1174beea42f08f54fac0eb2d7a28dde8a3dac2cdc605db2616891edf573c1dd9

General

Target
2026-08-25_f732008848b97ac4e4763780005739a2_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260826-bysbfaxyhw
SHA256 1174beea42f08f54fac0eb2d7a28dde8a3dac2cdc605db2616891edf573c1dd9
MD5 f732008848b97ac4e4763780005739a2
SHA1 28bc1581ccbfa313041ec38dd53d90879b07f2ca
SHA512 9d6f5a0e7beb98359d614f0534077cd54033978e463d8d5749f907871f776b80c5900c5cda12b93e6a32969f4453a0c4c0343d2e119f62daf2c1a3007407a936
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFourZ:0NA1Yakeer5+nsoW
TLSH
T1DC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (899) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 7 IoCs

pid	Process
2476	XKcc0wB8v9.exe
616	3zJvMwx.exe
5016	Yldl4cmHxvnb.exe
2620	hbkB0.exe
5952	4ApTSHRO7.exe
1948	HUrdayY.exe
5408	FraMA2blmk.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NEOWATCHLOG = "C:\\Windows\\3zJvMwx.exe"	XKcc0wB8v9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NISUM = "C:\\Windows\\Yldl4cmHxvnb.exe"	3zJvMwx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVAPSVC = "C:\\Windows\\hbkB0.exe"	Yldl4cmHxvnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TC = "C:\\Windows\\4ApTSHRO7.exe"	hbkB0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GUARDDOG = "C:\\Windows\\HUrdayY.exe"	4ApTSHRO7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGAVRTE = "C:\\Windows\\FraMA2blmk.exe"	HUrdayY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICLOAD95 = "C:\\Windows\\XKcc0wB8v9.exe"	2026-08-25_f732008848b97ac4e4763780005739a2_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Yldl4cmHxvnb.exe	3zJvMwx.exe
File created	C:\Windows\hbkB0.exe	Yldl4cmHxvnb.exe
File opened for modification	C:\Windows\hbkB0.exe	Yldl4cmHxvnb.exe
File created	C:\Windows\4ApTSHRO7.exe	hbkB0.exe
File opened for modification	C:\Windows\3zJvMwx.exe	XKcc0wB8v9.exe
File opened for modification	C:\Windows\4ApTSHRO7.exe	hbkB0.exe
File created	C:\Windows\HUrdayY.exe	4ApTSHRO7.exe
File opened for modification	C:\Windows\HUrdayY.exe	4ApTSHRO7.exe
File created	C:\Windows\FraMA2blmk.exe	HUrdayY.exe
File opened for modification	C:\Windows\FraMA2blmk.exe	HUrdayY.exe
File created	C:\Windows\XKcc0wB8v9.exe	2026-08-25_f732008848b97ac4e4763780005739a2_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\XKcc0wB8v9.exe	2026-08-25_f732008848b97ac4e4763780005739a2_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\3zJvMwx.exe	XKcc0wB8v9.exe
File created	C:\Windows\Yldl4cmHxvnb.exe	3zJvMwx.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5540	2476	WerFault.exe	90
1472	5952	WerFault.exe	98
5996	1948	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_f732008848b97ac4e4763780005739a2_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XKcc0wB8v9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3zJvMwx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ApTSHRO7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HUrdayY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Yldl4cmHxvnb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbkB0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FraMA2blmk.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-25_f732008848b97ac4e4763780005739a2_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_f732008848b97ac4e4763780005739a2_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4312

C:\Windows\XKcc0wB8v9.exe
C:\Windows\XKcc0wB8v9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 2316
  2⤵
  - Program crash
  PID:5540

C:\Windows\3zJvMwx.exe
C:\Windows\3zJvMwx.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:616

C:\Windows\Yldl4cmHxvnb.exe
C:\Windows\Yldl4cmHxvnb.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5016

C:\Windows\hbkB0.exe
C:\Windows\hbkB0.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2620

C:\Windows\4ApTSHRO7.exe
C:\Windows\4ApTSHRO7.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5952 -s 2308
  2⤵
  - Program crash
  PID:1472

C:\Windows\HUrdayY.exe
C:\Windows\HUrdayY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 2508
  2⤵
  - Program crash
  PID:5996

C:\Windows\FraMA2blmk.exe
C:\Windows\FraMA2blmk.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2476 -ip 2476
1⤵
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5952 -ip 5952
1⤵
PID:5868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1948 -ip 1948
1⤵
PID:2920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3zJvMwx.exe

Path C:\Windows\3zJvMwx.exe
Size 804KB
SHA256 ee55b7a5aea007e56cd41f0255778a8845c60970a84966613acac77e48ad0f24
MD5 4da166f74b0171ea3275235e8d44f832
SHA1 5a347dd7cd3d2fa6428863f95c75fb3e3fbbbc27
SHA512 e79aed3118515f532d969e091c31c506e36d7111365f98f2fdcf0dec4373df6c3933464fd1a03d3ebbc7b98b2101808812078f35d37b43fc954e9352e16f0503
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA9:0NA1Yakeer5+nsoP
TLSH
T15905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ApTSHRO7.exe

Path C:\Windows\4ApTSHRO7.exe
Size 804KB
SHA256 c89022c607a7a63a002e24748ce414e24f9d3d876ac9ecd6b62b6d94b12bd167
MD5 1f640bce4cd9dbbcb90e22b4399af9e0
SHA1 9900f34c9846ccaf786129364bc21cbc88432b3e
SHA512 660eac506d0a4cee9f5a1537558428d012b4260dde427adad1a380ad2b5b02c40ccfc880c09015963820ef7b5d040ec486b31c8bd0ff7dfadc3b8864b3886507
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouV:0NA1Yakeer5+nsoq
TLSH
T14705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FraMA2blmk.exe

Path C:\Windows\FraMA2blmk.exe
Size 804KB
SHA256 c89c7eac7837aadb8a55884511475195966e9396a12e7726be9c378d82d3e35e
MD5 5970c0056d875d2de4d49ae23f492a0a
SHA1 ec5963663bfde79a03a7cbfeb362ca071adaa7d8
SHA512 6db019a034f92669ca6144069b5fbeef8da46925c356e3cc39f3e64649dba0c7690f68766e97cf7b004089de672366a15afd5d185fb3ef3c2afb8215490fae88
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nsop
TLSH
T1F305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HUrdayY.exe

Path C:\Windows\HUrdayY.exe
Size 804KB
SHA256 28f52495bc8ccafd62a5e750319ea0548c4637e322a4076adb54fd92a05b2f1e
MD5 6d7f1d58efc2771959f13368f744b5c8
SHA1 b9616412e34886be9f7b5e7f3d1d048ff0f075fa
SHA512 e188a1a98d11269ed036354d839d2d15cfe032fe0e24698e195da4f0f3143bf4f5fad9b85e6f84b4590ad4452ae92ce258b116d50da90ee3a98105555c579f11
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nsor
TLSH
T15F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XKcc0wB8v9.exe

Path C:\Windows\XKcc0wB8v9.exe
Size 804KB
SHA256 a5fa156b5939e3c069451af6cf29539a0a55c8a3f528cf9cd6895c774610674a
MD5 23506b9dda55e5f4fc9ccab53b872c10
SHA1 aea8c1ae64d68b8aaa67b175407c93009cbbffd0
SHA512 2864ef3a2174ee17c9758bb36a024954e7d3ab9f6ae37a1027f52a5806ffdf3ae2958bf8f2e8e36220e9c29a052e2ceef2d9153ba9a0c08957d4fcbef9f672cd
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nsoo
TLSH
T16D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yldl4cmHxvnb.exe

Path C:\Windows\Yldl4cmHxvnb.exe
Size 804KB
SHA256 0f555f61a21a83424f5b825709b727be8e39a839a03e513b38e2fbec19333adb
MD5 229cc1e6f3f40503dcf94a62419b5877
SHA1 8072ddc7625ff6346c151cbae3da27b919054fb6
SHA512 50bfb3cae94e5f5ff78a2b008b8d65214ab15d36217c39453d6904a5898e36a3768c592eb0887771e39ef3ad41aa0581f7716026a7c6b75f00865512306d08e3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouf:0NA1Yakeer5+nsoS
TLSH
T1B905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbkB0.exe

Path C:\Windows\hbkB0.exe
Size 804KB
SHA256 75a2fa5f22d70c74bdc0737fe000051c110abb890e7f7c9ebe4746947d0031e3
MD5 930e73d89b8e6ca35a031e2cebb109c7
SHA1 4db2304a731104b323eb871e1828f66b0622e233
SHA512 080c3bc1ab652830a6b2fdc05a4eda8e9b2cac6c1a54fb861e14979a26cb248e2701935981486b19cab43a7da80b912f5ff5e92c4893617ea8d82fe2a069aec4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nso6
TLSH
T19605A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads