050815c5a8b5f3630d7e044db756c29b15fab0d37b8ed273dfedfb5f3bed8ff5

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 07:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_6a0b57092fbf1005de4a4aa87f36bdc6_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260823-hwpk4ayxes
SHA256 050815c5a8b5f3630d7e044db756c29b15fab0d37b8ed273dfedfb5f3bed8ff5
MD5 6a0b57092fbf1005de4a4aa87f36bdc6
SHA1 9db589090f89c272334f6619f5347b8088048f9e
SHA512 24bf27b0d4b031637d4b6daa32310f9447f608034645c5ff9092bfd38d53adb5df74ddd392c985503ef216b1078635f2a84b7aacfa51a9298df7b8ace7674ac5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nsok
TLSH
T18E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2115) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 21 IoCs

pid	Process
3512	Q63uT4CiEdx.exe
1160	XIavKUt7v.exe
5616	2IOQMhHCOl0Sa7E.exe
1540	BaIqpjWHc6d.exe
1780	nom0rhB.exe
6032	6uUVIteBw.exe
1164	EDMmZr7TvwuKll.exe
764	NsHSi.exe
4560	0M0AtwFtZgq.exe
1388	l2zl76nJ.exe
5784	xZBO3Q31w4.exe
6408	v5d6ZF4LxsN.exe
6660	PQvPRYVKIa1qg.exe
6964	eZ4ZhoLeZR.exe
6596	Aehr0lk9.exe
6896	AGqTi.exe
7340	ILhd8aAv.exe
7644	lA0BB.exe
7900	yEQCyGwN0PO.exe
8152	021PJhdU.exe
6304	8vvKU7tjAY8.exe

Adds Run key to start application 2 TTPs 21 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSM32 = "C:\\Windows\\NsHSi.exe"	EDMmZr7TvwuKll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCRSCAN = "C:\\Windows\\8vvKU7tjAY8.exe"	021PJhdU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AMON9X = "C:\\Windows\\eZ4ZhoLeZR.exe"	PQvPRYVKIa1qg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ESAFE = "C:\\Windows\\Q63uT4CiEdx.exe"	2026-08-22_6a0b57092fbf1005de4a4aa87f36bdc6_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ALERTSVC = "C:\\Windows\\XIavKUt7v.exe"	Q63uT4CiEdx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAV AUTO-PROTECT = "C:\\Windows\\2IOQMhHCOl0Sa7E.exe"	XIavKUt7v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PORTMONITOR = "C:\\Windows\\BaIqpjWHc6d.exe"	2IOQMhHCOl0Sa7E.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DVP95_0 = "C:\\Windows\\0M0AtwFtZgq.exe"	NsHSi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPROTECT = "C:\\Windows\\l2zl76nJ.exe"	0M0AtwFtZgq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SYMTRAY = "C:\\Windows\\PQvPRYVKIa1qg.exe"	v5d6ZF4LxsN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TFAK = "C:\\Windows\\6uUVIteBw.exe"	nom0rhB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICSUPPNT = "C:\\Windows\\EDMmZr7TvwuKll.exe"	6uUVIteBw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPSCHECK = "C:\\Windows\\xZBO3Q31w4.exe"	l2zl76nJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GBPOLL = "C:\\Windows\\v5d6ZF4LxsN.exe"	xZBO3Q31w4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVAPSVC = "C:\\Windows\\Aehr0lk9.exe"	eZ4ZhoLeZR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVAP = "C:\\Windows\\AGqTi.exe"	Aehr0lk9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WFINDV32 = "C:\\Windows\\ILhd8aAv.exe"	AGqTi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVWINNT = "C:\\Windows\\yEQCyGwN0PO.exe"	lA0BB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCCWIN97 = "C:\\Windows\\nom0rhB.exe"	BaIqpjWHc6d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CMGRDIAN = "C:\\Windows\\lA0BB.exe"	ILhd8aAv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPTC32 = "C:\\Windows\\021PJhdU.exe"	yEQCyGwN0PO.exe

Drops file in Windows directory 42 IoCs

description	ioc	Process
File created	C:\Windows\NsHSi.exe	EDMmZr7TvwuKll.exe
File opened for modification	C:\Windows\EDMmZr7TvwuKll.exe	6uUVIteBw.exe
File opened for modification	C:\Windows\Q63uT4CiEdx.exe	2026-08-22_6a0b57092fbf1005de4a4aa87f36bdc6_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\BaIqpjWHc6d.exe	2IOQMhHCOl0Sa7E.exe
File created	C:\Windows\nom0rhB.exe	BaIqpjWHc6d.exe
File opened for modification	C:\Windows\6uUVIteBw.exe	nom0rhB.exe
File created	C:\Windows\021PJhdU.exe	yEQCyGwN0PO.exe
File created	C:\Windows\8vvKU7tjAY8.exe	021PJhdU.exe
File opened for modification	C:\Windows\nom0rhB.exe	BaIqpjWHc6d.exe
File created	C:\Windows\xZBO3Q31w4.exe	l2zl76nJ.exe
File opened for modification	C:\Windows\xZBO3Q31w4.exe	l2zl76nJ.exe
File created	C:\Windows\PQvPRYVKIa1qg.exe	v5d6ZF4LxsN.exe
File opened for modification	C:\Windows\021PJhdU.exe	yEQCyGwN0PO.exe
File created	C:\Windows\Aehr0lk9.exe	eZ4ZhoLeZR.exe
File created	C:\Windows\ILhd8aAv.exe	AGqTi.exe
File opened for modification	C:\Windows\lA0BB.exe	ILhd8aAv.exe
File created	C:\Windows\EDMmZr7TvwuKll.exe	6uUVIteBw.exe
File opened for modification	C:\Windows\NsHSi.exe	EDMmZr7TvwuKll.exe
File created	C:\Windows\0M0AtwFtZgq.exe	NsHSi.exe
File created	C:\Windows\l2zl76nJ.exe	0M0AtwFtZgq.exe
File created	C:\Windows\AGqTi.exe	Aehr0lk9.exe
File created	C:\Windows\yEQCyGwN0PO.exe	lA0BB.exe
File opened for modification	C:\Windows\yEQCyGwN0PO.exe	lA0BB.exe
File opened for modification	C:\Windows\0M0AtwFtZgq.exe	NsHSi.exe
File created	C:\Windows\eZ4ZhoLeZR.exe	PQvPRYVKIa1qg.exe
File created	C:\Windows\Q63uT4CiEdx.exe	2026-08-22_6a0b57092fbf1005de4a4aa87f36bdc6_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\BaIqpjWHc6d.exe	2IOQMhHCOl0Sa7E.exe
File created	C:\Windows\6uUVIteBw.exe	nom0rhB.exe
File opened for modification	C:\Windows\2IOQMhHCOl0Sa7E.exe	XIavKUt7v.exe
File opened for modification	C:\Windows\l2zl76nJ.exe	0M0AtwFtZgq.exe
File created	C:\Windows\v5d6ZF4LxsN.exe	xZBO3Q31w4.exe
File opened for modification	C:\Windows\PQvPRYVKIa1qg.exe	v5d6ZF4LxsN.exe
File opened for modification	C:\Windows\AGqTi.exe	Aehr0lk9.exe
File created	C:\Windows\lA0BB.exe	ILhd8aAv.exe
File opened for modification	C:\Windows\8vvKU7tjAY8.exe	021PJhdU.exe
File opened for modification	C:\Windows\XIavKUt7v.exe	Q63uT4CiEdx.exe
File opened for modification	C:\Windows\v5d6ZF4LxsN.exe	xZBO3Q31w4.exe
File opened for modification	C:\Windows\eZ4ZhoLeZR.exe	PQvPRYVKIa1qg.exe
File opened for modification	C:\Windows\Aehr0lk9.exe	eZ4ZhoLeZR.exe
File created	C:\Windows\XIavKUt7v.exe	Q63uT4CiEdx.exe
File created	C:\Windows\2IOQMhHCOl0Sa7E.exe	XIavKUt7v.exe
File opened for modification	C:\Windows\ILhd8aAv.exe	AGqTi.exe

Program crash 10 IoCs

pid	pid_target	Process	procid_target
5196	1540	WerFault.exe	96
3376	1780	WerFault.exe	98
6868	5784	WerFault.exe	115
7552	6596	WerFault.exe	125
4328	6032	WerFault.exe	100
7896	764	WerFault.exe	109
8148	1160	WerFault.exe	92
3620	3512	WerFault.exe	90
4248	1164	WerFault.exe	105
5408	7340	WerFault.exe	129

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XIavKUt7v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2IOQMhHCOl0Sa7E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0M0AtwFtZgq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aehr0lk9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lA0BB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BaIqpjWHc6d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nom0rhB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6uUVIteBw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDMmZr7TvwuKll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NsHSi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PQvPRYVKIa1qg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_6a0b57092fbf1005de4a4aa87f36bdc6_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Q63uT4CiEdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l2zl76nJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xZBO3Q31w4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v5d6ZF4LxsN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eZ4ZhoLeZR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yEQCyGwN0PO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8vvKU7tjAY8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AGqTi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ILhd8aAv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	021PJhdU.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-22_6a0b57092fbf1005de4a4aa87f36bdc6_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_6a0b57092fbf1005de4a4aa87f36bdc6_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4128

C:\Windows\Q63uT4CiEdx.exe
C:\Windows\Q63uT4CiEdx.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 2508
  2⤵
  - Program crash
  PID:3620

C:\Windows\XIavKUt7v.exe
C:\Windows\XIavKUt7v.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 2316
  2⤵
  - Program crash
  PID:8148

C:\Windows\2IOQMhHCOl0Sa7E.exe
C:\Windows\2IOQMhHCOl0Sa7E.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5616

C:\Windows\BaIqpjWHc6d.exe
C:\Windows\BaIqpjWHc6d.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 2092
  2⤵
  - Program crash
  PID:5196

C:\Windows\nom0rhB.exe
C:\Windows\nom0rhB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 2100
  2⤵
  - Program crash
  PID:3376

C:\Windows\6uUVIteBw.exe
C:\Windows\6uUVIteBw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 2200
  2⤵
  - Program crash
  PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 1540 -ip 1540
1⤵
PID:4184

C:\Windows\EDMmZr7TvwuKll.exe
C:\Windows\EDMmZr7TvwuKll.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 2416
  2⤵
  - Program crash
  PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1780 -ip 1780
1⤵
PID:3884

C:\Windows\NsHSi.exe
C:\Windows\NsHSi.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 2212
  2⤵
  - Program crash
  PID:7896

C:\Windows\0M0AtwFtZgq.exe
C:\Windows\0M0AtwFtZgq.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4560

C:\Windows\l2zl76nJ.exe
C:\Windows\l2zl76nJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1388

C:\Windows\xZBO3Q31w4.exe
C:\Windows\xZBO3Q31w4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 2092
  2⤵
  - Program crash
  PID:6868

C:\Windows\v5d6ZF4LxsN.exe
C:\Windows\v5d6ZF4LxsN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6408

C:\Windows\PQvPRYVKIa1qg.exe
C:\Windows\PQvPRYVKIa1qg.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5784 -ip 5784
1⤵
PID:6848

C:\Windows\eZ4ZhoLeZR.exe
C:\Windows\eZ4ZhoLeZR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6964

C:\Windows\Aehr0lk9.exe
C:\Windows\Aehr0lk9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 2092
  2⤵
  - Program crash
  PID:7552

C:\Windows\AGqTi.exe
C:\Windows\AGqTi.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6896

C:\Windows\ILhd8aAv.exe
C:\Windows\ILhd8aAv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7340 -s 2512
  2⤵
  - Program crash
  PID:5408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6596 -ip 6596
1⤵
PID:7532

C:\Windows\lA0BB.exe
C:\Windows\lA0BB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7644

C:\Windows\yEQCyGwN0PO.exe
C:\Windows\yEQCyGwN0PO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7900

C:\Windows\021PJhdU.exe
C:\Windows\021PJhdU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8152

C:\Windows\8vvKU7tjAY8.exe
C:\Windows\8vvKU7tjAY8.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6032 -ip 6032
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 764 -ip 764
1⤵
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1160 -ip 1160
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3512 -ip 3512
1⤵
PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1164 -ip 1164
1⤵
PID:6228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 7340 -ip 7340
1⤵
PID:3528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

021PJhdU.exe

Path C:\Windows\021PJhdU.exe
Size 804KB
SHA256 77886be1426706e557883fe8c4c7392d579079e4b23c7a4c487af9b3e1db7c0b
MD5 4f5d24e3124c7652ade2c8db8ca83f08
SHA1 7ca64f64680627e41026da4c164b3659a29046da
SHA512 d2588646dd195c535d1cfd83e8e2d46fbd5c061389f1cb3bd9b3c8673c2a7415f3b5920eb7e3c5f2a066ea734b7800fe1cbda0d2416a12a8a027a3b405f058b4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nsoK
TLSH
T16305A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0M0AtwFtZgq.exe

Path C:\Windows\0M0AtwFtZgq.exe
Size 804KB
SHA256 87ab275ab553a6d0996b3618bfe4d0e2a031e3929a951505521cebd305927299
MD5 6edbc2dd6fb6f1cb8f0d9ffbfd43a7b0
SHA1 0b7ee714925c837886a3eb8caff61861997cc911
SHA512 861e7e80d098c9837dda283b9c2df410f362f04764da8381cf7c3bd03136b802e58b303494b7ddb41ce53662b1692995849c90d5ee6711a4f11f528c1b096437
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nsoY
TLSH
T1A905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2IOQMhHCOl0Sa7E.exe

Path C:\Windows\2IOQMhHCOl0Sa7E.exe
Size 804KB
SHA256 addcfb288b7db144731ca88d74e5e7e88a41a608a797daaa3a4a50ac5064de60
MD5 efaac1794610ac9c8f78b89271131ad7
SHA1 a261c4177e197a6370e589585421a95be3339dc7
SHA512 30d2100494fa029d2c80d69e123148aab22edb51532084fbd33172e55edaa1beae920d718c687a65e9d4e4b6772a5cbde0ebfebe2798500e38d4494a7bb57d97
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nsoY
TLSH
T15605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6uUVIteBw.exe

Path C:\Windows\6uUVIteBw.exe
Size 804KB
SHA256 e34496a5ca0d051d5f30d3103f8fecc15672e1b320035e1217a96200a362f522
MD5 20a7135c4bec903a03adec93b75891d9
SHA1 ab0156d1bbe3d6d3b4fcd4a87a093c15a40f10ba
SHA512 1f177910a6ff940eb3d1ab9e1265e4cd50f483287d0fd3992943a9a0108ff34792a9ab0c79f46af1ee876889ae9ed8c53dbad938cce248b266aec73e8dbfbae2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsom
TLSH
T13E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8vvKU7tjAY8.exe

Path C:\Windows\8vvKU7tjAY8.exe
Size 804KB
SHA256 0c959cb419fc3878f9aeea69057532f082528e84710a40aaa20872472f8a7718
MD5 68d816a97a9a3d25560de7061b66913d
SHA1 058675741cf193818a90ff2fcd0013e1b19df4a9
SHA512 ae9870c7f1a6f4b0eaf7f464e2871d94705deb27300bfb7a1a84873dd7ebb4a168e0cc9d477dd9291b7d140cb393eaa8f66dba8ed5c5c573b265a45521e9cd52
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoul:0NA1Yakeer5+nsoO
TLSH
T16405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGqTi.exe

Path C:\Windows\AGqTi.exe
Size 804KB
SHA256 8f42b5fed4fc338d52dae119687392f395c8e8d18fa5832d7ffc210d072877be
MD5 5545b874c06451b2adf4175d0d67fae7
SHA1 385000ab984dccf809fb7533157af672c5bc1df8
SHA512 f94fd219147e26ea940a2dbe262f4f4ab10de4ee8ee83db197d6fb4abbf52631da3e928d487c675ce51cac4d01fe435c5671be489d2defb5824cdedf5fed1236
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsog
TLSH
T17D05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aehr0lk9.exe

Path C:\Windows\Aehr0lk9.exe
Size 804KB
SHA256 32c94b6f856fdc59ab828ca9469b085e3f25d83d4d89d6cbe2e9b2004d6c7cfc
MD5 8be42d77d2ab0aed8e8cc8e519b56f2b
SHA1 cc090348be68567ab28a5800e7d2217735f360fd
SHA512 3f78ed1f77e4ed8082434216be5fb32e02cb47f5ba4b00947cac5843e4466954a996982dd99e7b98695c0b56c5af7a4df68f890f0826653a3ecbc3ff7a015b88
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nsoj
TLSH
T14005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BaIqpjWHc6d.exe

Path C:\Windows\BaIqpjWHc6d.exe
Size 804KB
SHA256 4e0d4fee13288c8c68e0da4bae017bcaff25c9ca24346390c5588557c2b23d1e
MD5 27c7d9cdc46d504e8b0a53086b53acc1
SHA1 633985313a97f29210f5d168c505cc29c4df1bb7
SHA512 306d3fad0621c9f39d4d80a1922f4a4382e475c30c74c05873ade8e95e61616c1e6868f476cdd1b948ecbd7e7ad55a6f8a69a825bed7e1aff74bdb1a815682fa
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nsoT
TLSH
T1AF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EDMmZr7TvwuKll.exe

Path C:\Windows\EDMmZr7TvwuKll.exe
Size 804KB
SHA256 cab69d53950854fbad8f88c2318f04e880fc754a3f414e77c3a5395ba202f019
MD5 1910ea0a31233daef231ade39743d520
SHA1 79a82002c8543229c60b162875aed244e3d7559c
SHA512 5c653769a9fd3f9ee5cb4150f4c22f88991e6259c20f022fc54dd93ccd4fc5d4808c0ea8a82974fb09ef81c45b9f4dda5575fb6ab070a0338d426139bc6f62ae
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoup:0NA1Yakeer5+nsow
TLSH
T13C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ILhd8aAv.exe

Path C:\Windows\ILhd8aAv.exe
Size 804KB
SHA256 a908f3cb6359698057b8a61d1ac4b9c017777e1f1d73fede76a9969cbc2a9b1a
MD5 d6a21141b2cc723dd75c4d2d104a512e
SHA1 24778762839c6ebb8fdb5124fdb17360432153db
SHA512 5897532df1b6490dd142c8db0539246443491782bb8588d79209300561f200911d9fbb1ffd59b247f764e6f28a9f0715920b14772a70b7dee2aa6875acf36743
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouE:0NA1Yakeer5+nsof
TLSH
T17805A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NsHSi.exe

Path C:\Windows\NsHSi.exe
Size 804KB
SHA256 36ae110ead1943652ace380e26446f93d1fbc39a0dd076ccf51bf0d6e3ea13b3
MD5 d09b662ddb00d1042ceb4fa9d1b0e2c5
SHA1 386ed113c477062018a8441cb400864252b1a6e0
SHA512 f949001d928ca3ba2e30fd3fa9fa45eba490656f9f66dac88d032868ffa469a142ba1b141e6e1f1b0f99c498932c7833ad666ee8c0b4b959d19808b4cf8fdec7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nso6
TLSH
T10105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PQvPRYVKIa1qg.exe

Path C:\Windows\PQvPRYVKIa1qg.exe
Size 804KB
SHA256 22a479c9c9c4b9f347d4859951f7698e2aa1f8c288ae0afc5e3fe5924bc7a320
MD5 f3e89318b43b5dad92a126dc875238bd
SHA1 73d4fbb1e4e3e9bb1e4fa37f01d5c213b407b419
SHA512 fb660c1f0eadfb042ea282716f64a1884adad64aed2a50f2a3d9ee62db75ba78d86f889540103952a7c56289b329c7b3e1d5329a03235fe7822bb84e42223446
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsoC
TLSH
T15605A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q63uT4CiEdx.exe

Path C:\Windows\Q63uT4CiEdx.exe
Size 804KB
SHA256 1cc8c17cb4a4eafe150978ff1adb3adb41de45caec8b5f5b4840e1ae6837035d
MD5 d90bb4e86169671a822e58f92bdba420
SHA1 cb4d29dbd765c29e7e199546d00c54d7ca0ec91d
SHA512 32d05a1914ebd16f0caa3024e6518d0632a818d9c3b321ae885dd4a135ad119a942098f4db7ac38d5ef3ccbb41173159729c9a86cb386d8e5477b58480713e11
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nsoP
TLSH
T19805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XIavKUt7v.exe

Path C:\Windows\XIavKUt7v.exe
Size 804KB
SHA256 09f3eeafa33f48fad19f26a422640029b3e34452acc5d01483360a4cd04c9831
MD5 cc696b561b83b9099eb0ef9b5cf75f02
SHA1 63c220cf2481ca8ac0b2c9564d3faa99cd446aa9
SHA512 f6012a3106fb5df24780b2b91055b55d679efceafb735180f607b0f534ddbd11405a33ef76c47dbe85cd4e5cc0e2e259473e8c9d5e98824bbb108d0e793efad3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsoe
TLSH
T15A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eZ4ZhoLeZR.exe

Path C:\Windows\eZ4ZhoLeZR.exe
Size 804KB
SHA256 efbee107cfd38f99f1642e02fed499ced3c0547f25ebcea2959da3109b2da322
MD5 49e8fdfbba9d486db06a20fe0e5f2916
SHA1 9ab0eea648a0013329315abbd93b6c2ff7d7e659
SHA512 e5f822afc45f5eb488726744118348df16f18d4baebe2865c589a4c9db9ee64613c2b29ff2d197db729d85d19d6d1e545dd2e6eee86db32b059f3b700d297f12
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoui:0NA1Yakeer5+nsoB
TLSH
T1E305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

l2zl76nJ.exe

Path C:\Windows\l2zl76nJ.exe
Size 804KB
SHA256 4041af2d760bd6cbd97fc281feb02a6b024be154cf192013823ed7e9044db4e1
MD5 c24ecd53aa1db51944f1109a966304f1
SHA1 1bee5bd65e56679c37bee4eb53170d098e6ede70
SHA512 a4fbd83369cb25554c14baca8cc76d136234f4c7aaa1a47cdcb679e43e0a0a3099e21fef73536830ef53ab6954f8000dfaa67782178603be29d728abce1c235e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nso0
TLSH
T1D105A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lA0BB.exe

Path C:\Windows\lA0BB.exe
Size 804KB
SHA256 246f10391fd07618f003b44bc4bb93af3aa6ddf34e4655d701ca037f5527c33e
MD5 43a1dd9a5a14c53cc41b99a675dbb771
SHA1 530c7817abf8030cbbe6f6e461f781f403f07689
SHA512 bddef6779d3c6fa9af4b27994f0ba73e1eaf10cfae5e3a0e1f2840eb3df57d2b8923f47eda655d84552498c357fefeee35c1eced8f5721d8b7e604d1ba5ca5a7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsoo
TLSH
T16005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nom0rhB.exe

Path C:\Windows\nom0rhB.exe
Size 804KB
SHA256 a80441b8d75a8c8bb3568f69cd2a0a1cb72c0ab8448c89200ec0424ea15dbeb4
MD5 41acfbea8e260e5b8c1ede49594a6f98
SHA1 7a56c9ffc5d01ddc305e8a8c79d9f25bbfca96dc
SHA512 5ae53f93ccf8b15ec7e47e0c03b7f1e6b519b9f7f616456712ac35a8b88f686aa580952b0026b8c6046356a97f8ef7354d3fa2c781158c72fd8e27ab2e908a45
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoug:0NA1Yakeer5+nsol
TLSH
T16205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v5d6ZF4LxsN.exe

Path C:\Windows\v5d6ZF4LxsN.exe
Size 804KB
SHA256 a3ccb6ecd1c091a3f72212506c95a6c240bfe64a2688bf316016023de79d4603
MD5 6b0f47d35a4d19ce42995b1f7ae62461
SHA1 ce774f6a742c6eb9812c1e7acf2412658f36818c
SHA512 6b661ccf51a9c7f1998fb4b53d6205ec8162e7089e0c6a5649428e346f64fbc61944665532f7722b52b5bd69a14e0de26dc186c30a0dc1503eba8d7e17181c47
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nsoz
TLSH
T1FD05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xZBO3Q31w4.exe

Path C:\Windows\xZBO3Q31w4.exe
Size 804KB
SHA256 551af12f8a8924380fe3a08a0604fb528c10d67430ed306b841533fe81fd43ac
MD5 a4ade5455c9d8ebc1eb96e6907670aed
SHA1 be1e1417c48cd1e3940592fe3079c0a27f0771a6
SHA512 4422ab42103f11dcbce0a7f36977e371958e60aafd30e022d8bdac01fcac8c3ba016fcf14fc5ac624065f67795b4dff32e6f7b6a77bf792b4aa2f485b4a46e57
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouS:0NA1Yakeer5+nson
TLSH
T1CC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yEQCyGwN0PO.exe

Path C:\Windows\yEQCyGwN0PO.exe
Size 804KB
SHA256 8303becf8a2661e46696200c39aeec0d353fbd725bca6834875f6b123a3e2600
MD5 9c61992ae0adaa673fd5693a610ce054
SHA1 401e37262658d4e57c8f16c5d8f1ac27c5b5eb7a
SHA512 110dad10e967df5137f12740ec35fd0376244459c8b86ece69ca72286a65d01aa3d746370b52047bff4b5d20e6a494621ad316415ab90d976de22d1621861a77
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouf:0NA1Yakeer5+nsoY
TLSH
T17305A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads