316469377e8136d1f5a9386a4be0e2c9cccec5b4c7e61886935d763352f95f46

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_477e232d610c743cdcb920e77725210f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260819-nt7lsaef88
SHA256 316469377e8136d1f5a9386a4be0e2c9cccec5b4c7e61886935d763352f95f46
MD5 477e232d610c743cdcb920e77725210f
SHA1 fdb2a06b443291ce48c41d7edf50ecc2c162b35b
SHA512 c6360b89fddf8dbb1ab3226f6482e84a9129d922214e119d894b9c795530c3e6a9996dc4767c7e65fe6f735606385fb77d077c3e2324d9f52d56cf098ffcafd5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoy
TLSH
T15705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (1009) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 10 IoCs

pid	Process
3548	39mFruR.exe
4508	iLcLlDdv6ALbb.exe
2648	3F7YjtoM.exe
2968	StvaZ1ZUu.exe
2484	0RvEyCTz.exe
3148	HREnFItS2.exe
1584	rYYoq78OUs0rnm.exe
1636	E93KOmOvPIPIHoY.exe
2328	QlEvxl42Cc4.exe
5836	4RGvS.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAV AUTO-PROTECT = "C:\\Windows\\iLcLlDdv6ALbb.exe"	39mFruR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVGCC32 = "C:\\Windows\\StvaZ1ZUu.exe"	3F7YjtoM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NVC95 = "C:\\Windows\\0RvEyCTz.exe"	StvaZ1ZUu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVW = "C:\\Windows\\HREnFItS2.exe"	0RvEyCTz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VBCONS = "C:\\Windows\\E93KOmOvPIPIHoY.exe"	rYYoq78OUs0rnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ESPWATCH = "C:\\Windows\\QlEvxl42Cc4.exe"	E93KOmOvPIPIHoY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCAPP = "C:\\Windows\\4RGvS.exe"	QlEvxl42Cc4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGAVRTCL = "C:\\Windows\\39mFruR.exe"	2026-08-19_477e232d610c743cdcb920e77725210f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCAPP = "C:\\Windows\\3F7YjtoM.exe"	iLcLlDdv6ALbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCAN95 = "C:\\Windows\\rYYoq78OUs0rnm.exe"	HREnFItS2.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\39mFruR.exe	2026-08-19_477e232d610c743cdcb920e77725210f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\iLcLlDdv6ALbb.exe	39mFruR.exe
File created	C:\Windows\rYYoq78OUs0rnm.exe	HREnFItS2.exe
File opened for modification	C:\Windows\rYYoq78OUs0rnm.exe	HREnFItS2.exe
File created	C:\Windows\3F7YjtoM.exe	iLcLlDdv6ALbb.exe
File opened for modification	C:\Windows\3F7YjtoM.exe	iLcLlDdv6ALbb.exe
File created	C:\Windows\0RvEyCTz.exe	StvaZ1ZUu.exe
File created	C:\Windows\HREnFItS2.exe	0RvEyCTz.exe
File opened for modification	C:\Windows\QlEvxl42Cc4.exe	E93KOmOvPIPIHoY.exe
File created	C:\Windows\39mFruR.exe	2026-08-19_477e232d610c743cdcb920e77725210f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\iLcLlDdv6ALbb.exe	39mFruR.exe
File created	C:\Windows\StvaZ1ZUu.exe	3F7YjtoM.exe
File opened for modification	C:\Windows\HREnFItS2.exe	0RvEyCTz.exe
File created	C:\Windows\QlEvxl42Cc4.exe	E93KOmOvPIPIHoY.exe
File opened for modification	C:\Windows\4RGvS.exe	QlEvxl42Cc4.exe
File opened for modification	C:\Windows\StvaZ1ZUu.exe	3F7YjtoM.exe
File opened for modification	C:\Windows\0RvEyCTz.exe	StvaZ1ZUu.exe
File created	C:\Windows\E93KOmOvPIPIHoY.exe	rYYoq78OUs0rnm.exe
File opened for modification	C:\Windows\E93KOmOvPIPIHoY.exe	rYYoq78OUs0rnm.exe
File created	C:\Windows\4RGvS.exe	QlEvxl42Cc4.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
6132	1148	WerFault.exe	87
4948	3148	WerFault.exe	103
6408	3548	WerFault.exe	90
6700	2484	WerFault.exe	101
6780	1584	WerFault.exe	105
2568	1636	WerFault.exe	107

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rYYoq78OUs0rnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E93KOmOvPIPIHoY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4RGvS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_477e232d610c743cdcb920e77725210f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3F7YjtoM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0RvEyCTz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QlEvxl42Cc4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39mFruR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iLcLlDdv6ALbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StvaZ1ZUu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HREnFItS2.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-19_477e232d610c743cdcb920e77725210f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_477e232d610c743cdcb920e77725210f_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 2164
  2⤵
  - Program crash
  PID:6132

C:\Windows\39mFruR.exe
C:\Windows\39mFruR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 2212
  2⤵
  - Program crash
  PID:6408

C:\Windows\iLcLlDdv6ALbb.exe
C:\Windows\iLcLlDdv6ALbb.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1148 -ip 1148
1⤵
PID:5344

C:\Windows\3F7YjtoM.exe
C:\Windows\3F7YjtoM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2648

C:\Windows\StvaZ1ZUu.exe
C:\Windows\StvaZ1ZUu.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2968

C:\Windows\0RvEyCTz.exe
C:\Windows\0RvEyCTz.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 2404
  2⤵
  - Program crash
  PID:6700

C:\Windows\HREnFItS2.exe
C:\Windows\HREnFItS2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 2088
  2⤵
  - Program crash
  PID:4948

C:\Windows\rYYoq78OUs0rnm.exe
C:\Windows\rYYoq78OUs0rnm.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 2400
  2⤵
  - Program crash
  PID:6780

C:\Windows\E93KOmOvPIPIHoY.exe
C:\Windows\E93KOmOvPIPIHoY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 2420
  2⤵
  - Program crash
  PID:2568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 3148 -ip 3148
1⤵
PID:6096

C:\Windows\QlEvxl42Cc4.exe
C:\Windows\QlEvxl42Cc4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2328

C:\Windows\4RGvS.exe
C:\Windows\4RGvS.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3548 -ip 3548
1⤵
PID:6384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2484 -ip 2484
1⤵
PID:6680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1584 -ip 1584
1⤵
PID:6760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1636 -ip 1636
1⤵
PID:7164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0RvEyCTz.exe

Path C:\Windows\0RvEyCTz.exe
Size 804KB
SHA256 156bf4fd9d4402e6613212af36d3d79fd468131f71eaddd358afd9aab684b367
MD5 5bb0ce0a2afd4aa4af7e06d93969f907
SHA1 b682d0a9345e376f6ce77e1fe777ec71f1f65e03
SHA512 7e2cda673bff1710d85b497a7b4f936f0ba3bc94e25464a3c46d6bef76435fcc180be4a3a1826056a0965135b98c7208434e7f017583a3880a775ca18aea47b1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nso6
TLSH
T1AC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39mFruR.exe

Path C:\Windows\39mFruR.exe
Size 804KB
SHA256 4d0521df03407cb0056319a2d07afd9cdffd0c2e4572f47e9c8a3e2dbbffeaa6
MD5 a5fc6becef4e379f27218a57c5d805ed
SHA1 ac17de949520961ebc614ae55d1067f1ab13f3da
SHA512 c477a1602f1d333f8778aff3576ef0166d7b285bd498074205bc6ee3d251f226826ea01bf8213a01f45a1e73bd345456f54201824876c93ab12dabae2dcad46f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nsoL
TLSH
T14105A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3F7YjtoM.exe

Path C:\Windows\3F7YjtoM.exe
Size 804KB
SHA256 b09cea34c93907de818101a0ee31e1acd1f32bf78464e21b942a286ffa7aa0d8
MD5 e105abfd9f292cbdef4260259d9e57e3
SHA1 dd4fbbde2a29dd79fcd3af43ac912bc5c46a2ca1
SHA512 f2bb118fb711923b6524c4a2922218da24d949003389422b4d94d71946630d4faa91ebc545246f1ed34976ac262044aac76545e9313d681079d6e694c75d3061
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou0:0NA1Yakeer5+nsoF
TLSH
T1F705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4RGvS.exe

Path C:\Windows\4RGvS.exe
Size 804KB
SHA256 f6b4eb1bc91fe97e08a8a2b5ef3eaec122eae43f4af8a9ce26a13e5ab277d523
MD5 9b192ffb1a8d5cda1e197f43ae48b9a4
SHA1 190796b25f60c26c2f6495ebfc202efffec95122
SHA512 06f460c773bead06daca31b3c0ef8b8ef93da3800829fa8984a6a9e919951aff249da8febbfaf49a9b03d7253e1c2c01aa98b76db665c49d12ea130531f0446e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou5:0NA1Yakeer5+nso+
TLSH
T16205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E93KOmOvPIPIHoY.exe

Path C:\Windows\E93KOmOvPIPIHoY.exe
Size 804KB
SHA256 08fb2a048e65b6dfe259c2c63fc71a8e05af4a3636c53e4146e38cf2f9d1ccaa
MD5 aebcab00544605dc53b8a91a365db0f6
SHA1 c8ce736aa3ab82cad16771bc6923e77bc90d8d00
SHA512 c428c2769a508332ada4eff5a7067994dbe752bc3dfcf7a0633c1f9c19e2031c92f078402c95cf62965366717302320d7d828370ea2438290f19c2633e0deb64
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nsoO
TLSH
T16505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HREnFItS2.exe

Path C:\Windows\HREnFItS2.exe
Size 804KB
SHA256 4da8548da3106249fd9b7bd54e0fa89af5b3224097712f4afb2a0b42e52245e4
MD5 7498075a472e4e968e318e54c19811c8
SHA1 a3b2462d84ae1abe848de1221eaecec38429e5d9
SHA512 e5665fc9ff8af454908484d45e429418d57aa680c4d28f10ef1c4ff13e87af9ccd6419fc21725b52c70e027c92c54275dd1d767ae3d55f592266551810f984d3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsoe
TLSH
T17105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QlEvxl42Cc4.exe

Path C:\Windows\QlEvxl42Cc4.exe
Size 804KB
SHA256 a4ed19ea584f581cdbb31ab86aa928819d6106a1d4359bbce9b0e8d161db82d3
MD5 03147d09ef4e49bcd072de0086f4ef06
SHA1 ba144cab691db83357e73ba64faac35398f40db2
SHA512 ef35417ef6369d8b393cec31c0783bad6860ad50c63479fdff51655b553e8736ce22ab98cdc91d853269daf3dbc8067c044e67609fea24b9c1b6aeb39f71142c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoe
TLSH
T18B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StvaZ1ZUu.exe

Path C:\Windows\StvaZ1ZUu.exe
Size 804KB
SHA256 b97340a8e3ac7f4702078b25129a0141859f6916cf03751835bcf637caa51482
MD5 dccb57287ec32e7f47f17369779023e9
SHA1 febab8d7182ea0d4ae0c72a6ce3f2a4f608c5620
SHA512 6ba87d4b0fd0a4dd097e8c4b0f9a5374cd036a437b9a75069c8c3a3b8689cae3b32f66c4ab912882d089db0308aee2a925c2850e9c01142e35e275ba8e2e0e56
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nsov
TLSH
T1F905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iLcLlDdv6ALbb.exe

Path C:\Windows\iLcLlDdv6ALbb.exe
Size 804KB
SHA256 933b91a5841e2fa62573428bf1464442b9b3c4672e86c199d5c38a30c89f3c20
MD5 eb587a0525bf338cdfac9c4f6e3e69a1
SHA1 7362357505bf057cb5ba25668be43e869763d709
SHA512 c1192ca90eac5b2fa3b77e3fcc3efca53cf3686191df8d0b1213dd11e59a33ecae52430189df4a13f12394d9809a3dc0978b7b843726f403fb3da43bfd091513
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsoQ
TLSH
T1D705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rYYoq78OUs0rnm.exe

Path C:\Windows\rYYoq78OUs0rnm.exe
Size 804KB
SHA256 8e1fbb4bf944352f33838ef53dbc11eda9194e094850b48e2844f7b7bfee95c5
MD5 08e93bb0e1143b698d515e63690d4ef4
SHA1 986782115b50d6ac3faad27ff426212ae30fb577
SHA512 28e2853545776257f572a70fffedee23ffa9bc8a9adafd2fa9e2f11b3645c82b3bcca3a81843d5973d6fba8e8e949f5eee8379697405c7b62cb79c9512c11c89
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsoG
TLSH
T18F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads