91ae6d2383c058a593f424ca9052c292dfc9f31c0215b6b043ee5ab44a9bf5de

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-26_b8d2c982316cdc681e2ed909a3011893_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260926-thhfeaxapd
SHA256 91ae6d2383c058a593f424ca9052c292dfc9f31c0215b6b043ee5ab44a9bf5de
MD5 b8d2c982316cdc681e2ed909a3011893
SHA1 da78fe1dd07ac6acc30b29de291092d5b3d05af9
SHA512 e16681fe29d9ec95b52882f2d96b8e38165915db0f0e13212089d08faa8a65234cda73847e4634442243e716100dd03b18135be08416247040ff669929590fd2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouF:0NA1Yakeer5+nso6
TLSH
T19605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (3059) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 31 IoCs

pid	Process
2892	SntwBXYzgnM2C.exe
4536	KckrD.exe
4744	DlJF7huOQ.exe
3812	qZa7rVt3x4tjLw3.exe
3396	dI79dBJCQd.exe
4196	LP81yQwMt1PTk.exe
3596	HpzpA.exe
3816	a5v0v.exe
4572	13mvBRHO1lrk.exe
6152	SHmc58qa2.exe
6408	gpziXDHdt.exe
6664	3GmAjuHwkepgdx.exe
6916	6sebnw6nlWzV.exe
6160	IN66nD.exe
7308	CDUqFyvyX.exe
7640	8ANnU6Bc.exe
8020	hBEM0MF.exe
7668	Gui3BUSDQoB.exe
6864	2AWjConsjRZ.exe
8404	mGbZwYuc3uVsTv.exe
8732	1on7ma.exe
9012	xqzTv9xL6w9TVia.exe
8648	KYpLD6Eq0.exe
8964	g5aVEN5AuIhQ.exe
8360	gDyrjnMjbplwV.exe
9412	TPnMtMWGI.exe
9684	vTWqloBsx.exe
9936	ekw74aO.exe
10192	qE692XyG.exe
7048	vGIeZ9O1.exe
10252	FZiDAmSavbL.exe

Adds Run key to start application 2 TTPs 31 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSSTAT = "C:\\Windows\\ekw74aO.exe"	vTWqloBsx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVXW = "C:\\Windows\\8ANnU6Bc.exe"	CDUqFyvyX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVGSERV = "C:\\Windows\\mGbZwYuc3uVsTv.exe"	2AWjConsjRZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NORMIST = "C:\\Windows\\gDyrjnMjbplwV.exe"	g5aVEN5AuIhQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ALERTSVC = "C:\\Windows\\KckrD.exe"	SntwBXYzgnM2C.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NTRTSCAN = "C:\\Windows\\DlJF7huOQ.exe"	KckrD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TC = "C:\\Windows\\dI79dBJCQd.exe"	qZa7rVt3x4tjLw3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ANTS = "C:\\Windows\\CDUqFyvyX.exe"	IN66nD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCSCAN = "C:\\Windows\\qZa7rVt3x4tjLw3.exe"	DlJF7huOQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FNRB32 = "C:\\Windows\\LP81yQwMt1PTk.exe"	dI79dBJCQd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAV7 = "C:\\Windows\\hBEM0MF.exe"	8ANnU6Bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUSPT = "C:\\Windows\\1on7ma.exe"	mGbZwYuc3uVsTv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ALERTSVC = "C:\\Windows\\a5v0v.exe"	HpzpA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ANTS = "C:\\Windows\\13mvBRHO1lrk.exe"	a5v0v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PVIEW95 = "C:\\Windows\\gpziXDHdt.exe"	SHmc58qa2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFINET = "C:\\Windows\\2AWjConsjRZ.exe"	Gui3BUSDQoB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AUTOTRACE = "C:\\Windows\\xqzTv9xL6w9TVia.exe"	1on7ma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVWNT = "C:\\Windows\\6sebnw6nlWzV.exe"	3GmAjuHwkepgdx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ACKWIN32 = "C:\\Windows\\Gui3BUSDQoB.exe"	hBEM0MF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WEBTRAP = "C:\\Windows\\FZiDAmSavbL.exe"	vGIeZ9O1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWEEPNET = "C:\\Windows\\HpzpA.exe"	LP81yQwMt1PTk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NTRTSCAN = "C:\\Windows\\3GmAjuHwkepgdx.exe"	gpziXDHdt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCAN95 = "C:\\Windows\\KYpLD6Eq0.exe"	xqzTv9xL6w9TVia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSGK32 = "C:\\Windows\\qE692XyG.exe"	ekw74aO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ETRUSTCIPE = "C:\\Windows\\vGIeZ9O1.exe"	qE692XyG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NETUTILS = "C:\\Windows\\TPnMtMWGI.exe"	gDyrjnMjbplwV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUCOMSERVE = "C:\\Windows\\SntwBXYzgnM2C.exe"	2026-09-26_b8d2c982316cdc681e2ed909a3011893_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ESPWATCH = "C:\\Windows\\SHmc58qa2.exe"	13mvBRHO1lrk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MINILOG = "C:\\Windows\\IN66nD.exe"	6sebnw6nlWzV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFIADMIN = "C:\\Windows\\g5aVEN5AuIhQ.exe"	KYpLD6Eq0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NISSERV = "C:\\Windows\\vTWqloBsx.exe"	TPnMtMWGI.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\3GmAjuHwkepgdx.exe	gpziXDHdt.exe
File opened for modification	C:\Windows\KYpLD6Eq0.exe	xqzTv9xL6w9TVia.exe
File created	C:\Windows\8ANnU6Bc.exe	CDUqFyvyX.exe
File opened for modification	C:\Windows\2AWjConsjRZ.exe	Gui3BUSDQoB.exe
File created	C:\Windows\mGbZwYuc3uVsTv.exe	2AWjConsjRZ.exe
File opened for modification	C:\Windows\g5aVEN5AuIhQ.exe	KYpLD6Eq0.exe
File created	C:\Windows\SHmc58qa2.exe	13mvBRHO1lrk.exe
File opened for modification	C:\Windows\gDyrjnMjbplwV.exe	g5aVEN5AuIhQ.exe
File created	C:\Windows\qE692XyG.exe	ekw74aO.exe
File opened for modification	C:\Windows\vTWqloBsx.exe	TPnMtMWGI.exe
File opened for modification	C:\Windows\LP81yQwMt1PTk.exe	dI79dBJCQd.exe
File created	C:\Windows\2AWjConsjRZ.exe	Gui3BUSDQoB.exe
File created	C:\Windows\g5aVEN5AuIhQ.exe	KYpLD6Eq0.exe
File created	C:\Windows\IN66nD.exe	6sebnw6nlWzV.exe
File created	C:\Windows\3GmAjuHwkepgdx.exe	gpziXDHdt.exe
File created	C:\Windows\vTWqloBsx.exe	TPnMtMWGI.exe
File opened for modification	C:\Windows\KckrD.exe	SntwBXYzgnM2C.exe
File created	C:\Windows\qZa7rVt3x4tjLw3.exe	DlJF7huOQ.exe
File opened for modification	C:\Windows\qZa7rVt3x4tjLw3.exe	DlJF7huOQ.exe
File opened for modification	C:\Windows\ekw74aO.exe	vTWqloBsx.exe
File created	C:\Windows\SntwBXYzgnM2C.exe	2026-09-26_b8d2c982316cdc681e2ed909a3011893_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\13mvBRHO1lrk.exe	a5v0v.exe
File opened for modification	C:\Windows\6sebnw6nlWzV.exe	3GmAjuHwkepgdx.exe
File opened for modification	C:\Windows\xqzTv9xL6w9TVia.exe	1on7ma.exe
File created	C:\Windows\HpzpA.exe	LP81yQwMt1PTk.exe
File created	C:\Windows\a5v0v.exe	HpzpA.exe
File created	C:\Windows\6sebnw6nlWzV.exe	3GmAjuHwkepgdx.exe
File created	C:\Windows\1on7ma.exe	mGbZwYuc3uVsTv.exe
File opened for modification	C:\Windows\hBEM0MF.exe	8ANnU6Bc.exe
File created	C:\Windows\FZiDAmSavbL.exe	vGIeZ9O1.exe
File opened for modification	C:\Windows\FZiDAmSavbL.exe	vGIeZ9O1.exe
File created	C:\Windows\gpziXDHdt.exe	SHmc58qa2.exe
File opened for modification	C:\Windows\IN66nD.exe	6sebnw6nlWzV.exe
File created	C:\Windows\KckrD.exe	SntwBXYzgnM2C.exe
File created	C:\Windows\DlJF7huOQ.exe	KckrD.exe
File opened for modification	C:\Windows\HpzpA.exe	LP81yQwMt1PTk.exe
File opened for modification	C:\Windows\Gui3BUSDQoB.exe	hBEM0MF.exe
File created	C:\Windows\LP81yQwMt1PTk.exe	dI79dBJCQd.exe
File opened for modification	C:\Windows\gpziXDHdt.exe	SHmc58qa2.exe
File created	C:\Windows\CDUqFyvyX.exe	IN66nD.exe
File opened for modification	C:\Windows\8ANnU6Bc.exe	CDUqFyvyX.exe
File opened for modification	C:\Windows\mGbZwYuc3uVsTv.exe	2AWjConsjRZ.exe
File opened for modification	C:\Windows\vGIeZ9O1.exe	qE692XyG.exe
File opened for modification	C:\Windows\SHmc58qa2.exe	13mvBRHO1lrk.exe
File opened for modification	C:\Windows\CDUqFyvyX.exe	IN66nD.exe
File created	C:\Windows\gDyrjnMjbplwV.exe	g5aVEN5AuIhQ.exe
File created	C:\Windows\vGIeZ9O1.exe	qE692XyG.exe
File created	C:\Windows\TPnMtMWGI.exe	gDyrjnMjbplwV.exe
File opened for modification	C:\Windows\TPnMtMWGI.exe	gDyrjnMjbplwV.exe
File opened for modification	C:\Windows\SntwBXYzgnM2C.exe	2026-09-26_b8d2c982316cdc681e2ed909a3011893_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\DlJF7huOQ.exe	KckrD.exe
File opened for modification	C:\Windows\dI79dBJCQd.exe	qZa7rVt3x4tjLw3.exe
File created	C:\Windows\13mvBRHO1lrk.exe	a5v0v.exe
File created	C:\Windows\hBEM0MF.exe	8ANnU6Bc.exe
File created	C:\Windows\Gui3BUSDQoB.exe	hBEM0MF.exe
File opened for modification	C:\Windows\1on7ma.exe	mGbZwYuc3uVsTv.exe
File created	C:\Windows\dI79dBJCQd.exe	qZa7rVt3x4tjLw3.exe
File opened for modification	C:\Windows\a5v0v.exe	HpzpA.exe
File created	C:\Windows\xqzTv9xL6w9TVia.exe	1on7ma.exe
File created	C:\Windows\KYpLD6Eq0.exe	xqzTv9xL6w9TVia.exe
File created	C:\Windows\ekw74aO.exe	vTWqloBsx.exe
File opened for modification	C:\Windows\qE692XyG.exe	ekw74aO.exe

Program crash 11 IoCs

pid	pid_target	Process	procid_target
7560	6916	WerFault.exe	114
8620	7668	WerFault.exe	127
8328	8404	WerFault.exe	131
9316	8648	WerFault.exe	141
10940	9012	WerFault.exe	137
10472	3396	WerFault.exe	98
10596	6160	WerFault.exe	116
10644	7640	WerFault.exe	123
10808	9936	WerFault.exe	153
10960	3812	WerFault.exe	96
10984	7308	WerFault.exe	118

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-26_b8d2c982316cdc681e2ed909a3011893_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-26_b8d2c982316cdc681e2ed909a3011893_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SHmc58qa2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3GmAjuHwkepgdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gui3BUSDQoB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2AWjConsjRZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KYpLD6Eq0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ekw74aO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qZa7rVt3x4tjLw3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5v0v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hBEM0MF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xqzTv9xL6w9TVia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vGIeZ9O1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FZiDAmSavbL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TPnMtMWGI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qE692XyG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KckrD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IN66nD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gDyrjnMjbplwV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g5aVEN5AuIhQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dI79dBJCQd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-26_b8d2c982316cdc681e2ed909a3011893_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LP81yQwMt1PTk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gpziXDHdt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DlJF7huOQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13mvBRHO1lrk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6sebnw6nlWzV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CDUqFyvyX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1on7ma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ANnU6Bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mGbZwYuc3uVsTv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vTWqloBsx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SntwBXYzgnM2C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HpzpA.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-26_b8d2c982316cdc681e2ed909a3011893_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-26_b8d2c982316cdc681e2ed909a3011893_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4188

C:\Windows\SntwBXYzgnM2C.exe
C:\Windows\SntwBXYzgnM2C.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2892

C:\Windows\KckrD.exe
C:\Windows\KckrD.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4536

C:\Windows\DlJF7huOQ.exe
C:\Windows\DlJF7huOQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4744

C:\Windows\qZa7rVt3x4tjLw3.exe
C:\Windows\qZa7rVt3x4tjLw3.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 2420
  2⤵
  - Program crash
  PID:10960

C:\Windows\dI79dBJCQd.exe
C:\Windows\dI79dBJCQd.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 2312
  2⤵
  - Program crash
  PID:10472

C:\Windows\LP81yQwMt1PTk.exe
C:\Windows\LP81yQwMt1PTk.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4196

C:\Windows\HpzpA.exe
C:\Windows\HpzpA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3596

C:\Windows\a5v0v.exe
C:\Windows\a5v0v.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3816

C:\Windows\13mvBRHO1lrk.exe
C:\Windows\13mvBRHO1lrk.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4572

C:\Windows\SHmc58qa2.exe
C:\Windows\SHmc58qa2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6152

C:\Windows\gpziXDHdt.exe
C:\Windows\gpziXDHdt.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6408

C:\Windows\3GmAjuHwkepgdx.exe
C:\Windows\3GmAjuHwkepgdx.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6664

C:\Windows\6sebnw6nlWzV.exe
C:\Windows\6sebnw6nlWzV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6916 -s 2092
  2⤵
  - Program crash
  PID:7560

C:\Windows\IN66nD.exe
C:\Windows\IN66nD.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6160 -s 2324
  2⤵
  - Program crash
  PID:10596

C:\Windows\CDUqFyvyX.exe
C:\Windows\CDUqFyvyX.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7308 -s 2420
  2⤵
  - Program crash
  PID:10984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6916 -ip 6916
1⤵
PID:7532

C:\Windows\8ANnU6Bc.exe
C:\Windows\8ANnU6Bc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 2324
  2⤵
  - Program crash
  PID:10644

C:\Windows\hBEM0MF.exe
C:\Windows\hBEM0MF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8020

C:\Windows\Gui3BUSDQoB.exe
C:\Windows\Gui3BUSDQoB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7668 -s 2092
  2⤵
  - Program crash
  PID:8620

C:\Windows\2AWjConsjRZ.exe
C:\Windows\2AWjConsjRZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6864

C:\Windows\mGbZwYuc3uVsTv.exe
C:\Windows\mGbZwYuc3uVsTv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8404 -s 2092
  2⤵
  - Program crash
  PID:8328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 7668 -ip 7668
1⤵
PID:8572

C:\Windows\1on7ma.exe
C:\Windows\1on7ma.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8732

C:\Windows\xqzTv9xL6w9TVia.exe
C:\Windows\xqzTv9xL6w9TVia.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9012 -s 2212
  2⤵
  - Program crash
  PID:10940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 8404 -ip 8404
1⤵
PID:9184

C:\Windows\KYpLD6Eq0.exe
C:\Windows\KYpLD6Eq0.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8648 -s 2092
  2⤵
  - Program crash
  PID:9316

C:\Windows\g5aVEN5AuIhQ.exe
C:\Windows\g5aVEN5AuIhQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8964

C:\Windows\gDyrjnMjbplwV.exe
C:\Windows\gDyrjnMjbplwV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 8648 -ip 8648
1⤵
PID:9288

C:\Windows\TPnMtMWGI.exe
C:\Windows\TPnMtMWGI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9412

C:\Windows\vTWqloBsx.exe
C:\Windows\vTWqloBsx.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9684

C:\Windows\ekw74aO.exe
C:\Windows\ekw74aO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9936 -s 2308
  2⤵
  - Program crash
  PID:10808

C:\Windows\qE692XyG.exe
C:\Windows\qE692XyG.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10192

C:\Windows\vGIeZ9O1.exe
C:\Windows\vGIeZ9O1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7048

C:\Windows\FZiDAmSavbL.exe
C:\Windows\FZiDAmSavbL.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:10252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 9012 -ip 9012
1⤵
PID:10920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3396 -ip 3396
1⤵
PID:10456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6160 -ip 6160
1⤵
PID:10584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 7640 -ip 7640
1⤵
PID:5736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 9936 -ip 9936
1⤵
PID:10792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 3812 -ip 3812
1⤵
PID:10932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 7308 -ip 7308
1⤵
PID:5404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13mvBRHO1lrk.exe

Path C:\Windows\13mvBRHO1lrk.exe
Size 804KB
SHA256 759aa0ed9ff1a463c822ba3966e7e78c36553e8bf4945dbc1ec2dd041bd82ca4
MD5 7378162787d1402581e57735edb4b56e
SHA1 638671cc8c431ec664e2c14be7be4a2f36f806f4
SHA512 97a553334aadefd3d9cb6d5e139880b425a066d8c4db92f7e4ca997781bd299d5f02ca624e141149eb86ca4dadcd2cc861ab5313ba5007ad5d24d1c2cbb36f92
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouB:0NA1Yakeer5+nsoW
TLSH
T12305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1on7ma.exe

Path C:\Windows\1on7ma.exe
Size 804KB
SHA256 434a091747608b2dfbf8853461be2efd21c4710994e38db03b218b4ef6633f9f
MD5 605a9a5fba3c130e4e0b7767bd6d2dfd
SHA1 7aa0a5d4d004d9a68dd8c7d873550364ec326121
SHA512 4fa99628fa32c782d80e002983ca5ae23fd56560b7e3b6774af180f31dc4f75ed530cff6c26525ee82f7bbb3e0c46d8b2f8e97f57208b3f666d4b1467d6dda6f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou3:0NA1Yakeer5+nsoi
TLSH
T14705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2AWjConsjRZ.exe

Path C:\Windows\2AWjConsjRZ.exe
Size 804KB
SHA256 2039959a7e6ecee1c2d05c1f637c346c61599c9def7a05210ef34c33a619dc6e
MD5 a671ffa39f91ba4175e8f6563fd6aa21
SHA1 9a02d7ad2fdd3c28693463323b6605768733ec15
SHA512 f5c0a18e86242532d5fb4b9a5b3f653d6db9fde546f288c2e2ae73297423a002044fadb48093e03370d2c41e304adeff4e297bd5ac815752e66851b5a305bfd7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouv:0NA1Yakeer5+nsoU
TLSH
T1B405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3GmAjuHwkepgdx.exe

Path C:\Windows\3GmAjuHwkepgdx.exe
Size 804KB
SHA256 5434c2cea50649a648eed233842e329f523169d2149375d864a2537705cf3e7d
MD5 3192dffe85ff46dc24c7959ba52bc5e0
SHA1 31b3bcf62831e565f16c0b3c85e78ef7b20f9fe1
SHA512 3c2ce2259ba153b617bbbb27f4a3c53e333a6b939f22dc753babab77e5c9fcb027122804b7f701a8917395bae103eed8537b765a8bc650aaa62eef5b13aa8233
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nsoL
TLSH
T15C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6sebnw6nlWzV.exe

Path C:\Windows\6sebnw6nlWzV.exe
Size 804KB
SHA256 4a8272f0acaff497ce35c04fcffdd31f908fe4c7233f85a90dc6b26bb71a8aee
MD5 7d34538ab2ff85f36abcbe1d95ccec02
SHA1 58fdb907667738fce039162fb22694602a648083
SHA512 579876a73b7a756081f1f19107e675fd4c312c3bfd3992c787e3ba049af7ba9c6ef89c455db234134d5b53f960a7782018376e771884c4a2e183b41a2e4d761a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nso8
TLSH
T13505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ANnU6Bc.exe

Path C:\Windows\8ANnU6Bc.exe
Size 804KB
SHA256 7e6c1caace73402f638971dfba78fed93e11cadf08bab22e2e49687b4bfe011f
MD5 1f300cbe531a18377f73ab8cff7685e1
SHA1 417032d7e7e43323f844d22d46cb98cebed1e8c6
SHA512 3c1c700e1881eeeb58f47d605ae5b3e2226b6a31ca613373dc9576fde5e6ec8a0e26aec83db9fd7aad818433b740c7c0320d3b900d2c801a753d492b59bf03fc
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nsom
TLSH
T18A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CDUqFyvyX.exe

Path C:\Windows\CDUqFyvyX.exe
Size 804KB
SHA256 46416f411e03da8584649e7c41c71f95fc5d090f888e0e7ee6ff8662ba84c717
MD5 dbf79f3979d6168cf007657953236542
SHA1 6d19b89448a3818acfe1a921a9cae93679013d6d
SHA512 2ee16c65b76e47d2e9de3f289a63577b435a58047062965c71217fd95e1ebf11bd58f243032115f6623c7cebe8a1326950297e409257d2f00c7ca7b25080d0f7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouN:0NA1Yakeer5+nsou
TLSH
T13305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DlJF7huOQ.exe

Path C:\Windows\DlJF7huOQ.exe
Size 804KB
SHA256 f63a18c4c3ee1c20bd4b525d59d801249ece70c97248ee80a556b7ddc759be3a
MD5 639811110e174f4699b0b7afcccb1552
SHA1 0db78ced4283aa74e53f82d73a05f2bc5234acd3
SHA512 1fc77faca452bab94c0fca934ad56cf3e086a9b32b1aa76e9a504da8dc947fe68fd56a02e8d0f6119319017caba6a9edec2d1899393452895c4c50ef023306e4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou3:0NA1Yakeer5+nso8
TLSH
T14805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FZiDAmSavbL.exe

Path C:\Windows\FZiDAmSavbL.exe
Size 804KB
SHA256 d895f96ae1399f12e4fe143b0e2161c42b995119e637c6b5325b2adaa35ff078
MD5 6f620de92b79dc1779f3512a29bb0f0d
SHA1 01d2435a6e2d1cde5fa7510c2395219782847214
SHA512 bf45d256de20f1a0ad1a622f277ea03b3c1d24865ec90407c0ecf4ac8e23fa516013b966bc163034740fe75de87a3029671ec182a43b286969508afc440864e1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouS:0NA1Yakeer5+nso1
TLSH
T14705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gui3BUSDQoB.exe

Path C:\Windows\Gui3BUSDQoB.exe
Size 804KB
SHA256 80b890a99c931e1b74c1cb20a6455e8b39b896a73dee514fbf0cf8d069043d65
MD5 1b5b528c3a24fa41800048cbe29dedf7
SHA1 70c9ee78534b6498a36d0af78be69c6c4dc9dccb
SHA512 5e2e524222e006900df2df125d0623c7d44ff13250ba2f14433c708fb366e9d25542868302b548559951a98908f115bc87fb64f5fa25d0dd42871bb7ac7b48bb
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nsoC
TLSH
T1A805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HpzpA.exe

Path C:\Windows\HpzpA.exe
Size 804KB
SHA256 5783759119e9ad124f51dfa7775dbec5f54a5bf9a2c122cdf17c0e3a912439c4
MD5 a995c358077b38a0784dd51374cbc7b1
SHA1 52e4e53c9f925d25af72eb675cabae554fb1dc7d
SHA512 81de1cc5bd3af2407abbaa039c6dfa37074b5958e25dbbf8b96a4f2faec632ba14cfc03be9f3e848f184121d90267b9d3fec6b7a5961fac20352ebceac8de785
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoM
TLSH
T13005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IN66nD.exe

Path C:\Windows\IN66nD.exe
Size 804KB
SHA256 efce1537170881e068e3e7057433ce1c232653eebf2ae93c802d70cbcf78ddf4
MD5 849c7d18d7a28ff274848b1bfac678f8
SHA1 5aec210827365a58f09a254307123cf8e48c859d
SHA512 e855f1ef8a11a0effb448d87527a936ffad160734987c8b0974b7445c46080d14b59fcc3bdb76913fd133a4df5f89a51dba4a5a9e5a34060ada427b17603805b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQ:0NA1Yakeer5+nsor
TLSH
T16205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KYpLD6Eq0.exe

Path C:\Windows\KYpLD6Eq0.exe
Size 804KB
SHA256 0ae07ab0c44b248efe617b270e2c2da226af3b90c8a4c05c87b3b5dfa896b860
MD5 07f19b096d969c5fde3c3d5c33f88484
SHA1 5bf453eb288cf50940910cbd9bfb8b840cbba8e6
SHA512 0b3d0e08dbcf22f51254bda4cfbcca0c6df1fab45801dbc77cefdfbd7820971f13e3217ef25f6a4354f078a7a2163204288026bfe2c8d4b43e4c0c887f8f983e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nso2
TLSH
T11805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KckrD.exe

Path C:\Windows\KckrD.exe
Size 804KB
SHA256 f25f7304aaa328f60d55b44e2cf5f948df3f92f604b7d12509b13c47c4b0fcf4
MD5 ed0d00141d2764f5672d54de9975b96a
SHA1 b309864545a732bebb00d50cd3a67641920522e3
SHA512 4312b8bde9e7f4b7a0d6850c113c9c391f3e3c8cb012c1d7cb0fb4a1d866954a48f684b483aab62efa2ea222bc63030ecccfa896246e3c56e3de428625e9a6fb
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouV:0NA1Yakeer5+nsoC
TLSH
T16505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LP81yQwMt1PTk.exe

Path C:\Windows\LP81yQwMt1PTk.exe
Size 804KB
SHA256 533dc057b7b3b0289c7831f237c8c1afabaa4527b11c913eb4b2c55a6ccd6a12
MD5 3dc9c4209435bb02f37f4a6b47a814d3
SHA1 c3226268f9768a2ed26043e7402670c527d1f449
SHA512 0dcbb3a261bca5bab17d3a1417c8b35e2cfbc700e8442df8b3602f78f2811fd5a0be7100aa63370d12727c4f8567ce73ff30fe650931fa8769c421d96213fe5c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nso4
TLSH
T1C805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SHmc58qa2.exe

Path C:\Windows\SHmc58qa2.exe
Size 804KB
SHA256 5e738d4e4b4564296bbf3eba06ac2b4ec876b355453a364e0e16cc4435c446a3
MD5 1eb825cdb09d8a80c6c64cea97e54d80
SHA1 2b6f6d00eb19c2ab23dffb51f63088a37199c0d9
SHA512 2d731ef2b142c380a5babab47383ee632e46d77b081462df253fc293037d66b378de9b7e2c4e4e5132ffe85d185be7c3f83e13bbd803c5f20d3be64ef9b1b3f5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsoQ
TLSH
T19005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SntwBXYzgnM2C.exe

Path C:\Windows\SntwBXYzgnM2C.exe
Size 804KB
SHA256 677a1715aa9f146c9390ee93f4f9dde542308a0a391d4f306e20bf0e608cc9aa
MD5 4ce6cdea60d6b82bb6bb6c5188cd9eae
SHA1 a388e862dab11f628dd0ece6dcdfac5a98bbdd1b
SHA512 df1fd90a9e002ff0220f6582fe7959a87ec99f21b9d951d520432b4c2981597705daf302d88ec4805d756f6eb7ac95ce8b9b800566d358d916ed12eae6d81561
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nso7
TLSH
T1EA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TPnMtMWGI.exe

Path C:\Windows\TPnMtMWGI.exe
Size 804KB
SHA256 25e20ccf65408fba5b37ab991cc781da2bc5e4d17bca183229680357e9af1699
MD5 be3b349e4ce455ca94a10f1e9d5b3cda
SHA1 fc711051316eee75d89daba4c359d5749135052c
SHA512 093a2b30e5c82c0c98f1a44ea45e74033c8766ca66076f9b4d42035a10987420e5ea1364fd3b91d7ea6237c113fc4c34d437bf9be4dbf0888036919ff4bea75f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nso0
TLSH
T1DD05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5v0v.exe

Path C:\Windows\a5v0v.exe
Size 804KB
SHA256 fc5849126785ab3562e212f03c5dba91970be361e11fc82ba098ec9cf1ae6322
MD5 89f8905282f99c613e97e6c0b7de0442
SHA1 60dca17fc0c1eea53c572b9348bc8becdfd3efe2
SHA512 be7961dce0cedc59f92c8234a89198883d9da426e46d65b66976949f9842f6d56c2ce5acda5c5afeafb5bb3c90d632227518061a53faa90e6e17b98135723247
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nsoK
TLSH
T16E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dI79dBJCQd.exe

Path C:\Windows\dI79dBJCQd.exe
Size 804KB
SHA256 208f38b18d566ca31f2787271b3b03e602a5ab723f0dd1ebae4505edba40a8b2
MD5 d4c09570177851148c9e2c4dc00a8897
SHA1 569ce90bc0a6c1ba26c70d51df55e30b373d42a9
SHA512 9525aed3b11ab06184a394e30f028d876a0b0d4ff718a11fdb07da7fcd6902045b686a7fbb140b79b96fa18116ccb2639bc082296d31153100c41f9cece77231
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoua:0NA1Yakeer5+nsoR
TLSH
T1C005A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ekw74aO.exe

Path C:\Windows\ekw74aO.exe
Size 804KB
SHA256 3df0c0842289d3e582a1838c3474206b4481201cea66e457e18da0f3ee08f886
MD5 656fd7db76af63a2e1393bd95cec75e7
SHA1 eb4087e835bbc081b55dd465f6a5728aa9c3bf03
SHA512 68ef5c7a55d3b12b92376ef212f96222b7e6390ca2781fe6a33c646842fe792edd449ae1b5ece4e50437fbdd41500960ebdff5b8498816b92cc917b1203b4613
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouS:0NA1Yakeer5+nso/
TLSH
T18605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g5aVEN5AuIhQ.exe

Path C:\Windows\g5aVEN5AuIhQ.exe
Size 804KB
SHA256 d807d5487a7e155bf9abb5129fffb5233a7a13cff312e80f23b406b1478a61af
MD5 429cdaff8e7434ddc167ee641b98d28c
SHA1 99a53aa7bab334e25ce2c8b647c2e16754f7df2c
SHA512 497b17fdb07a801f3857ada4dbe58b5d3157e7450b780d127bf87acf9493e1a3e7c3cd67512548ffeb673836bb2efb267fa757a727a626143921cd8a484bf808
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouo:0NA1Yakeer5+nsox
TLSH
T15705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gDyrjnMjbplwV.exe

Path C:\Windows\gDyrjnMjbplwV.exe
Size 804KB
SHA256 f8b616ffb4392c4c1ba9cbffb03846679af50f3e51737329dd1ee54569937740
MD5 eca508bf4f2031fd42c3c082fe384b10
SHA1 4baa699ab21a5295cd231e645b71685679ec1db2
SHA512 77e215d9eaede0a7286da4575f5eacc799c607191814af9fb5c2b60087ebe22377e85785513709e5d5ab42192c4238932b429a7d63b5637daf43caef5d01b989
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nso7
TLSH
T18505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpziXDHdt.exe

Path C:\Windows\gpziXDHdt.exe
Size 804KB
SHA256 3f9373d54f948f8ee6ec7451f774b47691b64fe360fd9b4636216718419a942e
MD5 83be403e67504a4538814cfd59b7eb81
SHA1 eb07f1c2cadb27860811c2663d02779954f8a3b1
SHA512 18a35f2f19087f5d7b1adfad390d0d35f5f884b3636229d61b92b550f635b90acdef5b589d3a21fa87e4b6736814d776b2b2a8af3af3844929ee5acbfd7f3d09
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouc:0NA1Yakeer5+nsoX
TLSH
T1A005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hBEM0MF.exe

Path C:\Windows\hBEM0MF.exe
Size 804KB
SHA256 2b1d7832bfdc3e433319a296fa5efcb68cfc8c7e09ba9365d0374a68c7ba590d
MD5 b3cda35e57e728f5238dfd3504f7e487
SHA1 e9f90d510ef10d159617f59ebcc27071edebdb1e
SHA512 228787dcfe969ba43a512e16ec0f46e552f7d0e70ebd404dc7459597e780c638af03597e5d128d327b39d80a86627ebb92f3ec85cac49a5befcd129efb7444d0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoui:0NA1Yakeer5+nsov
TLSH
T1CD05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mGbZwYuc3uVsTv.exe

Path C:\Windows\mGbZwYuc3uVsTv.exe
Size 804KB
SHA256 8b8843c552b78a6412ef339c6da30c04f0fb96b6dfcc80cf88be3fe9de07ad76
MD5 5f580ba4da4ea5ef521e8de8699eca26
SHA1 105dfa371b70aa979af4f028d32b3607141ddcff
SHA512 e0f192ecc08cafa8180480cd7fcf25ad24ab5d37932461215d602cb65e02fbeb4c076c80d24f1239945e4a0a72dcb290b768a6a50e8e0cc336fc7ff4aabd129e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nsot
TLSH
T1EE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qE692XyG.exe

Path C:\Windows\qE692XyG.exe
Size 804KB
SHA256 210f63009d1683a46502df24753d11c60ed81d888d1162b6c90129da04cba47b
MD5 a92468c907cd1f4426db23375ea99b98
SHA1 fa4e95490ec863f0c1f8ba66bd7fcb38cabdbfc1
SHA512 fc83bb0edffab9efa9f9dd768a4e864317524e5a0281b5c12ed246faf07d26b3de34f73b6162e4fb0505d14f87fa5b04d99675a9ae617b23d5c608b7aac1ef54
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsog
TLSH
T10605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qZa7rVt3x4tjLw3.exe

Path C:\Windows\qZa7rVt3x4tjLw3.exe
Size 804KB
SHA256 227fdd57fa59120b56f2b82f88c714e6f1e9a7ef0825ae905e3189f2f596826f
MD5 5455c1e5ac1c9a9fc28c66eafc699998
SHA1 5d534fb163cdd7115b5612b1a6a1784c2d808874
SHA512 17b295b2506a715f083407b59075f92911385f2370e06ce7890f7624cd7d630ee8fa483fb58514d5ea1d6ca939bcabd36e8b3f00e3c3e16807364b11f27292ec
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsos
TLSH
T17B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vGIeZ9O1.exe

Path C:\Windows\vGIeZ9O1.exe
Size 804KB
SHA256 d91e6d8a447e1e4e101a53fe0e2e613e85f7f6ca652c2a634c7844b4d7058180
MD5 8ab1756c7f3308f5f7720708b90a2108
SHA1 efa213ba149403a1c46e3f8c08d70e80d1ddc3c5
SHA512 7057029f59b074aade2beaf002b0c3210ae87e4ba81fc5acd97c0f896ecf72c3ecb957892668a450e6604b2fc6ab016dfa97b799ed7a56ca3edccaffabc8db37
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoug:0NA1Yakeer5+nsoV
TLSH
T1A205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vTWqloBsx.exe

Path C:\Windows\vTWqloBsx.exe
Size 804KB
SHA256 b2504ef5cff3fb09db9ff6695cf26972217bffb74cc6f0a555bea702653cdbbd
MD5 da60f36bc640f3f9dfccf13a6b9c83b3
SHA1 cd0c9f8dcda6ec011e4e815c779c844ef011cd2b
SHA512 6e4f41a5483709820c6fadd8a4315b08c14e6bf4351b0d6345c7f4dc5494f1b91d9695324e35a8e484b57d84cee026b66a7e72be09958261db804f14eec79b64
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsow
TLSH
T11905A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xqzTv9xL6w9TVia.exe

Path C:\Windows\xqzTv9xL6w9TVia.exe
Size 804KB
SHA256 f1bfa7ad0b1ce5a0d7a0494e1f95d0fa2734f75c2321b58d0d7240241c119be5
MD5 1dfb9dcc5a7b870276aad46ca5c52007
SHA1 ff68bd890af3027460a1572c28abcafe159ba2f2
SHA512 9215076866c9de0d5a028584ddb45886be84c410d4c5e26b0a6bfd392f81c4cf642348f0ac03920f14e691147aebf44b2240daa0ea6876104e2d9fad15f6b623
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nsof
TLSH
T1B705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads