03ebe6e7454f0b35e17bbe9cb5c40b73d271cd22efe6a8505fbb281e34d024fc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260930-2e6b3ayw2p
SHA256 03ebe6e7454f0b35e17bbe9cb5c40b73d271cd22efe6a8505fbb281e34d024fc
MD5 3117204ffc564f9bbfe2b7884464b166
SHA1 8cc023537cf3c4842b3f4a844fed9f4394638518
SHA512 0ff16949160248a2ba1a3c10c1814c548f9065fc469e468722f3263f909060c665c207ba42de0be9d5d2137d8ea3f0f1a1bdd9bcc35fcc327bf1f99dc110e5f1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nsoD
TLSH
T16305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (1783) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 20 IoCs

pid	Process
1340	q1vnkBps7.exe
2988	GoDr2.exe
5888	Tz0UPSPeAubAt8k.exe
2284	lQpW9xNLy.exe
4176	BMJ3sht.exe
716	vkMsrJsld6ICUWE.exe
4600	GkykM9dROCG.exe
5528	LFxGirYu.exe
4440	NuN87.exe
3128	RIFVKwtJH8t.exe
4212	wlu8A2.exe
5960	NuxsXi73l.exe
436	yV8PJccYCvMI.exe
6344	4PMGmtAHeoBz.exe
6592	poOJQkPLbc20d.exe
6848	s71aH3YM.exe
7124	YIhDFNMFZACs.exe
6364	DVVhllUN2.exe
6348	nUS9s9J4TYo.exe
7372	bzh7Z.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\P-WIN = "C:\\Windows\\poOJQkPLbc20d.exe"	4PMGmtAHeoBz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCVSSHLD = "C:\\Windows\\bzh7Z.exe"	nUS9s9J4TYo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAV7WIN = "C:\\Windows\\lQpW9xNLy.exe"	Tz0UPSPeAubAt8k.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NISSERV = "C:\\Windows\\BMJ3sht.exe"	lQpW9xNLy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NOTSTART = "C:\\Windows\\GkykM9dROCG.exe"	vkMsrJsld6ICUWE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\REALMON = "C:\\Windows\\LFxGirYu.exe"	GkykM9dROCG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFSCANGUI = "C:\\Windows\\RIFVKwtJH8t.exe"	NuN87.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICSUPP95 = "C:\\Windows\\nUS9s9J4TYo.exe"	DVVhllUN2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NOTSTART = "C:\\Windows\\q1vnkBps7.exe"	2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVLU32 = "C:\\Windows\\GoDr2.exe"	q1vnkBps7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LDSCAN = "C:\\Windows\\NuN87.exe"	LFxGirYu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SPHINX = "C:\\Windows\\wlu8A2.exe"	RIFVKwtJH8t.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVSCHED32 = "C:\\Windows\\yV8PJccYCvMI.exe"	NuxsXi73l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VET95 = "C:\\Windows\\s71aH3YM.exe"	poOJQkPLbc20d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCCWIN97 = "C:\\Windows\\YIhDFNMFZACs.exe"	s71aH3YM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VBCMSERV = "C:\\Windows\\DVVhllUN2.exe"	YIhDFNMFZACs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LDSCAN = "C:\\Windows\\Tz0UPSPeAubAt8k.exe"	GoDr2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVXMONITOR9X = "C:\\Windows\\vkMsrJsld6ICUWE.exe"	BMJ3sht.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPROTECT = "C:\\Windows\\NuxsXi73l.exe"	wlu8A2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-STOPW = "C:\\Windows\\4PMGmtAHeoBz.exe"	yV8PJccYCvMI.exe

Drops file in Windows directory 40 IoCs

description	ioc	Process
File created	C:\Windows\q1vnkBps7.exe	2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\BMJ3sht.exe	lQpW9xNLy.exe
File created	C:\Windows\vkMsrJsld6ICUWE.exe	BMJ3sht.exe
File opened for modification	C:\Windows\vkMsrJsld6ICUWE.exe	BMJ3sht.exe
File created	C:\Windows\wlu8A2.exe	RIFVKwtJH8t.exe
File opened for modification	C:\Windows\yV8PJccYCvMI.exe	NuxsXi73l.exe
File opened for modification	C:\Windows\4PMGmtAHeoBz.exe	yV8PJccYCvMI.exe
File created	C:\Windows\DVVhllUN2.exe	YIhDFNMFZACs.exe
File created	C:\Windows\LFxGirYu.exe	GkykM9dROCG.exe
File opened for modification	C:\Windows\NuN87.exe	LFxGirYu.exe
File created	C:\Windows\nUS9s9J4TYo.exe	DVVhllUN2.exe
File opened for modification	C:\Windows\GoDr2.exe	q1vnkBps7.exe
File created	C:\Windows\GkykM9dROCG.exe	vkMsrJsld6ICUWE.exe
File opened for modification	C:\Windows\RIFVKwtJH8t.exe	NuN87.exe
File created	C:\Windows\yV8PJccYCvMI.exe	NuxsXi73l.exe
File created	C:\Windows\4PMGmtAHeoBz.exe	yV8PJccYCvMI.exe
File created	C:\Windows\poOJQkPLbc20d.exe	4PMGmtAHeoBz.exe
File opened for modification	C:\Windows\poOJQkPLbc20d.exe	4PMGmtAHeoBz.exe
File created	C:\Windows\s71aH3YM.exe	poOJQkPLbc20d.exe
File opened for modification	C:\Windows\NuxsXi73l.exe	wlu8A2.exe
File opened for modification	C:\Windows\q1vnkBps7.exe	2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\Tz0UPSPeAubAt8k.exe	GoDr2.exe
File opened for modification	C:\Windows\lQpW9xNLy.exe	Tz0UPSPeAubAt8k.exe
File opened for modification	C:\Windows\GkykM9dROCG.exe	vkMsrJsld6ICUWE.exe
File created	C:\Windows\NuN87.exe	LFxGirYu.exe
File created	C:\Windows\RIFVKwtJH8t.exe	NuN87.exe
File opened for modification	C:\Windows\s71aH3YM.exe	poOJQkPLbc20d.exe
File created	C:\Windows\GoDr2.exe	q1vnkBps7.exe
File created	C:\Windows\Tz0UPSPeAubAt8k.exe	GoDr2.exe
File opened for modification	C:\Windows\DVVhllUN2.exe	YIhDFNMFZACs.exe
File opened for modification	C:\Windows\nUS9s9J4TYo.exe	DVVhllUN2.exe
File created	C:\Windows\bzh7Z.exe	nUS9s9J4TYo.exe
File opened for modification	C:\Windows\BMJ3sht.exe	lQpW9xNLy.exe
File opened for modification	C:\Windows\wlu8A2.exe	RIFVKwtJH8t.exe
File created	C:\Windows\YIhDFNMFZACs.exe	s71aH3YM.exe
File opened for modification	C:\Windows\YIhDFNMFZACs.exe	s71aH3YM.exe
File opened for modification	C:\Windows\bzh7Z.exe	nUS9s9J4TYo.exe
File created	C:\Windows\lQpW9xNLy.exe	Tz0UPSPeAubAt8k.exe
File opened for modification	C:\Windows\LFxGirYu.exe	GkykM9dROCG.exe
File created	C:\Windows\NuxsXi73l.exe	wlu8A2.exe

Program crash 13 IoCs

pid	pid_target	Process	procid_target
4728	4176	WerFault.exe	101
1288	4600	WerFault.exe	110
4324	5528	WerFault.exe	113
6856	6344	WerFault.exe	135
7572	6348	WerFault.exe	147
7644	7372	WerFault.exe	149
7304	2988	WerFault.exe	89
7284	4440	WerFault.exe	120
8064	716	WerFault.exe	105
8036	3128	WerFault.exe	125
6324	1340	WerFault.exe	85
3244	5960	WerFault.exe	131
8116	6848	WerFault.exe	140

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lQpW9xNLy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BMJ3sht.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NuN87.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NuxsXi73l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4PMGmtAHeoBz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tz0UPSPeAubAt8k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlu8A2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poOJQkPLbc20d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s71aH3YM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YIhDFNMFZACs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DVVhllUN2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzh7Z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vkMsrJsld6ICUWE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LFxGirYu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RIFVKwtJH8t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yV8PJccYCvMI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nUS9s9J4TYo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	q1vnkBps7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoDr2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GkykM9dROCG.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4852

C:\Windows\q1vnkBps7.exe
C:\Windows\q1vnkBps7.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 2308
  2⤵
  - Program crash
  PID:6324

C:\Windows\GoDr2.exe
C:\Windows\GoDr2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 2072
  2⤵
  - Program crash
  PID:7304

C:\Windows\Tz0UPSPeAubAt8k.exe
C:\Windows\Tz0UPSPeAubAt8k.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5888

C:\Windows\lQpW9xNLy.exe
C:\Windows\lQpW9xNLy.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2284

C:\Windows\BMJ3sht.exe
C:\Windows\BMJ3sht.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 1964
  2⤵
  - Program crash
  PID:4728

C:\Windows\vkMsrJsld6ICUWE.exe
C:\Windows\vkMsrJsld6ICUWE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 2200
  2⤵
  - Program crash
  PID:8064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4176 -ip 4176
1⤵
PID:5412

C:\Windows\GkykM9dROCG.exe
C:\Windows\GkykM9dROCG.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 1972
  2⤵
  - Program crash
  PID:1288

C:\Windows\LFxGirYu.exe
C:\Windows\LFxGirYu.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5528 -s 2016
  2⤵
  - Program crash
  PID:4324

C:\Windows\NuN87.exe
C:\Windows\NuN87.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 2080
  2⤵
  - Program crash
  PID:7284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4600 -ip 4600
1⤵
PID:3944

C:\Windows\RIFVKwtJH8t.exe
C:\Windows\RIFVKwtJH8t.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 2216
  2⤵
  - Program crash
  PID:8036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5528 -ip 5528
1⤵
PID:1960

C:\Windows\wlu8A2.exe
C:\Windows\wlu8A2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4212

C:\Windows\NuxsXi73l.exe
C:\Windows\NuxsXi73l.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 2300
  2⤵
  - Program crash
  PID:3244

C:\Windows\yV8PJccYCvMI.exe
C:\Windows\yV8PJccYCvMI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:436

C:\Windows\4PMGmtAHeoBz.exe
C:\Windows\4PMGmtAHeoBz.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6344 -s 1976
  2⤵
  - Program crash
  PID:6856

C:\Windows\poOJQkPLbc20d.exe
C:\Windows\poOJQkPLbc20d.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6344 -ip 6344
1⤵
PID:6828

C:\Windows\s71aH3YM.exe
C:\Windows\s71aH3YM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 2336
  2⤵
  - Program crash
  PID:8116

C:\Windows\YIhDFNMFZACs.exe
C:\Windows\YIhDFNMFZACs.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7124

C:\Windows\DVVhllUN2.exe
C:\Windows\DVVhllUN2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6364

C:\Windows\nUS9s9J4TYo.exe
C:\Windows\nUS9s9J4TYo.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6348 -s 1972
  2⤵
  - Program crash
  PID:7572

C:\Windows\bzh7Z.exe
C:\Windows\bzh7Z.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7372 -s 1836
  2⤵
  - Program crash
  PID:7644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6348 -ip 6348
1⤵
PID:7552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 7372 -ip 7372
1⤵
PID:7624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2988 -ip 2988
1⤵
PID:7616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4440 -ip 4440
1⤵
PID:7188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 716 -ip 716
1⤵
PID:7948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3128 -ip 3128
1⤵
PID:8028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1340 -ip 1340
1⤵
PID:7172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5960 -ip 5960
1⤵
PID:1076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 6848 -ip 6848
1⤵
PID:5924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4PMGmtAHeoBz.exe

Path C:\Windows\4PMGmtAHeoBz.exe
Size 804KB
SHA256 84e83b2f61c766d746a4f2cd05a5bc5addb7f1e7a638393a537078ff889623f3
MD5 eb8c9ce4294860a86597e395d6c6f35d
SHA1 1730bd745fc05d280e0a1382a5f82760e8bc22c0
SHA512 3648424e18c2dbf174e46ceedbe805e1fe3e736b985e7d4da851cd1ec6b7642642859b8e5698d09d102cb5fcc8ab2bb7dd875846090a747d382086043cdf6d3b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoug:0NA1Yakeer5+nso/
TLSH
T10605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BMJ3sht.exe

Path C:\Windows\BMJ3sht.exe
Size 804KB
SHA256 32116ba78a6c7f5d2a2506a3d3b0305cbab38acfcdeec8482f5432c3e34383c7
MD5 31199e4a6f1dfab8878dbf6d37f25d2e
SHA1 7d38381ab424146149ad3804d9eeec563f0d8323
SHA512 5888838a50013db2d33a0c6952836abc39803b02aa648d3f4d2242b0ab320ad67ebee57e5243eb359163f93acaa8ad69f854d1d8c1848308744159d61b808ba6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsoi
TLSH
T15A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DVVhllUN2.exe

Path C:\Windows\DVVhllUN2.exe
Size 804KB
SHA256 52799030eb2bd125556ba54a19d5ad7e80f686c89da3ec94302270d4a0ce1a80
MD5 24926ff5ab7ac3371d0575d4d1fe9bea
SHA1 ceea395d8a759559d2d692822855aae15fd40135
SHA512 469bf18503be69b47859835d06ba501185a9af4dd1cb70098c458dc7e8cb7a70bab21a4f7e73d724187c099120c5b528a9066d1bcc73e974bb338544ca5b17aa
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouH:0NA1Yakeer5+nsoE
TLSH
T19205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GkykM9dROCG.exe

Path C:\Windows\GkykM9dROCG.exe
Size 804KB
SHA256 244b7b45d9bd20e387e31dae76dec66480d66bc41b05cebe6798de0831c452f5
MD5 77e9554005bd7c64a1c779a7d051d008
SHA1 66e1b9e82b5d48495044a8a7cf8e7bd07980be3b
SHA512 40c566d3a50350f44041a14460598348693fa4ceb508c7c27743106faaa5a6219edb227a1f71ba3e32921d9e91106cf9519dc6a36cf1fed3bdc32e16857f588c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nso1
TLSH
T1F305A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoDr2.exe

Path C:\Windows\GoDr2.exe
Size 804KB
SHA256 125e2daf9b8e91177e4f003b27fa7ba5a1a7e8ccd7c151f832f474669a3be4e4
MD5 248c1f7344f0adec41ab9497d4715370
SHA1 e200a8900fb4b3062343bdabfd134178d45ff7b7
SHA512 383b1b1b149717609e15aabfb2aa0047ea934931941f8cd5d83e4ee3abf72d4ffc131c176b6e163b31aa3d6eae52a7f58245654c7233b8abf88b4eeea671b20f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoua:0NA1Yakeer5+nso9
TLSH
T1A005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LFxGirYu.exe

Path C:\Windows\LFxGirYu.exe
Size 804KB
SHA256 4d1dcd0412f1f871bd8cf385b0f70a210f9cfd4d95332e933d99d401bb7b5514
MD5 06baa7b38788f9eecfeca8eb16557e56
SHA1 5d7b0d3a2569da4de8fb0c070ff260857490d622
SHA512 dc05791882e6bd33054c6cc8bcd7b4a1f881d080559c914ac72132902a767d43a18ae5129d0380b5d439f47b85aedcd954349b3413dd9986a82a54aaa8a5dde7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouV0:0NA1Yakeer5+nsov
TLSH
T1EE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NuN87.exe

Path C:\Windows\NuN87.exe
Size 804KB
SHA256 b0342581cd7077c392322af8d1378e172dced1829a517da21d7846e4fb07b1ec
MD5 e877072383d921a8dda03ef11daf1a8b
SHA1 5cebd9d4680e30bd0efd90b19f3352987c1f48bc
SHA512 eab5a5923b25c0191e828b0135c8a02717bcadcbd24bb38bc03ef647c83d1cb234b51f03549e752291447aba99965d25e9da82f73c49a64716bd78a12c845115
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoum:0NA1Yakeer5+nsoB
TLSH
T19D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NuxsXi73l.exe

Path C:\Windows\NuxsXi73l.exe
Size 804KB
SHA256 0dbed69cc36d25317a5211d4c6ce7ee59de0ecfd5cec8faa4a0d97b8ef8dc7c0
MD5 e57fa39edb18dc800b4560aab10e0ad5
SHA1 09d718ab1eba2ead363d4c4ba1b115e70632e066
SHA512 b273e6d79d00bc7b6818189c703d2f399465b262a7c48be423cb43fb6eb0496660fec9921f2b375fbd3b2b86877e452af88c24d88a68ce00d50cd5dfa51a4300
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsoG
TLSH
T12305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RIFVKwtJH8t.exe

Path C:\Windows\RIFVKwtJH8t.exe
Size 804KB
SHA256 de8a39e14861d50263d281b6254bc877a79f693a928cc740976343659f766414
MD5 bc361625e3a8357a1e707cfe93affe3b
SHA1 f48a8e605351fbdec352e6c25a5316e71cd2db1d
SHA512 9e6aced4807a4bb489e2d986220d72cede54c33f3a3a8aa03f4961667097c923d6943d99a20621ada2f962974e1790df309fac5a0ba3ff2bc4d6352dac7ef5c2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nsoN
TLSH
T18E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tz0UPSPeAubAt8k.exe

Path C:\Windows\Tz0UPSPeAubAt8k.exe
Size 804KB
SHA256 6bf8f98f7df4f577c91d98d832b7b6e0b3712a8651bfffabef355e2415ec610e
MD5 00b64f64a6d06497aab9075963676670
SHA1 c8c9067f7914fb307bf7aaf8dce9740c20b49b3f
SHA512 ed04796d250e69829910dab0431f0cb52f41a29b2c3ea3a3f08661b89311d2e368783f183a7696d99511abef426cb22147fb37d2733df38c784f9694ad3b5262
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouh:0NA1Yakeer5+nsoq
TLSH
T19D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YIhDFNMFZACs.exe

Path C:\Windows\YIhDFNMFZACs.exe
Size 804KB
SHA256 cb018a59487fcd18921b0202867f9813b4aa512319fe2209e1f060d93884dbcb
MD5 373088a4ecff28d22734aee36483fc1b
SHA1 f9c51fd8dd2ddc3dfe8c63b4a8b969aac2b36d84
SHA512 85ed160e11fac5e5caad815c392c7a50a4a605cde0d94abd161bc728fd5c43f0e080664009e142e323adddce2969667669fc06771e3b2715f854e34e72d6aa05
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nsoj
TLSH
T16805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzh7Z.exe

Path C:\Windows\bzh7Z.exe
Size 804KB
SHA256 12acf4da8ed84958724a0a4df41524fc8efddf06d949ae946626b6fcaab22e4b
MD5 fc23117970fd91050de91206f57ec50d
SHA1 7cdfad5f3f84a93e6bf9a841c87a66e4e7aea92e
SHA512 8f7d2f3ca0d45a6ae58707c7d7bc4f73719107529fc50eee9e1be8b6ac8ca18c8b92af44cb7ba5ea527f25c80ba0ce08dc582f00a18b920db4fd952d5d81d2f3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsow
TLSH
T17805A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lQpW9xNLy.exe

Path C:\Windows\lQpW9xNLy.exe
Size 804KB
SHA256 6e131ee91b59bd9a98f4f3a7d1037a510326a7d94ea42a3109ed029762c5c657
MD5 57e8648384ab555e1735d94a4e0ac922
SHA1 42618f69828ae938a0c2a2111ae8527615352447
SHA512 27f19cb72a5e04659bbbdfa3b041e573c5fcfcea0b0897f26b2cdc8f9716f1d6e2f51abcb133cfe194b32562a0bc133a1d4173886432989a969461965c506677
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouz:0NA1Yakeer5+nsoY
TLSH
T1A005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nUS9s9J4TYo.exe

Path C:\Windows\nUS9s9J4TYo.exe
Size 804KB
SHA256 bf054ee14565efd4b057829eed789d80f69c4987e78ab81a7aef5be3fd7a4b71
MD5 6af5bba0045097023f2f9e5751ac73ac
SHA1 5e5eb6ac775244bd7851d92ca0004cc72450892d
SHA512 92c1f91f4f2c39ef19d78293a12afa237b2509286c58ee9df120170e6229b49f9565905651f525ab27a7884bc0b703f823a0d540a57663c01a1b38766fec8c71
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nsor
TLSH
T12805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

poOJQkPLbc20d.exe

Path C:\Windows\poOJQkPLbc20d.exe
Size 804KB
SHA256 01679a82b0694c4f0e8de1a4d9a50c9dc8fad14c57551f56bbf98edba17c0cd5
MD5 31722acdbafbe47d9802794bc8260c68
SHA1 63aa4a23bb88a2253461dc8433d6ee78e5354d33
SHA512 bb1ac8768145e593ba5da4a75a582becfead1ada28438d81f9ad8327af3b2a6955f95a7431c363de2059f1c4e9581b78dcde049bf83317c48a68ce9a1e295c11
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoux:0NA1Yakeer5+nsok
TLSH
T18E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

q1vnkBps7.exe

Path C:\Windows\q1vnkBps7.exe
Size 804KB
SHA256 b645db18fab8d477736505b3fe3f125f8f763477bc104eac457c8fc972f14809
MD5 90693d4055cd781909957b4e215ca1ca
SHA1 4cce3956ffd0cce4181432d219228b9a22e46dc4
SHA512 c16948793416d71d35d6a7ff8f2d60b1de8868679dcb6008711d906f3fe172717f8deffd595b7c42f135a97dd5b8668fbfc9b126fb36d5bb09856245a138997a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nsoH
TLSH
T19805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s71aH3YM.exe

Path C:\Windows\s71aH3YM.exe
Size 804KB
SHA256 bdc01c17cb6834cbbe369b89c9b3a1764dbccb1973af20e1b2b9a8c5fa993a32
MD5 6bc681720ace582f48679d82d7aa6c97
SHA1 795ffe82af5481a27bf9b2ce85be63cb8ffbedf0
SHA512 2f04b12ae3c451cdadc5b3e2aa1c05e916e21292fdb991b7f004070e1585b7d01b80dc8909e57a89dedc797f17ef4f41c81c9a6e9147ea7441a7e8ce548f9056
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFourQ:0NA1Yakeer5+nso4Q
TLSH
T10805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vkMsrJsld6ICUWE.exe

Path C:\Windows\vkMsrJsld6ICUWE.exe
Size 804KB
SHA256 cf52cd1841bad6ea6899415eef9c0aeed8ba58995dc9d2f2d8a3ce62ea3f5c71
MD5 e5aa804d66bf911ee0aef246554ff5ec
SHA1 57cc82ebb1f905366cca26381aa42d77098017ec
SHA512 b383d75b1aa43c0d3e32846a19f222f426b87bb60fa87f7f310cda53eb671640d8673454eec864e241774bde9472077a258232f5d26eed6710547a9df026e41c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou4:0NA1Yakeer5+nso5
TLSH
T11405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlu8A2.exe

Path C:\Windows\wlu8A2.exe
Size 804KB
SHA256 64df6509fce379eb4704719397be9652d024a189abb8be4badfb5b2a2eac2182
MD5 21590b0938c47a1f67df58bd2aa9e047
SHA1 3d28dc1c6823696a4e45c973d33a15cf8705788b
SHA512 69864b3c7623ef200b3403feb616194812ed163081979d86ac9f8ef61ed9baf0f42f7afe1e33b8b5c032f7478cea26abef32b7e45b042a8a046e610afeeb8440
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouJ:0NA1Yakeer5+nsoY
TLSH
T12605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yV8PJccYCvMI.exe

Path C:\Windows\yV8PJccYCvMI.exe
Size 804KB
SHA256 d4212b8205d281f6afc52f3a037b75b96c230c985d2779bc4cf85226756cd7f1
MD5 17cf49b73a8b8e6040e41efdf1f1c3b6
SHA1 2ca1da1aa467da6a22a0cdf40ab117766d91a6e9
SHA512 1b19e974488cb7a5a989b0166613f7b162cc689175975f3105c05586f0666678e96a4e7484a3c49ed48d099bc66348fb7616286a4580aa16062dd39cac5e0338
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsoi
TLSH
T13A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads