03ebe6e7454f0b35e17bbe9cb5c40b73d271cd22efe6a8505fbb281e34d024fc

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260930-2e6b3ayw2p
SHA256 03ebe6e7454f0b35e17bbe9cb5c40b73d271cd22efe6a8505fbb281e34d024fc
MD5 3117204ffc564f9bbfe2b7884464b166
SHA1 8cc023537cf3c4842b3f4a844fed9f4394638518
SHA512 0ff16949160248a2ba1a3c10c1814c548f9065fc469e468722f3263f909060c665c207ba42de0be9d5d2137d8ea3f0f1a1bdd9bcc35fcc327bf1f99dc110e5f1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nsoD
TLSH
T16305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2373) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 22 IoCs

pid	Process
3388	MBAjjsDrpO.exe
3212	SNUONs.exe
4744	EosK2d40Jq7T0.exe
5128	YhmLNY.exe
3020	glub6i.exe
2276	UsW0klvTT.exe
4660	geoBvprbpYhadP.exe
5740	RhTZCMU.exe
4740	KYRybpii.exe
4720	s4CJI9X4.exe
6208	F7p6FZBkbq.exe
6456	NUdJkM9Ha3rMSC.exe
6708	pTlJXexN.exe
6960	k1h6wQ.exe
6464	nAcBwhb1Dln.exe
7456	xGexZTBr5gDMjvm.exe
7708	0IYs5FGm7atpkHd.exe
7960	431Un4A8WGXX6Kj.exe
7668	7oL0zGNBq.exe
8416	UEqZYLXNtP.exe
8692	0sZIRwAyNive.exe
9040	YvtGa.exe

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVWUPD32 = "C:\\Windows\\glub6i.exe"	YhmLNY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IAMAPP = "C:\\Windows\\KYRybpii.exe"	RhTZCMU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAV7WIN = "C:\\Windows\\0IYs5FGm7atpkHd.exe"	xGexZTBr5gDMjvm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ESPWATCH = "C:\\Windows\\431Un4A8WGXX6Kj.exe"	0IYs5FGm7atpkHd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFINET32 = "C:\\Windows\\MBAjjsDrpO.exe"	2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVNT = "C:\\Windows\\SNUONs.exe"	MBAjjsDrpO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSGK32 = "C:\\Windows\\YhmLNY.exe"	EosK2d40Jq7T0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CLEANER3 = "C:\\Windows\\RhTZCMU.exe"	geoBvprbpYhadP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVSYNMGR = "C:\\Windows\\NUdJkM9Ha3rMSC.exe"	F7p6FZBkbq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FP-WIN = "C:\\Windows\\UEqZYLXNtP.exe"	7oL0zGNBq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPUPD = "C:\\Windows\\UsW0klvTT.exe"	glub6i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCPXYSVC = "C:\\Windows\\geoBvprbpYhadP.exe"	UsW0klvTT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VBCMSERV = "C:\\Windows\\s4CJI9X4.exe"	KYRybpii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-STOPW = "C:\\Windows\\pTlJXexN.exe"	NUdJkM9Ha3rMSC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWEEPSRV = "C:\\Windows\\k1h6wQ.exe"	pTlJXexN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAV7 = "C:\\Windows\\nAcBwhb1Dln.exe"	k1h6wQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCVSRTE = "C:\\Windows\\xGexZTBr5gDMjvm.exe"	nAcBwhb1Dln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAV7WIN = "C:\\Windows\\7oL0zGNBq.exe"	431Un4A8WGXX6Kj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LDNETMON = "C:\\Windows\\F7p6FZBkbq.exe"	s4CJI9X4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCAN95 = "C:\\Windows\\0sZIRwAyNive.exe"	UEqZYLXNtP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCMNHDLR = "C:\\Windows\\YvtGa.exe"	0sZIRwAyNive.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZAPRO = "C:\\Windows\\EosK2d40Jq7T0.exe"	SNUONs.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Windows\YhmLNY.exe	EosK2d40Jq7T0.exe
File opened for modification	C:\Windows\glub6i.exe	YhmLNY.exe
File opened for modification	C:\Windows\RhTZCMU.exe	geoBvprbpYhadP.exe
File opened for modification	C:\Windows\s4CJI9X4.exe	KYRybpii.exe
File opened for modification	C:\Windows\NUdJkM9Ha3rMSC.exe	F7p6FZBkbq.exe
File created	C:\Windows\7oL0zGNBq.exe	431Un4A8WGXX6Kj.exe
File created	C:\Windows\YhmLNY.exe	EosK2d40Jq7T0.exe
File created	C:\Windows\KYRybpii.exe	RhTZCMU.exe
File created	C:\Windows\xGexZTBr5gDMjvm.exe	nAcBwhb1Dln.exe
File opened for modification	C:\Windows\0IYs5FGm7atpkHd.exe	xGexZTBr5gDMjvm.exe
File opened for modification	C:\Windows\UEqZYLXNtP.exe	7oL0zGNBq.exe
File created	C:\Windows\0sZIRwAyNive.exe	UEqZYLXNtP.exe
File created	C:\Windows\YvtGa.exe	0sZIRwAyNive.exe
File opened for modification	C:\Windows\geoBvprbpYhadP.exe	UsW0klvTT.exe
File created	C:\Windows\SNUONs.exe	MBAjjsDrpO.exe
File created	C:\Windows\glub6i.exe	YhmLNY.exe
File created	C:\Windows\geoBvprbpYhadP.exe	UsW0klvTT.exe
File created	C:\Windows\RhTZCMU.exe	geoBvprbpYhadP.exe
File opened for modification	C:\Windows\pTlJXexN.exe	NUdJkM9Ha3rMSC.exe
File opened for modification	C:\Windows\SNUONs.exe	MBAjjsDrpO.exe
File opened for modification	C:\Windows\k1h6wQ.exe	pTlJXexN.exe
File opened for modification	C:\Windows\0sZIRwAyNive.exe	UEqZYLXNtP.exe
File created	C:\Windows\UsW0klvTT.exe	glub6i.exe
File opened for modification	C:\Windows\431Un4A8WGXX6Kj.exe	0IYs5FGm7atpkHd.exe
File opened for modification	C:\Windows\YvtGa.exe	0sZIRwAyNive.exe
File created	C:\Windows\MBAjjsDrpO.exe	2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\EosK2d40Jq7T0.exe	SNUONs.exe
File created	C:\Windows\F7p6FZBkbq.exe	s4CJI9X4.exe
File created	C:\Windows\NUdJkM9Ha3rMSC.exe	F7p6FZBkbq.exe
File created	C:\Windows\k1h6wQ.exe	pTlJXexN.exe
File created	C:\Windows\nAcBwhb1Dln.exe	k1h6wQ.exe
File opened for modification	C:\Windows\nAcBwhb1Dln.exe	k1h6wQ.exe
File opened for modification	C:\Windows\xGexZTBr5gDMjvm.exe	nAcBwhb1Dln.exe
File opened for modification	C:\Windows\MBAjjsDrpO.exe	2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\s4CJI9X4.exe	KYRybpii.exe
File created	C:\Windows\0IYs5FGm7atpkHd.exe	xGexZTBr5gDMjvm.exe
File created	C:\Windows\UEqZYLXNtP.exe	7oL0zGNBq.exe
File opened for modification	C:\Windows\UsW0klvTT.exe	glub6i.exe
File opened for modification	C:\Windows\KYRybpii.exe	RhTZCMU.exe
File opened for modification	C:\Windows\F7p6FZBkbq.exe	s4CJI9X4.exe
File created	C:\Windows\pTlJXexN.exe	NUdJkM9Ha3rMSC.exe
File created	C:\Windows\431Un4A8WGXX6Kj.exe	0IYs5FGm7atpkHd.exe
File opened for modification	C:\Windows\7oL0zGNBq.exe	431Un4A8WGXX6Kj.exe
File opened for modification	C:\Windows\EosK2d40Jq7T0.exe	SNUONs.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2540	3020	WerFault.exe	98
8900	7668	WerFault.exe	129
8228	3212	WerFault.exe	92
4192	4744	WerFault.exe	94
2812	6960	WerFault.exe	119
3712	7708	WerFault.exe	125
5268	4660	WerFault.exe	102

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EosK2d40Jq7T0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YhmLNY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geoBvprbpYhadP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RhTZCMU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KYRybpii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NUdJkM9Ha3rMSC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k1h6wQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UsW0klvTT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nAcBwhb1Dln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xGexZTBr5gDMjvm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	431Un4A8WGXX6Kj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7oL0zGNBq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0sZIRwAyNive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YvtGa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBAjjsDrpO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	glub6i.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	s4CJI9X4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F7p6FZBkbq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pTlJXexN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0IYs5FGm7atpkHd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UEqZYLXNtP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SNUONs.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_3117204ffc564f9bbfe2b7884464b166_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4188

C:\Windows\MBAjjsDrpO.exe
C:\Windows\MBAjjsDrpO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3388

C:\Windows\SNUONs.exe
C:\Windows\SNUONs.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 2196
  2⤵
  - Program crash
  PID:8228

C:\Windows\EosK2d40Jq7T0.exe
C:\Windows\EosK2d40Jq7T0.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 2308
  2⤵
  - Program crash
  PID:4192

C:\Windows\YhmLNY.exe
C:\Windows\YhmLNY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5128

C:\Windows\glub6i.exe
C:\Windows\glub6i.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 2100
  2⤵
  - Program crash
  PID:2540

C:\Windows\UsW0klvTT.exe
C:\Windows\UsW0klvTT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2276

C:\Windows\geoBvprbpYhadP.exe
C:\Windows\geoBvprbpYhadP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 2424
  2⤵
  - Program crash
  PID:5268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3020 -ip 3020
1⤵
PID:5404

C:\Windows\RhTZCMU.exe
C:\Windows\RhTZCMU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5740

C:\Windows\KYRybpii.exe
C:\Windows\KYRybpii.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4740

C:\Windows\s4CJI9X4.exe
C:\Windows\s4CJI9X4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4720

C:\Windows\F7p6FZBkbq.exe
C:\Windows\F7p6FZBkbq.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6208

C:\Windows\NUdJkM9Ha3rMSC.exe
C:\Windows\NUdJkM9Ha3rMSC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6456

C:\Windows\pTlJXexN.exe
C:\Windows\pTlJXexN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6708

C:\Windows\k1h6wQ.exe
C:\Windows\k1h6wQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6960 -s 2300
  2⤵
  - Program crash
  PID:2812

C:\Windows\nAcBwhb1Dln.exe
C:\Windows\nAcBwhb1Dln.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6464

C:\Windows\xGexZTBr5gDMjvm.exe
C:\Windows\xGexZTBr5gDMjvm.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7456

C:\Windows\0IYs5FGm7atpkHd.exe
C:\Windows\0IYs5FGm7atpkHd.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7708 -s 2316
  2⤵
  - Program crash
  PID:3712

C:\Windows\431Un4A8WGXX6Kj.exe
C:\Windows\431Un4A8WGXX6Kj.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7960

C:\Windows\7oL0zGNBq.exe
C:\Windows\7oL0zGNBq.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7668 -s 2092
  2⤵
  - Program crash
  PID:8900

C:\Windows\UEqZYLXNtP.exe
C:\Windows\UEqZYLXNtP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8416

C:\Windows\0sZIRwAyNive.exe
C:\Windows\0sZIRwAyNive.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 7668 -ip 7668
1⤵
PID:8876

C:\Windows\YvtGa.exe
C:\Windows\YvtGa.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:9040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3212 -ip 3212
1⤵
PID:8208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4744 -ip 4744
1⤵
PID:2756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6960 -ip 6960
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 7708 -ip 7708
1⤵
PID:3624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4660 -ip 4660
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0IYs5FGm7atpkHd.exe

Path C:\Windows\0IYs5FGm7atpkHd.exe
Size 804KB
SHA256 720af86551b033341d46c49abdbefc3fe36dbc0ac754fe9ac5f2f2dc40ca6f1d
MD5 489d3127c8b4dcab7819c4d30809039b
SHA1 d08df685f44ac4d08c2795a58d6490e5d508dc82
SHA512 eb1e2f58c5a3e4b53928bf2f2388302afdeacb8468a4be4182d975346c9d489a8f3d00f1aaf5840c09d4b806738d27b837b584fee0f2735b535ce33c57348ce6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nsov
TLSH
T11A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0sZIRwAyNive.exe

Path C:\Windows\0sZIRwAyNive.exe
Size 804KB
SHA256 af8dda5d4fe345965e02e894170d05651aa8c2e7f8f784b160b2356ec3cbcd23
MD5 6005764e94c089c4ab148ff19a2589b6
SHA1 61efe60e1c73fb8a581862d843acd31b5a21998c
SHA512 1d7eaca77c62325bc8a25c805f154f23f631ab218b29bcc521687b5055715061946d164c66695dc19c8aecaf9251be7c25f20aa7646455e70ba14a523f0ffe36
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouu:0NA1Yakeer5+nsox
TLSH
T19405A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

431Un4A8WGXX6Kj.exe

Path C:\Windows\431Un4A8WGXX6Kj.exe
Size 804KB
SHA256 554dc23dec0337cdef4fcdb92e9a56ce4db40a08694df21e5662d4483769eab4
MD5 e9390f466206f3c1a3d25e42638e603c
SHA1 f6c4a2ec0f46ee1607f66310c0cbd3c3b775ca6a
SHA512 be1e650e28d90bc8bb640cbb7202ca49c61ea89de06681dad4cfe4a492df33170cf6159d400ddcbcef25484e80bca11550820bc8136ce34be98ecd8670f70c49
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouz:0NA1Yakeer5+nsoU
TLSH
T16D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7oL0zGNBq.exe

Path C:\Windows\7oL0zGNBq.exe
Size 804KB
SHA256 d981e462da8d94bbe7d7238f3500b61b9c041ebf01356ca6a47a5a5f7ccd7d71
MD5 cba1b7210fbdf2cf7e5c66327b8415fb
SHA1 821f33e59c1cb4a2147f96c0a7d5337f2ffc4384
SHA512 38cb23543e654f16b34f1d687a53bffcd32c8bb9cc688564ae961dbed9152281407feb96189340e9dd5729230fe1e1b577f822634a682aaea44086314a88cb12
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouf:0NA1Yakeer5+nsog
TLSH
T1CA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EosK2d40Jq7T0.exe

Path C:\Windows\EosK2d40Jq7T0.exe
Size 804KB
SHA256 54b6c1b009e402ff82f75402356210872083243ea45863b7b0151981a2f9ffe0
MD5 293dd6f2ebcff65dcdb44b1fec962350
SHA1 33a81b1713380ae63a3b566b70e2313652e2ca7d
SHA512 4953a6f6be5ac0d4d52099c5cbb2e59548902bd8b538c2de183bbebcaed99fa8feb4e3b8486214f477fc4696a6768ed35c0c9637adc39de2c45c22eb2b2053b6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouo:0NA1Yakeer5+nso5
TLSH
T16B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F7p6FZBkbq.exe

Path C:\Windows\F7p6FZBkbq.exe
Size 804KB
SHA256 b39a0abe5f2ad721385431c12e2a325b2c99b02c393c200187dddb618f493d33
MD5 cc26924caff3efbebe71973ca33ab4c1
SHA1 7a37fbd910a6415833bb1f2aed7c0449758b864f
SHA512 00c383e30853eb80648ed8226977bcc749f26d42c45772ca203593490b852a425ad49dc2180ce3bfdc80a5a68a7eeeb160567d664375074088ef839a5ee1c43f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouH:0NA1Yakeer5+nsoc
TLSH
T13C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KYRybpii.exe

Path C:\Windows\KYRybpii.exe
Size 804KB
SHA256 3cdcb176a51fdbe3b11c73332054b5418d0048d255f3d3c79cacd7fefff5a4fc
MD5 6efa287f7392c3d331272bcca34f19d8
SHA1 f498d7749a194e1fc53f429c86ceb7ac9ca2290a
SHA512 33624b2e50dc90916af69dc51089235a98ccf8bdc2929bb9d4ba4c8e3762005329128f8417ab1f9f6339c3329a58d832fa5cc2f7c70e948f324ad2da0e8aa8f7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouC:0NA1Yakeer5+nsoN
TLSH
T1DF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBAjjsDrpO.exe

Path C:\Windows\MBAjjsDrpO.exe
Size 804KB
SHA256 4bd53ba79d080f60f9815911e7f2f081055bf74ed552b46603c0c85973bb45f3
MD5 437966d3f573437393aab812d3d04516
SHA1 f4b31a4011f2a3cfe4f0316b95a3db15dafe44f7
SHA512 4fb78ec5cdf21d87d6320393e1c44f539014d4e709d7a0cfc09a3ee4eb3a06e1030661f48b0d7eb8815343824c34b65cbfce92f76644ae11e1da79e2cc74843f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouH:0NA1Yakeer5+nsoA
TLSH
T10B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NUdJkM9Ha3rMSC.exe

Path C:\Windows\NUdJkM9Ha3rMSC.exe
Size 804KB
SHA256 571f2db9e3f044eeeebd74782fd9eae5a80184112639b6306c4cf43060468bec
MD5 f41db5a19bd34a17aa3871fc4b43280a
SHA1 4512509823777bad27e6d22a4993dafe4f182e2d
SHA512 9c119ee1e38ab9cf568e7a7576f24a4917b42158c71a5f0ed2667eb9152617124ecc5e0c1bfac1795e71ecf952cfa961bc180f2cf8b50ad3c008e30950771045
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoux:0NA1Yakeer5+nsog
TLSH
T17605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RhTZCMU.exe

Path C:\Windows\RhTZCMU.exe
Size 804KB
SHA256 6f9c02050051d4a1abc6561800d967cf03eb0791e4357911d72b935da0e7cecb
MD5 ed3d1c1c2db9b91e7866d511f677a530
SHA1 d053dfbb2cc5a2e4b3f1a7fc872dac84cbab0d6a
SHA512 1dedb53d7f1e5ef2b40320ebc6be20a4f576a3e76b096050ff25ca2d2375eb1243c73b75e5e770f3e8556149aa7100beed6a2c4b709d416314259de3a6e4ef0c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouv:0NA1Yakeer5+nsoK
TLSH
T14E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SNUONs.exe

Path C:\Windows\SNUONs.exe
Size 804KB
SHA256 e6ed5bf33e2b37737555749271d98149ae4b1a05a1e93aecb86486142a01d1ce
MD5 1710a7ebad51dfb5dbef4ffa79b9e2a2
SHA1 a780fe7b8ca6f0ecb643d69029b7f58a585f4ff0
SHA512 9de0b1415f1e31ef2be0e1ba7db41f2494c3dfdae56c17b583ee2de70f36ce4c57063027a364c735548975ba789b0d5f005aeb35579b168921c17e48bf971ac4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nsom
TLSH
T1D205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UEqZYLXNtP.exe

Path C:\Windows\UEqZYLXNtP.exe
Size 804KB
SHA256 ca992384edbe03eb411776d074693b6c625ecbab924b967e5440750ae127b353
MD5 f6d77c72253d87eedd4073bfa515cdaa
SHA1 3cd4a5aacfd1846c19de6d74a0035c932d0f4158
SHA512 23743088f4831c1faca8f9edf4e64ffd7545e6d54753677a845f732432a70f565a29cc9920b0f7966778f82c9ecb05438931c21f3c56af5029e15787b7808494
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nsoz
TLSH
T15705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UsW0klvTT.exe

Path C:\Windows\UsW0klvTT.exe
Size 804KB
SHA256 5cd082dbf27ec21f7e31c0982981c462ca2c21db3c594c7f2e6b01cc87d4ff76
MD5 a2189f9bc524f45b3ca97a741a6e0817
SHA1 ed507dbae6cea72dd1bbfc5c92544cf4d8cae1d3
SHA512 1d8cbc9327a12c060aab77b301ae1c97f29181db483f4ef015d96496a42194855c32fe83d2f1d244e36b8f8cc1222e12860d66a65b9af6faabf4339714096760
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouv:0NA1Yakeer5+nsoW
TLSH
T1B005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YhmLNY.exe

Path C:\Windows\YhmLNY.exe
Size 804KB
SHA256 097634765efeb689ef4bb1fccd65b62d762671b0d9fbd8aea727cc77d923749d
MD5 46669a04704e4d4fedf901f32672f0ef
SHA1 aa01abb995c7ed6c19f7ad3ee120f5bec75d1f2b
SHA512 734fbacf1fdfd5e3c31306c35bee48c67d26c10e13d2deeab906091351070228b0239d15523b37ca747ab886834b899bfdad2cfd345fb59e98db93e3e3b7de20
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nsob
TLSH
T1E905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YvtGa.exe

Path C:\Windows\YvtGa.exe
Size 804KB
SHA256 22060b5bf815809cdf9a761914bab86719b2589729046e624ab7223b2255ea81
MD5 8f1a4b756d8aa49f385b8a8d45f03f86
SHA1 801f7f4717256e40a6e86a812a98f55cefe1b049
SHA512 3d7e4d015466c883a298482aef646cdd6e9190decc56c892125a0e511499391eeabbccf4cb53b46c2c733e45b74b0d18ddcb55a283ef236fef593e57316e2db3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nsoa
TLSH
T16F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoBvprbpYhadP.exe

Path C:\Windows\geoBvprbpYhadP.exe
Size 804KB
SHA256 a485b22aca8e7ac25bf18caa89be626e11c3f3d8a0a1c7cff1c42f72021de443
MD5 e1d776dc1ac6fb64352696ead8c9dbb7
SHA1 f7443aec1f3dfa15f5a0c54df240a932ab57fd7d
SHA512 d2b524eda25d36f6f0f0ddeaca095f8b1bb64b173ee433789d7d970e0b996608183696085aae3a2390ea72c009dee97eb543e35c42198a0c91096a0ec24da753
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nsoQ
TLSH
T13005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glub6i.exe

Path C:\Windows\glub6i.exe
Size 804KB
SHA256 f227fbb61acaf493d84dd21eded9aaeb5b85c730e9a336e73db4c6b02af12849
MD5 e050f009aa0e05e340e29587fdb84351
SHA1 06510a23703e6b4f15229b0dabf821d4a093fdeb
SHA512 93b4224d1bb99c28b5b83cb63d11169ca59b9a6c5cd8ac7f0acbb156704f33aab7d74692003db3c117d342c7b12316dadcd9f2907221ab84be163448ed37bd1d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nso6
TLSH
T1F205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k1h6wQ.exe

Path C:\Windows\k1h6wQ.exe
Size 804KB
SHA256 8bdde897422446cb4b96f2eafc0e78a4ac8c8458b82e69495d0501aa77a44675
MD5 88d1f1e7c7c3c20f331c27efa021a9c4
SHA1 c312229e22b90cb8f724d2be1a65b15830c7a827
SHA512 fe0963ada4ecc7821b6d82bcd2dbebc5b06bd0cc9ba9a15d90b6b2963aae7b7e596ae079f9d0091ebc34d71035df9e6cfbaa0d183ef3e290e9dbdb90f2adda12
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nsoi
TLSH
T10705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nAcBwhb1Dln.exe

Path C:\Windows\nAcBwhb1Dln.exe
Size 804KB
SHA256 3818b62ded5ba61e3421743a0da398608a1c3b98029dc28b10cda7386a55396f
MD5 5b918c316078b796d3b933e7f0d73abe
SHA1 3c033e7489630e2361d83981813d5633c7037aa3
SHA512 3f9f6904454ab2365f9d15dd84b1243c70438abcf0ef4e2155998073be3697adfddc4f9c89497233ecd9a5fd36ed86dc5916a880d13a8124d6595c7a2bec64fc
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nsog
TLSH
T19F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pTlJXexN.exe

Path C:\Windows\pTlJXexN.exe
Size 804KB
SHA256 401d4e024630158e8754471d744380de54298e6e536f55d04b4e07e37095314e
MD5 206e35024f0c50bd2ce8c4fe1bdcfa0e
SHA1 b8f617c4b51da4e475fde95c8d970d986e20aee7
SHA512 cca45cefd9ec3a5bbf39a5f517e0de2daedf4d578a8b2bb83150d2e7268568003a8b818d89dfe896d1e7935c8ad56f6e45a20f5048addb1615a1043f70625351
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nso9
TLSH
T10F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s4CJI9X4.exe

Path C:\Windows\s4CJI9X4.exe
Size 804KB
SHA256 c59b556a60d6b8193331ca7878c8787d141b13636c2dc2cd1f0ca615db2cd87b
MD5 02852472458ceaa460463945c70294d7
SHA1 bca64b92708ad79b4d0871f5d14ff0e95778fa28
SHA512 e0c73fb7e51b11dad13c5aa97d1215d9dbb8467fd215d66aabe7b503a718e8ec181c560ed5195bf7baa643caf92a05f212a5aa587137bbcab6e7c1695a4f74a8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouH:0NA1Yakeer5+nsog
TLSH
T14705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xGexZTBr5gDMjvm.exe

Path C:\Windows\xGexZTBr5gDMjvm.exe
Size 804KB
SHA256 44f54973975387ee00f6ec9e32d045267db398a3be94dae6018dc9aeaf43753f
MD5 5a9d098dd547539dcfe70507b7291d18
SHA1 de7a9398364d941c1099eee438f2e25d9c878c56
SHA512 5be3a9fe680306bfb0cbcaa753595ccbc3bd41722f5bc314644e85a613d120166d64d0cf77988537f9509870074128f0bf6010c00b8f5b3f0e181f92f149ab48
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouC:0NA1Yakeer5+nsor
TLSH
T13305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads