0ec88b22711fd968865597dee55b60f8060f952487a5895f23c4b3de784f41bb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 08:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_83ef1d8e0eb6bcc47356fa323ab80c0f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260812-kj8vbaseqf
SHA256 0ec88b22711fd968865597dee55b60f8060f952487a5895f23c4b3de784f41bb
MD5 83ef1d8e0eb6bcc47356fa323ab80c0f
SHA1 575c0c619b12f58af7f12eb19d6a693a0067d49c
SHA512 66e3870b3b879f6f7070ae7175941709913d57e48cae2b0f82f31f4b12174fafea0834b5084c8bbf05f385c1e1e80756c8adf6c172ebf4fc293bf1ae39353da0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouc:0NA1Yakeer5+nso/
TLSH
T1F705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2347) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 21 IoCs

pid	Process
4684	bb36UdoHSy0vgF.exe
2356	dxNkHvwv.exe
2148	grIvjUchI.exe
1688	C2axOp8Pte2.exe
756	7wP0IivlUXR.exe
4904	hEeMOJvYa8YoKs2.exe
3124	KuOSlgTMl0LTrNu.exe
2604	7O0M9aVvgzYij.exe
5352	ikpQBtYwsl.exe
5592	wsAqb3UQMD.exe
5836	mtEL2qSqDwLk.exe
6080	ieFqIu.exe
6156	a2t4Vv.exe
6404	jBOcQPJb.exe
6640	kXEsHi5.exe
6888	mpDtZ.exe
7124	EuAtsmUHk.exe
716	PZ6MhVHygoz1.exe
7328	tPIyedqk2z.exe
7580	SwdbwGb.exe
7824	W3KuAB.exe

Adds Run key to start application 2 TTPs 21 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVGSERV = "C:\\Windows\\mpDtZ.exe"	kXEsHi5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NTVDM = "C:\\Windows\\EuAtsmUHk.exe"	mpDtZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCAN95 = "C:\\Windows\\W3KuAB.exe"	SwdbwGb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GUARD = "C:\\Windows\\7wP0IivlUXR.exe"	C2axOp8Pte2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSSTAT = "C:\\Windows\\hEeMOJvYa8YoKs2.exe"	7wP0IivlUXR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCEVTMGR = "C:\\Windows\\ikpQBtYwsl.exe"	7O0M9aVvgzYij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUALL = "C:\\Windows\\wsAqb3UQMD.exe"	ikpQBtYwsl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKSERV = "C:\\Windows\\tPIyedqk2z.exe"	PZ6MhVHygoz1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AGENTW = "C:\\Windows\\bb36UdoHSy0vgF.exe"	2026-08-12_83ef1d8e0eb6bcc47356fa323ab80c0f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VET95 = "C:\\Windows\\KuOSlgTMl0LTrNu.exe"	hEeMOJvYa8YoKs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FCH32 = "C:\\Windows\\7O0M9aVvgzYij.exe"	KuOSlgTMl0LTrNu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSMAIN = "C:\\Windows\\a2t4Vv.exe"	ieFqIu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCAFEE = "C:\\Windows\\dxNkHvwv.exe"	bb36UdoHSy0vgF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NWSERVICE = "C:\\Windows\\C2axOp8Pte2.exe"	grIvjUchI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUALL = "C:\\Windows\\PZ6MhVHygoz1.exe"	EuAtsmUHk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICSUPPNT = "C:\\Windows\\SwdbwGb.exe"	tPIyedqk2z.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EFPEADM = "C:\\Windows\\grIvjUchI.exe"	dxNkHvwv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NUI = "C:\\Windows\\mtEL2qSqDwLk.exe"	wsAqb3UQMD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICLOADNT = "C:\\Windows\\ieFqIu.exe"	mtEL2qSqDwLk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPUPD = "C:\\Windows\\jBOcQPJb.exe"	a2t4Vv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GENERICS = "C:\\Windows\\kXEsHi5.exe"	jBOcQPJb.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 42 IoCs

description	ioc	Process
File created	C:\Windows\PZ6MhVHygoz1.exe	EuAtsmUHk.exe
File created	C:\Windows\W3KuAB.exe	SwdbwGb.exe
File created	C:\Windows\C2axOp8Pte2.exe	grIvjUchI.exe
File created	C:\Windows\7wP0IivlUXR.exe	C2axOp8Pte2.exe
File created	C:\Windows\hEeMOJvYa8YoKs2.exe	7wP0IivlUXR.exe
File opened for modification	C:\Windows\ieFqIu.exe	mtEL2qSqDwLk.exe
File opened for modification	C:\Windows\SwdbwGb.exe	tPIyedqk2z.exe
File opened for modification	C:\Windows\dxNkHvwv.exe	bb36UdoHSy0vgF.exe
File opened for modification	C:\Windows\C2axOp8Pte2.exe	grIvjUchI.exe
File opened for modification	C:\Windows\mtEL2qSqDwLk.exe	wsAqb3UQMD.exe
File created	C:\Windows\ieFqIu.exe	mtEL2qSqDwLk.exe
File created	C:\Windows\7O0M9aVvgzYij.exe	KuOSlgTMl0LTrNu.exe
File opened for modification	C:\Windows\7O0M9aVvgzYij.exe	KuOSlgTMl0LTrNu.exe
File created	C:\Windows\mtEL2qSqDwLk.exe	wsAqb3UQMD.exe
File opened for modification	C:\Windows\a2t4Vv.exe	ieFqIu.exe
File created	C:\Windows\jBOcQPJb.exe	a2t4Vv.exe
File created	C:\Windows\bb36UdoHSy0vgF.exe	2026-08-12_83ef1d8e0eb6bcc47356fa323ab80c0f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\grIvjUchI.exe	dxNkHvwv.exe
File created	C:\Windows\KuOSlgTMl0LTrNu.exe	hEeMOJvYa8YoKs2.exe
File opened for modification	C:\Windows\PZ6MhVHygoz1.exe	EuAtsmUHk.exe
File opened for modification	C:\Windows\tPIyedqk2z.exe	PZ6MhVHygoz1.exe
File opened for modification	C:\Windows\W3KuAB.exe	SwdbwGb.exe
File opened for modification	C:\Windows\wsAqb3UQMD.exe	ikpQBtYwsl.exe
File created	C:\Windows\a2t4Vv.exe	ieFqIu.exe
File opened for modification	C:\Windows\jBOcQPJb.exe	a2t4Vv.exe
File opened for modification	C:\Windows\EuAtsmUHk.exe	mpDtZ.exe
File created	C:\Windows\tPIyedqk2z.exe	PZ6MhVHygoz1.exe
File opened for modification	C:\Windows\bb36UdoHSy0vgF.exe	2026-08-12_83ef1d8e0eb6bcc47356fa323ab80c0f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\dxNkHvwv.exe	bb36UdoHSy0vgF.exe
File created	C:\Windows\grIvjUchI.exe	dxNkHvwv.exe
File created	C:\Windows\ikpQBtYwsl.exe	7O0M9aVvgzYij.exe
File opened for modification	C:\Windows\ikpQBtYwsl.exe	7O0M9aVvgzYij.exe
File created	C:\Windows\wsAqb3UQMD.exe	ikpQBtYwsl.exe
File opened for modification	C:\Windows\kXEsHi5.exe	jBOcQPJb.exe
File created	C:\Windows\EuAtsmUHk.exe	mpDtZ.exe
File opened for modification	C:\Windows\7wP0IivlUXR.exe	C2axOp8Pte2.exe
File opened for modification	C:\Windows\hEeMOJvYa8YoKs2.exe	7wP0IivlUXR.exe
File opened for modification	C:\Windows\KuOSlgTMl0LTrNu.exe	hEeMOJvYa8YoKs2.exe
File opened for modification	C:\Windows\mpDtZ.exe	kXEsHi5.exe
File created	C:\Windows\SwdbwGb.exe	tPIyedqk2z.exe
File created	C:\Windows\kXEsHi5.exe	jBOcQPJb.exe
File created	C:\Windows\mpDtZ.exe	kXEsHi5.exe

Program crash 12 IoCs

pid	pid_target	Process	procid_target
8080	7824	WerFault.exe	129
6636	6156	WerFault.exe	113
7324	2356	WerFault.exe	91
4740	756	WerFault.exe	97
5332	4904	WerFault.exe	99
5860	2604	WerFault.exe	103
6296	4964	WerFault.exe	87
6092	2148	WerFault.exe	93
7836	3124	WerFault.exe	101
7324	5836	WerFault.exe	109
3632	6404	WerFault.exe	115
2352	6640	WerFault.exe	117

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jBOcQPJb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EuAtsmUHk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb36UdoHSy0vgF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxNkHvwv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7wP0IivlUXR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KuOSlgTMl0LTrNu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ikpQBtYwsl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mtEL2qSqDwLk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2t4Vv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tPIyedqk2z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grIvjUchI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C2axOp8Pte2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hEeMOJvYa8YoKs2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7O0M9aVvgzYij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kXEsHi5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mpDtZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	W3KuAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_83ef1d8e0eb6bcc47356fa323ab80c0f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wsAqb3UQMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ieFqIu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PZ6MhVHygoz1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SwdbwGb.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-12_83ef1d8e0eb6bcc47356fa323ab80c0f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_83ef1d8e0eb6bcc47356fa323ab80c0f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 2476
  2⤵
  - Program crash
  PID:6296

C:\Windows\bb36UdoHSy0vgF.exe
C:\Windows\bb36UdoHSy0vgF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4684

C:\Windows\dxNkHvwv.exe
C:\Windows\dxNkHvwv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 2228
  2⤵
  - Program crash
  PID:7324

C:\Windows\grIvjUchI.exe
C:\Windows\grIvjUchI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 2312
  2⤵
  - Program crash
  PID:6092

C:\Windows\C2axOp8Pte2.exe
C:\Windows\C2axOp8Pte2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1688

C:\Windows\7wP0IivlUXR.exe
C:\Windows\7wP0IivlUXR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 2200
  2⤵
  - Program crash
  PID:4740

C:\Windows\hEeMOJvYa8YoKs2.exe
C:\Windows\hEeMOJvYa8YoKs2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 2228
  2⤵
  - Program crash
  PID:5332

C:\Windows\KuOSlgTMl0LTrNu.exe
C:\Windows\KuOSlgTMl0LTrNu.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 2336
  2⤵
  - Program crash
  PID:7836

C:\Windows\7O0M9aVvgzYij.exe
C:\Windows\7O0M9aVvgzYij.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 2220
  2⤵
  - Program crash
  PID:5860

C:\Windows\ikpQBtYwsl.exe
C:\Windows\ikpQBtYwsl.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5352

C:\Windows\wsAqb3UQMD.exe
C:\Windows\wsAqb3UQMD.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5592

C:\Windows\mtEL2qSqDwLk.exe
C:\Windows\mtEL2qSqDwLk.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5836 -s 2332
  2⤵
  - Program crash
  PID:7324

C:\Windows\ieFqIu.exe
C:\Windows\ieFqIu.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6080

C:\Windows\a2t4Vv.exe
C:\Windows\a2t4Vv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6156 -s 2100
  2⤵
  - Program crash
  PID:6636

C:\Windows\jBOcQPJb.exe
C:\Windows\jBOcQPJb.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6404 -s 2312
  2⤵
  - Program crash
  PID:3632

C:\Windows\kXEsHi5.exe
C:\Windows\kXEsHi5.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 2324
  2⤵
  - Program crash
  PID:2352

C:\Windows\mpDtZ.exe
C:\Windows\mpDtZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6888

C:\Windows\EuAtsmUHk.exe
C:\Windows\EuAtsmUHk.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7124

C:\Windows\PZ6MhVHygoz1.exe
C:\Windows\PZ6MhVHygoz1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:716

C:\Windows\tPIyedqk2z.exe
C:\Windows\tPIyedqk2z.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7328

C:\Windows\SwdbwGb.exe
C:\Windows\SwdbwGb.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7580

C:\Windows\W3KuAB.exe
C:\Windows\W3KuAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7824 -s 1840
  2⤵
  - Program crash
  PID:8080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7824 -ip 7824
1⤵
PID:8056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6156 -ip 6156
1⤵
PID:6396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2356 -ip 2356
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 756 -ip 756
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4904 -ip 4904
1⤵
PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2604 -ip 2604
1⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4964 -ip 4964
1⤵
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2148 -ip 2148
1⤵
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3124 -ip 3124
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5836 -ip 5836
1⤵
PID:8160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6404 -ip 6404
1⤵
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6640 -ip 6640
1⤵
PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7O0M9aVvgzYij.exe

Path C:\Windows\7O0M9aVvgzYij.exe
Size 804KB
SHA256 53b5248be5701e22e87cca3351e7cbba269b63d26c14234554ccb009f9d268b8
MD5 07568739508d5a0c52ca62de778bed1d
SHA1 a998bc01c5622053bcc04650ebb0061c43aa0524
SHA512 2634f598924ca03d72c0cf4fa9559fab7f085fda916217b647d6f654c5104fb6af3b18ae5f34626d2a1a6a6a8af125dcf3f9789b3b400825a6117717abb475e5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nso8
TLSH
T12505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7wP0IivlUXR.exe

Path C:\Windows\7wP0IivlUXR.exe
Size 804KB
SHA256 c245fea0cffbba87db24b3bc3ce00bb17a71c4b741e708c884eff618d2ef6ce1
MD5 103b36987b04c24d8583d752930b5631
SHA1 5111eb27bf4806d10b8f592029e26841a8a7596f
SHA512 7908f239b6b520de4690d53e3458b367e9d8fdb97573d9600f881453343d63648854f32c29c815a004707a99290d5d30526172350a07a9fd9c2d4188bb3ea125
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouC:0NA1Yakeer5+nsov
TLSH
T15B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C2axOp8Pte2.exe

Path C:\Windows\C2axOp8Pte2.exe
Size 804KB
SHA256 949f99f58f9a74c91b012171c65e0bf27125a442922513a10ac9435819f0acef
MD5 57167eec5632c7ef33d63f673cd2f74d
SHA1 561790ba8f780849e401be0d3c50fd1bcc3e6b3a
SHA512 cd4ec993c8bfb54e3c81ca1249ba4e5197bda5354df4b3734d39c0a8dfff86bfe3f96778532d447a8749262b917a5978d90a6f27a9cea8645dd446e79df41c45
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou3:0NA1Yakeer5+nsoE
TLSH
T18805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EuAtsmUHk.exe

Path C:\Windows\EuAtsmUHk.exe
Size 804KB
SHA256 87e30e8235edb40c2d7206ffd49a322700e9e569200d8a87490be4baf7e3fc2e
MD5 f074047d336d3b28824e08ee97ad6082
SHA1 0c18d103113dc01cfa4f70886004b5c9c000a310
SHA512 daf579493d7f7aa241cf4976ffe8d928e1d5ccd6e455f5bc28dfc3652926899cf15aabc77cc8deeb2f018b9b383f9f0b2371ecbebef979371a7ae0074304c64d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouc:0NA1Yakeer5+nsor
TLSH
T14F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KuOSlgTMl0LTrNu.exe

Path C:\Windows\KuOSlgTMl0LTrNu.exe
Size 804KB
SHA256 c84d86e74a8236e200dc14656e8015c527d8e917c8c6d0e3a5a87fd6f1d7c228
MD5 6d997e5f637f42adbdb000f835df9918
SHA1 a3594dfe948b385223f9e661a857350232e68e08
SHA512 59595c594e20a27f426055d6caff06bbaee5fdb56e94bdc7b35fce2e5063563dca2b6cd40c35965a199c6e8c36d1816de90fd89f0a18dbe6b1b3870387ad9ba5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoA
TLSH
T15C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PZ6MhVHygoz1.exe

Path C:\Windows\PZ6MhVHygoz1.exe
Size 804KB
SHA256 64b85b41e51fe331bef378f06f0b7cb8757b395088c0abf2c5de3b4545ab48b5
MD5 89162eee2d2e72fc685811089ace72d0
SHA1 9022c4ccc1fa8a6872ea8bcdc99244f29a5c3336
SHA512 bb2313f4eeca20392d1e2959a2eb9a057ef678f63abb07224bd6746ee2a1d226fd78589601f3825023240d453d864d32c4ac9f85ea8d4704b48a49afb6b95448
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nsoZ
TLSH
T1DF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwdbwGb.exe

Path C:\Windows\SwdbwGb.exe
Size 804KB
SHA256 cb37fd9d803dbfad60afe2ff962086eb5eecf4f8df71329291052d083b76e1e1
MD5 b60478f21945f9970138afe3d4d13de3
SHA1 3d7f3cc8954771484f2794981091453e4d5ea052
SHA512 97ae83c731d04ad092902b90b08c59bacbc15b78b66a8c75435b4bbf521be8b6158881bb53c3f776bcbaebd670fc871b4fde35ad67aaaee79acc83bb01a38de8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nsoE
TLSH
T18405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W3KuAB.exe

Path C:\Windows\W3KuAB.exe
Size 804KB
SHA256 a0b5871bce3b7bf3a73fcbee8d324a8019a570e78ba614cfd7f578c52e5d5c44
MD5 82c69de1500ba7956ddac163e43d39ba
SHA1 dafdc48931ae07e656fcce211b608c615ed44ff3
SHA512 0da01e000c9820b3b01449f0b0843b32bdab3572559ee2331d78d15be135d8af5d0a534a26cd6f516ff3734242f5227214012b6d779a8c4678157db3d00a6181
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nsoq
TLSH
T14F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2t4Vv.exe

Path C:\Windows\a2t4Vv.exe
Size 804KB
SHA256 94443539bcf36c8322c3faabb5f8df2b0bc8035acb4c8103b48aa0d978699aff
MD5 cf7682304e18ce71c35c483d9f88aee1
SHA1 0c567eec8f915cfec3a95ee2a6392f5c6416b5a3
SHA512 53729e1fe5a69201c2ac20ea0b3480381738af99a41f5d2b100744a39aa35017655e3fa5695b65120fd096fdf8b93302762ad427b86a2ed48cb22ffc68642ad7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nso5
TLSH
T11505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb36UdoHSy0vgF.exe

Path C:\Windows\bb36UdoHSy0vgF.exe
Size 804KB
SHA256 1a0ae2eb2b208609bc21087ea63ef12db2c8976b156ba3ff728b151f84d4d2c6
MD5 6ff8e1058d6b98dd0cc661a8598f09be
SHA1 03ed02ca2bb7e95b560601b49852a0baa909fd9a
SHA512 be0680eb11d265a4958a9b3be9039bd70d9de91b06b89c306235a7d488a9aba94553b8a87537c4ac65ec18bba733e858cdde354f1a012f6bd75dea7e5b5eef31
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsoe
TLSH
T16005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxNkHvwv.exe

Path C:\Windows\dxNkHvwv.exe
Size 804KB
SHA256 c087fb7e515920ec89f39ec2bd7c50c9c2bb160fb3f795f42f87a6c6235ae5cd
MD5 9a0a20cb68f44bc52ea6e9c71e8fcf78
SHA1 205225f2080bb67694dd32a1ebc02deab3c0dde5
SHA512 e72c9c838b1a7092b5bf7188aac7716211793ccf2ad8f5ed719026dd2f48d332158241c81a3a262e5569215fe114ae44d2a979d7bcb6f9c0c297de6450f3f9db
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsoe
TLSH
T16F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

grIvjUchI.exe

Path C:\Windows\grIvjUchI.exe
Size 804KB
SHA256 e769912bedb1a767369f442d8382a15fcbe61659e3526e541ab1fde40d94eb3a
MD5 e9d8b75be1eca2b7ce64a02baa06a3a9
SHA1 92f48f84ffbda9c00dca10c123c9608faa96d662
SHA512 c9abe590d58db5acb313fd99bfa929004c6b89cc7c033fa7e1b12a55dcaca19d18634aa4a51346b610934773f8970fe3a88496a0bf11e5ecb8f3c86004c71b4e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou3:0NA1Yakeer5+nsoG
TLSH
T12A05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hEeMOJvYa8YoKs2.exe

Path C:\Windows\hEeMOJvYa8YoKs2.exe
Size 804KB
SHA256 463c56989b59ae6ec1e18db569b9218a32fdeb51763dd8690ef9cc9188b3b5f9
MD5 a5021e89978b7e1388fca81958e3abc1
SHA1 54ee5c23b6d6689d8ffc0c9acc35929f061499cf
SHA512 b17c040c6ca94f21760f0bcf389f078e60827aac73d4200547e3f580179b5812cc85dd77c5eed609b16d85ea41fae6aa42ff5e14b5660a174d24f879b2ebd27d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nso2
TLSH
T17B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ieFqIu.exe

Path C:\Windows\ieFqIu.exe
Size 804KB
SHA256 5a7db358ef009288f07a0251cc84d929ca9ea8885cccbb0a6242dead3ba7c774
MD5 bf2648c15fb2dd2bf2023aa22ba7fbe5
SHA1 cadb59ffbb344637907b4364eba6feaab38d959c
SHA512 da3bfa32a44753cf53544996d098514c9848aa18cae5f50f64bc9819b2082785524fd3ed0b5ff30fb6d9fb9729cfeb593c08de3877fdcfdad8b28bbe0b783dd4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nsoP
TLSH
T16405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ikpQBtYwsl.exe

Path C:\Windows\ikpQBtYwsl.exe
Size 804KB
SHA256 83cd7c37906e9638ad7ff49c2ed46555c856552fb1c8449c44a50982a35d11c8
MD5 1848ff1d3900e4d2cdd4fc75e6b9d861
SHA1 431eb163e3ac2c5ca99f867884e14556c18bb10a
SHA512 e4d3aaed7a77396e9702942c759ce9649d786eedcd571ad9c295cf5eee2cd20b2fe96d54157cd8eca6fef8067313e2eb7dc5ace41c8f784dc28781de1e85c2e9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nsol
TLSH
T1A005A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jBOcQPJb.exe

Path C:\Windows\jBOcQPJb.exe
Size 804KB
SHA256 050914428693fe7ebfb35643f6d6d9704621974b6d413ecfca5cb8287dee890e
MD5 f92b4c5894a1eb25b4a26865a19cc312
SHA1 bf3ef0bd1ca846ba9860919318bef2abd7908f9a
SHA512 efbeaf801b62748282c752beddab2077d6a0e21057ce970cc8d338c07fb7e5925a91cbea973d85c1c9507c3e61c28428b4d7b59f782e40fa20dd684ccd9c2d25
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoua:0NA1Yakeer5+nsox
TLSH
T15005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kXEsHi5.exe

Path C:\Windows\kXEsHi5.exe
Size 804KB
SHA256 cbae65479681089879bf3429a3e8194f06729d53b107bea805650304657b1377
MD5 910e1b580b4e16524b796c946b8cb785
SHA1 02a2a1a90395fc75190408774d03af504ba00e1d
SHA512 5eb42d303b617fa7cd0af1f3ad7573ea20c4640f3166595b146c05ad3d0282b7ab55bbca385a1cd2f4eedf484922b0033ab37ac4980e687021c4533afefa9fba
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouC:0NA1Yakeer5+nsoB
TLSH
T12305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpDtZ.exe

Path C:\Windows\mpDtZ.exe
Size 804KB
SHA256 91f08119f304f59ca7c0c2a7f05c3e3df747f81d386dfe8943e65d774cee810a
MD5 da4a95bcf59eaa4973365a4552eeba8f
SHA1 cbc0f2ffaf84529099d65c53ce7694acf61d2aaa
SHA512 e63c18e7752671754466019f369e787150c98c956c654bc972f556152e7da38b73c9b8ab0df4135f9bb13921bf9fe0536c68e72bbc1ca412d00770dc26518b57
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouB:0NA1Yakeer5+nsoA
TLSH
T12D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mtEL2qSqDwLk.exe

Path C:\Windows\mtEL2qSqDwLk.exe
Size 804KB
SHA256 fb7a62d9a9cec65fb5cbe67abc227663b859e27c43d6685e891fd04c5ae169b8
MD5 ca906032c8cd7da58c2c026c5b2b3617
SHA1 d8ebe0b3185d13abc199e89a2315fd16f53b8323
SHA512 382b6e03b1a077dde8841b2368ce328e1e88a647e0ca953d4fc116408fdf031fbae7c2b7813639ce5270a56c06c480be8c02c89ebb6c2464df448d599650a99e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouJ:0NA1Yakeer5+nsoQ
TLSH
T13905A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tPIyedqk2z.exe

Path C:\Windows\tPIyedqk2z.exe
Size 804KB
SHA256 f4f1da1da9de54466f446c2dda9b854d47cdc74d6f339619141aa735de7f89e3
MD5 7c4b67617b944a779ab52ce0c195541f
SHA1 8dd77f58bfc7ee32c93fa56211abd349f865e8f9
SHA512 e03e020b9487d7a1232064d85498400201ad2ce7353b1595e90de18992ecd26922a50f564bfc9d2bc8d1584411847d972f74fa31d653c325ff16e54d165583dd
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou7:0NA1Yakeer5+nso6
TLSH
T17905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsAqb3UQMD.exe

Path C:\Windows\wsAqb3UQMD.exe
Size 804KB
SHA256 a2c2ef06378b1defa83b6cd2f585941670f7951f7cda0d6e8f7e492834deba16
MD5 07824e2d9d3bc223a614cabc3ec1a390
SHA1 fcf99e1c847d0db8aed23d5f4808863c08ccf164
SHA512 8c6aa77543bfb1280a564e2f2a7db18b9f0642c1ca523a41cb69702c239fba27c25d635e52678db46f264a6d77b69aab9484fd4bf61f843d012b089c5e2d49d8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou7r:0NA1Yakeer5+nsoSr
TLSH
T16305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads