f776134c1d4bc1b79f2e9e1f60a5eab1453b8c7065a917fb40240d6bd14f9a77

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_844b4dbe3aa99264faa6ae4d3144ff2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260813-e15w4a1grb
SHA256 f776134c1d4bc1b79f2e9e1f60a5eab1453b8c7065a917fb40240d6bd14f9a77
MD5 844b4dbe3aa99264faa6ae4d3144ff2d
SHA1 51acd29dfd5c2895b7faf0e23b1cb21358eda008
SHA512 e7660e45e3f5cc80ff8d0834d7e3556fd5037e6f3aff540b78248fe9b89dcc6d13215d23466362bd8a0b30de66860617a10619f6cee9dd5b2adba429854ee811
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoux:0NA1Yakeer5+nsoW
TLSH
T1D105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (1852) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 17 IoCs

pid	Process
5076	bFoKC.exe
4800	MbxUGU.exe
3692	1G3SZ1Jt6oL.exe
1876	Z8kqBj1.exe
5208	k1yxcC.exe
3264	pZgh6nMBrivFk.exe
1096	RdB61J7.exe
6016	FUjG6yl.exe
3940	ucZbwGZkdpFCLHy.exe
6284	VHpa91YX5D.exe
6544	kHYnVly6Cen.exe
6824	sYz3TMWu6yS.exe
7092	YPGpJteuiENS0zC.exe
7212	hxJaziSeWrRGKe.exe
7576	dKIM3Zz8U.exe
7892	D40knV4Z.exe
8156	GXVCXwSyl5EIA5.exe

Adds Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCCWIN98 = "C:\\Windows\\GXVCXwSyl5EIA5.exe"	D40knV4Z.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VBCMSERV = "C:\\Windows\\MbxUGU.exe"	bFoKC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVPROXY = "C:\\Windows\\pZgh6nMBrivFk.exe"	k1yxcC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SPHINX = "C:\\Windows\\FUjG6yl.exe"	RdB61J7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NEOWATCHLOG = "C:\\Windows\\bFoKC.exe"	2026-08-13_844b4dbe3aa99264faa6ae4d3144ff2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPFTRAY = "C:\\Windows\\RdB61J7.exe"	pZgh6nMBrivFk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CLAW95CF = "C:\\Windows\\dKIM3Zz8U.exe"	hxJaziSeWrRGKe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFINET = "C:\\Windows\\Z8kqBj1.exe"	1G3SZ1Jt6oL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AUTOTRACE = "C:\\Windows\\ucZbwGZkdpFCLHy.exe"	FUjG6yl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWEEPNET = "C:\\Windows\\kHYnVly6Cen.exe"	VHpa91YX5D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOOKOUT = "C:\\Windows\\YPGpJteuiENS0zC.exe"	sYz3TMWu6yS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVNT = "C:\\Windows\\hxJaziSeWrRGKe.exe"	YPGpJteuiENS0zC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPROTECT = "C:\\Windows\\D40knV4Z.exe"	dKIM3Zz8U.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSMAIN = "C:\\Windows\\1G3SZ1Jt6oL.exe"	MbxUGU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSMON = "C:\\Windows\\k1yxcC.exe"	Z8kqBj1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CLEANER = "C:\\Windows\\VHpa91YX5D.exe"	ucZbwGZkdpFCLHy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVLU32 = "C:\\Windows\\sYz3TMWu6yS.exe"	kHYnVly6Cen.exe

Drops file in Windows directory 34 IoCs

description	ioc	Process
File created	C:\Windows\RdB61J7.exe	pZgh6nMBrivFk.exe
File opened for modification	C:\Windows\RdB61J7.exe	pZgh6nMBrivFk.exe
File created	C:\Windows\VHpa91YX5D.exe	ucZbwGZkdpFCLHy.exe
File created	C:\Windows\dKIM3Zz8U.exe	hxJaziSeWrRGKe.exe
File created	C:\Windows\GXVCXwSyl5EIA5.exe	D40knV4Z.exe
File opened for modification	C:\Windows\k1yxcC.exe	Z8kqBj1.exe
File opened for modification	C:\Windows\Z8kqBj1.exe	1G3SZ1Jt6oL.exe
File opened for modification	C:\Windows\FUjG6yl.exe	RdB61J7.exe
File created	C:\Windows\ucZbwGZkdpFCLHy.exe	FUjG6yl.exe
File created	C:\Windows\kHYnVly6Cen.exe	VHpa91YX5D.exe
File created	C:\Windows\Z8kqBj1.exe	1G3SZ1Jt6oL.exe
File opened for modification	C:\Windows\kHYnVly6Cen.exe	VHpa91YX5D.exe
File opened for modification	C:\Windows\sYz3TMWu6yS.exe	kHYnVly6Cen.exe
File opened for modification	C:\Windows\hxJaziSeWrRGKe.exe	YPGpJteuiENS0zC.exe
File opened for modification	C:\Windows\dKIM3Zz8U.exe	hxJaziSeWrRGKe.exe
File opened for modification	C:\Windows\pZgh6nMBrivFk.exe	k1yxcC.exe
File created	C:\Windows\bFoKC.exe	2026-08-13_844b4dbe3aa99264faa6ae4d3144ff2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\MbxUGU.exe	bFoKC.exe
File created	C:\Windows\YPGpJteuiENS0zC.exe	sYz3TMWu6yS.exe
File created	C:\Windows\pZgh6nMBrivFk.exe	k1yxcC.exe
File opened for modification	C:\Windows\VHpa91YX5D.exe	ucZbwGZkdpFCLHy.exe
File created	C:\Windows\D40knV4Z.exe	dKIM3Zz8U.exe
File created	C:\Windows\sYz3TMWu6yS.exe	kHYnVly6Cen.exe
File created	C:\Windows\MbxUGU.exe	bFoKC.exe
File created	C:\Windows\1G3SZ1Jt6oL.exe	MbxUGU.exe
File opened for modification	C:\Windows\ucZbwGZkdpFCLHy.exe	FUjG6yl.exe
File opened for modification	C:\Windows\GXVCXwSyl5EIA5.exe	D40knV4Z.exe
File opened for modification	C:\Windows\bFoKC.exe	2026-08-13_844b4dbe3aa99264faa6ae4d3144ff2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\1G3SZ1Jt6oL.exe	MbxUGU.exe
File created	C:\Windows\k1yxcC.exe	Z8kqBj1.exe
File created	C:\Windows\FUjG6yl.exe	RdB61J7.exe
File opened for modification	C:\Windows\YPGpJteuiENS0zC.exe	sYz3TMWu6yS.exe
File created	C:\Windows\hxJaziSeWrRGKe.exe	YPGpJteuiENS0zC.exe
File opened for modification	C:\Windows\D40knV4Z.exe	dKIM3Zz8U.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
7460	6824	WerFault.exe	112
7800	7092	WerFault.exe	114
6888	7892	WerFault.exe	125
7116	6544	WerFault.exe	110
1324	7576	WerFault.exe	121

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ucZbwGZkdpFCLHy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YPGpJteuiENS0zC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dKIM3Zz8U.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D40knV4Z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_844b4dbe3aa99264faa6ae4d3144ff2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Z8kqBj1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k1yxcC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FUjG6yl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sYz3TMWu6yS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MbxUGU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VHpa91YX5D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kHYnVly6Cen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bFoKC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdB61J7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hxJaziSeWrRGKe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GXVCXwSyl5EIA5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1G3SZ1Jt6oL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pZgh6nMBrivFk.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-13_844b4dbe3aa99264faa6ae4d3144ff2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_844b4dbe3aa99264faa6ae4d3144ff2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3116

C:\Windows\bFoKC.exe
C:\Windows\bFoKC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5076

C:\Windows\MbxUGU.exe
C:\Windows\MbxUGU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4800

C:\Windows\1G3SZ1Jt6oL.exe
C:\Windows\1G3SZ1Jt6oL.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3692

C:\Windows\Z8kqBj1.exe
C:\Windows\Z8kqBj1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1876

C:\Windows\k1yxcC.exe
C:\Windows\k1yxcC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5208

C:\Windows\pZgh6nMBrivFk.exe
C:\Windows\pZgh6nMBrivFk.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3264

C:\Windows\RdB61J7.exe
C:\Windows\RdB61J7.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1096

C:\Windows\FUjG6yl.exe
C:\Windows\FUjG6yl.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6016

C:\Windows\ucZbwGZkdpFCLHy.exe
C:\Windows\ucZbwGZkdpFCLHy.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3940

C:\Windows\VHpa91YX5D.exe
C:\Windows\VHpa91YX5D.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6284

C:\Windows\kHYnVly6Cen.exe
C:\Windows\kHYnVly6Cen.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6544 -s 2312
  2⤵
  - Program crash
  PID:7116

C:\Windows\sYz3TMWu6yS.exe
C:\Windows\sYz3TMWu6yS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6824 -s 2096
  2⤵
  - Program crash
  PID:7460

C:\Windows\YPGpJteuiENS0zC.exe
C:\Windows\YPGpJteuiENS0zC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 2096
  2⤵
  - Program crash
  PID:7800

C:\Windows\hxJaziSeWrRGKe.exe
C:\Windows\hxJaziSeWrRGKe.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6824 -ip 6824
1⤵
PID:7436

C:\Windows\dKIM3Zz8U.exe
C:\Windows\dKIM3Zz8U.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7576 -s 2424
  2⤵
  - Program crash
  PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7092 -ip 7092
1⤵
PID:7772

C:\Windows\D40knV4Z.exe
C:\Windows\D40knV4Z.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7892 -s 2096
  2⤵
  - Program crash
  PID:6888

C:\Windows\GXVCXwSyl5EIA5.exe
C:\Windows\GXVCXwSyl5EIA5.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 7892 -ip 7892
1⤵
PID:6868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6544 -ip 6544
1⤵
PID:6832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 7576 -ip 7576
1⤵
PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1G3SZ1Jt6oL.exe

Path C:\Windows\1G3SZ1Jt6oL.exe
Size 804KB
SHA256 ac4379d585b7f8ab024436c51429794b0a0b69eb9057336729240e88816ce21e
MD5 51ea983838f34ef28bdc7fdb36e21564
SHA1 f9a3f87d38c8c30bf66753bffbf4eea611b5914b
SHA512 a4b4d0782acccc2d63993407c716e08d42cc6ae510e8f1a8bb6b9d0e30abe5c98608283c5406335094f4196c1efd2aa386fff5d16820b58e2f4118496770b2a3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouG:0NA1Yakeer5+nso3
TLSH
T12905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D40knV4Z.exe

Path C:\Windows\D40knV4Z.exe
Size 804KB
SHA256 14fd05d3529a5c668539ebca6b4a42b1dbe57926b1662672ff1c18bd5a3dba86
MD5 579e2608a001d211b6406695387b1fc5
SHA1 aafa04f1bf2bef57d2335d8d5be008478cf78fe4
SHA512 1a3801ee498a3b8a922b1ac7473bd7f8a3ed71f8b46fbe4115fc5b1d053a7e481b4855cdddea60b105535d3a8a5be6b64f672eb83998aebb29886fd2971b6dca
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouZ:0NA1Yakeer5+nsow
TLSH
T1F505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FUjG6yl.exe

Path C:\Windows\FUjG6yl.exe
Size 804KB
SHA256 187c1755006d94d557045f3d32ee2f1ad0059ddeb5980a5941eb096b2f877b7a
MD5 119e0b012276a6923fb3107a2648da98
SHA1 e61a62b0bc260d01e74dd4b5fbf093905b588717
SHA512 9c4925fe286629c9f2f90cf7b6aa57891c6d9b998bee0f241ffcba70c0d8dad1f21c960200f1c93af2a2f8ac0fe04a672a08cf8dd4cc9688e564e3ec557da644
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsoc
TLSH
T17105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GXVCXwSyl5EIA5.exe

Path C:\Windows\GXVCXwSyl5EIA5.exe
Size 804KB
SHA256 bcd85ec2837cf55ac3caf7d426b8318ae6ce688eb67292d05fd2f7dcc7cbac50
MD5 0b76affa7cc51f1424775db9a6a9c9d3
SHA1 7be656e6c7004277b9ad58cefd99b88d493ea2cb
SHA512 ffe133c4370a2347e7ee8c69ba4fe406e4c6be9f35e765dbde56ae34758602536ef6bd67ba0bb208206f5f168ed2fc5d8c95976a3c7746613d54c5cd4650fd21
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsoq
TLSH
T1EF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MbxUGU.exe

Path C:\Windows\MbxUGU.exe
Size 804KB
SHA256 5eb657df510333346ce05501579c9a74b7615700f4a224017a6ec43f0cc04caa
MD5 2fc8935f3b833491632e1320862284da
SHA1 551654e586eac1f4710c2e866cb3435f98eb17bb
SHA512 df31f2cf4ed79ebedd4ba06af22d17629eb1ee569e304430917e163dad8272d596343483945d4e1fa8d7ed0d2a379555f9048c38c47d841ac4cb0a77f1d917f2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou8:0NA1Yakeer5+nsoz
TLSH
T12005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdB61J7.exe

Path C:\Windows\RdB61J7.exe
Size 804KB
SHA256 38114d17316fde7522d9da511ceac507d10b2791aa94bd89f710162fb5dc4176
MD5 5776cb3f7c432eccbda2a33a1bfd381d
SHA1 e386d1029e4f3cd23c5e57eb902fbc00c6b7fc5a
SHA512 7ca4750848b9ce97bfc5c63c788d15c74a11eb07e6f871b55f3fe5bfd76fc4f055d630e2af1fc7ab8f65d56b168eb733a1cb32db135fa345b82001aecce4792f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou5:0NA1Yakeer5+nsow
TLSH
T19205A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VHpa91YX5D.exe

Path C:\Windows\VHpa91YX5D.exe
Size 804KB
SHA256 9a8707eafee83211b7875123cf0f8dfaa773227ca6f3cf60226f1b991271b962
MD5 9cdd94b6b8110daae9dd0448e8339489
SHA1 da0950f629b2a0ca733e731545d0671aeedc3c47
SHA512 8835d18e867bdfa34850dbe7fd2f04eaa79cf3576a60f30623b5f2e7fb2f3e85a31739b9ca57020c2864f9de0d68811ff120c7cb1eeb6498387adef27ec16d1d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou0:0NA1Yakeer5+nsoF
TLSH
T1F605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YPGpJteuiENS0zC.exe

Path C:\Windows\YPGpJteuiENS0zC.exe
Size 804KB
SHA256 a9b14fe49877b0d3cde9ae630cc03e311842f7077736b4dd0c9110008926be83
MD5 9b0ee6aaeff54459dc54f97b5e8457ba
SHA1 ec9cbad0de80f7636af53b4f86c5d3df049882d3
SHA512 25b0874ad7d73f975d62fcd825c6d74776dc67b2cd65d3740f20510f0eaa4f0b57afa68e10e0dfba741c54f008a47ad34f0a60c1bf9431c9d0ef0755525f6947
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou5:0NA1Yakeer5+nsoo
TLSH
T10E05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Z8kqBj1.exe

Path C:\Windows\Z8kqBj1.exe
Size 804KB
SHA256 45f366c423cb54a0db5974ce8f83920277256f18d0920e30d494c32eb349b7de
MD5 3e71ef17c6ef7c20e519fcd743400219
SHA1 d334ff702478b277afa4813fa7f9bc830f3554bd
SHA512 b485d2bb85222c311636f8fd77c8e38bd2797591dd5aa0c77176c7ff3e70f683847c67a036ab140c12645cbbbcf26d8d3344343942f657b1e06d41b5f0f8ba0a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouU:0NA1Yakeer5+nsoJ
TLSH
T1F305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bFoKC.exe

Path C:\Windows\bFoKC.exe
Size 804KB
SHA256 404d087b45f61fb9c69074fe26789e33c4cdce8be71beebe4316cdf045827ea7
MD5 e142fbdf6474033ccbf731bd405dfe12
SHA1 daa95bd4134ec52aa459812609fa7cf9c57c40bd
SHA512 809f050f42eeb9f5b5d904ba5d123971ea49dc3acd665eec150cf918c75aa9aa0249fc524e71b3ff30e43b98782b3988752aafce7cb8529f6c0377f1ae25131a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nso3
TLSH
T15305A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dKIM3Zz8U.exe

Path C:\Windows\dKIM3Zz8U.exe
Size 804KB
SHA256 6b9e4e8b323b5ef121f07855057ed5b14739a00dc8e37f1325aabbd4846f41c7
MD5 1be424f27b9c0679db9702b8171c520f
SHA1 d4e3b58043a52ae48e144a6f81be8070e3d38390
SHA512 6a7b8d2d12257f714bb71051c4dbeea8607c69e316693dfb99ac4322e7a1e53de0b803ed3907f6fa3d2cf53e7fa4b8c95e02ac981b1f8e47aa12566a2ca27e07
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou3:0NA1Yakeer5+nsoM
TLSH
T12105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hxJaziSeWrRGKe.exe

Path C:\Windows\hxJaziSeWrRGKe.exe
Size 804KB
SHA256 ce23e4f62b3ff613bcb8b4127556c25db4a4b141892d199f09f7afaab14b0cec
MD5 e09ff284fef85f4174366fde3e5c4688
SHA1 88a3146ec1dbe782fa4fcc1ca868e1d630eea66d
SHA512 adf6eee82ab6e5ba950962566ca8428093f6baff912b89028edfcecece2a6fa89111655b6ecdae97935858698709e0c66ac4588bf85a06e87562c10e0312bc9a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouf:0NA1Yakeer5+nsos
TLSH
T11705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k1yxcC.exe

Path C:\Windows\k1yxcC.exe
Size 804KB
SHA256 3a164a2fa744dd7e41725b02c612cbee8a353df0ca34aaf583a6c9acc8b29c50
MD5 424f3b248025163c6859472f5058cd47
SHA1 35310bdc86e2af731b68edd0ac7b922736074059
SHA512 242a65e8671d7e5a98c969bafba4cb2c89b01496815422de75e682616c710218c1d297e623c4020d1cb28cd9bfb1e0f2a2bb72c44329806afd5325631aa2dfc0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoue:0NA1Yakeer5+nsoD
TLSH
T16505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kHYnVly6Cen.exe

Path C:\Windows\kHYnVly6Cen.exe
Size 804KB
SHA256 6906e6a048101c00ecbf18e3be891184f1f6babb8e4e75a7e21247ce35297112
MD5 35b112b5e6f250389864eb83ecef3ccc
SHA1 612bc02a64ccb75b468f910dc41c8d1d9be37bdc
SHA512 a04101218f53c7102faab4e7a5ab9134fc2752390e8676d9963310a3a93446bce114e550d889934da4586310e8cc13e4c863fd8f5b498ea5bcd32a50a330799d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouJ:0NA1Yakeer5+nso4
TLSH
T12305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pZgh6nMBrivFk.exe

Path C:\Windows\pZgh6nMBrivFk.exe
Size 804KB
SHA256 442475d81ce6f8cb1df7fbdf13d20b38c2566953ba45b5be22a45f645c86e8a6
MD5 7a7e00a5a674df6874bbce3a81e387ba
SHA1 4904ea56f3db9c99319da2ce9f19f8a87b79ef04
SHA512 3c02b8bd8fbd2d61c7bc875624a5834670844cb9cbfcecf2b9af3b37cd2908d32c13191c1d443070b3efaecbf1e1a819da8a3f8147cf2cfe08c24fbbc5c4cc2f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouS:0NA1Yakeer5+nsol
TLSH
T1D905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sYz3TMWu6yS.exe

Path C:\Windows\sYz3TMWu6yS.exe
Size 804KB
SHA256 77615f662aa841ee24545996a15ad4ca2327d739c9aaecfe02f8c11593aae3ba
MD5 a783cdc63ec87e0d1b08111705ff58b6
SHA1 83c04623fbbb29e5e4297cc0912235ad9f35a8b2
SHA512 9dc0174111f0490c22d3eafda557625e29dc0e90279b73cc857e2df8acb1e9c6c0aa2110bb9cbb5b5f3dca86d467ad7fe5e03bc862906bd68c05a0fda0829a5c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nsoG
TLSH
T1CF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucZbwGZkdpFCLHy.exe

Path C:\Windows\ucZbwGZkdpFCLHy.exe
Size 804KB
SHA256 1d3a6bcca005a701ac9076a5f1d98c285686e1d8fb0efeee9b7e2e0cb520bb09
MD5 7bc836213336678d1590b95981343064
SHA1 9736e74560d3e87599735d08d8d6d818d79eec76
SHA512 5944a05cdd3036ae601c98653414e555808cbdf694f144a68bd85d4a80252264a0d124e39d1bc61de4163395d95e75feedf6a3a4c1a54487565fe5146bd7fb6a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFous:0NA1Yakeer5+nso5
TLSH
T1A205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads