5b18835d8f5041ce9b5e620355b32dc3574d63f44db35c0c1b617a5dd9582b77

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_1f4c434f94d07dce839401f3cacd558a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample261003-tpaddatxat
SHA256 5b18835d8f5041ce9b5e620355b32dc3574d63f44db35c0c1b617a5dd9582b77
MD5 1f4c434f94d07dce839401f3cacd558a
SHA1 d1904d516ff082d24f11f9de123178da4873b092
SHA512 604b930d751113e4715a3e28654ded6e2050e445e870d3e426c13437d751e236199ab1c0922be124de1b68244d5281b3670e7153d82e6ecea41aea4796a94a85
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouoN:0NA1Yakeer5+nso1N
TLSH
T19805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (1179) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 12 IoCs

pid	Process
4296	cb08p.exe
6088	GmqvX3V4.exe
3216	7odr0xzGUoFeH.exe
3480	WSVrLR1Ikgo.exe
1244	w80txJzomv.exe
4796	QCXOJy3OhoB.exe
2652	jKNbDnjhcD.exe
1924	MNHUgU9UWoXbvBg.exe
5056	v7AnR4CPWBAW9y.exe
3524	onZiSaCwBDI.exe
1676	ujqVIci.exe
3232	UvigcZvv6HeXFVN.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKSERV = "C:\\Windows\\cb08p.exe"	2026-10-02_1f4c434f94d07dce839401f3cacd558a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NTRTSCAN = "C:\\Windows\\GmqvX3V4.exe"	cb08p.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPUPD = "C:\\Windows\\7odr0xzGUoFeH.exe"	GmqvX3V4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ESAFE = "C:\\Windows\\WSVrLR1Ikgo.exe"	7odr0xzGUoFeH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\POP3TRAP = "C:\\Windows\\w80txJzomv.exe"	WSVrLR1Ikgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCAFEE = "C:\\Windows\\jKNbDnjhcD.exe"	QCXOJy3OhoB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WATCHDOG = "C:\\Windows\\MNHUgU9UWoXbvBg.exe"	jKNbDnjhcD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PORTMONITOR = "C:\\Windows\\QCXOJy3OhoB.exe"	w80txJzomv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NISSERV = "C:\\Windows\\v7AnR4CPWBAW9y.exe"	MNHUgU9UWoXbvBg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WATCHDOG = "C:\\Windows\\onZiSaCwBDI.exe"	v7AnR4CPWBAW9y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCMNHDLR = "C:\\Windows\\ujqVIci.exe"	onZiSaCwBDI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUCOMSERVE = "C:\\Windows\\UvigcZvv6HeXFVN.exe"	ujqVIci.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\7odr0xzGUoFeH.exe	GmqvX3V4.exe
File opened for modification	C:\Windows\w80txJzomv.exe	WSVrLR1Ikgo.exe
File created	C:\Windows\jKNbDnjhcD.exe	QCXOJy3OhoB.exe
File opened for modification	C:\Windows\MNHUgU9UWoXbvBg.exe	jKNbDnjhcD.exe
File created	C:\Windows\v7AnR4CPWBAW9y.exe	MNHUgU9UWoXbvBg.exe
File opened for modification	C:\Windows\ujqVIci.exe	onZiSaCwBDI.exe
File opened for modification	C:\Windows\UvigcZvv6HeXFVN.exe	ujqVIci.exe
File opened for modification	C:\Windows\WSVrLR1Ikgo.exe	7odr0xzGUoFeH.exe
File opened for modification	C:\Windows\jKNbDnjhcD.exe	QCXOJy3OhoB.exe
File created	C:\Windows\cb08p.exe	2026-10-02_1f4c434f94d07dce839401f3cacd558a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\cb08p.exe	2026-10-02_1f4c434f94d07dce839401f3cacd558a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\GmqvX3V4.exe	cb08p.exe
File created	C:\Windows\7odr0xzGUoFeH.exe	GmqvX3V4.exe
File created	C:\Windows\w80txJzomv.exe	WSVrLR1Ikgo.exe
File created	C:\Windows\ujqVIci.exe	onZiSaCwBDI.exe
File created	C:\Windows\UvigcZvv6HeXFVN.exe	ujqVIci.exe
File created	C:\Windows\GmqvX3V4.exe	cb08p.exe
File created	C:\Windows\WSVrLR1Ikgo.exe	7odr0xzGUoFeH.exe
File created	C:\Windows\QCXOJy3OhoB.exe	w80txJzomv.exe
File opened for modification	C:\Windows\QCXOJy3OhoB.exe	w80txJzomv.exe
File created	C:\Windows\MNHUgU9UWoXbvBg.exe	jKNbDnjhcD.exe
File opened for modification	C:\Windows\v7AnR4CPWBAW9y.exe	MNHUgU9UWoXbvBg.exe
File created	C:\Windows\onZiSaCwBDI.exe	v7AnR4CPWBAW9y.exe
File opened for modification	C:\Windows\onZiSaCwBDI.exe	v7AnR4CPWBAW9y.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2636	2856	WerFault.exe	87
1064	3216	WerFault.exe	97
3320	2652	WerFault.exe	107
6804	3524	WerFault.exe	115
7068	6088	WerFault.exe	92
2084	3232	WerFault.exe	119

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WSVrLR1Ikgo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-02_1f4c434f94d07dce839401f3cacd558a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-02_1f4c434f94d07dce839401f3cacd558a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WSVrLR1Ikgo.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UvigcZvv6HeXFVN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb08p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QCXOJy3OhoB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jKNbDnjhcD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MNHUgU9UWoXbvBg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v7AnR4CPWBAW9y.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_1f4c434f94d07dce839401f3cacd558a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GmqvX3V4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7odr0xzGUoFeH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WSVrLR1Ikgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w80txJzomv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	onZiSaCwBDI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ujqVIci.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-02_1f4c434f94d07dce839401f3cacd558a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_1f4c434f94d07dce839401f3cacd558a_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 2144
  2⤵
  - Program crash
  PID:2636

C:\Windows\cb08p.exe
C:\Windows\cb08p.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4296

C:\Windows\GmqvX3V4.exe
C:\Windows\GmqvX3V4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 2308
  2⤵
  - Program crash
  PID:7068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2856 -ip 2856
1⤵
PID:4676

C:\Windows\7odr0xzGUoFeH.exe
C:\Windows\7odr0xzGUoFeH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 2092
  2⤵
  - Program crash
  PID:1064

C:\Windows\WSVrLR1Ikgo.exe
C:\Windows\WSVrLR1Ikgo.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3480

C:\Windows\w80txJzomv.exe
C:\Windows\w80txJzomv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3216 -ip 3216
1⤵
PID:1892

C:\Windows\QCXOJy3OhoB.exe
C:\Windows\QCXOJy3OhoB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4796

C:\Windows\jKNbDnjhcD.exe
C:\Windows\jKNbDnjhcD.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 2092
  2⤵
  - Program crash
  PID:3320

C:\Windows\MNHUgU9UWoXbvBg.exe
C:\Windows\MNHUgU9UWoXbvBg.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1924

C:\Windows\v7AnR4CPWBAW9y.exe
C:\Windows\v7AnR4CPWBAW9y.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2652 -ip 2652
1⤵
PID:5500

C:\Windows\onZiSaCwBDI.exe
C:\Windows\onZiSaCwBDI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 2216
  2⤵
  - Program crash
  PID:6804

C:\Windows\ujqVIci.exe
C:\Windows\ujqVIci.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1676

C:\Windows\UvigcZvv6HeXFVN.exe
C:\Windows\UvigcZvv6HeXFVN.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 2340
  2⤵
  - Program crash
  PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3524 -ip 3524
1⤵
PID:6784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6088 -ip 6088
1⤵
PID:7048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3232 -ip 3232
1⤵
PID:6416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7odr0xzGUoFeH.exe

Path C:\Windows\7odr0xzGUoFeH.exe
Size 804KB
SHA256 2290ea26581e30b96a446c38d0fcbebfb5a7b0d491824c6c877413e3249add5c
MD5 097c1c8786426488c9cc810b4f1c03ea
SHA1 31a3554045fb7bfbf01e67acf3a4044c4dd18e5b
SHA512 784bfa6526362ff54c81ec01cea9daad2e6814253f3cafa87cc48457855852ce6253661b857e1b908bcbeab15159c03bfb5448a08b33a10b55b219dbd1d5e7d2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou7:0NA1Yakeer5+nsou
TLSH
T1FE05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GmqvX3V4.exe

Path C:\Windows\GmqvX3V4.exe
Size 804KB
SHA256 5130bdcfe13dd57a22f97514077254acb498a88210fbd2a5b36145916e40de21
MD5 96703cbbead328c8510b9910334a1037
SHA1 8fa6a55a44bd281756dfa6684d4dd1e60bf2d5ff
SHA512 5533f2414b5388957fff41afee725158d5a071b3bf8f9c58eb97f473050fe9960677e95f19c3abacdd9673f8609fe5a77da721142ae77bc98992524a5f440b82
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou+:0NA1Yakeer5+nsoL
TLSH
T12005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MNHUgU9UWoXbvBg.exe

Path C:\Windows\MNHUgU9UWoXbvBg.exe
Size 804KB
SHA256 eb11f1e8129b3d28c56288a9cedf1ef9309dc9eb7919de25a894273a79da9867
MD5 2eb874e5e62e006054ebb9923b19ffd5
SHA1 325ec6ea76ced32407027b58428a32bc2a2e61a4
SHA512 9419d3239149f89a1da4755cf072af17e63f25492da178ae35f13a260a751a7de41ca16fd72c6bfa04e0e49240a3d2658ed48aac4b603204aadc3815ec36be1c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nsoF
TLSH
T18B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QCXOJy3OhoB.exe

Path C:\Windows\QCXOJy3OhoB.exe
Size 804KB
SHA256 5b047bdb8accde46d1134ec1dda20208aded4bcf7107e850be78a998433eb6fa
MD5 d54715d9480c1dba5cd9d6043891b2a1
SHA1 a2cf95e97c768abb2e5dd7ceff58916de3fe14a4
SHA512 290c5dce1f2954c538342c184719200dab55f6333a194c51325a37d6e43bd48146fdab321a5e9ce5e412f7cc1383a3e78b8cd8efab3c2069eb559c00f0825006
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFour:0NA1Yakeer5+nsoi
TLSH
T14905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UvigcZvv6HeXFVN.exe

Path C:\Windows\UvigcZvv6HeXFVN.exe
Size 804KB
SHA256 0397b57986631d9643ee00078376ec0f5318ea6088ebe47a56650b49eaf93ae6
MD5 25512616e880ae30b8249717ee9f83ff
SHA1 3bc8f121269639376e02636d3a514653d251926a
SHA512 f9fbfdac5dfdaea0e43013ff77033e6d4912c6837d5aceca07c76176d18875a47106d29254d394d62dc0b8b272081394bfcabe82138c51392990b366c455d66f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nso5
TLSH
T16505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WSVrLR1Ikgo.exe

Path C:\Windows\WSVrLR1Ikgo.exe
Size 804KB
SHA256 a595be09db4c59e30249357c83adc7d2a6f608cd155001fe86754cbfee5222e5
MD5 0fd3e104582180cd3066fc36237a9f13
SHA1 f0eeace6175cb022b1b09e6af2149f038d942a75
SHA512 aaf881b3a6557af0969196548094b9022dc7716791020c1a891b5c680a41ccf59693f96b3dab3898ca3cafb8dab9aecec4547e434f1aeb921968338c9d384d0e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nsoq
TLSH
T14605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb08p.exe

Path C:\Windows\cb08p.exe
Size 804KB
SHA256 7baad8c8971ae2e7cfd356a854c0a1e40312cd436d72b3becd1ddc2d8c9605f2
MD5 948be3ce2c82c59fc849ff38942fd65a
SHA1 efcb7f963ef6914b3945b1144699a86277330d84
SHA512 7b72f8373a9db121ecb1ec80e4a0e6f80e7ba783e51646a6d4dc9d2c0e27e2b820b1a10c8548e5970ac1ad2cbd9c6841fb33bbf9e305da49caab8bd0d7ebd0d7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nsoa
TLSH
T10105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jKNbDnjhcD.exe

Path C:\Windows\jKNbDnjhcD.exe
Size 804KB
SHA256 dea56f267c89f2d1723b54b6de3fcd305addb1b093b4eb46248bf69e462b4165
MD5 11130261309825d3297bd120cc81ed76
SHA1 99b8be404061e9039bc5389bec266826fdb1e450
SHA512 6f811e156c151256f52d58edadc7261f9cbab5db883d0d81d3d4305f697c2524b2240c579d7de6bb5d5413b2c235cbe102305979663d4cbf80ffa56e27b8bdb1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nsoj
TLSH
T14A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onZiSaCwBDI.exe

Path C:\Windows\onZiSaCwBDI.exe
Size 804KB
SHA256 943cc64764ba3f45df8fa8ae08016260501fb14885763d2f286b17aeb3a20492
MD5 0dfa7765fc583923f90a0077b13df876
SHA1 107e4a04cc5d1f752e4a94c46d2aaebca42a42ff
SHA512 77711ebad76d58c10300d68a6d5fdea41158cddceed72e89baa2c9d81c73ea519e6b9453739057ce2844b1bc7023f5d524243dfcba8b69076536967b9d04b7a6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nsow
TLSH
T1B105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ujqVIci.exe

Path C:\Windows\ujqVIci.exe
Size 804KB
SHA256 9aac090d9078d5b229b62a0f6f1c2ad4042c4776ddc3ca8e8c8cf15db44a65ac
MD5 db8a5f0a06cc14f8528bc480b77cffe7
SHA1 0b7c82bd204f437bd331fcdec8ae1c321793b904
SHA512 bb3eddf4272e76e1885d196760e214df96066089ff1f9b90c9e27f079f3ed1ca7b108982f582ea953b11458fb04030da8d46d0f553560c22c53d4345cef9f190
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouH:0NA1Yakeer5+nsom
TLSH
T1FF05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v7AnR4CPWBAW9y.exe

Path C:\Windows\v7AnR4CPWBAW9y.exe
Size 804KB
SHA256 15c6a501102f9a362fcf1371e86f593364b4b95624e439203df2f24d41ea5a16
MD5 5932e1b8849da23cb1e655ac75730156
SHA1 ea07e633482771e95a04df170f8afe5ab703f32c
SHA512 cc92a476a3fefaa8ae0b03538dbed16092e8c79a3c7ba0f7e5ec4fbb028cc7d56b212a4717bef37e4369343f054617832da18b584c382b7bd710cbc0d51994ec
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouK:0NA1Yakeer5+nsoH
TLSH
T17905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w80txJzomv.exe

Path C:\Windows\w80txJzomv.exe
Size 804KB
SHA256 2d68dc19de2bb1b07078aa648ff8e263cc563c95705613fc211a9dfff2e5aed6
MD5 29aa859fe7b42645535925b3ec895de7
SHA1 a59aa297ea976f9bbbbfc85b4374a9f5224d5e69
SHA512 113e2c3b6ceea117f1369e9bc777ebf5d703ec9146f3d93ccf792f0e9687d9c34632f570c77d7d363341fab2a3f388c11a60aaf627d7848992c672b2fdb00aea
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nsog
TLSH
T19005A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads