1319ebe719098de3cdd933dce07e507721b23ae52f003e09ce3a8a33c3de70f9

General

Target
2026-09-30_250b37dc1f44ad473b07a41afbca1f47_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample260930-p83f2sw15n
SHA256 1319ebe719098de3cdd933dce07e507721b23ae52f003e09ce3a8a33c3de70f9
MD5 250b37dc1f44ad473b07a41afbca1f47
SHA1 1b9fd44bbc0dd83d67b019affb732d2e9af6bbe5
SHA512 2797a8ce3c151c58f99a87a2e5108ed25d874f6e19b6ba8ba8bf41636a794f3c8155e2543b6b6f91768899e2fcba90b36c23725d169f70ffcfbd082c0f3167aa
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouf:0NA1Yakeer5+nsoc
TLSH
T14905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5364	PgGCAqT2n2ttMN.exe
3440	pCkCEJlZjv.exe
5748	McibFsL.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCFWALLICON = "C:\\Windows\\PgGCAqT2n2ttMN.exe"	2026-09-30_250b37dc1f44ad473b07a41afbca1f47_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKPOP = "C:\\Windows\\pCkCEJlZjv.exe"	PgGCAqT2n2ttMN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NETUTILS = "C:\\Windows\\McibFsL.exe"	pCkCEJlZjv.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\McibFsL.exe	pCkCEJlZjv.exe
File opened for modification	C:\Windows\McibFsL.exe	pCkCEJlZjv.exe
File created	C:\Windows\PgGCAqT2n2ttMN.exe	2026-09-30_250b37dc1f44ad473b07a41afbca1f47_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\PgGCAqT2n2ttMN.exe	2026-09-30_250b37dc1f44ad473b07a41afbca1f47_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\pCkCEJlZjv.exe	PgGCAqT2n2ttMN.exe
File opened for modification	C:\Windows\pCkCEJlZjv.exe	PgGCAqT2n2ttMN.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	2372	WerFault.exe	88

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-30_250b37dc1f44ad473b07a41afbca1f47_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-30_250b37dc1f44ad473b07a41afbca1f47_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pCkCEJlZjv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	McibFsL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_250b37dc1f44ad473b07a41afbca1f47_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PgGCAqT2n2ttMN.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-30_250b37dc1f44ad473b07a41afbca1f47_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_250b37dc1f44ad473b07a41afbca1f47_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 2376
  2⤵
  - Program crash
  PID:2712

C:\Windows\PgGCAqT2n2ttMN.exe
C:\Windows\PgGCAqT2n2ttMN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5364

C:\Windows\pCkCEJlZjv.exe
C:\Windows\pCkCEJlZjv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3440

C:\Windows\McibFsL.exe
C:\Windows\McibFsL.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2372 -ip 2372
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

McibFsL.exe

Path C:\Windows\McibFsL.exe
Size 804KB
SHA256 c39660446eb4799af520ba2805248122c555a4ebda1bcb3200cc88dc98c32e83
MD5 888159ea131112f056401a5e7bc13280
SHA1 d2eecbecb6b30caa4feffb94302d5d2d5c3779ba
SHA512 2ec3968db2ec72393a00f84a11ebff59581a8c51acae5be7d49e19de4a245660f18fe91e9c7809a26f270b0cc8c44a37280f014736e5500ba4ba62c8eb8323c0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouh:0NA1Yakeer5+nsoS
TLSH
T11005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PgGCAqT2n2ttMN.exe

Path C:\Windows\PgGCAqT2n2ttMN.exe
Size 804KB
SHA256 b1f3872dbe2af7ca17b26bfff7832d5b05b146735593f3f7a919fccc690c2a9e
MD5 cb45b9b5a1525430e66f73a74b88efa2
SHA1 b20318eeed0262a99d9d678822446f6b9965cd5e
SHA512 fbf7e3a5aca0e321fc422c866d31c63296373cd86b9614328e7a0db1614f81d92bab2e2f8a7c8b93ce75b3543baa6d6854afdbfe597a21211c510fb3e1920da6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFous:0NA1Yakeer5+nsox
TLSH
T17A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pCkCEJlZjv.exe

Path C:\Windows\pCkCEJlZjv.exe
Size 804KB
SHA256 84a5c68e580028ccb5c3e9b306e8b2067ce5b714ac2be17eeb1408210fe0562a
MD5 f45bfbc917d6a230c1a743faec1abe29
SHA1 fa243d20a55e30a663c0979cd3be9bd4cdb33050
SHA512 1cf5da755003e3387370c73e926a0ffaff291a989f732c4520b1226e218a54b8ef3dd3478f7fbe7e9eeb47ecf9867345f439e39859cc4152edcf209b2e7ee719
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nso7
TLSH
T1FB05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads