285fae4087c6733ea116cd7fe4e1a3a12b82e86ef995c10c11d62e6261e87af5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample261001-pmwflsxtcx
SHA256 285fae4087c6733ea116cd7fe4e1a3a12b82e86ef995c10c11d62e6261e87af5
MD5 6fab30e68e8e5eeb59cc24a37d146914
SHA1 851963b6c72282fd13ec876c4a9fccd35f50702a
SHA512 332cc9edc2139961d5df743d75b9a0e1ebc3890a5f6df8e20541c7e6c9ef4dbe2e665c59bf3d8410adf57d4a26b06ce92c99c9d85e92f025705b105d6b2dd620
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nsoG
TLSH
T12505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (2271) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 25 IoCs

pid	Process
5732	PMC0KkrBEuVzaY.exe
2380	8B9JacGQDj.exe
3440	rYj5y6LhunqC.exe
1072	eXKmpM14hP.exe
5596	6cYEYdAJM1.exe
5996	sSUlsd.exe
5968	VyRpZka5.exe
2604	5IVq0927Omeoh.exe
5224	sCwpMssE.exe
6412	rXOzguF.exe
6680	5oVL2nQ.exe
6932	SZo0oC0.exe
4708	KITQbTUAVX.exe
7172	Bx6FvversmU4y0j.exe
7436	LSAKz0.exe
7756	whiR7bSF.exe
8060	qotOPnzGOJO.exe
6808	2Qaan1aqLeo.exe
2388	7G57eQyy.exe
6020	utho0KJh.exe
7116	0nkMH.exe
180	Idor6rKnLI.exe
8416	xRbD6tU.exe
8660	mCFvT7OohygE9.exe
8952	ejn5DB4yXMq.exe

Adds Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVXMONITORNT = "C:\\Windows\\SZo0oC0.exe"	5oVL2nQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\REALMON = "C:\\Windows\\KITQbTUAVX.exe"	SZo0oC0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NORMIST = "C:\\Windows\\qotOPnzGOJO.exe"	whiR7bSF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSHWIN32 = "C:\\Windows\\utho0KJh.exe"	7G57eQyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NEOWATCHLOG = "C:\\Windows\\mCFvT7OohygE9.exe"	xRbD6tU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VPC32 = "C:\\Windows\\ejn5DB4yXMq.exe"	mCFvT7OohygE9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WGFE95 = "C:\\Windows\\eXKmpM14hP.exe"	rYj5y6LhunqC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NUPGRADE = "C:\\Windows\\rXOzguF.exe"	sCwpMssE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPM = "C:\\Windows\\Bx6FvversmU4y0j.exe"	KITQbTUAVX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MPFTRAY = "C:\\Windows\\whiR7bSF.exe"	LSAKz0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AUTOTRACE = "C:\\Windows\\7G57eQyy.exe"	2Qaan1aqLeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\POPROXY = "C:\\Windows\\VyRpZka5.exe"	sSUlsd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFIADMIN = "C:\\Windows\\sCwpMssE.exe"	5IVq0927Omeoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EVPN = "C:\\Windows\\5oVL2nQ.exe"	rXOzguF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWEEP95 = "C:\\Windows\\2Qaan1aqLeo.exe"	qotOPnzGOJO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVWNT = "C:\\Windows\\0nkMH.exe"	utho0KJh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSAV32 = "C:\\Windows\\xRbD6tU.exe"	Idor6rKnLI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\APVXDWIN = "C:\\Windows\\PMC0KkrBEuVzaY.exe"	2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VPC32 = "C:\\Windows\\8B9JacGQDj.exe"	PMC0KkrBEuVzaY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WRADMIN = "C:\\Windows\\6cYEYdAJM1.exe"	eXKmpM14hP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AMON9X = "C:\\Windows\\sSUlsd.exe"	6cYEYdAJM1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TFAK = "C:\\Windows\\LSAKz0.exe"	Bx6FvversmU4y0j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCAPP = "C:\\Windows\\Idor6rKnLI.exe"	0nkMH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TFAK = "C:\\Windows\\rYj5y6LhunqC.exe"	8B9JacGQDj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ESPWATCH = "C:\\Windows\\5IVq0927Omeoh.exe"	VyRpZka5.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mCFvT7OohygE9.exe	xRbD6tU.exe
File opened for modification	C:\Windows\eXKmpM14hP.exe	rYj5y6LhunqC.exe
File opened for modification	C:\Windows\KITQbTUAVX.exe	SZo0oC0.exe
File created	C:\Windows\Idor6rKnLI.exe	0nkMH.exe
File created	C:\Windows\ejn5DB4yXMq.exe	mCFvT7OohygE9.exe
File opened for modification	C:\Windows\ejn5DB4yXMq.exe	mCFvT7OohygE9.exe
File created	C:\Windows\8B9JacGQDj.exe	PMC0KkrBEuVzaY.exe
File created	C:\Windows\whiR7bSF.exe	LSAKz0.exe
File opened for modification	C:\Windows\7G57eQyy.exe	2Qaan1aqLeo.exe
File created	C:\Windows\Bx6FvversmU4y0j.exe	KITQbTUAVX.exe
File created	C:\Windows\sSUlsd.exe	6cYEYdAJM1.exe
File opened for modification	C:\Windows\VyRpZka5.exe	sSUlsd.exe
File opened for modification	C:\Windows\rXOzguF.exe	sCwpMssE.exe
File opened for modification	C:\Windows\5oVL2nQ.exe	rXOzguF.exe
File opened for modification	C:\Windows\whiR7bSF.exe	LSAKz0.exe
File created	C:\Windows\2Qaan1aqLeo.exe	qotOPnzGOJO.exe
File created	C:\Windows\7G57eQyy.exe	2Qaan1aqLeo.exe
File created	C:\Windows\PMC0KkrBEuVzaY.exe	2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\rYj5y6LhunqC.exe	8B9JacGQDj.exe
File created	C:\Windows\6cYEYdAJM1.exe	eXKmpM14hP.exe
File opened for modification	C:\Windows\6cYEYdAJM1.exe	eXKmpM14hP.exe
File created	C:\Windows\VyRpZka5.exe	sSUlsd.exe
File created	C:\Windows\5oVL2nQ.exe	rXOzguF.exe
File created	C:\Windows\SZo0oC0.exe	5oVL2nQ.exe
File opened for modification	C:\Windows\2Qaan1aqLeo.exe	qotOPnzGOJO.exe
File opened for modification	C:\Windows\8B9JacGQDj.exe	PMC0KkrBEuVzaY.exe
File opened for modification	C:\Windows\sCwpMssE.exe	5IVq0927Omeoh.exe
File created	C:\Windows\qotOPnzGOJO.exe	whiR7bSF.exe
File opened for modification	C:\Windows\qotOPnzGOJO.exe	whiR7bSF.exe
File opened for modification	C:\Windows\0nkMH.exe	utho0KJh.exe
File opened for modification	C:\Windows\sSUlsd.exe	6cYEYdAJM1.exe
File created	C:\Windows\KITQbTUAVX.exe	SZo0oC0.exe
File opened for modification	C:\Windows\Bx6FvversmU4y0j.exe	KITQbTUAVX.exe
File opened for modification	C:\Windows\LSAKz0.exe	Bx6FvversmU4y0j.exe
File created	C:\Windows\utho0KJh.exe	7G57eQyy.exe
File opened for modification	C:\Windows\Idor6rKnLI.exe	0nkMH.exe
File opened for modification	C:\Windows\xRbD6tU.exe	Idor6rKnLI.exe
File created	C:\Windows\mCFvT7OohygE9.exe	xRbD6tU.exe
File opened for modification	C:\Windows\SZo0oC0.exe	5oVL2nQ.exe
File opened for modification	C:\Windows\rYj5y6LhunqC.exe	8B9JacGQDj.exe
File created	C:\Windows\5IVq0927Omeoh.exe	VyRpZka5.exe
File opened for modification	C:\Windows\5IVq0927Omeoh.exe	VyRpZka5.exe
File created	C:\Windows\sCwpMssE.exe	5IVq0927Omeoh.exe
File created	C:\Windows\LSAKz0.exe	Bx6FvversmU4y0j.exe
File created	C:\Windows\0nkMH.exe	utho0KJh.exe
File created	C:\Windows\xRbD6tU.exe	Idor6rKnLI.exe
File opened for modification	C:\Windows\PMC0KkrBEuVzaY.exe	2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\eXKmpM14hP.exe	rYj5y6LhunqC.exe
File created	C:\Windows\rXOzguF.exe	sCwpMssE.exe
File opened for modification	C:\Windows\utho0KJh.exe	7G57eQyy.exe

Program crash 11 IoCs

pid	pid_target	Process	procid_target
7136	6680	WerFault.exe	122
7640	4708	WerFault.exe	126
7964	7172	WerFault.exe	131
8864	180	WerFault.exe	151
5520	5732	WerFault.exe	91
5396	2380	WerFault.exe	93
8300	5224	WerFault.exe	115
4276	2388	WerFault.exe	145
5992	6020	WerFault.exe	147
5880	8660	WerFault.exe	155
2008	8952	WerFault.exe	159

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cYEYdAJM1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sSUlsd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VyRpZka5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5IVq0927Omeoh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bx6FvversmU4y0j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7G57eQyy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mCFvT7OohygE9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ejn5DB4yXMq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8B9JacGQDj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSAKz0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whiR7bSF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2Qaan1aqLeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utho0KJh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5oVL2nQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SZo0oC0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PMC0KkrBEuVzaY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rYj5y6LhunqC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eXKmpM14hP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sCwpMssE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qotOPnzGOJO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0nkMH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rXOzguF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KITQbTUAVX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idor6rKnLI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xRbD6tU.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2100

C:\Windows\PMC0KkrBEuVzaY.exe
C:\Windows\PMC0KkrBEuVzaY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 2088
  2⤵
  - Program crash
  PID:5520

C:\Windows\8B9JacGQDj.exe
C:\Windows\8B9JacGQDj.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 2088
  2⤵
  - Program crash
  PID:5396

C:\Windows\rYj5y6LhunqC.exe
C:\Windows\rYj5y6LhunqC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3440

C:\Windows\eXKmpM14hP.exe
C:\Windows\eXKmpM14hP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1072

C:\Windows\6cYEYdAJM1.exe
C:\Windows\6cYEYdAJM1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5596

C:\Windows\sSUlsd.exe
C:\Windows\sSUlsd.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5996

C:\Windows\VyRpZka5.exe
C:\Windows\VyRpZka5.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5968

C:\Windows\5IVq0927Omeoh.exe
C:\Windows\5IVq0927Omeoh.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2604

C:\Windows\sCwpMssE.exe
C:\Windows\sCwpMssE.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 2076
  2⤵
  - Program crash
  PID:8300

C:\Windows\rXOzguF.exe
C:\Windows\rXOzguF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6412

C:\Windows\5oVL2nQ.exe
C:\Windows\5oVL2nQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6680 -s 1980
  2⤵
  - Program crash
  PID:7136

C:\Windows\SZo0oC0.exe
C:\Windows\SZo0oC0.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6932

C:\Windows\KITQbTUAVX.exe
C:\Windows\KITQbTUAVX.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1944
  2⤵
  - Program crash
  PID:7640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6680 -ip 6680
1⤵
PID:6108

C:\Windows\Bx6FvversmU4y0j.exe
C:\Windows\Bx6FvversmU4y0j.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7172 -s 1972
  2⤵
  - Program crash
  PID:7964

C:\Windows\LSAKz0.exe
C:\Windows\LSAKz0.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4708 -ip 4708
1⤵
PID:7620

C:\Windows\whiR7bSF.exe
C:\Windows\whiR7bSF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 7172 -ip 7172
1⤵
PID:7944

C:\Windows\qotOPnzGOJO.exe
C:\Windows\qotOPnzGOJO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8060

C:\Windows\2Qaan1aqLeo.exe
C:\Windows\2Qaan1aqLeo.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6808

C:\Windows\7G57eQyy.exe
C:\Windows\7G57eQyy.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 2096
  2⤵
  - Program crash
  PID:4276

C:\Windows\utho0KJh.exe
C:\Windows\utho0KJh.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 2096
  2⤵
  - Program crash
  PID:5992

C:\Windows\0nkMH.exe
C:\Windows\0nkMH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7116

C:\Windows\Idor6rKnLI.exe
C:\Windows\Idor6rKnLI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 180 -s 1968
  2⤵
  - Program crash
  PID:8864

C:\Windows\xRbD6tU.exe
C:\Windows\xRbD6tU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8416

C:\Windows\mCFvT7OohygE9.exe
C:\Windows\mCFvT7OohygE9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8660 -s 2084
  2⤵
  - Program crash
  PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 180 -ip 180
1⤵
PID:8844

C:\Windows\ejn5DB4yXMq.exe
C:\Windows\ejn5DB4yXMq.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8952 -s 1968
  2⤵
  - Program crash
  PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 5732 -ip 5732
1⤵
PID:9184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2380 -ip 2380
1⤵
PID:8352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 5224 -ip 5224
1⤵
PID:8208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2388 -ip 2388
1⤵
PID:8356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 6020 -ip 6020
1⤵
PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 8660 -ip 8660
1⤵
PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 8952 -ip 8952
1⤵
PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0nkMH.exe

Path C:\Windows\0nkMH.exe
Size 804KB
SHA256 14144e0a2b20a76fb369822f5eada13f3ccb357303fafc1561ab0328439505de
MD5 8d0e05c1dd7c1200a702be1d8380c243
SHA1 1260d8e074d4f7d239386d97032e4fa397efb1ad
SHA512 db52ba3c6f9982e2ef29139b9b5a546bc8d33292d69745ba45e53814375b37965d712764dc5cd703cd0ed581438e3350f0078309ded6ada7c84a6c9369f5fb6c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nsoN
TLSH
T12F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2Qaan1aqLeo.exe

Path C:\Windows\2Qaan1aqLeo.exe
Size 804KB
SHA256 063b12e3d6a72b4628acae9e810e70d2c11246c0e030dde2d29507afacb27a77
MD5 b3d5f02b675cda4018fba19cf32df5df
SHA1 cbe02b0861cb3bd6d15f7dfa2c42fa3cd860ff3d
SHA512 5236a978e8ef3b21e86d69b8fe5dd8ab5f07e30e664d450671e30fe2dbff48b7d368c11e88111aeeb8f2da2bf28af3c916c283983a438d6ac97ba88709574558
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nsol
TLSH
T15105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5IVq0927Omeoh.exe

Path C:\Windows\5IVq0927Omeoh.exe
Size 804KB
SHA256 dd511af6f84e4a3fa829267875733e608dcd2e259071a257c5b2d67cb5681e0a
MD5 c69d3e55c2d3e6c20fe49a5cb11871fb
SHA1 fb042b872b26d8223a8dd965f6453b67e857933c
SHA512 712630ea453e5903542e75d037ad03d419c19582ebc97cc08db2f6a6c0d118f6db90a39ebcdd0808920a712cbf6210fb4df35b733fe4c8d2d787cfe77e4a6948
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou4:0NA1Yakeer5+nso/
TLSH
T11005A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5oVL2nQ.exe

Path C:\Windows\5oVL2nQ.exe
Size 804KB
SHA256 213dc5ab270f3672225ca5000637b6976f1833b8bc42980040489b7619c6d9ed
MD5 bb6a3b37fa9e38231d369b26f01d3e08
SHA1 6f568f17c845bbc82e59362c359d1b6925d96f45
SHA512 f5b81e86aa0a226333c6d2df186874d379784b04e2bec66348fcfb2dc78b7687e7515ac12e3bb4421e263cc58684fed8db44f1c133fd74be65ee3c606c30ddaf
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou5:0NA1Yakeer5+nso4
TLSH
T18E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cYEYdAJM1.exe

Path C:\Windows\6cYEYdAJM1.exe
Size 804KB
SHA256 dcf62ba56f2120cc0b594cafdc9f7b89ba8a4b70e005d7a07982e026d85ecd95
MD5 6284fd2c1ab441fc5ab19abb595e38da
SHA1 d465f0574285b6ec2a30b8a90bc882be29855fda
SHA512 7eeeafd3a4edf9effc1974d91041b86e50edee0f45e30552796ee1caa87687b9e39ffb17d0a65e6f668b3b4b506e5c87608b9c7c98c71955c2d3c3fa81ab0a70
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouEn:0NA1Yakeer5+nsofn
TLSH
T1F705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7G57eQyy.exe

Path C:\Windows\7G57eQyy.exe
Size 804KB
SHA256 e2100467a507e6b67a2d3acfef9ec16e07a74de66f14288b74d18cc19ce056a0
MD5 d9b2894de6a6b6ace193fb424b5b25d8
SHA1 2a7f8cce8820ce260be5de30303f4b05f92381d5
SHA512 c656e29dca992059a52db7851b1431b8c38578fc712896139da44e74a226782b599c1c7f42df01fc87684479fbd8ff297bfb68e1cd771e9b26ab99ebe8df34e3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nsob
TLSH
T17B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8B9JacGQDj.exe

Path C:\Windows\8B9JacGQDj.exe
Size 804KB
SHA256 98df2478d0004c16bd39ac701e0aa21adcf1ad762dc2f5527bdd16b377d033a9
MD5 62668a7659d02e8bef2da29c5bf3eb18
SHA1 f64e17a9db84cf9bebcc61e32de784faa2e25c78
SHA512 1ac9ec42e452ed8e97a39d5325c54d342515ad091fbe0022bff7db533dd52ce6167c74919df99e0736145739d787afaa087eb640819ed590a32ec8601c7d55ee
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nsoc
TLSH
T13705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bx6FvversmU4y0j.exe

Path C:\Windows\Bx6FvversmU4y0j.exe
Size 804KB
SHA256 0242b104b0b47cae0bf6bcd816dbeccdf568384a9f25887cf55cf8d8538a859f
MD5 3242d2650a073f1a935b51fc5a2a6898
SHA1 8f3352e51ac770fd42849bfdb0dd6f59598cb0d5
SHA512 2a30eac5baa609f90f6bbd650e2118badd09c7642fbbf888613f7a6314cf9c874f157f392f3f95d893f0e63769ae5b50a073d00c775f06a671ebee5869b00cd6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouE:0NA1Yakeer5+nsof
TLSH
T1B405A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Idor6rKnLI.exe

Path C:\Windows\Idor6rKnLI.exe
Size 804KB
SHA256 c87e4097e4dcbb92c2e8a2d4de4d96bd2114b7f1bc8cd30d7caaa8e4bee8f322
MD5 be6179da6a84a324adb87fe282c7485e
SHA1 ec13b0b606b15e6a49b76032c7e598169a0494cd
SHA512 eca20926352e106a611eab3859a963fd18e59930988eab6b540518ac85a52556a50ff2aac7d8110f60524fcb2820a496386668c40b3f6c088f5d0b8c59c98d55
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsoy
TLSH
T1CC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KITQbTUAVX.exe

Path C:\Windows\KITQbTUAVX.exe
Size 804KB
SHA256 691032915619c434a4ec062be9cb7c02f9e12cba44ba944185b6be0d1d882ec5
MD5 dd0a28ccb039028ac425816fdcd8443b
SHA1 8af4e42bd89d199d4a742b93418530267d3abbc7
SHA512 2905933335159db469d26f10d7479ecdf49e7a6a54eaec64d14a4481d3eea5f740bffd52599a91727ce006dcd134c30a5456ebb3ac963b72e92905aee1f3f366
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou1:0NA1Yakeer5+nsok
TLSH
T11305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LSAKz0.exe

Path C:\Windows\LSAKz0.exe
Size 804KB
SHA256 316e3113cfd09907cf7bd12ff752894778789f66d8a3d66a8042de55746225f0
MD5 3505e2ee6866ff9a17f9d58258e311fb
SHA1 309aa73f835efbce360387d593d500507e3511e2
SHA512 d40990bc573a260035b45f755242d65445970550d69bd36ee9412e81f422277753e4c189619ad42438ec95e498de603c15e980c2286ed4ccff2ecd7ac602cdc4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou3:0NA1Yakeer5+nsoA
TLSH
T1B505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PMC0KkrBEuVzaY.exe

Path C:\Windows\PMC0KkrBEuVzaY.exe
Size 804KB
SHA256 6f3ea0c1d36849bdb42b6d9c05e305d9c272e9405e9a3ce7f8802e99f6738fa2
MD5 3bfc436d2c017e0ab76497ef1ac6bdb4
SHA1 d07234a96302bc1d4d01c171106bb50d09c71414
SHA512 75dbb7ea5d37a156a8a2537ee417e6664c08c10d7bdbd9130b58739bc25a2b255eb82cdc8616fe0d63995ee98a334fc347b7942585eab27c587ec30e1094ea17
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoS
TLSH
T17005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SZo0oC0.exe

Path C:\Windows\SZo0oC0.exe
Size 804KB
SHA256 0e144490a13cecf10b1b9d7df7cb4937cb48332c1daa98a6d33230cb872e8d1d
MD5 8face523b32820b094734f3087c6eb0e
SHA1 ac7a4af80cbf0d7f09654208d849163906fa9b1e
SHA512 acb2c918edf12229378019e5b4f9f147cffc960a6ccfb99aa9e333fd508573f04443a93e1aadcff528a7925d4dc41631c77b8daaa2318ee603a62de20d277796
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouB:0NA1Yakeer5+nsok
TLSH
T12A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VyRpZka5.exe

Path C:\Windows\VyRpZka5.exe
Size 804KB
SHA256 24403740e9a382502dc93e7f07b85796c6de29d7231ade1cf57bbce21387ef41
MD5 a5fac2a5066986712832acd4378d3b8d
SHA1 ef0a837733b7e60f64ecd121cbd5af813f5ca5fb
SHA512 341ced02aa457b44c614cbe0d20fd396d2c5e66958553b587d079aef7526f7345be8eb1688760110447bdf63e03617b5956bf5be926d84884daab43c7eecb1b3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nsog
TLSH
T15905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eXKmpM14hP.exe

Path C:\Windows\eXKmpM14hP.exe
Size 804KB
SHA256 c17e8fc504fac16845a8db16b54d4f680ebd5da01a16f1d7ef227c7354caf184
MD5 ea53c069930843be0ab6364f243e6cf8
SHA1 292e74e77e49597b74722567ac268a9bb0278915
SHA512 973aa5d6b2fdf9e4887ec43798bf736d2bd3c7e2fbf122d4c36a7277c6b5e141b9200055a7fb05660dfa119a8d8a86b0d35f0ed50edc1ef288f432c1aa67d89f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouI:0NA1Yakeer5+nsoz
TLSH
T1E305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ejn5DB4yXMq.exe

Path C:\Windows\ejn5DB4yXMq.exe
Size 804KB
SHA256 356653457aacd5b22cd0c0397a9b78bcf16be2b2fd8e2f15173d63fe0fa06cbd
MD5 6fb28a600ac2239a88258a3f119cb5e6
SHA1 1c3c6c1e4fda169fbd39373a94fa9cb8daf6cae2
SHA512 8fa514055983b7b21525f3a091c09cb39f012442fb74a49b125587385931ff453da89caa7999aa1d251c0a524afb9c60f29a508f81615ce7dcf6a2c088495305
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nso4
TLSH
T1A405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mCFvT7OohygE9.exe

Path C:\Windows\mCFvT7OohygE9.exe
Size 804KB
SHA256 fae6aa862218d74b634c9fb970f2b1931a23299e8edb2ad2caa29c64a7fc2589
MD5 baa56e3fc003274df809c2790b2a37a4
SHA1 797f6c80e86bb0886555cdd7f1fddd5d31bb9f98
SHA512 ab8663aa6edf22d45a8d57c14dfdaf611ba31f65e4efa6cc6c4f3aaa045a21d2ab067e3b588edac40fb7a4eef17141a8c11bdddceb79c6460b9336a28e474482
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsok
TLSH
T12F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qotOPnzGOJO.exe

Path C:\Windows\qotOPnzGOJO.exe
Size 804KB
SHA256 9d0202b0560f729868622c83a88c1a988b03f55090215860d6871ed67fd3e191
MD5 4d7ea0937e954b4ca4fca47eadfa10e6
SHA1 594207b36625f475332dbbfa1c1ba51116f81660
SHA512 b4622d5b933ac59f0cd8b7684c7438d8ac0b1beefb5c96f78f5c067d1c32c4d64f3474ef14b6464fa3e4a257b44a6d94e4d0c581a09372ada6afda69543f21e9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouh:0NA1Yakeer5+nsoC
TLSH
T19905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rXOzguF.exe

Path C:\Windows\rXOzguF.exe
Size 804KB
SHA256 ac1fcc3ff3e6ef61b70cdaeee8c564d95bb9445c17448d2240a630425eb670ec
MD5 db1f2111a725ad8a499d6d9fd6613829
SHA1 9f7cb300909b295151f7ea8eb357a9be0a584633
SHA512 1255a2a62483ab7f1ae7dc2baf3092c957600bcfce9e8d937790ad4402fde1b77554d89c2e2823250711b8dbc05345e81862392e12de8d76bd8798bac5c3405b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nsol
TLSH
T1EA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rYj5y6LhunqC.exe

Path C:\Windows\rYj5y6LhunqC.exe
Size 804KB
SHA256 967c9eab6474c1f3e84869c5d4df63d13346c0e1d6959a22f492fbb063e0970b
MD5 95365b00053c9cded9f513d349a74963
SHA1 1cab21ba94a43f24260a45eadf04c5d46661a3c7
SHA512 898f53a6c7420c09fa716a3b0a2411a7de1ae12157f9c8caa5c88946b10d99facf2139e4d9fbae22daf2e29992a618f596558c31b886e074e4bf5a4f7b94cff2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouH:0NA1Yakeer5+nsom
TLSH
T12505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sCwpMssE.exe

Path C:\Windows\sCwpMssE.exe
Size 804KB
SHA256 49058bc88e1db556a9d856870388af8559e3b8d877d6fdca6954506098eb57b6
MD5 a5b2435048255e70c3e38b762ecb6e2b
SHA1 f2a47dc23afa195ba767f376a007fde9e75eb78b
SHA512 449a9904d83b7b9594e657ef81be4c1b1422518c2d58c9770cfe60ddffe4dfa988898710703ac0527676441645c0b1eecb02fec58fc132e189df22f96b68e8c7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouk:0NA1Yakeer5+nsoV
TLSH
T10C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sSUlsd.exe

Path C:\Windows\sSUlsd.exe
Size 804KB
SHA256 6da7eab8211426fddba2262dd2a651682064192253aea429b8ab09d4fda72993
MD5 81f272b2d8a4cb4984575337e83bf74f
SHA1 c8ae60a281f8861d8b62f48c87288b86237b6219
SHA512 2e794264097064dab880d791576ee39a1ca53b52d8f0c33933075fb69ca62334a1af0ab784690d94b1758c5292bd44dc9288bdf98858bafe976710b7b7894f5c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou7:0NA1Yakeer5+nsog
TLSH
T1CF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utho0KJh.exe

Path C:\Windows\utho0KJh.exe
Size 804KB
SHA256 e06b9e0cb8672adf9266fcb5daa05a0375421a49e4969e6cfd09e31ddf2d9f44
MD5 1c294a955542329b3b2de3bf624cd3fe
SHA1 535bf3e286531091f5cce8021b77ef4f49f5fd36
SHA512 a7bc92dd846e3c61511e65130009bb59f5ab0ea397cd381ed7811898b902edad0e9b0c094bceb8bc9f3ec00c1f330653d1c5af2cb037ce3ae0d182a68bcc8e03
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoug:0NA1Yakeer5+nsoh
TLSH
T19905A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whiR7bSF.exe

Path C:\Windows\whiR7bSF.exe
Size 804KB
SHA256 32690f2484364ecce1ecd96a94e4930ad58e4ff3d9b24fe8b0b59b27e1efb151
MD5 7bb4ffb17ee106ac411ca773d0bfab7f
SHA1 4afdb5a3a1fdbe031b165ec338fe32e21371aa00
SHA512 b7496b2368916fd9b6f6095336bd09d113faa49dba85d0378b0295b7e4fa30fc8844584cb359fcbacbff4a8d93cc4f96d1ff0f07e2a8f9d23cac60d397e42f45
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoua:0NA1Yakeer5+nsob
TLSH
T10F05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xRbD6tU.exe

Path C:\Windows\xRbD6tU.exe
Size 804KB
SHA256 efe541379ac095df6192f150d4c972573022d5141130027818568f91d07a7c21
MD5 0d1d9fa45a61de009b4f4ce7a1364567
SHA1 de17de577ddf5f107747b00c40cbd766191470f4
SHA512 58726b61fe4edf1513c4cd30b97692c6695bf0e290e9805cdff92d2a14ff32439e2f60c427c8ad17aff6429f9551c90ee549380b7cb21e2301b3d1ab2e0e4977
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoup:0NA1Yakeer5+nso4
TLSH
T1EB05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads