6dad71f74b74a208f9d4e70a7af1a6cd7473fb5b9e20012da410955e1edf135c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_4ba43c96526c3e4498b7d867f604c235_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260810-2jfbfavydv
SHA256 6dad71f74b74a208f9d4e70a7af1a6cd7473fb5b9e20012da410955e1edf135c
MD5 4ba43c96526c3e4498b7d867f604c235
SHA1 2e1304ab3fda22affc880723e29f1fed48c9d11a
SHA512 135aa7843bcdd370ab361abb1f9810c9d48303a625bb755fe05af32830295106e3cd9aa96f9f09309861b426b3659d01b8e967c1138ae8dc56ec38f9bde8c115
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou5:0NA1Yakeer5+nso+
TLSH
T15805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (1109) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 10 IoCs

pid	Process
1196	QsCIWj6wUeJ.exe
4160	QTEXse.exe
5092	9pWBeSsqDGnhaE4.exe
2428	M5uYw.exe
4436	42u1czqXFH9LSrc.exe
4340	ZAszM.exe
728	QpaJgD.exe
5296	X0gkY3oI.exe
5640	j5B2Y.exe
5896	jzxsV.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EVPN = "C:\\Windows\\QTEXse.exe"	QsCIWj6wUeJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ANTS = "C:\\Windows\\9pWBeSsqDGnhaE4.exe"	QTEXse.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSECOMR = "C:\\Windows\\M5uYw.exe"	9pWBeSsqDGnhaE4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUSPT = "C:\\Windows\\ZAszM.exe"	42u1czqXFH9LSrc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSGK32 = "C:\\Windows\\X0gkY3oI.exe"	QpaJgD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VET95 = "C:\\Windows\\j5B2Y.exe"	X0gkY3oI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SPHINX = "C:\\Windows\\jzxsV.exe"	j5B2Y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFINET32 = "C:\\Windows\\42u1czqXFH9LSrc.exe"	M5uYw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGHTML = "C:\\Windows\\QpaJgD.exe"	ZAszM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NMAIN = "C:\\Windows\\QsCIWj6wUeJ.exe"	2026-08-10_4ba43c96526c3e4498b7d867f604c235_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\jzxsV.exe	j5B2Y.exe
File opened for modification	C:\Windows\QsCIWj6wUeJ.exe	2026-08-10_4ba43c96526c3e4498b7d867f604c235_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\QTEXse.exe	QsCIWj6wUeJ.exe
File created	C:\Windows\9pWBeSsqDGnhaE4.exe	QTEXse.exe
File created	C:\Windows\X0gkY3oI.exe	QpaJgD.exe
File created	C:\Windows\j5B2Y.exe	X0gkY3oI.exe
File opened for modification	C:\Windows\j5B2Y.exe	X0gkY3oI.exe
File created	C:\Windows\QsCIWj6wUeJ.exe	2026-08-10_4ba43c96526c3e4498b7d867f604c235_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\QTEXse.exe	QsCIWj6wUeJ.exe
File opened for modification	C:\Windows\42u1czqXFH9LSrc.exe	M5uYw.exe
File created	C:\Windows\ZAszM.exe	42u1czqXFH9LSrc.exe
File created	C:\Windows\QpaJgD.exe	ZAszM.exe
File opened for modification	C:\Windows\QpaJgD.exe	ZAszM.exe
File opened for modification	C:\Windows\X0gkY3oI.exe	QpaJgD.exe
File created	C:\Windows\jzxsV.exe	j5B2Y.exe
File opened for modification	C:\Windows\9pWBeSsqDGnhaE4.exe	QTEXse.exe
File created	C:\Windows\M5uYw.exe	9pWBeSsqDGnhaE4.exe
File opened for modification	C:\Windows\M5uYw.exe	9pWBeSsqDGnhaE4.exe
File created	C:\Windows\42u1czqXFH9LSrc.exe	M5uYw.exe
File opened for modification	C:\Windows\ZAszM.exe	42u1czqXFH9LSrc.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5544	4340	WerFault.exe	102
4144	728	WerFault.exe	104
4788	5896	WerFault.exe	113

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZAszM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QpaJgD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QsCIWj6wUeJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QTEXse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9pWBeSsqDGnhaE4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	M5uYw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	X0gkY3oI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j5B2Y.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jzxsV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_4ba43c96526c3e4498b7d867f604c235_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42u1czqXFH9LSrc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_4ba43c96526c3e4498b7d867f604c235_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_4ba43c96526c3e4498b7d867f604c235_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:436

C:\Windows\QsCIWj6wUeJ.exe
C:\Windows\QsCIWj6wUeJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1196

C:\Windows\QTEXse.exe
C:\Windows\QTEXse.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4160

C:\Windows\9pWBeSsqDGnhaE4.exe
C:\Windows\9pWBeSsqDGnhaE4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5092

C:\Windows\M5uYw.exe
C:\Windows\M5uYw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2428

C:\Windows\42u1czqXFH9LSrc.exe
C:\Windows\42u1czqXFH9LSrc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4436

C:\Windows\ZAszM.exe
C:\Windows\ZAszM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 1968
  2⤵
  - Program crash
  PID:5544

C:\Windows\QpaJgD.exe
C:\Windows\QpaJgD.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 2112
  2⤵
  - Program crash
  PID:4144

C:\Windows\X0gkY3oI.exe
C:\Windows\X0gkY3oI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4340 -ip 4340
1⤵
PID:5520

C:\Windows\j5B2Y.exe
C:\Windows\j5B2Y.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5640

C:\Windows\jzxsV.exe
C:\Windows\jzxsV.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 1968
  2⤵
  - Program crash
  PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 728 -ip 728
1⤵
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5896 -ip 5896
1⤵
PID:3068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

42u1czqXFH9LSrc.exe

Path C:\Windows\42u1czqXFH9LSrc.exe
Size 804KB
SHA256 fbb63523878d07b2a1b40bc98685ab3c760c61d9b2b025a0952280348977ff1b
MD5 60d09f5adb5fc544a79c88528d6249a7
SHA1 ad6f61c47d0302cfb9d555859e9724054103ff9f
SHA512 9c74290cef3f68b24254aee860b69fb7a67e9ad0757d816d5953c7d10db3270e30e65fea25a1b60902e7823db83ff81dae73b273659e37ba7e390ea7e25f8708
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouf:0NA1Yakeer5+nsoi
TLSH
T18905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9pWBeSsqDGnhaE4.exe

Path C:\Windows\9pWBeSsqDGnhaE4.exe
Size 804KB
SHA256 9b95aab00cf8bbf0002c14d8837a22e7177246f833fc64437667dcaa5ac8a3e6
MD5 5ce10c43efa21a91728119015f7fefc4
SHA1 e0bdd7b140180ace1406cba510473badcff18bfa
SHA512 7f21f0a44db3f302fc411afb500279a81024fec0b725727c8479302833a9065a4306e6ba188b595f384397931a87a5d6da00f5a5979551c2272e24fa7e3aeff9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouk:0NA1Yakeer5+nsoL
TLSH
T18F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

M5uYw.exe

Path C:\Windows\M5uYw.exe
Size 804KB
SHA256 7d0290aa58dfa79a6abba2b47c01f73843179df6feeafdfbedd0ee0b2260066d
MD5 02c0d5a750829cdc3d581bf122cdb3ce
SHA1 673493f91a223ca0d18efc24770e1065b0fe7131
SHA512 74d38b4745ab01af8cbff2d7c1139872bb2dadc4ef60871d16e66ebd3638fa82c4ea940bd3fb3b098a77d8d0bb61dd58582894d1b5dd9f7a298d58f7fe3faa85
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouc:0NA1Yakeer5+nsop
TLSH
T19205A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QTEXse.exe

Path C:\Windows\QTEXse.exe
Size 804KB
SHA256 27431d9acdc528d76ac315f24d6930dccf4a593375df673ec387529c7c416085
MD5 dfe44908606e04b0b901f724cb4f4f94
SHA1 09559d18deb51a515b6eed53dbfbbee9aea06938
SHA512 b44d82a499a3c5968a8ddeb41a627063dc9c4d84375135bc1ef8539a8d4bbad0dfe8679de0b7ad800cae436562ddf654af8662cb6bfdad343cc9d03dbf994a19
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoux:0NA1Yakeer5+nsoK
TLSH
T14D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QpaJgD.exe

Path C:\Windows\QpaJgD.exe
Size 804KB
SHA256 a601f240eff058b433f64e5927ce2e7d9d2e4e25ecbf3dc21d42b01beef407d6
MD5 83466ab904a9329e7680f23e25f184b7
SHA1 41b15ea353eae57e0965838672619017d99e6c32
SHA512 0e0d0e1a0447fb0885d8229a95f5299d5801320901fac45dbe4f11f2558b546406f790965439109691b13c0d2d2cfd5b99e8c1250cdf590376f8839e7d91f3bf
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouh:0NA1Yakeer5+nsoM
TLSH
T10B05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QsCIWj6wUeJ.exe

Path C:\Windows\QsCIWj6wUeJ.exe
Size 804KB
SHA256 4c8cc5bbfe77ca2aae7eb24d894b701940209dcf8f96a8d45954ecb8a3e7a08b
MD5 f55f7645a37a356e490db552919130dd
SHA1 e45495862c51dcdbb3129bf0eacc9b70ae1cd2dc
SHA512 9da3daaca6479dc3bf4997f0e00f0c2e1bb149ed1bc45d4214a9ab4d12d9625363fa173ac0463833c60bdd9fb8023f39c4b0c4dc1074ec9412405120c191abd7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou1G:0NA1Yakeer5+nsoR
TLSH
T18205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

X0gkY3oI.exe

Path C:\Windows\X0gkY3oI.exe
Size 804KB
SHA256 f1f25e9d359445fad088a46796ac3e66411a9babf0cacae15afbe6bc27d72cbc
MD5 188151b807680a2dd04fe6745fc79891
SHA1 d8cef207ff50916b74f9efc0b6337812a579bba9
SHA512 26114b99dace1d093aea8b2f8bbb72dc113036c87ce4daaa9ea92696d830a01460c648e49dae04aa0fd89eaa472190336188b17194a2f8ad35c945c100f6d981
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsoe
TLSH
T1AE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZAszM.exe

Path C:\Windows\ZAszM.exe
Size 804KB
SHA256 151ca8eea11a74a7a64dba15c5d910c50aacff477e098b6bb053c19c466f8a12
MD5 e898adcc3229dc7eb1614830ca1d231e
SHA1 2577e9bbc68564fdd4899bd8220d7b0ac574d651
SHA512 6010654a295d2d50e85b73d38d789f011f79869a8800e00d99e5f2314afc216af140436d430495951ecdb672427c2014edaf55302c5f39e36b1120c684d07f4a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouK:0NA1Yakeer5+nso3
TLSH
T15B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

j5B2Y.exe

Path C:\Windows\j5B2Y.exe
Size 804KB
SHA256 8ac98d46bafa20786884446ef96b0ad4ac4431c984906602b06e4560115c45ed
MD5 1f9acda9ca5e8118298d0e080053e038
SHA1 82994a9bdd47dbc1c59a4355994def3f02d29fc3
SHA512 2a9aebe63ac832a146811252b101a74170cb375840f6811151c175ba0941a11b8826c88713299071d561343bbf8af43948a7ec8b00fa7bf5caeba8549fd86303
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nso7
TLSH
T15305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jzxsV.exe

Path C:\Windows\jzxsV.exe
Size 804KB
SHA256 7fbe2f6d74d7ebc4169f58d03458e8711acba86fa703267281b95bbfa983d6c5
MD5 141e0561210f5cd2c744bcecf963fb72
SHA1 1024951ffad29fb294cb595cba2e9716f61a36f4
SHA512 a161849feaaa924d6fc778e5efe625cf93a3b7ad12111459f16026008428b07ffc467e338980a04ac43600bdfa8006277a5270c669dcca504fa4afe490050433
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsoK
TLSH
T1B405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads