9202bfbe3ac3e708a23a85cee7eef29fd870d2e993bb5774ea0754bc1bf4e09e

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_559eb6c1d65bc40a153ba2ded270286a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260812-ve7fss1dmg
SHA256 9202bfbe3ac3e708a23a85cee7eef29fd870d2e993bb5774ea0754bc1bf4e09e
MD5 559eb6c1d65bc40a153ba2ded270286a
SHA1 be139693505c083cb67f131f6ef2dec8b563437c
SHA512 0590f46adb6fdfe2f6fcad7794fe234b1380692874dc7bd39b2044fb938b19d5ea78425c204706a37636104542bd831b6d029907b87022b119c9c563dbe546fe
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nsoI
TLSH
T1AE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2084) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 22 IoCs

pid	Process
2056	izwDxJhiFN8L.exe
3568	s21JK01.exe
2192	vLQGz.exe
5780	OpeVYSi.exe
5608	xovOX60jss7hI.exe
1604	4o0S5pBaLntvc.exe
3976	jWikJqtdEr.exe
904	Uo2io5lGzxMKI2.exe
504	5MnyBxbJjj3eJ.exe
6228	vloIZ.exe
6480	Au0YvqaGw3S.exe
6812	inK0FNMS.exe
7084	4nzVsTv.exe
2300	4wOq5Wa.exe
7096	HRWZS9FM3z.exe
7460	bQDAgR0YDEK.exe
7716	OX6W6J.exe
7968	hp6ctQPvgq.exe
7344	CurWWnBEiyc.exe
7072	QtOoWLUN.exe
8368	BpLW8i6zUT.exe
8620	RH2UHwW.exe

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CDP = "C:\\Windows\\vloIZ.exe"	5MnyBxbJjj3eJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AUTODOWN = "C:\\Windows\\Au0YvqaGw3S.exe"	vloIZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\POPROXY = "C:\\Windows\\HRWZS9FM3z.exe"	4wOq5Wa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VETTRAY = "C:\\Windows\\RH2UHwW.exe"	BpLW8i6zUT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFIADMIN = "C:\\Windows\\izwDxJhiFN8L.exe"	2026-08-12_559eb6c1d65bc40a153ba2ded270286a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CPD = "C:\\Windows\\s21JK01.exe"	izwDxJhiFN8L.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NOTSTART = "C:\\Windows\\inK0FNMS.exe"	Au0YvqaGw3S.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EFPEADM = "C:\\Windows\\4nzVsTv.exe"	inK0FNMS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCTOOL = "C:\\Windows\\bQDAgR0YDEK.exe"	HRWZS9FM3z.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCANPM = "C:\\Windows\\vLQGz.exe"	s21JK01.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WRCTRL = "C:\\Windows\\OpeVYSi.exe"	vLQGz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VETTRAY = "C:\\Windows\\4o0S5pBaLntvc.exe"	xovOX60jss7hI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NOTSTART = "C:\\Windows\\Uo2io5lGzxMKI2.exe"	jWikJqtdEr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IAMAPP = "C:\\Windows\\5MnyBxbJjj3eJ.exe"	Uo2io5lGzxMKI2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TAUMON = "C:\\Windows\\4wOq5Wa.exe"	4nzVsTv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WRCTRL = "C:\\Windows\\OX6W6J.exe"	bQDAgR0YDEK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSCAN40 = "C:\\Windows\\QtOoWLUN.exe"	CurWWnBEiyc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVWUPD32 = "C:\\Windows\\xovOX60jss7hI.exe"	OpeVYSi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NISUM = "C:\\Windows\\jWikJqtdEr.exe"	4o0S5pBaLntvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TBSCAN = "C:\\Windows\\hp6ctQPvgq.exe"	OX6W6J.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVW = "C:\\Windows\\CurWWnBEiyc.exe"	hp6ctQPvgq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVP32 = "C:\\Windows\\BpLW8i6zUT.exe"	QtOoWLUN.exe

Drops file in Windows directory 44 IoCs

description	ioc	Process
File created	C:\Windows\4o0S5pBaLntvc.exe	xovOX60jss7hI.exe
File created	C:\Windows\jWikJqtdEr.exe	4o0S5pBaLntvc.exe
File created	C:\Windows\inK0FNMS.exe	Au0YvqaGw3S.exe
File opened for modification	C:\Windows\bQDAgR0YDEK.exe	HRWZS9FM3z.exe
File created	C:\Windows\OX6W6J.exe	bQDAgR0YDEK.exe
File created	C:\Windows\BpLW8i6zUT.exe	QtOoWLUN.exe
File created	C:\Windows\OpeVYSi.exe	vLQGz.exe
File opened for modification	C:\Windows\4o0S5pBaLntvc.exe	xovOX60jss7hI.exe
File opened for modification	C:\Windows\Uo2io5lGzxMKI2.exe	jWikJqtdEr.exe
File opened for modification	C:\Windows\CurWWnBEiyc.exe	hp6ctQPvgq.exe
File created	C:\Windows\QtOoWLUN.exe	CurWWnBEiyc.exe
File created	C:\Windows\xovOX60jss7hI.exe	OpeVYSi.exe
File opened for modification	C:\Windows\5MnyBxbJjj3eJ.exe	Uo2io5lGzxMKI2.exe
File opened for modification	C:\Windows\OX6W6J.exe	bQDAgR0YDEK.exe
File created	C:\Windows\s21JK01.exe	izwDxJhiFN8L.exe
File opened for modification	C:\Windows\OpeVYSi.exe	vLQGz.exe
File created	C:\Windows\4wOq5Wa.exe	4nzVsTv.exe
File created	C:\Windows\hp6ctQPvgq.exe	OX6W6J.exe
File opened for modification	C:\Windows\hp6ctQPvgq.exe	OX6W6J.exe
File opened for modification	C:\Windows\QtOoWLUN.exe	CurWWnBEiyc.exe
File opened for modification	C:\Windows\BpLW8i6zUT.exe	QtOoWLUN.exe
File opened for modification	C:\Windows\xovOX60jss7hI.exe	OpeVYSi.exe
File created	C:\Windows\5MnyBxbJjj3eJ.exe	Uo2io5lGzxMKI2.exe
File created	C:\Windows\Au0YvqaGw3S.exe	vloIZ.exe
File opened for modification	C:\Windows\inK0FNMS.exe	Au0YvqaGw3S.exe
File opened for modification	C:\Windows\4wOq5Wa.exe	4nzVsTv.exe
File created	C:\Windows\bQDAgR0YDEK.exe	HRWZS9FM3z.exe
File created	C:\Windows\CurWWnBEiyc.exe	hp6ctQPvgq.exe
File opened for modification	C:\Windows\Au0YvqaGw3S.exe	vloIZ.exe
File created	C:\Windows\izwDxJhiFN8L.exe	2026-08-12_559eb6c1d65bc40a153ba2ded270286a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\s21JK01.exe	izwDxJhiFN8L.exe
File opened for modification	C:\Windows\vLQGz.exe	s21JK01.exe
File created	C:\Windows\Uo2io5lGzxMKI2.exe	jWikJqtdEr.exe
File created	C:\Windows\vloIZ.exe	5MnyBxbJjj3eJ.exe
File created	C:\Windows\HRWZS9FM3z.exe	4wOq5Wa.exe
File opened for modification	C:\Windows\HRWZS9FM3z.exe	4wOq5Wa.exe
File created	C:\Windows\vLQGz.exe	s21JK01.exe
File created	C:\Windows\4nzVsTv.exe	inK0FNMS.exe
File created	C:\Windows\RH2UHwW.exe	BpLW8i6zUT.exe
File opened for modification	C:\Windows\RH2UHwW.exe	BpLW8i6zUT.exe
File opened for modification	C:\Windows\jWikJqtdEr.exe	4o0S5pBaLntvc.exe
File opened for modification	C:\Windows\izwDxJhiFN8L.exe	2026-08-12_559eb6c1d65bc40a153ba2ded270286a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\vloIZ.exe	5MnyBxbJjj3eJ.exe
File opened for modification	C:\Windows\4nzVsTv.exe	inK0FNMS.exe

Program crash 10 IoCs

pid	pid_target	Process	procid_target
6724	504	WerFault.exe	106
7364	7084	WerFault.exe	117
8268	7968	WerFault.exe	129
8096	2056	WerFault.exe	90
8032	2192	WerFault.exe	94
8296	5780	WerFault.exe	96
3852	6228	WerFault.exe	108
5984	6480	WerFault.exe	110
8148	3388	WerFault.exe	87
5436	1604	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	izwDxJhiFN8L.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpeVYSi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OX6W6J.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QtOoWLUN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RH2UHwW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4o0S5pBaLntvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jWikJqtdEr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4nzVsTv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HRWZS9FM3z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bQDAgR0YDEK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BpLW8i6zUT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s21JK01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vLQGz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xovOX60jss7hI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uo2io5lGzxMKI2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5MnyBxbJjj3eJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vloIZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4wOq5Wa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hp6ctQPvgq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_559eb6c1d65bc40a153ba2ded270286a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CurWWnBEiyc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au0YvqaGw3S.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inK0FNMS.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-12_559eb6c1d65bc40a153ba2ded270286a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_559eb6c1d65bc40a153ba2ded270286a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 2372
  2⤵
  - Program crash
  PID:8148

C:\Windows\izwDxJhiFN8L.exe
C:\Windows\izwDxJhiFN8L.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 2280
  2⤵
  - Program crash
  PID:8096

C:\Windows\s21JK01.exe
C:\Windows\s21JK01.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3568

C:\Windows\vLQGz.exe
C:\Windows\vLQGz.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 2204
  2⤵
  - Program crash
  PID:8032

C:\Windows\OpeVYSi.exe
C:\Windows\OpeVYSi.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 2196
  2⤵
  - Program crash
  PID:8296

C:\Windows\xovOX60jss7hI.exe
C:\Windows\xovOX60jss7hI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5608

C:\Windows\4o0S5pBaLntvc.exe
C:\Windows\4o0S5pBaLntvc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 2308
  2⤵
  - Program crash
  PID:5436

C:\Windows\jWikJqtdEr.exe
C:\Windows\jWikJqtdEr.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3976

C:\Windows\Uo2io5lGzxMKI2.exe
C:\Windows\Uo2io5lGzxMKI2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:904

C:\Windows\5MnyBxbJjj3eJ.exe
C:\Windows\5MnyBxbJjj3eJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 504 -s 2100
  2⤵
  - Program crash
  PID:6724

C:\Windows\vloIZ.exe
C:\Windows\vloIZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6228 -s 2212
  2⤵
  - Program crash
  PID:3852

C:\Windows\Au0YvqaGw3S.exe
C:\Windows\Au0YvqaGw3S.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6480 -s 2212
  2⤵
  - Program crash
  PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 504 -ip 504
1⤵
PID:6700

C:\Windows\inK0FNMS.exe
C:\Windows\inK0FNMS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6812

C:\Windows\4nzVsTv.exe
C:\Windows\4nzVsTv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7084 -s 2100
  2⤵
  - Program crash
  PID:7364

C:\Windows\4wOq5Wa.exe
C:\Windows\4wOq5Wa.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2300

C:\Windows\HRWZS9FM3z.exe
C:\Windows\HRWZS9FM3z.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 7084 -ip 7084
1⤵
PID:7344

C:\Windows\bQDAgR0YDEK.exe
C:\Windows\bQDAgR0YDEK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7460

C:\Windows\OX6W6J.exe
C:\Windows\OX6W6J.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7716

C:\Windows\hp6ctQPvgq.exe
C:\Windows\hp6ctQPvgq.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7968 -s 2092
  2⤵
  - Program crash
  PID:8268

C:\Windows\CurWWnBEiyc.exe
C:\Windows\CurWWnBEiyc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7344

C:\Windows\QtOoWLUN.exe
C:\Windows\QtOoWLUN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7968 -ip 7968
1⤵
PID:8248

C:\Windows\BpLW8i6zUT.exe
C:\Windows\BpLW8i6zUT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8368

C:\Windows\RH2UHwW.exe
C:\Windows\RH2UHwW.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2056 -ip 2056
1⤵
PID:8112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2192 -ip 2192
1⤵
PID:8052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5780 -ip 5780
1⤵
PID:7972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6228 -ip 6228
1⤵
PID:8568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 6480 -ip 6480
1⤵
PID:8824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 3388 -ip 3388
1⤵
PID:8284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1604 -ip 1604
1⤵
PID:5768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4nzVsTv.exe

Path C:\Windows\4nzVsTv.exe
Size 804KB
SHA256 9d2a79c4f7e918837abe0683852abb65f2be26e7e02cd93f141bc5892d94248c
MD5 66b0f90538915e82e3738a85f35331a0
SHA1 f3f2d84d74589445aa9ac08d912d1cdf331f9547
SHA512 faf76f58f78423c9c4cd95972bfa2cd3042e319ca12447d4710aba62f0b65f908d3a9bb83bfceb9de09bb8cc2395094c2b951de8106e1074ebced14c7c12d7a0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsoC
TLSH
T18505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4o0S5pBaLntvc.exe

Path C:\Windows\4o0S5pBaLntvc.exe
Size 804KB
SHA256 9f77431e56236a96ae19631a6d17111400f1f3b57dac5a2e9701b02e8c4622ef
MD5 5d9e8726b2987c9bdf21bc91db13f082
SHA1 a1bfdbeeb21be2ff8ec76d24c747314eade4bf3e
SHA512 bb856fe868be5f0799e668a2769ced2d74d8e4b2c83dc20855ff3cfff165cb89c15b036f6cca77669a6d98ce6364dddf1890013431096ba93e9c93f611144720
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoS
TLSH
T17A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4wOq5Wa.exe

Path C:\Windows\4wOq5Wa.exe
Size 804KB
SHA256 f7db02d6d8d60c6aebe5d478ecbcefb44a9f5121f1c5c17d224dcae4f80ba6bd
MD5 90420a326055043a51f841cd54929926
SHA1 c78988a1f2cac4e50731bf0f102171ea2912c65a
SHA512 e25c90fb690a8d2952f14e59ad4580540cec79797848e81c206baaa4e645aba3b79f2b810dd836981f512311a5e1f9cfad352cf3afe2b29befbf1373793fdfe5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nsof
TLSH
T1F805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5MnyBxbJjj3eJ.exe

Path C:\Windows\5MnyBxbJjj3eJ.exe
Size 804KB
SHA256 35425bee6cde1b88fb09179aa937af170025cefbfe4b533d510035da3f70e0e3
MD5 5b866cf5884ca346b56f6e01b4633c3f
SHA1 669cc42f390d4eaf30d048deba4555d5f750148e
SHA512 f11bc13ed2a86d9baead705ba5341c855413ab057a25f5efc7ccb478fced6ae3f2a470edb2749fd0920dcbcbb1a508a242a8e14ebb6e81c5ba7a88f2a57a28fd
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nso+
TLSH
T13905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Au0YvqaGw3S.exe

Path C:\Windows\Au0YvqaGw3S.exe
Size 804KB
SHA256 9ce4c9a0eb785a857b1a460e0f0db4b696752d861a719f1f750f5617dc84c125
MD5 3fbe41a9c1d2fc966ae51579ed33be7d
SHA1 a46368e08bb13531759913a152f9688564a927bc
SHA512 e5aed7fb2b4bc1b4f3e7e8b80e5fcf9e12d148f92fa13b2be0a9bbf9460cfc4c5924813cb1ea795734052ea66b6cf09fe2375e109dd74d832d892c23b25faca1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou1:0NA1Yakeer5+nsoS
TLSH
T15405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BpLW8i6zUT.exe

Path C:\Windows\BpLW8i6zUT.exe
Size 804KB
SHA256 600f1a49ab0e896bec26f23c0c9dd73c0376b829842927b30af1e6aac9e0cb2b
MD5 e05695fba586a46b28eabf44eb7808f0
SHA1 b42b3fb3db2710cecdea309f27282ebbdc531727
SHA512 556fbc103cf388d272632998bdc78c1123f0ad5549dd8f152dba850dcd7491e5d3540e7908db35d92a65f5fb6fe27cc6f81c249f01d1af4dff0504f96bb7fb5f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nsog
TLSH
T12F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurWWnBEiyc.exe

Path C:\Windows\CurWWnBEiyc.exe
Size 804KB
SHA256 70b465ff2aceb6c855756e5f285552f3153d6bb2e88daed7a69bb5e198a58cd7
MD5 8a652db17af6738ea6e23562772e5d3a
SHA1 8d0f69cff24a13303604e1c2373653ce21556dcc
SHA512 aee8b84b2e7934689e1377f5b56616ed5c6283ca1edbda2099f7736c93958aad464ff7d152fe8363ba53a4f84d8af7097528ecf95f1ec578a5eaadd0265502be
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsoL
TLSH
T19E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HRWZS9FM3z.exe

Path C:\Windows\HRWZS9FM3z.exe
Size 804KB
SHA256 cfc07760acf272c01d52efaf3cb4e74d51bc62a9b64856f2ccccedc307b038cf
MD5 c12d671259fb538e2e2e80eeaf4b40db
SHA1 f028f8f6a144505728d40b37024dbf1158c6a65f
SHA512 fa555e31937b3dd46080e2252714e8cd90702f7adb213e8b0e7f556bc11bba1247e192c437a393d751e486787b384567580247bfe35366bafbedcd3b256a210f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoug:0NA1Yakeer5+nso1
TLSH
T19805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OX6W6J.exe

Path C:\Windows\OX6W6J.exe
Size 804KB
SHA256 546fb7b987fefbfbc5a23b98e5bf03e1bc78caeffc5ea077423b7d05bc0b1319
MD5 7a932e705d6f96342aba9726311517a5
SHA1 5f01477372e8e2fa5739c514d2d2923272e0b0bc
SHA512 88ab0b3e66f84e56eafc7bf9f2f2a82594e24c2eea00eed70584eeb602deb74ead79a32737c1721b9774973830b5c9e3dea098ce4f145a2e1d045a152043e839
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nsoj
TLSH
T12F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpeVYSi.exe

Path C:\Windows\OpeVYSi.exe
Size 804KB
SHA256 a25bc5b052e01b3edeea5c83ca6f011ec20402522a1d9e37e20f0f555debade9
MD5 cbb727d76a28a05eab0b6ba933a3b342
SHA1 85d829a9a539bb972650b71c4450a38adc9002d2
SHA512 57b68209b8aae8ea97de572a85ca8051eaf6776b841109c3992ea819835ddc33167faf14ba1533beb15f32b520f9bfa47e6d6adcbe63e46c8c8098b8027ded57
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouU:0NA1Yakeer5+nsoH
TLSH
T1A005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtOoWLUN.exe

Path C:\Windows\QtOoWLUN.exe
Size 804KB
SHA256 7fd233e89e099b60bd7dfc640adf65d9c9c76c0534159416a09782aa9b65743f
MD5 c2cf257a89fdfed4770ecb905c082746
SHA1 402a32899789e949c94c93bc2c225e6f3d95990d
SHA512 8bf92a34bbed5820cbf1aa234bb32b3e2a027d4fdf5b5bf4320ef55ae0aba758bf423051fd3c0ec43a6bdafd8db98e71384df6e4a115d3b38720ebdb3906c99a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouC:0NA1Yakeer5+nsod
TLSH
T12805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RH2UHwW.exe

Path C:\Windows\RH2UHwW.exe
Size 804KB
SHA256 2d93c33b87571ae1338bd86f7a036becfcdb24717d802a2df9b9f22d12c9b5da
MD5 a17121350a8350304c3e35dbfd4591bf
SHA1 0e1f9dd5d8d781850e41c16b8e6ea21b232f4d2f
SHA512 ae29c3a86c59f31217d7f1d2e43554c16af888a62d7b8d7449e86b2bfc697a61e65a106619e292cf7856c66a40cd701c094ad0ea20fed11c05d0d74ea6706c90
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoO
TLSH
T1E105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uo2io5lGzxMKI2.exe

Path C:\Windows\Uo2io5lGzxMKI2.exe
Size 804KB
SHA256 40f939314cc233507395a85cea29ed2b79bf60b8b25366fb05eea439504c7839
MD5 f419bc506f3c919d74b5a1dbf9f7619b
SHA1 36f1869f8f60baf73a902a27861a71a1ca2422ed
SHA512 7bb202f39e3bec9ce9ed3de25e5c5727e789493da66ceae4cf920dcec325610d9ce7553d49139428bdd561394ffb3e61790c90846bbab5d7279feb82c69b3d85
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nsob
TLSH
T1D205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bQDAgR0YDEK.exe

Path C:\Windows\bQDAgR0YDEK.exe
Size 804KB
SHA256 c38936ab0430bd362f905e7db1542aea0ab0987b4e8eac0d977ba70d665ff6df
MD5 3851ceeacd453d54d7ec9927b4d12930
SHA1 a256d7c2b223daadebbb63399d5a2b7c1db1337e
SHA512 7cfb1e7913b2bf9d38f04ca3309975cd3409e6b15fcdc62d465c486a6d87f1f2376e3d85bf02ba318b33f3d7a2ed42cfbf388858b74698ee5bef8297a1ff0189
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nsoD
TLSH
T1CD05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hp6ctQPvgq.exe

Path C:\Windows\hp6ctQPvgq.exe
Size 804KB
SHA256 e04b4726b91ff00452f02be24d8a943261108d7f293a521f273da293446a8b90
MD5 76edec706896aeff8510ef1ade062e38
SHA1 5cce397e59485f48a5184a3bffb801b09947b1b7
SHA512 4d5c6adfb297a9b49a971e73002016e070629f97a9229e37f6be02a5217d5475217f1ce99fb886b134bf3db07cb947a4d7b19af298842e3c640319c0a3e651e8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouz:0NA1Yakeer5+nsoo
TLSH
T1AE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inK0FNMS.exe

Path C:\Windows\inK0FNMS.exe
Size 804KB
SHA256 f74cfaea2962264bfe82cdf9320d8daa01af556b963c50f927b34329b294d6eb
MD5 5dbb1cb30ed248c231226a29d4828e47
SHA1 27ee80d8abd9aa3f2983b60c0701e717f898f133
SHA512 a62d1ca9d96e70ef09423b2f3991fed3af298ef387cd48ecd7a61b0698b040c9e63fbd3a65734e037a5ca9160dc690ff7535e19c1b37080922bec374f52a9686
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nso/
TLSH
T19105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

izwDxJhiFN8L.exe

Path C:\Windows\izwDxJhiFN8L.exe
Size 804KB
SHA256 681674f68b5a02a43caad459bc25720f16425e5d6f74e8ef7a8e24e7ef2aae1f
MD5 2faeb497984e2b0d60ea8d8af4c82fb4
SHA1 17a2f25ad5d24c87ffaa6aeee92ea16083c95fc1
SHA512 52f37787dc1b8460038abb34846607108d3df6910a3fd2f13e8326392a2fba8a5f19576c139d74f626aef5bcb139e55bad1dc38beab436add0e972b278735440
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouK:0NA1Yakeer5+nsot
TLSH
T13E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jWikJqtdEr.exe

Path C:\Windows\jWikJqtdEr.exe
Size 804KB
SHA256 d460af05edf64a6a926f529dd4650137dc5968e550ea413c8643ba4f8bcd3887
MD5 a187cfcc9005fe2fa66154e9997fd285
SHA1 81a7f1fc44f3384eb09fceec86c6a527d0897201
SHA512 7e44b64c85a1db4c18a8537f12306670720d5f2a2d5359c46c85a009634b04feba0b2d0d9e9d58afa4331efb0d7e7732edb28db80f2aebe0618f058f9be72bf4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsoW
TLSH
T16405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s21JK01.exe

Path C:\Windows\s21JK01.exe
Size 804KB
SHA256 80839fe81379b3eeb204cd26c5f0585e5a0a98dd502b3014378d754637edac51
MD5 eed8668e6acf0467296f338ce9edae37
SHA1 57ebe8c5c1e7cdecaa8c904a071e816f26f6455e
SHA512 df96d7b5e55cbebc4feb3286d5a3dda135debb0b42b46a83eaca52461ecebf7c17abc6bdacbcf86b791287bc5bff3a4895eb9271a64ecb5e6f7c47da4169fd76
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouJ:0NA1Yakeer5+nsos
TLSH
T1E905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vLQGz.exe

Path C:\Windows\vLQGz.exe
Size 804KB
SHA256 d3b6c9b3ec4dda5801075b98299c0b360d23b64c45018b31fb1ad7201e35e10a
MD5 99d8d5ba83ac41a445637c4c5e67d48e
SHA1 13141b32c1d9fe351a04db5504610a7417d04e40
SHA512 d22fac6a18292f771c01ba1657d640ebdda83ab313e5f318e82dcef526f7acbf7e000acdea351d00f617f5deaf37c37e97c8d899e037932f8cd6c30e681d06e5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nsoc
TLSH
T14D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vloIZ.exe

Path C:\Windows\vloIZ.exe
Size 804KB
SHA256 df967a373cd2d08ab2693064ffa5d76c2bd766684df658b0ab6562ab5309c323
MD5 0bcc40c1a82532e9556bfdcd6a95429d
SHA1 d951a0de68bead88c94a9b8a54476ad018bcf530
SHA512 160c20202e664d5db3ba7672d8eb839d08f3f3c79f0b57bfe92d77f472e8fb278500d264febda1ec27058e9fea981bc56476d1a1733aabb9e13fd16eb3f03774
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFous:0NA1Yakeer5+nso/
TLSH
T13205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xovOX60jss7hI.exe

Path C:\Windows\xovOX60jss7hI.exe
Size 804KB
SHA256 fdee0dcc44a5c2c8d42fe4c206b078e3c73be5511a4ca2751c65d8b84e6805cf
MD5 8797156ee6f293b21091faf24530ad09
SHA1 ea00169de67a11fefc2fcedb6294a7496554f915
SHA512 93e8486f06c19a8ddbcda31b7cb077cb4eca49abcc214c2da98e72445dc473c58d9f4a78032cdaeb502866f610b9238a92bfc8bd750544f13f32273badfd612a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFous:0NA1Yakeer5+nsoR
TLSH
T13405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads