525b2f192ba8600b52547661458087e5af252c7c2eb41e9c832e48b168ee3c3e

General

Target
2026-10-02_67788ed84ca810886cde961d04cbf426_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample261003-m62evsyvbz
SHA256 525b2f192ba8600b52547661458087e5af252c7c2eb41e9c832e48b168ee3c3e
MD5 67788ed84ca810886cde961d04cbf426
SHA1 3b6bfb8f6dcb34724c78897feff71cdf9ed7fb58
SHA512 0fcf3e8fcc05dbf3655880a562e9077332bd0671ad75b90a94b5e43ffa48335fe43b52bfdbb90a0cf04625998ccf26d34177df408f499351cd5ec438340a5378
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoue:0NA1Yakeer5+nsoz
TLSH
T12D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (935) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 8 IoCs

pid	Process
4288	ROrQ7MZuvxDBXva.exe
2984	cYXVmO.exe
2468	I0B1xPxc8A.exe
2372	ZI2kHkZyYQDL0.exe
4980	MuVGEon.exe
5384	YMF78gbtLLBh9pv.exe
5668	iTryoN.exe
6008	6D8L2e9i3vK1d5X.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CONNECTIONMONITOR = "C:\\Windows\\iTryoN.exe"	YMF78gbtLLBh9pv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\POPROXY = "C:\\Windows\\6D8L2e9i3vK1d5X.exe"	iTryoN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WATCHDOG = "C:\\Windows\\ROrQ7MZuvxDBXva.exe"	2026-10-02_67788ed84ca810886cde961d04cbf426_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FP-WIN = "C:\\Windows\\cYXVmO.exe"	ROrQ7MZuvxDBXva.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\P-WIN = "C:\\Windows\\I0B1xPxc8A.exe"	cYXVmO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RESCUE = "C:\\Windows\\ZI2kHkZyYQDL0.exe"	I0B1xPxc8A.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MOOLIVE = "C:\\Windows\\MuVGEon.exe"	ZI2kHkZyYQDL0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EVPN = "C:\\Windows\\YMF78gbtLLBh9pv.exe"	MuVGEon.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\YMF78gbtLLBh9pv.exe	MuVGEon.exe
File created	C:\Windows\cYXVmO.exe	ROrQ7MZuvxDBXva.exe
File opened for modification	C:\Windows\cYXVmO.exe	ROrQ7MZuvxDBXva.exe
File created	C:\Windows\I0B1xPxc8A.exe	cYXVmO.exe
File opened for modification	C:\Windows\I0B1xPxc8A.exe	cYXVmO.exe
File opened for modification	C:\Windows\MuVGEon.exe	ZI2kHkZyYQDL0.exe
File opened for modification	C:\Windows\ROrQ7MZuvxDBXva.exe	2026-10-02_67788ed84ca810886cde961d04cbf426_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\MuVGEon.exe	ZI2kHkZyYQDL0.exe
File created	C:\Windows\iTryoN.exe	YMF78gbtLLBh9pv.exe
File opened for modification	C:\Windows\iTryoN.exe	YMF78gbtLLBh9pv.exe
File created	C:\Windows\YMF78gbtLLBh9pv.exe	MuVGEon.exe
File created	C:\Windows\ROrQ7MZuvxDBXva.exe	2026-10-02_67788ed84ca810886cde961d04cbf426_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\ZI2kHkZyYQDL0.exe	I0B1xPxc8A.exe
File opened for modification	C:\Windows\ZI2kHkZyYQDL0.exe	I0B1xPxc8A.exe
File opened for modification	C:\Windows\6D8L2e9i3vK1d5X.exe	iTryoN.exe
File created	C:\Windows\6D8L2e9i3vK1d5X.exe	iTryoN.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5912	4980	WerFault.exe	106
4772	5048	WerFault.exe	87
2444	2984	WerFault.exe	94

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-02_67788ed84ca810886cde961d04cbf426_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-02_67788ed84ca810886cde961d04cbf426_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROrQ7MZuvxDBXva.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cYXVmO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZI2kHkZyYQDL0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MuVGEon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iTryoN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6D8L2e9i3vK1d5X.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_67788ed84ca810886cde961d04cbf426_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	I0B1xPxc8A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YMF78gbtLLBh9pv.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-02_67788ed84ca810886cde961d04cbf426_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_67788ed84ca810886cde961d04cbf426_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 2256
  2⤵
  - Program crash
  PID:4772

C:\Windows\ROrQ7MZuvxDBXva.exe
C:\Windows\ROrQ7MZuvxDBXva.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4288

C:\Windows\cYXVmO.exe
C:\Windows\cYXVmO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 2320
  2⤵
  - Program crash
  PID:2444

C:\Windows\I0B1xPxc8A.exe
C:\Windows\I0B1xPxc8A.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2468

C:\Windows\ZI2kHkZyYQDL0.exe
C:\Windows\ZI2kHkZyYQDL0.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2372

C:\Windows\MuVGEon.exe
C:\Windows\MuVGEon.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 1964
  2⤵
  - Program crash
  PID:5912

C:\Windows\YMF78gbtLLBh9pv.exe
C:\Windows\YMF78gbtLLBh9pv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5384

C:\Windows\iTryoN.exe
C:\Windows\iTryoN.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4980 -ip 4980
1⤵
PID:5888

C:\Windows\6D8L2e9i3vK1d5X.exe
C:\Windows\6D8L2e9i3vK1d5X.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5048 -ip 5048
1⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2984 -ip 2984
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6D8L2e9i3vK1d5X.exe

Path C:\Windows\6D8L2e9i3vK1d5X.exe
Size 804KB
SHA256 d735ca7f2a2c473a5789e6bb135398fc569a178eb5cdafe34d898ca20f0171a2
MD5 4f14c04563ea21066151cca35837b59a
SHA1 8aa43bad3faeaf351e90ab4d81dad340a3cd1c22
SHA512 f1c8bae6dcf8b6c946981fd7977561599cfeb306a1ef5a7a7ffc1203f390395f5a0a008d217162731901f249f32fad0b8b71c4882d6ad7284cef3a28b90b2558
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsou
TLSH
T1EE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

I0B1xPxc8A.exe

Path C:\Windows\I0B1xPxc8A.exe
Size 804KB
SHA256 b0efce60c5b8d05570997f868498e973039b2ed4d39253d70b9bccb48e58b79c
MD5 56c986dc9c5148c395f4e9c433727a64
SHA1 943cc800958a34bd7f6e507ef7617340d31ae3d9
SHA512 2bccc8f5000edea55c2a4b3184a8339d704d5f221eaccbbd890fe66edafa3cdaea32c9964cad8d2001dc4af1a5e32f8d7358c7edea405e9ca8f56230f75ccd46
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouO:0NA1Yakeer5+nso1
TLSH
T1FB05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MuVGEon.exe

Path C:\Windows\MuVGEon.exe
Size 804KB
SHA256 0739c32bcc70c1cd3202e6f0f6ff89a7b6989aa7b12165c8a5a616177d74c233
MD5 2a57c2a26c54e87312cf3e56f42efb83
SHA1 0c00367d71ecacc4ca100df66b14ce852f96f1b1
SHA512 1dc70678b0649446e56945d59f1e8252550d80bc2067826e7da6c20f2e75570e3e84eef95d4385000aea6d9294cf9b068b669c2d41c99c800ea7f0ed4f5bb9ca
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouov:0NA1Yakeer5+nso7
TLSH
T11605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ROrQ7MZuvxDBXva.exe

Path C:\Windows\ROrQ7MZuvxDBXva.exe
Size 804KB
SHA256 33f65cace714d0f2fb807859051a41ded9644dc59f60f4e84680475714344084
MD5 2d4b319d4ebb524054a33da63b1e2fd0
SHA1 1d73782ec6f0fa36d96950298904252a96f0e7ad
SHA512 b238d413c2ebeac4de5256d507f40f31f77a8289fa78be731d0ecee387557e197fdeb60c89ac2db582cd48c83fb3b7a28addacc74f9af580f126165d0d8ac8d1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nsoC
TLSH
T1D005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YMF78gbtLLBh9pv.exe

Path C:\Windows\YMF78gbtLLBh9pv.exe
Size 804KB
SHA256 1f4bdbc9257b0d780ed9d746e96bafccbff73908ea3e849a955f56b52e570dc2
MD5 25362fd67555917998c7f3a213ce2246
SHA1 d5519329a4620fca8e682136c702bfa9a29161d3
SHA512 6020ce78ab0311bc31fe5fff548d9bdc37771ee6fe45ec21058fe901309c96678140d221cf6db1db53b107220593dce47336405cb29220584a14fbdd9c34ed6a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouJ:0NA1Yakeer5+nsoA
TLSH
T18105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZI2kHkZyYQDL0.exe

Path C:\Windows\ZI2kHkZyYQDL0.exe
Size 804KB
SHA256 d2c7343e30442832dd2a8663aeb56827c38d14a92bde934abaa8107468b792ce
MD5 33a1acd15cb9dd3373b4395ff7ef5080
SHA1 e4adace014c9e16c08a1f862fb04cc74e9a66cb6
SHA512 18c0531c782c9050231d31428171edc1e10707cc2ad16fd56651258c9b8e2c0013c910a12badeed3b4c8377da858b7c0526c8936beef893b89164f6a429e1c5e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouh1:0NA1Yakeer5+nsoY
TLSH
T15405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cYXVmO.exe

Path C:\Windows\cYXVmO.exe
Size 804KB
SHA256 361ccf44950030e366abef68c58ebd6c81d5925379cfde3e92289e3137148be0
MD5 e2752fa107d27add2855519029da43ec
SHA1 568ac6aeeadd0b9a975f45c0e331f93b879cdce4
SHA512 ec4f0fec054d1110aa9e8ecbcbdb23e58d3fbfb6572db3211a0beb890e1962b2e998085117dfd160315e49a699093c288ee56d61c95d790124e8a37af4f5081e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQ:0NA1Yakeer5+nsoP
TLSH
T17505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iTryoN.exe

Path C:\Windows\iTryoN.exe
Size 804KB
SHA256 de626cef0e6d6e76ef5fe2435b9d50501adfd277347e57882ee84522145d22e5
MD5 882d105006099a2dea7bd1211a53d49e
SHA1 66016292daa4569c9f15ae458af61ff80a59b3f3
SHA512 7c91944b1f134eefa12cce061f689f3726ac1c150f2c66962b7e5271547f4bbe6c479034b840d1f095f9db8cca1a304de0427b4ad94356961e087a6966ead1c4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nso+
TLSH
T19505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads