285fae4087c6733ea116cd7fe4e1a3a12b82e86ef995c10c11d62e6261e87af5

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample261001-pmwflsxtcx
SHA256 285fae4087c6733ea116cd7fe4e1a3a12b82e86ef995c10c11d62e6261e87af5
MD5 6fab30e68e8e5eeb59cc24a37d146914
SHA1 851963b6c72282fd13ec876c4a9fccd35f50702a
SHA512 332cc9edc2139961d5df743d75b9a0e1ebc3890a5f6df8e20541c7e6c9ef4dbe2e665c59bf3d8410adf57d4a26b06ce92c99c9d85e92f025705b105d6b2dd620
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nsoG
TLSH
T12505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (3089) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 32 IoCs

pid	Process
4000	93iZtCHShD.exe
5456	EYhkFvLkMUB.exe
3808	4n7dHasQlcAlId.exe
4684	am3UIr8O.exe
4180	CPIDP3kVWoEQwgI.exe
5204	YKS7QnEWO4.exe
5960	teuTrYwSoHSGvW.exe
1268	vzr40nwFCJU9.exe
5924	uGCBqpCuuByI1aU.exe
4276	NbBsavCBriPaRgV.exe
6444	LMP9vyPP5S.exe
6716	2CiPmO28slVS.exe
7008	TcWMlGzSl3BtB.exe
5088	BZJP3LXmyFAEy9t.exe
6940	aM4t3ohs3Rv0.exe
7040	TgS3gEuNpJ.exe
7196	LNyXrTK.exe
7452	8pBo7AD9.exe
7712	Mx8my.exe
7972	2ulMW722r.exe
7228	Gvz62m.exe
8244	leEKKmtx2YrjMw.exe
8496	OiZavZGzIRZ.exe
8752	GZgKOOdCZp7u.exe
9008	1Ms2Nl.exe
8504	oeoyJPtFP.exe
9352	8ti2TRYXsZ.exe
9612	D4HKMc99uz79j.exe
10036	AWJzda.exe
9620	2uaQYyPByNCK82.exe
2172	ai7g3nQ6O0gWC1.exe
10316	HQtImjuBnSPLt0.exe

Adds Run key to start application 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PERSFW = "C:\\Windows\\TcWMlGzSl3BtB.exe"	2CiPmO28slVS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FRW = "C:\\Windows\\AWJzda.exe"	D4HKMc99uz79j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CPDCLNT = "C:\\Windows\\NbBsavCBriPaRgV.exe"	uGCBqpCuuByI1aU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVENGNAVEX15 = "C:\\Windows\\8pBo7AD9.exe"	LNyXrTK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WIMMUN32 = "C:\\Windows\\8ti2TRYXsZ.exe"	oeoyJPtFP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-PROT = "C:\\Windows\\HQtImjuBnSPLt0.exe"	ai7g3nQ6O0gWC1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWNETSUP = "C:\\Windows\\teuTrYwSoHSGvW.exe"	YKS7QnEWO4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCUPDATE = "C:\\Windows\\vzr40nwFCJU9.exe"	teuTrYwSoHSGvW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PAVPROXY = "C:\\Windows\\Gvz62m.exe"	2ulMW722r.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ESAFE = "C:\\Windows\\BZJP3LXmyFAEy9t.exe"	TcWMlGzSl3BtB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAV7WIN = "C:\\Windows\\2ulMW722r.exe"	Mx8my.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DOORS = "C:\\Windows\\D4HKMc99uz79j.exe"	8ti2TRYXsZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VBCONS = "C:\\Windows\\4n7dHasQlcAlId.exe"	EYhkFvLkMUB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCAFEE = "C:\\Windows\\am3UIr8O.exe"	4n7dHasQlcAlId.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-PROT95 = "C:\\Windows\\YKS7QnEWO4.exe"	CPIDP3kVWoEQwgI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BLACKICE = "C:\\Windows\\leEKKmtx2YrjMw.exe"	Gvz62m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ISRV95 = "C:\\Windows\\1Ms2Nl.exe"	GZgKOOdCZp7u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFIADMIN = "C:\\Windows\\ai7g3nQ6O0gWC1.exe"	2uaQYyPByNCK82.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSM32 = "C:\\Windows\\93iZtCHShD.exe"	2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCM = "C:\\Windows\\EYhkFvLkMUB.exe"	93iZtCHShD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWNETSUP = "C:\\Windows\\CPIDP3kVWoEQwgI.exe"	am3UIr8O.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ESPWATCH = "C:\\Windows\\uGCBqpCuuByI1aU.exe"	vzr40nwFCJU9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATWATCH = "C:\\Windows\\2CiPmO28slVS.exe"	LMP9vyPP5S.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGHTML = "C:\\Windows\\aM4t3ohs3Rv0.exe"	BZJP3LXmyFAEy9t.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVP = "C:\\Windows\\LNyXrTK.exe"	TgS3gEuNpJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOCKDOWN = "C:\\Windows\\TgS3gEuNpJ.exe"	aM4t3ohs3Rv0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKWCTL9 = "C:\\Windows\\Mx8my.exe"	8pBo7AD9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVP32 = "C:\\Windows\\OiZavZGzIRZ.exe"	leEKKmtx2YrjMw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCCWIN98 = "C:\\Windows\\GZgKOOdCZp7u.exe"	OiZavZGzIRZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFALERT = "C:\\Windows\\oeoyJPtFP.exe"	1Ms2Nl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NETUTILS = "C:\\Windows\\2uaQYyPByNCK82.exe"	AWJzda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NEOWATCHLOG = "C:\\Windows\\LMP9vyPP5S.exe"	NbBsavCBriPaRgV.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\8pBo7AD9.exe	LNyXrTK.exe
File opened for modification	C:\Windows\GZgKOOdCZp7u.exe	OiZavZGzIRZ.exe
File created	C:\Windows\BZJP3LXmyFAEy9t.exe	TcWMlGzSl3BtB.exe
File opened for modification	C:\Windows\93iZtCHShD.exe	2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\4n7dHasQlcAlId.exe	EYhkFvLkMUB.exe
File created	C:\Windows\teuTrYwSoHSGvW.exe	YKS7QnEWO4.exe
File opened for modification	C:\Windows\teuTrYwSoHSGvW.exe	YKS7QnEWO4.exe
File opened for modification	C:\Windows\aM4t3ohs3Rv0.exe	BZJP3LXmyFAEy9t.exe
File opened for modification	C:\Windows\HQtImjuBnSPLt0.exe	ai7g3nQ6O0gWC1.exe
File created	C:\Windows\GZgKOOdCZp7u.exe	OiZavZGzIRZ.exe
File opened for modification	C:\Windows\1Ms2Nl.exe	GZgKOOdCZp7u.exe
File opened for modification	C:\Windows\D4HKMc99uz79j.exe	8ti2TRYXsZ.exe
File created	C:\Windows\uGCBqpCuuByI1aU.exe	vzr40nwFCJU9.exe
File created	C:\Windows\2CiPmO28slVS.exe	LMP9vyPP5S.exe
File created	C:\Windows\LNyXrTK.exe	TgS3gEuNpJ.exe
File opened for modification	C:\Windows\OiZavZGzIRZ.exe	leEKKmtx2YrjMw.exe
File created	C:\Windows\YKS7QnEWO4.exe	CPIDP3kVWoEQwgI.exe
File created	C:\Windows\leEKKmtx2YrjMw.exe	Gvz62m.exe
File created	C:\Windows\1Ms2Nl.exe	GZgKOOdCZp7u.exe
File opened for modification	C:\Windows\oeoyJPtFP.exe	1Ms2Nl.exe
File opened for modification	C:\Windows\AWJzda.exe	D4HKMc99uz79j.exe
File opened for modification	C:\Windows\2uaQYyPByNCK82.exe	AWJzda.exe
File created	C:\Windows\HQtImjuBnSPLt0.exe	ai7g3nQ6O0gWC1.exe
File created	C:\Windows\OiZavZGzIRZ.exe	leEKKmtx2YrjMw.exe
File created	C:\Windows\D4HKMc99uz79j.exe	8ti2TRYXsZ.exe
File created	C:\Windows\vzr40nwFCJU9.exe	teuTrYwSoHSGvW.exe
File opened for modification	C:\Windows\NbBsavCBriPaRgV.exe	uGCBqpCuuByI1aU.exe
File created	C:\Windows\4n7dHasQlcAlId.exe	EYhkFvLkMUB.exe
File created	C:\Windows\CPIDP3kVWoEQwgI.exe	am3UIr8O.exe
File created	C:\Windows\Mx8my.exe	8pBo7AD9.exe
File opened for modification	C:\Windows\ai7g3nQ6O0gWC1.exe	2uaQYyPByNCK82.exe
File opened for modification	C:\Windows\LMP9vyPP5S.exe	NbBsavCBriPaRgV.exe
File opened for modification	C:\Windows\2CiPmO28slVS.exe	LMP9vyPP5S.exe
File created	C:\Windows\TcWMlGzSl3BtB.exe	2CiPmO28slVS.exe
File created	C:\Windows\93iZtCHShD.exe	2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\YKS7QnEWO4.exe	CPIDP3kVWoEQwgI.exe
File opened for modification	C:\Windows\uGCBqpCuuByI1aU.exe	vzr40nwFCJU9.exe
File created	C:\Windows\AWJzda.exe	D4HKMc99uz79j.exe
File opened for modification	C:\Windows\Gvz62m.exe	2ulMW722r.exe
File opened for modification	C:\Windows\leEKKmtx2YrjMw.exe	Gvz62m.exe
File opened for modification	C:\Windows\8ti2TRYXsZ.exe	oeoyJPtFP.exe
File opened for modification	C:\Windows\TcWMlGzSl3BtB.exe	2CiPmO28slVS.exe
File opened for modification	C:\Windows\8pBo7AD9.exe	LNyXrTK.exe
File created	C:\Windows\2uaQYyPByNCK82.exe	AWJzda.exe
File opened for modification	C:\Windows\EYhkFvLkMUB.exe	93iZtCHShD.exe
File opened for modification	C:\Windows\CPIDP3kVWoEQwgI.exe	am3UIr8O.exe
File created	C:\Windows\NbBsavCBriPaRgV.exe	uGCBqpCuuByI1aU.exe
File created	C:\Windows\LMP9vyPP5S.exe	NbBsavCBriPaRgV.exe
File opened for modification	C:\Windows\TgS3gEuNpJ.exe	aM4t3ohs3Rv0.exe
File created	C:\Windows\oeoyJPtFP.exe	1Ms2Nl.exe
File opened for modification	C:\Windows\vzr40nwFCJU9.exe	teuTrYwSoHSGvW.exe
File opened for modification	C:\Windows\Mx8my.exe	8pBo7AD9.exe
File created	C:\Windows\2ulMW722r.exe	Mx8my.exe
File created	C:\Windows\ai7g3nQ6O0gWC1.exe	2uaQYyPByNCK82.exe
File created	C:\Windows\EYhkFvLkMUB.exe	93iZtCHShD.exe
File opened for modification	C:\Windows\am3UIr8O.exe	4n7dHasQlcAlId.exe
File created	C:\Windows\TgS3gEuNpJ.exe	aM4t3ohs3Rv0.exe
File opened for modification	C:\Windows\LNyXrTK.exe	TgS3gEuNpJ.exe
File created	C:\Windows\Gvz62m.exe	2ulMW722r.exe
File opened for modification	C:\Windows\BZJP3LXmyFAEy9t.exe	TcWMlGzSl3BtB.exe
File opened for modification	C:\Windows\2ulMW722r.exe	Mx8my.exe
File created	C:\Windows\8ti2TRYXsZ.exe	oeoyJPtFP.exe
File created	C:\Windows\am3UIr8O.exe	4n7dHasQlcAlId.exe
File created	C:\Windows\aM4t3ohs3Rv0.exe	BZJP3LXmyFAEy9t.exe

Program crash 12 IoCs

pid	pid_target	Process	procid_target
4552	4684	WerFault.exe	96
6344	1268	WerFault.exe	107
6920	4276	WerFault.exe	111
9832	8504	WerFault.exe	147
10504	9620	WerFault.exe	159
10708	2036	WerFault.exe	88
11216	9612	WerFault.exe	151
10660	8244	WerFault.exe	139
4760	10036	WerFault.exe	157
4856	10316	WerFault.exe	163
1236	6940	WerFault.exe	125
4404	7712	WerFault.exe	133

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93iZtCHShD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	am3UIr8O.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	teuTrYwSoHSGvW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2CiPmO28slVS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TgS3gEuNpJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LMP9vyPP5S.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LNyXrTK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2ulMW722r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gvz62m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ai7g3nQ6O0gWC1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TcWMlGzSl3BtB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OiZavZGzIRZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1Ms2Nl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ti2TRYXsZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4n7dHasQlcAlId.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YKS7QnEWO4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	leEKKmtx2YrjMw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GZgKOOdCZp7u.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CPIDP3kVWoEQwgI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uGCBqpCuuByI1aU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AWJzda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2uaQYyPByNCK82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EYhkFvLkMUB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NbBsavCBriPaRgV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mx8my.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D4HKMc99uz79j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HQtImjuBnSPLt0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vzr40nwFCJU9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BZJP3LXmyFAEy9t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aM4t3ohs3Rv0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8pBo7AD9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oeoyJPtFP.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_6fab30e68e8e5eeb59cc24a37d146914_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 2288
  2⤵
  - Program crash
  PID:10708

C:\Windows\93iZtCHShD.exe
C:\Windows\93iZtCHShD.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4000

C:\Windows\EYhkFvLkMUB.exe
C:\Windows\EYhkFvLkMUB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5456

C:\Windows\4n7dHasQlcAlId.exe
C:\Windows\4n7dHasQlcAlId.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3808

C:\Windows\am3UIr8O.exe
C:\Windows\am3UIr8O.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 2092
  2⤵
  - Program crash
  PID:4552

C:\Windows\CPIDP3kVWoEQwgI.exe
C:\Windows\CPIDP3kVWoEQwgI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4180

C:\Windows\YKS7QnEWO4.exe
C:\Windows\YKS7QnEWO4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4684 -ip 4684
1⤵
PID:4404

C:\Windows\teuTrYwSoHSGvW.exe
C:\Windows\teuTrYwSoHSGvW.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5960

C:\Windows\vzr40nwFCJU9.exe
C:\Windows\vzr40nwFCJU9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 2088
  2⤵
  - Program crash
  PID:6344

C:\Windows\uGCBqpCuuByI1aU.exe
C:\Windows\uGCBqpCuuByI1aU.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5924

C:\Windows\NbBsavCBriPaRgV.exe
C:\Windows\NbBsavCBriPaRgV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 2100
  2⤵
  - Program crash
  PID:6920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1268 -ip 1268
1⤵
PID:6324

C:\Windows\LMP9vyPP5S.exe
C:\Windows\LMP9vyPP5S.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6444

C:\Windows\2CiPmO28slVS.exe
C:\Windows\2CiPmO28slVS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4276 -ip 4276
1⤵
PID:6900

C:\Windows\TcWMlGzSl3BtB.exe
C:\Windows\TcWMlGzSl3BtB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7008

C:\Windows\BZJP3LXmyFAEy9t.exe
C:\Windows\BZJP3LXmyFAEy9t.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5088

C:\Windows\aM4t3ohs3Rv0.exe
C:\Windows\aM4t3ohs3Rv0.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6940 -s 2428
  2⤵
  - Program crash
  PID:1236

C:\Windows\TgS3gEuNpJ.exe
C:\Windows\TgS3gEuNpJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7040

C:\Windows\LNyXrTK.exe
C:\Windows\LNyXrTK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7196

C:\Windows\8pBo7AD9.exe
C:\Windows\8pBo7AD9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7452

C:\Windows\Mx8my.exe
C:\Windows\Mx8my.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 2416
  2⤵
  - Program crash
  PID:4404

C:\Windows\2ulMW722r.exe
C:\Windows\2ulMW722r.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7972

C:\Windows\Gvz62m.exe
C:\Windows\Gvz62m.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7228

C:\Windows\leEKKmtx2YrjMw.exe
C:\Windows\leEKKmtx2YrjMw.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8244 -s 2324
  2⤵
  - Program crash
  PID:10660

C:\Windows\OiZavZGzIRZ.exe
C:\Windows\OiZavZGzIRZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8496

C:\Windows\GZgKOOdCZp7u.exe
C:\Windows\GZgKOOdCZp7u.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8752

C:\Windows\1Ms2Nl.exe
C:\Windows\1Ms2Nl.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9008

C:\Windows\oeoyJPtFP.exe
C:\Windows\oeoyJPtFP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8504 -s 2092
  2⤵
  - Program crash
  PID:9832

C:\Windows\8ti2TRYXsZ.exe
C:\Windows\8ti2TRYXsZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9352

C:\Windows\D4HKMc99uz79j.exe
C:\Windows\D4HKMc99uz79j.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9612 -s 2196
  2⤵
  - Program crash
  PID:11216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 8504 -ip 8504
1⤵
PID:9800

C:\Windows\AWJzda.exe
C:\Windows\AWJzda.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10036 -s 2324
  2⤵
  - Program crash
  PID:4760

C:\Windows\2uaQYyPByNCK82.exe
C:\Windows\2uaQYyPByNCK82.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9620 -s 2084
  2⤵
  - Program crash
  PID:10504

C:\Windows\ai7g3nQ6O0gWC1.exe
C:\Windows\ai7g3nQ6O0gWC1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2172

C:\Windows\HQtImjuBnSPLt0.exe
C:\Windows\HQtImjuBnSPLt0.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:10316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10316 -s 2220
  2⤵
  - Program crash
  PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 9620 -ip 9620
1⤵
PID:10484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2036 -ip 2036
1⤵
PID:10688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 9612 -ip 9612
1⤵
PID:11196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 8244 -ip 8244
1⤵
PID:10648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 10036 -ip 10036
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 10316 -ip 10316
1⤵
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6940 -ip 6940
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 7712 -ip 7712
1⤵
PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1Ms2Nl.exe

Path C:\Windows\1Ms2Nl.exe
Size 804KB
SHA256 0d300a61d48c33454e730f8b662d1d9774dd2da5e268a52c68f20a56b5e2d9a5
MD5 2e07bf64429e90fed46876878f77d417
SHA1 d442e9d76b0ade6ab271e553bb0ac5a43f778551
SHA512 ca956a8726868e6b8f0dd9e94b03d92390f851be07b796a2375956f549b81567abbafc46107e5d0951efe1e6b6b73aee4450cba74287e67bbd14f9c8341a94a7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou4:0NA1Yakeer5+nsof
TLSH
T1BC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2CiPmO28slVS.exe

Path C:\Windows\2CiPmO28slVS.exe
Size 804KB
SHA256 aaf96ff4ec0b959a827a4c6159188fb1cf3e9bfaddaecf4f5a2cbe2beb5985b2
MD5 6bc94f541dcf8497056885a4728b60e0
SHA1 054dd96c71e5e665fe49031004e813adf1723857
SHA512 850f117a6ebf39ffc13fd0731ea60059bcdc8a46444d187729c00d8e8a8eb38e43ba18c9b408c48b11faea73adbfe0840e296bf56efc2b48cdd3ee12dde3902f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nso/
TLSH
T18405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2uaQYyPByNCK82.exe

Path C:\Windows\2uaQYyPByNCK82.exe
Size 804KB
SHA256 7dd11a8f9c0ef906ce7c279cc9fa448516d083cc41b70c933414a76f0b3c10b8
MD5 c60e929e8769641cbe8ef959c1a310c4
SHA1 6c4df2a3cf5d3ce63575f82ed5ca22029155bc9b
SHA512 a6e274b5740f8546da57329d8a5997b7812c05abcb9550058ddbbc5d92758220cee8c2d847253ab86a1e0a91cd2e8684e85ef203ce42e92ec33643a456ff7abc
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQ:0NA1Yakeer5+nsot
TLSH
T17B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ulMW722r.exe

Path C:\Windows\2ulMW722r.exe
Size 804KB
SHA256 63fe9e37ad29ddc21d01e051ea5e395d7c26c74e7b197b8833352166b6047ba7
MD5 a78da278ca25b11158d17a56dd986a75
SHA1 fac4a3ae9106cd427580e6c413af0211981d465b
SHA512 a7388c3856e8ba59e9ca59fb341f7b94524ddd31ee2faad9fb8e1d23ed25cb8aba2ee94c06f8470a9780982c66da4dff15e4d5ec866dd68c5616f4d4bc56718a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFous:0NA1Yakeer5+nso1
TLSH
T13905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4n7dHasQlcAlId.exe

Path C:\Windows\4n7dHasQlcAlId.exe
Size 804KB
SHA256 633ea60c5a3c2c2146ee07ea9787e20e5b7debeefafb296cca8a9c3957db287f
MD5 96b23c95955f85b998ccf56e97cb7d70
SHA1 a106bd813ae5de3936785c6ccfeb8a246085ea29
SHA512 d161fa41c3cc8a4822efe3f167c8c01259a3eb5223f8bd54e4f9912e001a0bf78e268f9f8adc06b8867cbb2ab4959d594bd52903f4edeb99b8509abd56d62632
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouw:0NA1Yakeer5+nsoF
TLSH
T18405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8pBo7AD9.exe

Path C:\Windows\8pBo7AD9.exe
Size 804KB
SHA256 d035973392aebdec05cde97aa783558b9156ce99fbdc2488a087f1b991b57e45
MD5 712912d2254212100f4e1a69ca87a1f1
SHA1 5f300ecba8bf364ec2352090b59a08bc243816d5
SHA512 ac430b3408a2c934545c9585366522d7609013184ec6f94a5c22a106ca7a415bbb7495022de03500bbf223d4312207314d037f5cd931929e8649bd3021a9c865
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouC:0NA1Yakeer5+nsoz
TLSH
T1D605A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ti2TRYXsZ.exe

Path C:\Windows\8ti2TRYXsZ.exe
Size 804KB
SHA256 3eebd7b3d8de49524a61c27e1e175e068a6c1cdbaab301cc08a989ff7cb28a5e
MD5 66737a95888be6a2b57ecb70820dc380
SHA1 62cc3ed8a4f3bcebc612cb516f4cf08e078c6938
SHA512 28872b811ce1b66612c029a1a792a740705ad0ea2d870965498b2a9bd503c1534f220f6ad1246a3856b1414aea3f6b1461cb11749f9f0788dc129bf4053ac302
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nson
TLSH
T12605A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93iZtCHShD.exe

Path C:\Windows\93iZtCHShD.exe
Size 804KB
SHA256 0eb33b72e279787412651876cb60b283c04eb3e629638bdbe6d0cb51f993ca4e
MD5 d444dd26a9cfeedcbe82f82447ba8d5e
SHA1 79abff9dcb65150b5920f90b00ad0c256b17a907
SHA512 b2ecc98fc0adf5f1e669aa065ec474b53c59c91954fe563b65d642467cdf106df10d241d5658fa526401d451e9481585af70835be499007e46652ac2faa4268f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsow
TLSH
T10105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AWJzda.exe

Path C:\Windows\AWJzda.exe
Size 804KB
SHA256 479438b7c03d52f8471a5529b82fc565332f8afa0cc764e8eae2dc8825f701cc
MD5 134ff58f05f7e63dd44ec96670ef7bd7
SHA1 8a56cda0f169d712ecd1a24892e27add2432898d
SHA512 79d344ea420fe0995edb7e9078ec07704601d064c67d43574a8ceab6c6ea0c388282075d8fb988de3d7cc38c4ba7c119f83a3fcc57ab8f26590a77c111b3af5d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nso5
TLSH
T16905A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BZJP3LXmyFAEy9t.exe

Path C:\Windows\BZJP3LXmyFAEy9t.exe
Size 804KB
SHA256 930a18ae1b444c866c1a2db52c99cf2fadaf3102f3a49dc57442ee6b2c94e898
MD5 5d81c25a7186ca05b3f2b4eb9e2754b3
SHA1 724bc9c74311c2aa3033d75ac565030ebfbdf596
SHA512 bc257f3fa9969d4479feba8e8aec4b1f39c014a9389403bad350dba4588a9527f6172d78e6efc18ca02694bea7af8dec614f524d43c837fd34dd91ae97c978f0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsoU
TLSH
T1F305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CPIDP3kVWoEQwgI.exe

Path C:\Windows\CPIDP3kVWoEQwgI.exe
Size 804KB
SHA256 12748f7caae33debd48435873065c1539c5e134f32b67650f7d4da7809e0628c
MD5 fb2b8c8fdd45cd63b8c2268375a20a00
SHA1 00bba273d3ea0809ced0dbf9de121d95991f5bc4
SHA512 bac195dd40c209effcc35e7e0f54a6aabb03cb17b069aa65f13f92e1c14421154efdf3981570702c35e817f5f479f0ebe0aad2a2634d5d120bc873833ba314ce
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFous:0NA1Yakeer5+nso9
TLSH
T1FC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D4HKMc99uz79j.exe

Path C:\Windows\D4HKMc99uz79j.exe
Size 804KB
SHA256 658efa04bd3158c57b7850616ac20a1edcdfb5190f44f718862b23bfe8443d43
MD5 3042942a1f9aef1ebf7833d3f933efdb
SHA1 05500558dc8f9ceff63370fd2b46156f7edd1399
SHA512 955ce52f58205824258ef55db2abfd0aa4a32965d7a5fa9aa1bbaec27d672cfb0a28927c2f2e6fabe92391977d583735efc30295bda4ef354054498d92a780f2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouZ:0NA1Yakeer5+nsoe
TLSH
T1A705A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EYhkFvLkMUB.exe

Path C:\Windows\EYhkFvLkMUB.exe
Size 804KB
SHA256 538f244f2f33279816659fa179c66e8751b3b921d21e8cfcb21fc720d18df4a5
MD5 557b0b0a1632650c4fd457c63cb1c0c9
SHA1 88e8e8f34d91df431a83f9c15efa080afef2f018
SHA512 deaac404c6afdff765dbfa30feefbfdc07c84ad62adac1e9da68c40083b62a6b845d2f9aec7808419d8979d84436c0c5a442155a37a48a18769cefd0b7aad258
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouB:0NA1Yakeer5+nso8
TLSH
T15905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GZgKOOdCZp7u.exe

Path C:\Windows\GZgKOOdCZp7u.exe
Size 804KB
SHA256 8b22bee4c1d47899d1189d21bed63d751ccf916f63100d79d77a9abf3823b47e
MD5 19a9f1daf246c442ffaa3f6351bce530
SHA1 698b297a44b85313044765f6ac93f48b06676edb
SHA512 83d7b3cd017025ecae567b212b506d9ae6eea8304f57f413009583fbaffe03682f3f9e91903dbae4b455c6b3eda1987a2393a854e976d594c16ac5836679c0e0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoue:0NA1Yakeer5+nsoR
TLSH
T1D305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gvz62m.exe

Path C:\Windows\Gvz62m.exe
Size 804KB
SHA256 7dcf73b23124a39790eb5fb493a5bb29f434a764758476ca6690dfbc1018b241
MD5 dfc51562386108a05f65c4752deb4d8c
SHA1 c0a376edf180d2ebf9757bba97704f1a40df9f6b
SHA512 3d6a7ca11599e71539db852deb477cec7328e64081e2f7274554c6d3f0f3f1e169b4cb57964e1165cb81536397bfa4d6f05dc1961eb02777820c672878572bd3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQ:0NA1Yakeer5+nsoZ
TLSH
T1DD05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HQtImjuBnSPLt0.exe

Path C:\Windows\HQtImjuBnSPLt0.exe
Size 804KB
SHA256 589f30f0cc030b09bb871c4c29b42cc52b2ee89f2f6517fd86095dc8c292f6cd
MD5 dd83c7419cc0742a986ba9d6dbe7daf3
SHA1 9b7f747dbe2296299db2367d52b305b19a0168bb
SHA512 8bbb64fdc6fb13f8708aadfc34c421552df4c8a01ca17b3dffb70f598f536d6744b3c6ea50a6aa890284c9c784e94960b0a28426aa0a15ea29de2e8cee1ab98d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouu:0NA1Yakeer5+nsoT
TLSH
T1E005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LMP9vyPP5S.exe

Path C:\Windows\LMP9vyPP5S.exe
Size 804KB
SHA256 ab592b4d1229465a5029fa098e38980e5930f7e3ccd4e9335fceb757cdea6caa
MD5 0b54081563c98a40a4139862bef0516b
SHA1 46deb2f5b86c6a46e25c0fa383b36aa51a72d353
SHA512 3fd010f1a54b4d34b450adb060d74aa38c57ddcd0c469ffab077d691fdb38e956f7fca859be173b88a58ebf00b7b7627e1f97d4d0704f2de85035abf61372ba9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouc:0NA1Yakeer5+nsoP
TLSH
T1D705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LNyXrTK.exe

Path C:\Windows\LNyXrTK.exe
Size 804KB
SHA256 1dbd6e65568e0310f480629a64a31384cd52043f2484a826a1ac6d42fbbe0a63
MD5 56635d97f77ddba815727c336e82029a
SHA1 2d7074505be348c68f35c70787798ad46031540d
SHA512 9679d17cc12d47d2fc240783ed41a9a1e21ef866d67317960b98870dec73490f92fbba9df795c1a79b43a404d2ae14ee8aacaf3f7e60dd0cfd5cb794a03b8009
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouF:0NA1Yakeer5+nsoq
TLSH
T1C405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mx8my.exe

Path C:\Windows\Mx8my.exe
Size 804KB
SHA256 c2a80122d3c95368c82692891030d06876c7dfdaead9dbcd312c5cfe3dbfee24
MD5 5e8bf3cd236a21f922071e494bc37701
SHA1 e25f205792228d591ee6d8d08705104edf01dda8
SHA512 2621e89f436d4924c62e886845e16c4e1028979cc88695c676bc23cb384596ba5038046e53f0a44a28a1fc99d15dc9b4ded3cdd4bd214f58a74e69808a622e52
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouZ:0NA1Yakeer5+nsoq
TLSH
T1EB05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NbBsavCBriPaRgV.exe

Path C:\Windows\NbBsavCBriPaRgV.exe
Size 804KB
SHA256 f9c229c7294f5b53c4031668c736f3866d4c37cdf296c4a352e4d086d89e2d10
MD5 d67ff8cd0827f31c7bcbc65e250cc6cd
SHA1 9adfd1beefd8bc4614471662faa7d06d06552585
SHA512 da4770411eece9403adf68bc259b9a45cfcdb2224cb7495047da37ab542dface7c0eace1566acf753f27c8bebd5458a9f62adfb85e9aba477893a2ea1c045878
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouZ:0NA1Yakeer5+nsoI
TLSH
T16905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OiZavZGzIRZ.exe

Path C:\Windows\OiZavZGzIRZ.exe
Size 804KB
SHA256 07a301cdf8f2a65ca4deb7b5bbbf797d3ff25a40e524918ae09429d6ab8a9b74
MD5 7e46a6afe460a88f83d70b42474b0c6f
SHA1 44f1105988440dd3ef29df50c2d73d810f793d82
SHA512 af73a85d9ab26a0b0c63c371b8262e06952f9cb6a6b5b19abf9ccdb86749d56c98a795791ba2a358f908f1239959a7d08a6c5fe59d911d7de7923489205866e2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouY:0NA1Yakeer5+nso3
TLSH
T17E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TcWMlGzSl3BtB.exe

Path C:\Windows\TcWMlGzSl3BtB.exe
Size 804KB
SHA256 3ff826c6b16d04ed3f813aa50aa2671641fb0a412f674d1cbb56b510339c4930
MD5 ecf2fabccbd965a50f563b39506cb70c
SHA1 07fe33bb075c21a50e30af7b2a593f6c3eaa5ffa
SHA512 6a0351b4e67d9091a49733bd11893a2648aec96032ed443d3728bd00154c8752e977a64306c23684b255463807799eec8cb7b3e1f64b1c34b11d082ea1e9a832
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nsoG
TLSH
T10805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TgS3gEuNpJ.exe

Path C:\Windows\TgS3gEuNpJ.exe
Size 804KB
SHA256 47978062fffb47a655d0c7122373b66074a29669699e2ac3b4afca4a980fd534
MD5 800305aa410aca510413b66c64ae14ce
SHA1 44aaed0d7691da4286180fcab3787582f99770df
SHA512 31cca7cb0326e5beee19a7ac33f66f9db539479bd7abaab7d4f382288757c3ec3a207714409abd0e463cbf41f736e89a129aeb2d8f72aca4dbf65cc7d6cbf890
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouV:0NA1Yakeer5+nsoS
TLSH
T1A305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YKS7QnEWO4.exe

Path C:\Windows\YKS7QnEWO4.exe
Size 804KB
SHA256 8d43144d7af49817ad8abbfb24fbc236a4af1a27aa2bd2e3e2ba5a08d17da460
MD5 a86c809144e8e7c861b26a27a16bbc36
SHA1 60314fb7d57190745f94887e43e743a79f097342
SHA512 472df56a8bbb5017b7532f2a9555746a4293bd30e2cc8c1ed2fad38ead6b9888a9c2842a35ffee9f4be85e15519681e9d3df80bb97a89e91ec4d2d8abdf1fada
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsoH
TLSH
T1CA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aM4t3ohs3Rv0.exe

Path C:\Windows\aM4t3ohs3Rv0.exe
Size 804KB
SHA256 ea52758ce3d651fbf0909c53317f30b00df838edb3eb485f0bf50e322a96a45a
MD5 d96ada3b8d9f95f30ebed041f1ba77d5
SHA1 408d01e32d7e499034314523fea0e345e6d69cf3
SHA512 e917dbd91cac9826658ca84f32077630e6994d713f46b977d9a85f2122936d112071da4b0d3d74cd152d63018b57dacf9ca358440e33ad3c6f38b0c5e653cf93
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouY:0NA1Yakeer5+nsof
TLSH
T14F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ai7g3nQ6O0gWC1.exe

Path C:\Windows\ai7g3nQ6O0gWC1.exe
Size 804KB
SHA256 88d168e4b7e82301445fc7a893b4e993951ef755aadc816adfd7cd8906d3e6fa
MD5 9481a80204316bb1620de6166bab55fc
SHA1 9c2d2bcb1dbe2b88096b6908543e04f1274132f6
SHA512 f04bd37ff2e2cebd8c6261f35fe36f2b239e5482617944d2b15551c44b778079775ea0dfec7dbf0ff7477bfac93a8ff902e9f9ce5cd74accccd3df35c2426352
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouY:0NA1Yakeer5+nso3
TLSH
T10405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am3UIr8O.exe

Path C:\Windows\am3UIr8O.exe
Size 804KB
SHA256 be373b3b63f49b390c2316a29b4c7c598ec055cf4c6e6dfc9f2c1e0f79b9e6d6
MD5 fb0fad7f8a9b1392e7449a0145d404c2
SHA1 12781a2e5cac6ab5db8d37552047f63f70fc46ea
SHA512 a06a321d28a6733d6513b85397c21f1522ccb6d7e6fbc44667f492a1dbfa919ba2e63e82a7f36b10a71255491a1c399b5a9d55f54282432177b3894a7376720e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nsoZ
TLSH
T1A805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

leEKKmtx2YrjMw.exe

Path C:\Windows\leEKKmtx2YrjMw.exe
Size 804KB
SHA256 59ac77a2f03340dc9ea0487192573a52d91a651388b133cbe124b555062d3b1c
MD5 13b2028f301d1900e184b827ac2303ba
SHA1 a698e44f48a7a7bb1761f0faed7c48d1869fc5eb
SHA512 1cffff179354fe6a30cace6eb7e648c8293cf55e1c97d8fec015bc3b936cf96e24c0a3c949e713732cc9a03f422a02af357d8516790110411a50ecd5c07a0f23
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsoW
TLSH
T1E805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oeoyJPtFP.exe

Path C:\Windows\oeoyJPtFP.exe
Size 804KB
SHA256 b8d0e0f6b5af473bd48a0ce433b1cdde8996256710eeb0711a5c9903233af70e
MD5 4a0d65654057e0ae61223fd334df22b5
SHA1 73b6c8f7ccda947f44cd17e80526dd160194fe8a
SHA512 7d32d8da9afd38e70ad85bd33302df98d486620fe4ccdf1955479a0b540f4aff40b5d532b36c1cf6dc3dacdffba4b04e8bced83033f611c19b467e1d111b3c59
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nson
TLSH
T1B905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

teuTrYwSoHSGvW.exe

Path C:\Windows\teuTrYwSoHSGvW.exe
Size 804KB
SHA256 e374723b26bd872ae687ec751ba428278416231f52d41d8c4c4157e05df1ceaf
MD5 27dde643a8af2e7a83e5c4eafc346f15
SHA1 d190a23576237773663f0d54e764ecc2001fab6e
SHA512 2b2919368422d42359280151ec32e0eb783757b5af6634a04f608655024bd2c3b8a3b9f17128e5a1143e9dbff26e1bb84e3b920fe92954a2b995fee7e8973287
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouV:0NA1Yakeer5+nsoC
TLSH
T1A905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uGCBqpCuuByI1aU.exe

Path C:\Windows\uGCBqpCuuByI1aU.exe
Size 804KB
SHA256 0015b7899a42ffae06302d8d6d64a856f62d9cba3e17174fef400be8132a7159
MD5 e5d5b310ded83a2587ad51e613758dd3
SHA1 2be36834d481b45b3bf43859723da38b506aec51
SHA512 5e918dd8d3f4c0d1fb2927eb0a140023c9a576e451211488278390a04443234e0016490a1b3cee06150a201560dfa8562872ecd3c29a3b9690ebefbfa45a0d41
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nso5
TLSH
T1FB05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vzr40nwFCJU9.exe

Path C:\Windows\vzr40nwFCJU9.exe
Size 804KB
SHA256 0ed91dfa38377a2899e4435306dfce4d300ed2b186340129ac84aca93dcea92c
MD5 b6f68a25d13511550781a5c062247aa5
SHA1 eb60fb09226f23429d29594a0063262f86ba8a67
SHA512 eb39f3b195d05d02cb967408326e5d261f6657c2771d05ed4a33acc09cf05920071fe227298218959e5d23f4080ad54c34082b45c70748e8f1c5b54288d31fab
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nso0
TLSH
T1B405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads