f535375922f854bd3049f4e5d4f6f95f1607e5a7f3d98484aa1994a85b177dc4

General

Target
2026-09-30_f9e92e8ff68f7b16e2f3d601a5c3a1d8_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260930-has2dsvdrb
SHA256 f535375922f854bd3049f4e5d4f6f95f1607e5a7f3d98484aa1994a85b177dc4
MD5 f9e92e8ff68f7b16e2f3d601a5c3a1d8
SHA1 85b3936d8432e19ef3c8f7bc8758100ac4338eeb
SHA512 0c25c2759973c52d682a001e0b7321cf13cb0e5cf738c17c42b20a3fd72e003e0f5a65be05ab1983bf6d43ccb7b1625cbffb2dfe73f77f6fcfdfa01f147a1462
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFous:0NA1Yakeer5+nsoX
TLSH
T14E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (790) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 6 IoCs

pid	Process
4860	M6hYrr6PgUV5FVR.exe
1500	RcqNq.exe
2944	ZiXN0McFaCSy.exe
4112	oXUK5mWQv0.exe
2240	E2w6b.exe
5068	ixDNUwEpz.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVP = "C:\\Windows\\M6hYrr6PgUV5FVR.exe"	2026-09-30_f9e92e8ff68f7b16e2f3d601a5c3a1d8_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BLACKICE = "C:\\Windows\\RcqNq.exe"	M6hYrr6PgUV5FVR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NOTSTART = "C:\\Windows\\ZiXN0McFaCSy.exe"	RcqNq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GUARD = "C:\\Windows\\oXUK5mWQv0.exe"	ZiXN0McFaCSy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMC = "C:\\Windows\\E2w6b.exe"	oXUK5mWQv0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-PROT = "C:\\Windows\\ixDNUwEpz.exe"	E2w6b.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\M6hYrr6PgUV5FVR.exe	2026-09-30_f9e92e8ff68f7b16e2f3d601a5c3a1d8_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\RcqNq.exe	M6hYrr6PgUV5FVR.exe
File created	C:\Windows\ZiXN0McFaCSy.exe	RcqNq.exe
File created	C:\Windows\oXUK5mWQv0.exe	ZiXN0McFaCSy.exe
File created	C:\Windows\E2w6b.exe	oXUK5mWQv0.exe
File opened for modification	C:\Windows\M6hYrr6PgUV5FVR.exe	2026-09-30_f9e92e8ff68f7b16e2f3d601a5c3a1d8_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\RcqNq.exe	M6hYrr6PgUV5FVR.exe
File opened for modification	C:\Windows\ZiXN0McFaCSy.exe	RcqNq.exe
File opened for modification	C:\Windows\oXUK5mWQv0.exe	ZiXN0McFaCSy.exe
File opened for modification	C:\Windows\E2w6b.exe	oXUK5mWQv0.exe
File created	C:\Windows\ixDNUwEpz.exe	E2w6b.exe
File opened for modification	C:\Windows\ixDNUwEpz.exe	E2w6b.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5556	1316	WerFault.exe	86
5540	2240	WerFault.exe	102
4040	5068	WerFault.exe	104

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-30_f9e92e8ff68f7b16e2f3d601a5c3a1d8_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-30_f9e92e8ff68f7b16e2f3d601a5c3a1d8_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_f9e92e8ff68f7b16e2f3d601a5c3a1d8_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	M6hYrr6PgUV5FVR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RcqNq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZiXN0McFaCSy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oXUK5mWQv0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E2w6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ixDNUwEpz.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-30_f9e92e8ff68f7b16e2f3d601a5c3a1d8_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_f9e92e8ff68f7b16e2f3d601a5c3a1d8_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 2260
  2⤵
  - Program crash
  PID:5556

C:\Windows\M6hYrr6PgUV5FVR.exe
C:\Windows\M6hYrr6PgUV5FVR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4860

C:\Windows\RcqNq.exe
C:\Windows\RcqNq.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1500

C:\Windows\ZiXN0McFaCSy.exe
C:\Windows\ZiXN0McFaCSy.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2944

C:\Windows\oXUK5mWQv0.exe
C:\Windows\oXUK5mWQv0.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4112

C:\Windows\E2w6b.exe
C:\Windows\E2w6b.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 2316
  2⤵
  - Program crash
  PID:5540

C:\Windows\ixDNUwEpz.exe
C:\Windows\ixDNUwEpz.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 2192
  2⤵
  - Program crash
  PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1316 -ip 1316
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2240 -ip 2240
1⤵
PID:5612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5068 -ip 5068
1⤵
PID:1212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2w6b.exe

Path C:\Windows\E2w6b.exe
Size 804KB
SHA256 7eb736f60370c36e69876c079e3f702629afa9d534f1b30621c9fb84627367dc
MD5 1cf71d819e19b997dbe1f3bb4293cda7
SHA1 8b2100d0527b4791f46e88102525081d7ff3cb87
SHA512 29f0fd01599a0fb79965fdb95cbf12fde80d2e9ce4d399c2c375aed6f2ea3c583fada1f0dbaf355b4661d0069190694326405f84d1b5b9e13342c90ed5938094
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouZ:0NA1Yakeer5+nso4
TLSH
T14705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

M6hYrr6PgUV5FVR.exe

Path C:\Windows\M6hYrr6PgUV5FVR.exe
Size 804KB
SHA256 6798f5003f47990a124ffdfc8f9261ca8dac03fc9fac6f2ed6f8601419ef1eb9
MD5 0e03905f63d32c230aefbb39b61f2156
SHA1 ba91fec250dd554e80229f724befcad7be9090e3
SHA512 447e2a461ddfe06b7c1a57b16242d655bd331766a3868ffc7d1f3bfc4a9b6cf68976defe94c5e94f07deebb5960c863218b41dd30c779604f1a8a8ed214874ae
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nsoT
TLSH
T1B505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RcqNq.exe

Path C:\Windows\RcqNq.exe
Size 804KB
SHA256 405d142fa38330573ebb807bd6acdf784c4680ece7603dc729100baebb248adc
MD5 b4d05972aa731cbc5a6f6e0196957a42
SHA1 ecec0a0ec51e928b47fa217eaef46a8e751adc69
SHA512 037395d337536dbc5b62cc28cab8282b83210c403af7b07a9d07d68c4a9d4bcca433f36b04613fa8ce1c2fa33cc9a5f1938ca842a6fce657d62e1d62f2e1f0c5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQX:0NA1Yakeer5+nsof
TLSH
T1AA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZiXN0McFaCSy.exe

Path C:\Windows\ZiXN0McFaCSy.exe
Size 804KB
SHA256 3f0cc3f639b2ebac1240f2a742cdac808d953438a33adf3f1a5a10331676f76b
MD5 b272a73578df03d1ceb5000973322342
SHA1 5be362673c9e0692e38336ff7135990fbf99ca15
SHA512 c5aa56511ae643f64ab1d075194f85f78b588a1ba8b69b5710fa1f5b47f8121e0d62a20a0298aa9167f6cf9a2391b363e5cc952c8f36529c51c5fffcf89e7814
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsom
TLSH
T10E05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ixDNUwEpz.exe

Path C:\Windows\ixDNUwEpz.exe
Size 804KB
SHA256 4ecf5571ec4f20fa3257e0eb55488b04f0cb3e07a3a135d97b52369957d2ca10
MD5 061564513d9df45efad74d146e62261f
SHA1 e659997e375937139cadaade74a6ac1058ac9bd4
SHA512 f767427ae7cb3fe5042029a3ba5d7cc3a7938dbecb10fcb65e4ed58a0c61573b1bfe96f76321689abf3d103c94a6bb788e6a497ed37a41a4346aad63237b59d5
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nsoq
TLSH
T1A005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oXUK5mWQv0.exe

Path C:\Windows\oXUK5mWQv0.exe
Size 804KB
SHA256 024dda168134b3d3f031440d2f7c925b7228a81e617e2102abab29aed33dcc5f
MD5 754978d3e53ec146e00fd53219f5a0a7
SHA1 b235377179a5a8a1d3d4e3f471e78f71864a0e30
SHA512 bb730e153df7278e1efe9e7d5c7313ac728bbad62f777d2bf0bfb24803470a22e1720ba088f956de0e681d345b12d7a13db39928ac62f70871ba7665593fb831
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou6:0NA1Yakeer5+nsof
TLSH
T19F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads