm4.exe

Path C:\Windows\iAL89VMhVJDdm4.exe
Size 804KB
SHA256 1be2a30688bd247c7632b4f51041b493ba8ce312635bc13a08c202e11d9b5bad
MD5 1e0de95c9c03d61f857581de077595a7
SHA1 b5dc78a187bacb38fb652f4292d71a7a8ee48971
SHA512 98cb1fe635b75ea92b6e524fafe59579d0d97700582aed8e8e3817e69247015d19f2a22cfcfcdc9bdc8dc9b20c58c8141ac2810b781a52e363562645336f79f1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouEq:0NA1Yakeer5+nsoc
TLSH
T14A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads