ac636cb7c1a0518c81de63500ca805a0e6936ed8565b34574127ff20ed32d6b9

General

Target
2026-10-06_1c280963068c138c21443bc1f8d9ce88_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample261006-se4c2afc87
SHA256 ac636cb7c1a0518c81de63500ca805a0e6936ed8565b34574127ff20ed32d6b9
MD5 1c280963068c138c21443bc1f8d9ce88
SHA1 a940dce68c9996a759c26ef3b4db20eacb0e80e7
SHA512 e3ea83150f31821ec826ccd58fc69cca0fe02fa318899260dfaf52d9e0286ab9c74e618dcac17b56531954fa010dda217654db5910a56c6aa39f408736d44d7a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouf:0NA1Yakeer5+nsow
TLSH
T17705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (955) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 8 IoCs

pid	Process
5544	Z1MoTLDnDDlGvR.exe
4160	JqsGvir.exe
3024	Hmj38UDIo5.exe
1672	zr3HhN3UCjEFolB.exe
4936	TEMOZ0iWm3Nj.exe
1608	SZ3G3VYW8bkc1.exe
3536	4oHay.exe
3420	5KbToq0.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NDD32 = "C:\\Windows\\JqsGvir.exe"	Z1MoTLDnDDlGvR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SAFEWEB = "C:\\Windows\\TEMOZ0iWm3Nj.exe"	zr3HhN3UCjEFolB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSMB32 = "C:\\Windows\\SZ3G3VYW8bkc1.exe"	TEMOZ0iWm3Nj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPROTECT = "C:\\Windows\\5KbToq0.exe"	6xw1GicCt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RTVSCN95 = "C:\\Windows\\Hmj38UDIo5.exe"	JqsGvir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VSECOMR = "C:\\Windows\\zr3HhN3UCjEFolB.exe"	Hmj38UDIo5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVXMONITOR9X = "C:\\Windows\\4oHay.exe"	SZ3G3VYW8bkc1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MGAVRTCL = "C:\\Windows\\6xw1GicCt.exe"	4oHay.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SPHINX = "C:\\Windows\\Z1MoTLDnDDlGvR.exe"	2026-10-06_1c280963068c138c21443bc1f8d9ce88_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\4oHay.exe	SZ3G3VYW8bkc1.exe
File created	C:\Windows\5KbToq0.exe	6xw1GicCt.exe
File opened for modification	C:\Windows\Z1MoTLDnDDlGvR.exe	2026-10-06_1c280963068c138c21443bc1f8d9ce88_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\Hmj38UDIo5.exe	JqsGvir.exe
File opened for modification	C:\Windows\TEMOZ0iWm3Nj.exe	zr3HhN3UCjEFolB.exe
File created	C:\Windows\4oHay.exe	SZ3G3VYW8bkc1.exe
File created	C:\Windows\Z1MoTLDnDDlGvR.exe	2026-10-06_1c280963068c138c21443bc1f8d9ce88_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\zr3HhN3UCjEFolB.exe	Hmj38UDIo5.exe
File created	C:\Windows\TEMOZ0iWm3Nj.exe	zr3HhN3UCjEFolB.exe
File created	C:\Windows\SZ3G3VYW8bkc1.exe	TEMOZ0iWm3Nj.exe
File opened for modification	C:\Windows\SZ3G3VYW8bkc1.exe	TEMOZ0iWm3Nj.exe
File opened for modification	C:\Windows\5KbToq0.exe	6xw1GicCt.exe
File created	C:\Windows\JqsGvir.exe	Z1MoTLDnDDlGvR.exe
File opened for modification	C:\Windows\JqsGvir.exe	Z1MoTLDnDDlGvR.exe
File created	C:\Windows\Hmj38UDIo5.exe	JqsGvir.exe
File opened for modification	C:\Windows\zr3HhN3UCjEFolB.exe	Hmj38UDIo5.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4816	5544	WerFault.exe	89
2780	2696	WerFault.exe	106
3316	1608	WerFault.exe	102
3892	3536	WerFault.exe	104

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-06_1c280963068c138c21443bc1f8d9ce88_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-06_1c280963068c138c21443bc1f8d9ce88_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zr3HhN3UCjEFolB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SZ3G3VYW8bkc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4oHay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6xw1GicCt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5KbToq0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JqsGvir.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmj38UDIo5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TEMOZ0iWm3Nj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-06_1c280963068c138c21443bc1f8d9ce88_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Z1MoTLDnDDlGvR.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-06_1c280963068c138c21443bc1f8d9ce88_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-06_1c280963068c138c21443bc1f8d9ce88_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3120

C:\Windows\Z1MoTLDnDDlGvR.exe
C:\Windows\Z1MoTLDnDDlGvR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 2092
  2⤵
  - Program crash
  PID:4816

C:\Windows\JqsGvir.exe
C:\Windows\JqsGvir.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4160

C:\Windows\Hmj38UDIo5.exe
C:\Windows\Hmj38UDIo5.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5544 -ip 5544
1⤵
PID:5212

C:\Windows\zr3HhN3UCjEFolB.exe
C:\Windows\zr3HhN3UCjEFolB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1672

C:\Windows\TEMOZ0iWm3Nj.exe
C:\Windows\TEMOZ0iWm3Nj.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4936

C:\Windows\SZ3G3VYW8bkc1.exe
C:\Windows\SZ3G3VYW8bkc1.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 2216
  2⤵
  - Program crash
  PID:3316

C:\Windows\4oHay.exe
C:\Windows\4oHay.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 2512
  2⤵
  - Program crash
  PID:3892

C:\Windows\6xw1GicCt.exe
C:\Windows\6xw1GicCt.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 2096
  2⤵
  - Program crash
  PID:2780

C:\Windows\5KbToq0.exe
C:\Windows\5KbToq0.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2696 -ip 2696
1⤵
PID:5336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1608 -ip 1608
1⤵
PID:5452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3536 -ip 3536
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Network Service Discovery

1

T1046

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4oHay.exe

Path C:\Windows\4oHay.exe
Size 804KB
SHA256 563f8ea3615f12388ee08b573778bb8a189d024d7797bcd53460ae479cfe250a
MD5 db8e0bade220abe61bc27a9d46182395
SHA1 5f611014c557b115c16d3549c54f361763329d4e
SHA512 e2f6a57875e2cc1453338e19596a0d16b8dc0cbe5713ebc3df77849636bcd1f73fb15ee7011a41699e534f3bf909ffa5bcd8a61c660b95d75dc9faaec4b9a5f1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou8:0NA1Yakeer5+nsox
TLSH
T15105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5KbToq0.exe

Path C:\Windows\5KbToq0.exe
Size 804KB
SHA256 85a5eb029bb77693b254e3abd5187c1d2423327acca20a2c00ed7338339df4ae
MD5 794ae04c2b9f518fb5e30846deeff18b
SHA1 3adec51a06b59b53cc1daf89ae818fee2cadefe0
SHA512 1e4ba5926378b151c1cd939761055c51b914db5b6a1edfcc1c27864e481bca175d370ccc628059dc1a83e3f07a198e33d4768ce5edc686aebdd9a123f3342702
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoui:0NA1Yakeer5+nsod
TLSH
T12105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hmj38UDIo5.exe

Path C:\Windows\Hmj38UDIo5.exe
Size 804KB
SHA256 190562c8d1f1113ba58e0ada56eb22a079e2e9c0f4d8522907c818db0bf25725
MD5 3b97a3577b33c0f4fb7696f240c98cab
SHA1 3cb0a15866745a62c5292035f67e457763f3c8f8
SHA512 06bce711c203c6319d64440ab33167f7e857cd9fbfb5da14808bdd8bbf81824de4c80750f551550bbb9b0719fdecc1f413dab11df3a3b235f1dbf34fbcac4fc2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouh:0NA1Yakeer5+nso8
TLSH
T1E405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JqsGvir.exe

Path C:\Windows\JqsGvir.exe
Size 804KB
SHA256 146784402565b5a5f2f9006d794f5fbd632fb057af56abfebb2913608f6fb0de
MD5 a2f55b4337421bf82fd506fd5be14855
SHA1 6a5b71f850a18d25efd49a073f372eed5473aaca
SHA512 55f077f09a85f5fbaffa8f8a0fec2b14caa4e3941b72e3590218102201db1a3ec9babcd6bbcc41ae1d57187e69a4cf910e08c9b442471cc42332eb6f893092fe
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouU:0NA1Yakeer5+nsoN
TLSH
T15505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SZ3G3VYW8bkc1.exe

Path C:\Windows\SZ3G3VYW8bkc1.exe
Size 804KB
SHA256 3b5bf6898ecba7729f4b2c0bb4ae1e7852acbec3307ba241d77c72260b4627d9
MD5 b49f58036a3a0c2ec4c5b8dbf8d29ced
SHA1 dfe502eb8addd903310b3ef4583dd1d7e6d4679c
SHA512 f4458eb8d4fccf9ae876ec282fbba76419680fc9ade450b2ca837771d83fc08af7e993da12d9576bed1471bcce85180ca4ff5d13369e3d8c8753834f325af488
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsoQ
TLSH
T11E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TEMOZ0iWm3Nj.exe

Path C:\Windows\TEMOZ0iWm3Nj.exe
Size 804KB
SHA256 29ebf59dd76efba908319dc17ac263636aeef55d6e86d218edca6764d9da37bb
MD5 0ad65c0e3eab878eb0c0d87c866fd498
SHA1 9effa42c624af1983e12f2960e236b1a0217093a
SHA512 d65338160081ffa8649dc5b3e01f608d1a2a3802d01a589719d6ff20a1f2f9659b6635134496607de10ddaac85f0b4f8632fb4161520d4209865fc4b1156c4f3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nsoo
TLSH
T13C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Z1MoTLDnDDlGvR.exe

Path C:\Windows\Z1MoTLDnDDlGvR.exe
Size 804KB
SHA256 50314e53ea3e744a73a5212af325caeb613d2cd3c92482685459256834f26416
MD5 78f8b62514b78e28fc6890e4c19fbae7
SHA1 71657c0f20b923d6f2f794fe808cd370fb6feb0e
SHA512 cad60d7f99b55162e79906bbe56eae36a5d4dbc34dfd6ebe52e12a6361b78fca8f2ba97ed1d7a7fb4aefcff37687c319da922c56a1bd67b53244af5f99a01c29
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoul:0NA1Yakeer5+nsou
TLSH
T1C205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zr3HhN3UCjEFolB.exe

Path C:\Windows\zr3HhN3UCjEFolB.exe
Size 804KB
SHA256 3ca0bbad4205a1fa597a14909ef3189b257510e2e82ed407be3c24eb82c6842e
MD5 01a9c57bbf03425751b3fba668ea37ea
SHA1 b9ab0b12c571bf73ff18e82bc079ad6fe7511b9f
SHA512 80edced7531e91c890cbefb4a92cb2f5952e5b780f1d8a4936f04539fcadfd5c9cd97d887e8a2d8f12425655929570d4b8311d0c0f451d0f6e50bf9b8389a1c8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouG:0NA1Yakeer5+nsoT
TLSH
T1F505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads