f776134c1d4bc1b79f2e9e1f60a5eab1453b8c7065a917fb40240d6bd14f9a77

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_844b4dbe3aa99264faa6ae4d3144ff2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260813-e15w4a1grb
SHA256 f776134c1d4bc1b79f2e9e1f60a5eab1453b8c7065a917fb40240d6bd14f9a77
MD5 844b4dbe3aa99264faa6ae4d3144ff2d
SHA1 51acd29dfd5c2895b7faf0e23b1cb21358eda008
SHA512 e7660e45e3f5cc80ff8d0834d7e3556fd5037e6f3aff540b78248fe9b89dcc6d13215d23466362bd8a0b30de66860617a10619f6cee9dd5b2adba429854ee811
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoux:0NA1Yakeer5+nsoW
TLSH
T1D105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2026) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 20 IoCs

pid	Process
2636	DQUYdcTGx0yixC.exe
3632	pLpvnZCoLUpp.exe
1728	adCBm350BS0P.exe
984	RI3IgQ.exe
5032	NCvwNR.exe
4076	OWjmPC6qoS.exe
2260	9rtScKKv.exe
2484	ev6KL7j.exe
1224	4crRO4238.exe
2868	TToIm.exe
5416	a25KA.exe
5664	SxMgi.exe
5904	78sqC.exe
5132	eKY4N2bKi2cYv.exe
6188	i4ctBDOwvpcLSw.exe
6432	y8oDk5aoDt.exe
6680	I9trJik2VpyvgMH.exe
6976	Gm9UtMV6c.exe
6440	ZmQtnSzC2mCp.exe
5172	HetGsL.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGAVRTCL = "C:\\Windows\\adCBm350BS0P.exe"	pLpvnZCoLUpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SERV95 = "C:\\Windows\\RI3IgQ.exe"	adCBm350BS0P.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NTXCONFIG = "C:\\Windows\\ev6KL7j.exe"	9rtScKKv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWEEPNET = "C:\\Windows\\SxMgi.exe"	a25KA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AUTOTRACE = "C:\\Windows\\HetGsL.exe"	ZmQtnSzC2mCp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VIR-HELP = "C:\\Windows\\OWjmPC6qoS.exe"	NCvwNR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGAVRTE = "C:\\Windows\\TToIm.exe"	4crRO4238.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVSYNMGR = "C:\\Windows\\a25KA.exe"	TToIm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUSPT = "C:\\Windows\\eKY4N2bKi2cYv.exe"	78sqC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAV7 = "C:\\Windows\\y8oDk5aoDt.exe"	i4ctBDOwvpcLSw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IFACE = "C:\\Windows\\DQUYdcTGx0yixC.exe"	2026-08-13_844b4dbe3aa99264faa6ae4d3144ff2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WIMMUN32 = "C:\\Windows\\pLpvnZCoLUpp.exe"	DQUYdcTGx0yixC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSSTAT = "C:\\Windows\\NCvwNR.exe"	RI3IgQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATWATCH = "C:\\Windows\\9rtScKKv.exe"	OWjmPC6qoS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGAVRTE = "C:\\Windows\\i4ctBDOwvpcLSw.exe"	eKY4N2bKi2cYv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICSUPP95 = "C:\\Windows\\I9trJik2VpyvgMH.exe"	y8oDk5aoDt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCMNHDLR = "C:\\Windows\\Gm9UtMV6c.exe"	I9trJik2VpyvgMH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUSPT = "C:\\Windows\\4crRO4238.exe"	ev6KL7j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVCL = "C:\\Windows\\78sqC.exe"	SxMgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TC = "C:\\Windows\\ZmQtnSzC2mCp.exe"	Gm9UtMV6c.exe

Drops file in Windows directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\adCBm350BS0P.exe	pLpvnZCoLUpp.exe
File created	C:\Windows\TToIm.exe	4crRO4238.exe
File opened for modification	C:\Windows\TToIm.exe	4crRO4238.exe
File created	C:\Windows\pLpvnZCoLUpp.exe	DQUYdcTGx0yixC.exe
File opened for modification	C:\Windows\RI3IgQ.exe	adCBm350BS0P.exe
File created	C:\Windows\OWjmPC6qoS.exe	NCvwNR.exe
File created	C:\Windows\4crRO4238.exe	ev6KL7j.exe
File created	C:\Windows\i4ctBDOwvpcLSw.exe	eKY4N2bKi2cYv.exe
File opened for modification	C:\Windows\I9trJik2VpyvgMH.exe	y8oDk5aoDt.exe
File opened for modification	C:\Windows\4crRO4238.exe	ev6KL7j.exe
File opened for modification	C:\Windows\SxMgi.exe	a25KA.exe
File opened for modification	C:\Windows\78sqC.exe	SxMgi.exe
File created	C:\Windows\eKY4N2bKi2cYv.exe	78sqC.exe
File created	C:\Windows\I9trJik2VpyvgMH.exe	y8oDk5aoDt.exe
File created	C:\Windows\9rtScKKv.exe	OWjmPC6qoS.exe
File created	C:\Windows\ev6KL7j.exe	9rtScKKv.exe
File opened for modification	C:\Windows\a25KA.exe	TToIm.exe
File created	C:\Windows\78sqC.exe	SxMgi.exe
File opened for modification	C:\Windows\i4ctBDOwvpcLSw.exe	eKY4N2bKi2cYv.exe
File opened for modification	C:\Windows\ZmQtnSzC2mCp.exe	Gm9UtMV6c.exe
File created	C:\Windows\DQUYdcTGx0yixC.exe	2026-08-13_844b4dbe3aa99264faa6ae4d3144ff2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\DQUYdcTGx0yixC.exe	2026-08-13_844b4dbe3aa99264faa6ae4d3144ff2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\9rtScKKv.exe	OWjmPC6qoS.exe
File created	C:\Windows\y8oDk5aoDt.exe	i4ctBDOwvpcLSw.exe
File created	C:\Windows\Gm9UtMV6c.exe	I9trJik2VpyvgMH.exe
File created	C:\Windows\ZmQtnSzC2mCp.exe	Gm9UtMV6c.exe
File created	C:\Windows\NCvwNR.exe	RI3IgQ.exe
File created	C:\Windows\SxMgi.exe	a25KA.exe
File opened for modification	C:\Windows\Gm9UtMV6c.exe	I9trJik2VpyvgMH.exe
File created	C:\Windows\HetGsL.exe	ZmQtnSzC2mCp.exe
File created	C:\Windows\adCBm350BS0P.exe	pLpvnZCoLUpp.exe
File opened for modification	C:\Windows\OWjmPC6qoS.exe	NCvwNR.exe
File created	C:\Windows\a25KA.exe	TToIm.exe
File opened for modification	C:\Windows\eKY4N2bKi2cYv.exe	78sqC.exe
File opened for modification	C:\Windows\y8oDk5aoDt.exe	i4ctBDOwvpcLSw.exe
File opened for modification	C:\Windows\HetGsL.exe	ZmQtnSzC2mCp.exe
File opened for modification	C:\Windows\pLpvnZCoLUpp.exe	DQUYdcTGx0yixC.exe
File created	C:\Windows\RI3IgQ.exe	adCBm350BS0P.exe
File opened for modification	C:\Windows\NCvwNR.exe	RI3IgQ.exe
File opened for modification	C:\Windows\ev6KL7j.exe	9rtScKKv.exe

Program crash 11 IoCs

pid	pid_target	Process	procid_target
1312	3632	WerFault.exe	88
6884	6188	WerFault.exe	119
6332	6680	WerFault.exe	123
5660	984	WerFault.exe	92
2516	4076	WerFault.exe	99
2672	2636	WerFault.exe	86
5680	2484	WerFault.exe	103
2784	1224	WerFault.exe	105
4812	5032	WerFault.exe	97
4652	2260	WerFault.exe	101
2428	6432	WerFault.exe	121

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_844b4dbe3aa99264faa6ae4d3144ff2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DQUYdcTGx0yixC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4crRO4238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TToIm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eKY4N2bKi2cYv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pLpvnZCoLUpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OWjmPC6qoS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a25KA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gm9UtMV6c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RI3IgQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9rtScKKv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i4ctBDOwvpcLSw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y8oDk5aoDt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HetGsL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adCBm350BS0P.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NCvwNR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev6KL7j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SxMgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78sqC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	I9trJik2VpyvgMH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZmQtnSzC2mCp.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-13_844b4dbe3aa99264faa6ae4d3144ff2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_844b4dbe3aa99264faa6ae4d3144ff2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1600

C:\Windows\DQUYdcTGx0yixC.exe
C:\Windows\DQUYdcTGx0yixC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 2216
  2⤵
  - Program crash
  PID:2672

C:\Windows\pLpvnZCoLUpp.exe
C:\Windows\pLpvnZCoLUpp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1984
  2⤵
  - Program crash
  PID:1312

C:\Windows\adCBm350BS0P.exe
C:\Windows\adCBm350BS0P.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1728

C:\Windows\RI3IgQ.exe
C:\Windows\RI3IgQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 2104
  2⤵
  - Program crash
  PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3632 -ip 3632
1⤵
PID:4324

C:\Windows\NCvwNR.exe
C:\Windows\NCvwNR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 2304
  2⤵
  - Program crash
  PID:4812

C:\Windows\OWjmPC6qoS.exe
C:\Windows\OWjmPC6qoS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 2096
  2⤵
  - Program crash
  PID:2516

C:\Windows\9rtScKKv.exe
C:\Windows\9rtScKKv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 2320
  2⤵
  - Program crash
  PID:4652

C:\Windows\ev6KL7j.exe
C:\Windows\ev6KL7j.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 2212
  2⤵
  - Program crash
  PID:5680

C:\Windows\4crRO4238.exe
C:\Windows\4crRO4238.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 2220
  2⤵
  - Program crash
  PID:2784

C:\Windows\TToIm.exe
C:\Windows\TToIm.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2868

C:\Windows\a25KA.exe
C:\Windows\a25KA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5416

C:\Windows\SxMgi.exe
C:\Windows\SxMgi.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5664

C:\Windows\78sqC.exe
C:\Windows\78sqC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5904

C:\Windows\eKY4N2bKi2cYv.exe
C:\Windows\eKY4N2bKi2cYv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5132

C:\Windows\i4ctBDOwvpcLSw.exe
C:\Windows\i4ctBDOwvpcLSw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6188 -s 1988
  2⤵
  - Program crash
  PID:6884

C:\Windows\y8oDk5aoDt.exe
C:\Windows\y8oDk5aoDt.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 2320
  2⤵
  - Program crash
  PID:2428

C:\Windows\I9trJik2VpyvgMH.exe
C:\Windows\I9trJik2VpyvgMH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6680 -s 1980
  2⤵
  - Program crash
  PID:6332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6188 -ip 6188
1⤵
PID:6864

C:\Windows\Gm9UtMV6c.exe
C:\Windows\Gm9UtMV6c.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6976

C:\Windows\ZmQtnSzC2mCp.exe
C:\Windows\ZmQtnSzC2mCp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6680 -ip 6680
1⤵
PID:6264

C:\Windows\HetGsL.exe
C:\Windows\HetGsL.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 984 -ip 984
1⤵
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4076 -ip 4076
1⤵
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2636 -ip 2636
1⤵
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2484 -ip 2484
1⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1224 -ip 1224
1⤵
PID:6128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5032 -ip 5032
1⤵
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2260 -ip 2260
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6432 -ip 6432
1⤵
PID:3680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4crRO4238.exe

Path C:\Windows\4crRO4238.exe
Size 804KB
SHA256 adb1295e1077400a251a12975be57f5368b2d0b707d6c03e9fff992677bfbc6a
MD5 28cac379a067b29228eb9b6b8ade78ea
SHA1 825ca05b2cd529fd8c8d57a130c7c2af16aed572
SHA512 262c6b01725e0156639cf2a306b0ddaf071b3fe96ac5bec607ae8ef326d6fbfd6b5de2c1d67218a7d346092d806d35dd0582964cf3f16fb09b7d519cc2aa9de2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouU:0NA1Yakeer5+nsox
TLSH
T1AB05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78sqC.exe

Path C:\Windows\78sqC.exe
Size 804KB
SHA256 66e1f45da768db92ab2e4e84f111269fbe8166698a70854d2334dc719efc5de7
MD5 4689b21acd32ea8fce144344c18d9949
SHA1 3b2c9e5448f2026eb8dfb24d9d402d480cc78cc3
SHA512 2686d576fd4bba0f43c6b8422dbf29186aac93c34aa559388834e03ee20491dcb4a81a7140af4ae5fab08adc5c2baedcbd931d115ad0c806a68ed739a9a63881
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsoY
TLSH
T1E405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9rtScKKv.exe

Path C:\Windows\9rtScKKv.exe
Size 804KB
SHA256 0da0edec947ba1d121944da3997fd23bff20bf51c32ef62e69422572530c7156
MD5 4f1305107f90000e78864bb05bdde90a
SHA1 6220b6088f5590395fe3c9c172ac5fae573b9b0d
SHA512 ebe9790bf8fdb8a06b6619961e7c5980b1cf69cd214ed5e62682863163c04f2665c3c7ca9956ec420ceb554aeb204340c0d822b389d930162e9a488e57441fde
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou3:0NA1Yakeer5+nso4
TLSH
T1E505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DQUYdcTGx0yixC.exe

Path C:\Windows\DQUYdcTGx0yixC.exe
Size 804KB
SHA256 c245a7ef328bbee9e1ea238b154cfa8c1a3564e60a39d14e4b8450e51b0c0909
MD5 d254c98f36a5195cddd4a5bf16b05641
SHA1 53b32ecf5b131f30792a4f547dfacf65de1030f3
SHA512 c2c1b0a6d89a396f97857408664c601de80b31668b59932663eacadc923bfa7bc8b00cd149faa5e6bb8f6ac25f9cad3e760be37de7ce7beb76aafbcfc6b5942d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nsoJ
TLSH
T10305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gm9UtMV6c.exe

Path C:\Windows\Gm9UtMV6c.exe
Size 804KB
SHA256 584d0351088a7b0d14219cc766de1a4865ad3e7a2e03cf4a54573a0787b262cd
MD5 b05c7fcc0cc61310fcd6bb2ca5ebd9d7
SHA1 e780305367dbc3c8b22c3c267e1a0e8960b4b046
SHA512 f6fb3e03aee858a62ce1de9f512b492ceb9d76938fded6eecd622e4591829d507fdd6e6a4b60f7bf23c637a186b7938e06be2f069d9a4360f3ff12c5f1f1008c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouI:0NA1Yakeer5+nsoj
TLSH
T14105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HetGsL.exe

Path C:\Windows\HetGsL.exe
Size 804KB
SHA256 d0ae50ba666e7a7a43929a522e930d868577ed9c0f1c1cafb14dae0b55c8b163
MD5 43e1856735ad38e9b2390bb1edd36d7c
SHA1 9e761a46366d8f0bae234e92ad36188a61cfa331
SHA512 65b7cee0c143e879789e4e0d76aeec2f70e441ebfb7691f5750b292d146e03f5dc7d93505a01eda6e977f1d03f03352f9bce71b956de895416fc6f66cd70c59a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouz:0NA1Yakeer5+nsok
TLSH
T1FA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

I9trJik2VpyvgMH.exe

Path C:\Windows\I9trJik2VpyvgMH.exe
Size 804KB
SHA256 e595e1444d99690371d1af9915b36ee45a13f24b167d9c6ea1bde2249641c040
MD5 ad3a2ee97a75c3e1732df30fa93c4896
SHA1 61390d798993d36fe9353f2c5326207f91badac4
SHA512 7342c2ee9942fb1db70a7952e8804020585f82925599ad82debdedf8002fd08257054368eaed464d80402b44498c79ddae02d84ba2ae25a69d312db492af4cc0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nso5
TLSH
T1B605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NCvwNR.exe

Path C:\Windows\NCvwNR.exe
Size 804KB
SHA256 0435d90e90fd9527abe855d3aff0995287388079d59239c48a69a8e6a610ab89
MD5 7e1ed8c0163b90e699d94bda2179cf41
SHA1 2ea14e52042619cc4e48fbf23b0c4259a36e7d47
SHA512 d6cc4d7359a4bf1a72b5956d91dc2a577e98f751c43a99816f6c97803c2ddaf9c9fa9f3ae3f75916c4850352760f687d1fe0558f949752dc87cb7a3e8d7c83d9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouB:0NA1Yakeer5+nsoG
TLSH
T1F905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OWjmPC6qoS.exe

Path C:\Windows\OWjmPC6qoS.exe
Size 804KB
SHA256 06cad111c42d914fb09a632b832d231f9e0c4e1b7d886d0b9f840e64944fe59c
MD5 cc94b49826995fd60dca8eb5c4411f29
SHA1 35290cc391b192a60c3195b018393bebf41dd131
SHA512 0aaec28dfa9329b6319f0c6d45c6566e44df12c1586fcc1f6349acc6834e8f216c7c1349861dafe19545d62cfe6a77fa9df4ce9f0320bfb8d115dddbddd1d549
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou0:0NA1Yakeer5+nso1
TLSH
T18F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RI3IgQ.exe

Path C:\Windows\RI3IgQ.exe
Size 804KB
SHA256 0a9a2af702e8c40cd4ba641dbdbe5516212c306723ee5e91452a533ffc1c8b07
MD5 9ddc065d416b5613fbf90da945ab417f
SHA1 87179639dbe39117faf44735a9eb4f49b278e1cd
SHA512 7aa671c54860494f8fb50bd5860ad37af053b7d947d6179cbbf4c2d27ba8892a96d03c0eeb23c36a04edeffed4d77aefef86938eff7717569da7001264762fa9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouY:0NA1Yakeer5+nsoP
TLSH
T13E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SxMgi.exe

Path C:\Windows\SxMgi.exe
Size 804KB
SHA256 ece7d97f9382908e0b97477ffca2a5f88cf73f060c303f441a7e8aa3e0b85f25
MD5 a2c4e560d9f1b27fae55dcabb644a05f
SHA1 e67cf285a48743142b9812bd8532bba061715fd3
SHA512 526b2f0758fd5f3857b49ef791756b9cc45954aa59c943ce408aa64836ef5e4d73b4eea798c2cb3946ab46a9a8e121a831127de34a4f2d3abb3e2c7b0be67e1b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouz:0NA1Yakeer5+nsoG
TLSH
T1EC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TToIm.exe

Path C:\Windows\TToIm.exe
Size 804KB
SHA256 cb0d18d79454b1fe9192a205db822ae3b4990d7c272831ccd20d6966d7950051
MD5 a9482186d26738edb8dab581b44df9b8
SHA1 8c9bf50ca4b9f8aaad93d4db89d5ecc74f1e69b8
SHA512 d77969ea2e2063e7c28047b4f90b3499e76fda06336abcafad76ac61923075036b3a2d292f6aa3239e647e12a1cf5ff5966b6eeebe3ae1772e81122354543d6a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nso3
TLSH
T14305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZmQtnSzC2mCp.exe

Path C:\Windows\ZmQtnSzC2mCp.exe
Size 804KB
SHA256 835a16349e8517f6db3f70ef149a5c5c249a7d5ebc049da56cdfb28cff27c498
MD5 c77497eae9e427d33d3c6b187d90e14d
SHA1 f5cf524dd8e410691cd04f9edbaa95419f92c4b7
SHA512 4a2316802135a1b7c4ccea216a6f8040f0e73be927bba342ddd091ba2ec5f17d4b9c79bbf1a8df7536437ce12f3188b340c9821a395b1a72891cd58a0f96f214
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouc:0NA1Yakeer5+nsox
TLSH
T12805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a25KA.exe

Path C:\Windows\a25KA.exe
Size 804KB
SHA256 12994eed05260c4ba07f5db7f2b1716830276c47eedbd0aa821c8f92c89cfd07
MD5 04190c446e1eaf54c5c9f730c31def55
SHA1 e587d32d23098f30c9d5f566ee9a906338beb88c
SHA512 ae00ac98e9810ebf67f2a17f35268850747500633199a51f73d6f7266828c1aff820723f55e3773af2140f6aef7a49cc247096ec4caa3a8c876833bc0db397ea
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouYH:0NA1Yakeer5+nsoj
TLSH
T16005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adCBm350BS0P.exe

Path C:\Windows\adCBm350BS0P.exe
Size 804KB
SHA256 e4174b86a870ca1b5eb50e344eb5117f7118be98547bb7530b3072b846493542
MD5 01f9a99aaf52938b3866f48d155b2f82
SHA1 39244098b6a6bd0a85350400131eb0d90759a098
SHA512 af26987fc2ada2d49e5a5fd259b721a1a8226e63b4788824a26a046e3298b45209c8272a5cac2d47ac676a1bb6b43107f2817fdfbbf1914928443f12a194826b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsoX
TLSH
T1D505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eKY4N2bKi2cYv.exe

Path C:\Windows\eKY4N2bKi2cYv.exe
Size 804KB
SHA256 575825f501d4573c96302207a41579baa6d48d319f2629fee97b5d7a77330978
MD5 688248723289bed02fffca9f0500f2a5
SHA1 1c3d1425d4b76f1d419e8219c9b24746110b72cd
SHA512 fab35b2aafb67ea59cea8cc9d22c2330942ac4140a07300429747ba5fa095b78697305deaafc90786a17d84adfea4345418d6ca3bc002f9ae5242c936f69a250
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoui:0NA1Yakeer5+nso7
TLSH
T1C405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev6KL7j.exe

Path C:\Windows\ev6KL7j.exe
Size 804KB
SHA256 5a347ac4848c13e62b46ac79e0b1c2b9d13fd1688ebd68bb38ad7d94a0b6dc05
MD5 06d9cd8672bf47bff8f1601bf72adcc7
SHA1 6440b81aefc881090d7ae73a411057abfedcddb4
SHA512 ec7f0d8a246ff77dc08f6eff62521c346d9d07d31cf4102ae1009a6a8db0ab5f3b7ac04891a0e81659d56308791f254e1510848d7fa7f18e7ed1db3b7c1c87ca
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou8:0NA1Yakeer5+nsoF
TLSH
T1AC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i4ctBDOwvpcLSw.exe

Path C:\Windows\i4ctBDOwvpcLSw.exe
Size 804KB
SHA256 6645d2738857a9920feac040d02a14c48841941c6204043e95426ec58f9c182b
MD5 d980929136e3516785ae563f2f1a5ab0
SHA1 787e16fddcd911ceb9e78a752911f1912329a338
SHA512 2aba16777fb9f9216045154b13b9df6d867baefdba52af90a1508325c5730042fad056346522accdf068bb9fcb8a1a8a064b9b3578d310965f16d14371829999
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsoY
TLSH
T10105A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pLpvnZCoLUpp.exe

Path C:\Windows\pLpvnZCoLUpp.exe
Size 804KB
SHA256 837ec1d5369fda033360b60f7da782b73af1dc17bee241a3be9cc41617624448
MD5 124b3585f784c8064cd0edd8e571a432
SHA1 25cb094aa0bfcd52d8a26acb3f2c14dea42bbf0d
SHA512 0f57206954f4b5ad48be180450b5e9e076b09b2acff6132a518385200f42d47e1975644d70e73628ce7c660489f49cdb3fc1e30462bc09a4fb6eeff2de98c2a6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoul:0NA1Yakeer5+nsoW
TLSH
T1D805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

y8oDk5aoDt.exe

Path C:\Windows\y8oDk5aoDt.exe
Size 804KB
SHA256 7f14b259965c00c719b6e72d0f29018bc8c3575fa07a46c903ffa1e662401b71
MD5 1340e5c6f90680afd87731ebad1f8d84
SHA1 6cbb81f44d16b89f98b068412d1b659435e2d0c3
SHA512 a1ae3d0c6b8f6e1a70af0e1d91421aede3060117b2f86243f5e4652ace331a2bdef8c77b6af6c6e9eeb7f5e5743a9dded5dddbd2d0fffd8408c893ab665ed8f8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nso7
TLSH
T14D05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads