f80ed15a8add2178c7453310dc242a439079bdeb3ad25270503d8bec9ff35846

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_926f7230a4078f3f4a519270cb3c0d2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260820-pd42dsdb45
SHA256 f80ed15a8add2178c7453310dc242a439079bdeb3ad25270503d8bec9ff35846
MD5 926f7230a4078f3f4a519270cb3c0d2d
SHA1 3851b7573c8d5d2e9c72bd4a31af707995898f2d
SHA512 93e555bb4f3e486467abb9c7ba1f8914b1609e3d69b5ad27b6445a21d036c81bd244220000637ddae40370479ba28c3141eee8ff5dd12a42a77f0c26af1b4a49
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsoy
TLSH
T19A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (1898) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 20 IoCs

pid	Process
1328	PUgA6GkhyjxZ5rQ.exe
4476	EBpose52eDunU.exe
6528	SyWwPO5ID.exe
5200	g94X6O68.exe
6512	B7TbjXl6.exe
2388	3cJp1cm9.exe
2824	yipD5E.exe
1748	BVp3C2gaF3Q6cc.exe
5980	MDhn41yRSa.exe
2316	Kaa8Mh65NrkQ.exe
5820	VCOAgiyBlT.exe
3692	7eLrFN.exe
2888	gXCE3xPM41s0K4.exe
5588	hpRzglTs1eFJ.exe
2656	ZEqxX9.exe
7312	x6KaSU.exe
7568	3C5r8i.exe
7816	gPW60OY3JY1sO.exe
8108	QIBT7Dv.exe
7492	hcih4.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVPROXY = "C:\\Windows\\SyWwPO5ID.exe"	EBpose52eDunU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LDPROMEN = "C:\\Windows\\3cJp1cm9.exe"	B7TbjXl6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FNRB32 = "C:\\Windows\\VCOAgiyBlT.exe"	Kaa8Mh65NrkQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EVPN = "C:\\Windows\\ZEqxX9.exe"	hpRzglTs1eFJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AUTOTRACE = "C:\\Windows\\7eLrFN.exe"	VCOAgiyBlT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IFACE = "C:\\Windows\\x6KaSU.exe"	ZEqxX9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CPDCLNT = "C:\\Windows\\BVp3C2gaF3Q6cc.exe"	yipD5E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPSCHECK = "C:\\Windows\\MDhn41yRSa.exe"	BVp3C2gaF3Q6cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVAPSVC = "C:\\Windows\\Kaa8Mh65NrkQ.exe"	MDhn41yRSa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WATCHDOG = "C:\\Windows\\gXCE3xPM41s0K4.exe"	7eLrFN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPFSERVICE = "C:\\Windows\\3C5r8i.exe"	x6KaSU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NVC95 = "C:\\Windows\\gPW60OY3JY1sO.exe"	3C5r8i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFSCANGUI = "C:\\Windows\\hcih4.exe"	QIBT7Dv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WIMMUN32 = "C:\\Windows\\PUgA6GkhyjxZ5rQ.exe"	2026-08-20_926f7230a4078f3f4a519270cb3c0d2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOOKOUT = "C:\\Windows\\EBpose52eDunU.exe"	PUgA6GkhyjxZ5rQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-STOPW = "C:\\Windows\\g94X6O68.exe"	SyWwPO5ID.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SERV95 = "C:\\Windows\\B7TbjXl6.exe"	g94X6O68.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCAPP = "C:\\Windows\\yipD5E.exe"	3cJp1cm9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUALL = "C:\\Windows\\hpRzglTs1eFJ.exe"	gXCE3xPM41s0K4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSMA32 = "C:\\Windows\\QIBT7Dv.exe"	gPW60OY3JY1sO.exe

Drops file in Windows directory 40 IoCs

description	ioc	Process
File created	C:\Windows\EBpose52eDunU.exe	PUgA6GkhyjxZ5rQ.exe
File opened for modification	C:\Windows\BVp3C2gaF3Q6cc.exe	yipD5E.exe
File opened for modification	C:\Windows\MDhn41yRSa.exe	BVp3C2gaF3Q6cc.exe
File created	C:\Windows\VCOAgiyBlT.exe	Kaa8Mh65NrkQ.exe
File opened for modification	C:\Windows\gXCE3xPM41s0K4.exe	7eLrFN.exe
File created	C:\Windows\hpRzglTs1eFJ.exe	gXCE3xPM41s0K4.exe
File created	C:\Windows\QIBT7Dv.exe	gPW60OY3JY1sO.exe
File created	C:\Windows\yipD5E.exe	3cJp1cm9.exe
File created	C:\Windows\ZEqxX9.exe	hpRzglTs1eFJ.exe
File opened for modification	C:\Windows\gPW60OY3JY1sO.exe	3C5r8i.exe
File created	C:\Windows\g94X6O68.exe	SyWwPO5ID.exe
File opened for modification	C:\Windows\g94X6O68.exe	SyWwPO5ID.exe
File created	C:\Windows\B7TbjXl6.exe	g94X6O68.exe
File created	C:\Windows\Kaa8Mh65NrkQ.exe	MDhn41yRSa.exe
File opened for modification	C:\Windows\7eLrFN.exe	VCOAgiyBlT.exe
File opened for modification	C:\Windows\x6KaSU.exe	ZEqxX9.exe
File opened for modification	C:\Windows\PUgA6GkhyjxZ5rQ.exe	2026-08-20_926f7230a4078f3f4a519270cb3c0d2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\EBpose52eDunU.exe	PUgA6GkhyjxZ5rQ.exe
File created	C:\Windows\MDhn41yRSa.exe	BVp3C2gaF3Q6cc.exe
File created	C:\Windows\x6KaSU.exe	ZEqxX9.exe
File created	C:\Windows\PUgA6GkhyjxZ5rQ.exe	2026-08-20_926f7230a4078f3f4a519270cb3c0d2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\SyWwPO5ID.exe	EBpose52eDunU.exe
File created	C:\Windows\BVp3C2gaF3Q6cc.exe	yipD5E.exe
File opened for modification	C:\Windows\VCOAgiyBlT.exe	Kaa8Mh65NrkQ.exe
File created	C:\Windows\gXCE3xPM41s0K4.exe	7eLrFN.exe
File created	C:\Windows\hcih4.exe	QIBT7Dv.exe
File opened for modification	C:\Windows\3cJp1cm9.exe	B7TbjXl6.exe
File opened for modification	C:\Windows\Kaa8Mh65NrkQ.exe	MDhn41yRSa.exe
File created	C:\Windows\7eLrFN.exe	VCOAgiyBlT.exe
File created	C:\Windows\3cJp1cm9.exe	B7TbjXl6.exe
File opened for modification	C:\Windows\yipD5E.exe	3cJp1cm9.exe
File opened for modification	C:\Windows\hpRzglTs1eFJ.exe	gXCE3xPM41s0K4.exe
File opened for modification	C:\Windows\3C5r8i.exe	x6KaSU.exe
File opened for modification	C:\Windows\QIBT7Dv.exe	gPW60OY3JY1sO.exe
File opened for modification	C:\Windows\hcih4.exe	QIBT7Dv.exe
File opened for modification	C:\Windows\SyWwPO5ID.exe	EBpose52eDunU.exe
File opened for modification	C:\Windows\B7TbjXl6.exe	g94X6O68.exe
File opened for modification	C:\Windows\ZEqxX9.exe	hpRzglTs1eFJ.exe
File created	C:\Windows\3C5r8i.exe	x6KaSU.exe
File created	C:\Windows\gPW60OY3JY1sO.exe	3C5r8i.exe

Program crash 11 IoCs

pid	pid_target	Process	procid_target
6608	5200	WerFault.exe	95
6992	5980	WerFault.exe	108
8020	7312	WerFault.exe	124
7292	7492	WerFault.exe	134
5568	6528	WerFault.exe	93
7336	5820	WerFault.exe	112
5624	7568	WerFault.exe	126
6016	6512	WerFault.exe	97
6840	7816	WerFault.exe	128
7428	2316	WerFault.exe	110
7592	2656	WerFault.exe	122

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gXCE3xPM41s0K4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SyWwPO5ID.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B7TbjXl6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BVp3C2gaF3Q6cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VCOAgiyBlT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EBpose52eDunU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaa8Mh65NrkQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hpRzglTs1eFJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x6KaSU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcih4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7eLrFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_926f7230a4078f3f4a519270cb3c0d2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g94X6O68.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3cJp1cm9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yipD5E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3C5r8i.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gPW60OY3JY1sO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PUgA6GkhyjxZ5rQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MDhn41yRSa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZEqxX9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QIBT7Dv.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_926f7230a4078f3f4a519270cb3c0d2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_926f7230a4078f3f4a519270cb3c0d2d_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:788

C:\Windows\PUgA6GkhyjxZ5rQ.exe
C:\Windows\PUgA6GkhyjxZ5rQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1328

C:\Windows\EBpose52eDunU.exe
C:\Windows\EBpose52eDunU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4476

C:\Windows\SyWwPO5ID.exe
C:\Windows\SyWwPO5ID.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6528 -s 2204
  2⤵
  - Program crash
  PID:5568

C:\Windows\g94X6O68.exe
C:\Windows\g94X6O68.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 2096
  2⤵
  - Program crash
  PID:6608

C:\Windows\B7TbjXl6.exe
C:\Windows\B7TbjXl6.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 2312
  2⤵
  - Program crash
  PID:6016

C:\Windows\3cJp1cm9.exe
C:\Windows\3cJp1cm9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5200 -ip 5200
1⤵
PID:6320

C:\Windows\yipD5E.exe
C:\Windows\yipD5E.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2824

C:\Windows\BVp3C2gaF3Q6cc.exe
C:\Windows\BVp3C2gaF3Q6cc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1748

C:\Windows\MDhn41yRSa.exe
C:\Windows\MDhn41yRSa.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 2100
  2⤵
  - Program crash
  PID:6992

C:\Windows\Kaa8Mh65NrkQ.exe
C:\Windows\Kaa8Mh65NrkQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 2420
  2⤵
  - Program crash
  PID:7428

C:\Windows\VCOAgiyBlT.exe
C:\Windows\VCOAgiyBlT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 2200
  2⤵
  - Program crash
  PID:7336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5980 -ip 5980
1⤵
PID:4700

C:\Windows\7eLrFN.exe
C:\Windows\7eLrFN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3692

C:\Windows\gXCE3xPM41s0K4.exe
C:\Windows\gXCE3xPM41s0K4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2888

C:\Windows\hpRzglTs1eFJ.exe
C:\Windows\hpRzglTs1eFJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5588

C:\Windows\ZEqxX9.exe
C:\Windows\ZEqxX9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 2424
  2⤵
  - Program crash
  PID:7592

C:\Windows\x6KaSU.exe
C:\Windows\x6KaSU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7312 -s 2096
  2⤵
  - Program crash
  PID:8020

C:\Windows\3C5r8i.exe
C:\Windows\3C5r8i.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7568 -s 2200
  2⤵
  - Program crash
  PID:5624

C:\Windows\gPW60OY3JY1sO.exe
C:\Windows\gPW60OY3JY1sO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7816 -s 2312
  2⤵
  - Program crash
  PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 7312 -ip 7312
1⤵
PID:8000

C:\Windows\QIBT7Dv.exe
C:\Windows\QIBT7Dv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8108

C:\Windows\hcih4.exe
C:\Windows\hcih4.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7492 -s 1996
  2⤵
  - Program crash
  PID:7292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7492 -ip 7492
1⤵
PID:7284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6528 -ip 6528
1⤵
PID:8016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5820 -ip 5820
1⤵
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 7568 -ip 7568
1⤵
PID:6028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6512 -ip 6512
1⤵
PID:6692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 7816 -ip 7816
1⤵
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2316 -ip 2316
1⤵
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2656 -ip 2656
1⤵
PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3C5r8i.exe

Path C:\Windows\3C5r8i.exe
Size 804KB
SHA256 cee76227851da2d47d52b22a12a8433964d3a5ea824201c34a9fc3497020da4c
MD5 0eb68186b8e86d98de6b13046b60f88e
SHA1 23118230e19880eecab6f0ecc1de26fb3f95158a
SHA512 29b56ddbcf504931af5c527865e0e5a0e4494f9a8b408e3be8ee5a114dbfba81ab3d5f8c10806af153d6b60bf2fafb9074c885bdd71ade05c316f889198fc5ea
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouU:0NA1Yakeer5+nsoJ
TLSH
T14105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3cJp1cm9.exe

Path C:\Windows\3cJp1cm9.exe
Size 804KB
SHA256 38b38be3ee4664b3c659fe326e4008ade53345c35857017d423d270a53039cd2
MD5 16fd3221a52a38a052ba644910006551
SHA1 59573fd252002326bf6ace5272d61c34196a0907
SHA512 e63bb356e7318a96c78262ea98c89c2da12bd0b3729a3917afc80df865bcc1911dbb285e9a5e8b22516dc3026b6e61988ca31ed76a3799e9b8f10090f043170f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouE:0NA1Yakeer5+nsor
TLSH
T14105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7eLrFN.exe

Path C:\Windows\7eLrFN.exe
Size 804KB
SHA256 7ee89e7b27212d5384c21e780d86a172ad6998fbf9e8b4d26e499c15dc96b716
MD5 72674c9812a6c92c3a5986d1edd8327f
SHA1 ec591adca877a08dc76bc8b698878db73a2611b1
SHA512 cca8eb457a3b896762210f1f49a74b8887365354a578ac512e837855fc67f3e8dc8cca61f2e0e1bd7825be804d7eabf149f030fa7eac9ef03ff1c19739cff463
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nso8
TLSH
T12805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B7TbjXl6.exe

Path C:\Windows\B7TbjXl6.exe
Size 804KB
SHA256 8c3c3060b1a1827221eca287f26896f96c3ad0027f3414880b99a5395c4d53e0
MD5 fd6523504a493481578f36b13227f0e5
SHA1 4edeab9839b291c854e4cc93e562abb198f1d9b6
SHA512 4b4bb72e5e485e93e59112736936cc73376951e97fd77609dc14765748c19ce83129ed343a461ed598afa11f8b7cb71e0598bceb73da9027a3e9403a67bb32ac
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoud:0NA1Yakeer5+nso6
TLSH
T14F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BVp3C2gaF3Q6cc.exe

Path C:\Windows\BVp3C2gaF3Q6cc.exe
Size 804KB
SHA256 d22af9989e9dd586a7d0da2de179ccf3bf4653c8a08f1d2b9bcb31cbc135d8a0
MD5 1d296f005a0a285547a5a19fab94e8e3
SHA1 4e392223b25e797d5db7cf0d853079ba29371bc1
SHA512 f93a4f0382137f6157713bda927acf212ef415862c483cb83bcb71c164cac46d81c3ad86c985176ac662f82091ad0ea704298794f944503c0fa121815c0174db
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nso6
TLSH
T10805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EBpose52eDunU.exe

Path C:\Windows\EBpose52eDunU.exe
Size 804KB
SHA256 8e254a741e2f0c903a8994fd21d6dd52cc37bab501d0f5397a70de8876bded20
MD5 b39a6092d19aafcd9f9d1b083fa378ff
SHA1 e04a64da2a72c36b9aa2f35d0bdfc0796a274bba
SHA512 cd273286fc598aad1b7851628fa50cca93d04d5f0fada7c96327e5c0ed848c614178ea0f7034fe5e3bc90419b5a523a56c5a5a8aa20f037e98c754a68fe0e11d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouB:0NA1Yakeer5+nsoK
TLSH
T1FF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kaa8Mh65NrkQ.exe

Path C:\Windows\Kaa8Mh65NrkQ.exe
Size 804KB
SHA256 993ddd15fdaf89d5c8d718cc154fa58f6a27c852529c9f3ac8db24e2af46faaa
MD5 97791725f729d736ee091be8f78ae2ea
SHA1 a31da8a15df56c45b94453a96330da33c3155706
SHA512 3f17f5778ec8ccb8043790ce00afb3c7370a550ec66daef1de2ca48d076c4fa7aef979a501b25174e9114a68e287a69e08662055c3a5dd3684e1f1217d8b3d97
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou:0NA1Yakeer5+nso
TLSH
T1A305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MDhn41yRSa.exe

Path C:\Windows\MDhn41yRSa.exe
Size 804KB
SHA256 062441187e1915946d614047ac0e02373a2f7e044cdf9d2aa70d31f4aee4737d
MD5 39f21fff2d263be9b448adc97b1a61e9
SHA1 9d77ebca64179d7347ea49da8fe061a68949fd3a
SHA512 18ca55aa289268b6f2827d96374fcead7602cbff30904963fe9b70b088c5fe2b46a0ffda655e2e1eb140eeb8394cb100ee02ec9c44ea002dc8f85eb3c81f4fc0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nsoU
TLSH
T1FC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PUgA6GkhyjxZ5rQ.exe

Path C:\Windows\PUgA6GkhyjxZ5rQ.exe
Size 804KB
SHA256 cde556abfb8f59b86205d03dcddfb44e207ac7c1533a51215d960d00e68db393
MD5 3119ac1c7a1cf2dbff269107c8225b8f
SHA1 ee31698e8b4f02b221205381368fe439a178968f
SHA512 63c93f1fd3060eb55e5740a28b98f7a660edfb710ee0792380f1fbc87f6051ec4b93dd7eaa28d3bffb2fbcd06bb3ba6bdfbc5d77d2a8935caf51e8bec48ddbaa
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQ:0NA1Yakeer5+nsoH
TLSH
T13605A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QIBT7Dv.exe

Path C:\Windows\QIBT7Dv.exe
Size 804KB
SHA256 a24246be44963f69908b21222e78f601f6c9f0a76ca55c1c4d0436dd5331bf74
MD5 643ebe307076243e77e40a4011c3c077
SHA1 b2aa33634fd1580500846fc4752314c361b79363
SHA512 111ada43508668184a8186119373211907e7c1e8e862a23fce29d2237776079c31f8532988692a7a99fa012e626789e8c9bb09cfea10d7f2e06aafb5db9ce66d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouK:0NA1Yakeer5+nsoP
TLSH
T1C105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SyWwPO5ID.exe

Path C:\Windows\SyWwPO5ID.exe
Size 804KB
SHA256 ff53ddf5ec6c8a8898e4cb9f3d709c7967c1b9480190737a98dd8e74bf8e5cd5
MD5 4eff4f1d19071fb43f63061673f7b8ec
SHA1 5ebd16f208be2ce940a1809f7699cfa8516f9d38
SHA512 2e6d0e23614b0f6b31ccacb2084ad26bbb137f8833fbea8a063f8f04b101f45096ad14fb7897349e92f87bc4d553108c0aaa2aaa3a092e9ac51ad4afca940e02
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nsof
TLSH
T19805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCOAgiyBlT.exe

Path C:\Windows\VCOAgiyBlT.exe
Size 804KB
SHA256 478447a15a3b0adc496cf3f0ffa77b047d0d23ee8417023c20d3efe73eb73cd3
MD5 1b69b8501848eb66a1da3ce2b0794b32
SHA1 f04fbb4309bcb66044bd1364c16b6b54dd9dd0d8
SHA512 2b13cbddf10a32e5da172b926e7ceabe07f6d8ce6c046024b5d993ffb3e3edc3b66fe637cbc6a15b705a0f9cb6fce6c96e635bbd5ae7835d417af85292b651c7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou6:0NA1Yakeer5+nsoF
TLSH
T12805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZEqxX9.exe

Path C:\Windows\ZEqxX9.exe
Size 804KB
SHA256 9015cb173075b21db885492041cd7f41ea1a80012f031ddd69710ce9b0dfa59f
MD5 59bbee9025ec4c0c689c27b25a57bf86
SHA1 e724aeaffc344f16bf3ef0dfa1e321e49918a566
SHA512 984bc1d079bee2101135bcb72cb0ae497cca7a0a4d4f04dbfe90a59eab2cd067199c855f6b9d77b2951b53d94d08d1a6f90cb7381fdeedf8d8fb66dcae4fc2b0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nsoD
TLSH
T12D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g94X6O68.exe

Path C:\Windows\g94X6O68.exe
Size 804KB
SHA256 d196c3aeec454c52c0d7f9adda313ff932893dc93752df0529f8153f7e489df3
MD5 cbe8c047667849fd0e13d30bc7c40572
SHA1 dfccb6484e4ca8b282b674408a0fcd28b30e3b3c
SHA512 60273baf3d2be14e75439435f27e6d053af1cfeea1b8eea6e8c1594ab38a8d3bb7327c0c77bf73760e008cb26ab3acb2e3adb0a39c178f93ff240c4ef31e6837
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nsox
TLSH
T1A905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gPW60OY3JY1sO.exe

Path C:\Windows\gPW60OY3JY1sO.exe
Size 804KB
SHA256 6685a336edaaa9507a05c8a421ac282d569af2acd106403fa5313541d1ddd9bf
MD5 3c14f4b180465845d9ad72d50618119d
SHA1 67d5916d5f70dc7660a1201a1b2c00b3928c2f74
SHA512 0b383c5fdfdd04c605ee997b16c9d6a072d6e85066866bc5ab691da04a63ac308db877f1dea45cc2aa1fc9286cf893d790de48e7c63a55c696fdc9e100696069
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nso+
TLSH
T18405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gXCE3xPM41s0K4.exe

Path C:\Windows\gXCE3xPM41s0K4.exe
Size 804KB
SHA256 c5ff99358800aca7ffa34363b496255e8bafa740f55931b3cc04d7fa0e947c65
MD5 9198debe39cc774cccf493ee6df33078
SHA1 997e5d138d697d030a46e2ac28b5c7e117462ab0
SHA512 1b0e17764878e9215cf4bd9fa3fae27ee6969f82a931b345ce90c545faaba3f8e0792435ef240a85f4b4f30db37a6425e7324f60c0b38143c3c1ad054f2c5693
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nsou
TLSH
T13405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcih4.exe

Path C:\Windows\hcih4.exe
Size 804KB
SHA256 a535a785c8a4c6a89fe3605725087135636a55e77f1e8fa3f7684ee28d30e467
MD5 a83b827010028a8957ba2972437db43a
SHA1 dafb936654a736d35b457ec80b582a0e33c6286c
SHA512 9d85f450050d0bc78a9f31fe63ead2f4854d217c111a2b3e22749e35d9db490bc4c1fe1017ec7f0614d3dbbe174f097683ba33b26e3c8ec00ce9225d494b0ed0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouh:0NA1Yakeer5+nso8
TLSH
T13B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hpRzglTs1eFJ.exe

Path C:\Windows\hpRzglTs1eFJ.exe
Size 804KB
SHA256 376fa3dcf599b1d1071f97c4907b9a758208771852feb40f4d85ff93e65e8b2a
MD5 975b75db4d1989d20868c65619963a86
SHA1 30a783ec3f5cd3757b2b81fc9fef4e69eaa8afaf
SHA512 2e301303a71a92be0665ebc37bed0590f732ea3f998c368bdb75efb6865185b5772c0f1b52acd7198e010327f8ceb0eb67c9057079fbeb9c5f58d97e8a363d5e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouC:0NA1Yakeer5+nsoT
TLSH
T1E905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x6KaSU.exe

Path C:\Windows\x6KaSU.exe
Size 804KB
SHA256 1e79d954117506fbce099064867bcd87273843e78800896abcafae05cf7145c5
MD5 7412a8a7c4cff3f54837b719a7d978a4
SHA1 57a346b696f7a200c708da152c484933bf07c111
SHA512 3ab768a37d18ff610ff8bbb7cfc81c3bf058b2b462288d15168723a78ef3079abce4bbccb2e6e5d04b0095cd1736940ea72eee06fb0d6889b0da44273dee8df2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouG:0NA1Yakeer5+nsob
TLSH
T12305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yipD5E.exe

Path C:\Windows\yipD5E.exe
Size 804KB
SHA256 472bc43e8bc99422c87cf31ea1f22c59cf9636becc7745d4ed865eefbd5e128e
MD5 2193c341d342be0aa60bb391b2ef5f98
SHA1 48ce901fcbd7925adf8860f437235b2aafca4d14
SHA512 91fe592ea2db2c891b68ad59c2e31189a0f1893b0bb8ee83eb18914a9bd6ff81a0dd3a4cd20b7c8fac63f2715ded92e454553fc063d8165a566162002677242c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsoG
TLSH
T12F05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads