052622679fba386bb724da8a2b4b6deb27dacfee1fc116e5f399d033802eb98b

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_b79d80187db3840efabf3a4ead94d8eb_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample261011-e4kekae12t
SHA256 052622679fba386bb724da8a2b4b6deb27dacfee1fc116e5f399d033802eb98b
MD5 b79d80187db3840efabf3a4ead94d8eb
SHA1 29810a897b5ebbf69242d2fd1ce44ba072ad51b3
SHA512 d26d2378e3543d9f639acfe9624f131553cc3d19f4f7da594f00be555458434cfc7d595a69101c71d4e7acb7acdc677a777a94965a2d0c078ab02899ec3b3907
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsoU
TLSH
T1AA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Contacts a large (3087) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 34 IoCs

pid	Process
5552	vTLKWoH.exe
1208	oIvp4.exe
3948	ibFSvCaUReAv9.exe
2640	1TnXw2TXLIxG.exe
4672	6cQzJ6uVaXS.exe
2892	ZJ5zEhSVl.exe
4776	0tCuic6rgY.exe
4244	JHdXK.exe
4308	hFYuKsNyyFj.exe
5236	o6wVFbk2MM09LJd.exe
6240	0Fs02.exe
6516	yoEQtUhwpvUaV.exe
6812	nvjVjKmIzsr.exe
7080	huEvB77xEgwQ.exe
6676	agWlX4vvqaFuSA.exe
6460	wa5QmvC.exe
7428	JblmVp6y.exe
7692	e1zdeiTVzvHIL.exe
7952	KgnsTey5.exe
5048	odcUs3oGLlIc.exe
8340	vCKUVOpRCjK80Zv.exe
8604	Hrvc16ElUo0p013.exe
8856	5peUNR.exe
9108	WH7ijXx6OvY.exe
9120	Ht73Z8.exe
9476	ELPB427Gd38e.exe
9744	mp4oJIYlE4aIEO.exe
10004	4yuMmAeGGO.exe
9728	xQ2rW87.exe
10232	vvXg3I0j.exe
10356	etKNp.exe
10608	iijhSSxbxTJQD.exe
10856	SM2UrbRHa4g.exe
11104	kVwpdEED.exe

Adds Run key to start application 2 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RULAUNCH = "C:\\Windows\\Hrvc16ElUo0p013.exe"	vCKUVOpRCjK80Zv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAV7WIN = "C:\\Windows\\nvjVjKmIzsr.exe"	yoEQtUhwpvUaV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CMGRDIAN = "C:\\Windows\\xQ2rW87.exe"	4yuMmAeGGO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NTXCONFIG = "C:\\Windows\\vvXg3I0j.exe"	xQ2rW87.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FP-WIN = "C:\\Windows\\kVwpdEED.exe"	SM2UrbRHa4g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-PROT = "C:\\Windows\\agWlX4vvqaFuSA.exe"	huEvB77xEgwQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPM = "C:\\Windows\\KgnsTey5.exe"	e1zdeiTVzvHIL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TCA = "C:\\Windows\\vCKUVOpRCjK80Zv.exe"	odcUs3oGLlIc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CFGWIZ = "C:\\Windows\\5peUNR.exe"	Hrvc16ElUo0p013.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\F-STOPW = "C:\\Windows\\WH7ijXx6OvY.exe"	5peUNR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCCWIN97 = "C:\\Windows\\JHdXK.exe"	0tCuic6rgY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ADVXDWIN = "C:\\Windows\\o6wVFbk2MM09LJd.exe"	hFYuKsNyyFj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATWATCH = "C:\\Windows\\yoEQtUhwpvUaV.exe"	0Fs02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCCNTMON = "C:\\Windows\\Ht73Z8.exe"	WH7ijXx6OvY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CCEVTMGR = "C:\\Windows\\mp4oJIYlE4aIEO.exe"	ELPB427Gd38e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RULAUNCH = "C:\\Windows\\4yuMmAeGGO.exe"	mp4oJIYlE4aIEO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CONNECTIONMONITOR = "C:\\Windows\\etKNp.exe"	vvXg3I0j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BLACKICE = "C:\\Windows\\SM2UrbRHa4g.exe"	iijhSSxbxTJQD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATCON = "C:\\Windows\\oIvp4.exe"	vTLKWoH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VPTRAY = "C:\\Windows\\ZJ5zEhSVl.exe"	6cQzJ6uVaXS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZAPRO = "C:\\Windows\\0Fs02.exe"	o6wVFbk2MM09LJd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NPROTECT = "C:\\Windows\\huEvB77xEgwQ.exe"	nvjVjKmIzsr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFSCANGUI = "C:\\Windows\\wa5QmvC.exe"	agWlX4vvqaFuSA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVSCHED32 = "C:\\Windows\\0tCuic6rgY.exe"	ZJ5zEhSVl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCUPDATE = "C:\\Windows\\hFYuKsNyyFj.exe"	JHdXK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWEEPNET = "C:\\Windows\\iijhSSxbxTJQD.exe"	etKNp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WATCHDOG = "C:\\Windows\\1TnXw2TXLIxG.exe"	ibFSvCaUReAv9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NOTSTART = "C:\\Windows\\6cQzJ6uVaXS.exe"	1TnXw2TXLIxG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TDS2-NT = "C:\\Windows\\e1zdeiTVzvHIL.exe"	JblmVp6y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FSMA32 = "C:\\Windows\\ELPB427Gd38e.exe"	Ht73Z8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCANPM = "C:\\Windows\\ibFSvCaUReAv9.exe"	oIvp4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SAFEWEB = "C:\\Windows\\vTLKWoH.exe"	2026-10-10_b79d80187db3840efabf3a4ead94d8eb_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCRSCAN = "C:\\Windows\\JblmVp6y.exe"	wa5QmvC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LUSPT = "C:\\Windows\\odcUs3oGLlIc.exe"	KgnsTey5.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hFYuKsNyyFj.exe	JHdXK.exe
File created	C:\Windows\o6wVFbk2MM09LJd.exe	hFYuKsNyyFj.exe
File created	C:\Windows\huEvB77xEgwQ.exe	nvjVjKmIzsr.exe
File created	C:\Windows\5peUNR.exe	Hrvc16ElUo0p013.exe
File created	C:\Windows\oIvp4.exe	vTLKWoH.exe
File created	C:\Windows\6cQzJ6uVaXS.exe	1TnXw2TXLIxG.exe
File opened for modification	C:\Windows\JblmVp6y.exe	wa5QmvC.exe
File opened for modification	C:\Windows\mp4oJIYlE4aIEO.exe	ELPB427Gd38e.exe
File created	C:\Windows\JblmVp6y.exe	wa5QmvC.exe
File created	C:\Windows\mp4oJIYlE4aIEO.exe	ELPB427Gd38e.exe
File opened for modification	C:\Windows\oIvp4.exe	vTLKWoH.exe
File opened for modification	C:\Windows\KgnsTey5.exe	e1zdeiTVzvHIL.exe
File created	C:\Windows\WH7ijXx6OvY.exe	5peUNR.exe
File opened for modification	C:\Windows\WH7ijXx6OvY.exe	5peUNR.exe
File opened for modification	C:\Windows\Ht73Z8.exe	WH7ijXx6OvY.exe
File opened for modification	C:\Windows\vvXg3I0j.exe	xQ2rW87.exe
File created	C:\Windows\ZJ5zEhSVl.exe	6cQzJ6uVaXS.exe
File opened for modification	C:\Windows\0tCuic6rgY.exe	ZJ5zEhSVl.exe
File created	C:\Windows\hFYuKsNyyFj.exe	JHdXK.exe
File opened for modification	C:\Windows\e1zdeiTVzvHIL.exe	JblmVp6y.exe
File created	C:\Windows\KgnsTey5.exe	e1zdeiTVzvHIL.exe
File opened for modification	C:\Windows\odcUs3oGLlIc.exe	KgnsTey5.exe
File created	C:\Windows\etKNp.exe	vvXg3I0j.exe
File created	C:\Windows\0tCuic6rgY.exe	ZJ5zEhSVl.exe
File created	C:\Windows\agWlX4vvqaFuSA.exe	huEvB77xEgwQ.exe
File created	C:\Windows\Hrvc16ElUo0p013.exe	vCKUVOpRCjK80Zv.exe
File opened for modification	C:\Windows\4yuMmAeGGO.exe	mp4oJIYlE4aIEO.exe
File opened for modification	C:\Windows\etKNp.exe	vvXg3I0j.exe
File opened for modification	C:\Windows\iijhSSxbxTJQD.exe	etKNp.exe
File created	C:\Windows\1TnXw2TXLIxG.exe	ibFSvCaUReAv9.exe
File opened for modification	C:\Windows\o6wVFbk2MM09LJd.exe	hFYuKsNyyFj.exe
File opened for modification	C:\Windows\0Fs02.exe	o6wVFbk2MM09LJd.exe
File created	C:\Windows\odcUs3oGLlIc.exe	KgnsTey5.exe
File opened for modification	C:\Windows\ELPB427Gd38e.exe	Ht73Z8.exe
File created	C:\Windows\vvXg3I0j.exe	xQ2rW87.exe
File created	C:\Windows\vTLKWoH.exe	2026-10-10_b79d80187db3840efabf3a4ead94d8eb_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\nvjVjKmIzsr.exe	yoEQtUhwpvUaV.exe
File created	C:\Windows\SM2UrbRHa4g.exe	iijhSSxbxTJQD.exe
File opened for modification	C:\Windows\6cQzJ6uVaXS.exe	1TnXw2TXLIxG.exe
File created	C:\Windows\kVwpdEED.exe	SM2UrbRHa4g.exe
File opened for modification	C:\Windows\ZJ5zEhSVl.exe	6cQzJ6uVaXS.exe
File created	C:\Windows\yoEQtUhwpvUaV.exe	0Fs02.exe
File opened for modification	C:\Windows\kVwpdEED.exe	SM2UrbRHa4g.exe
File opened for modification	C:\Windows\vTLKWoH.exe	2026-10-10_b79d80187db3840efabf3a4ead94d8eb_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\1TnXw2TXLIxG.exe	ibFSvCaUReAv9.exe
File created	C:\Windows\JHdXK.exe	0tCuic6rgY.exe
File opened for modification	C:\Windows\nvjVjKmIzsr.exe	yoEQtUhwpvUaV.exe
File created	C:\Windows\wa5QmvC.exe	agWlX4vvqaFuSA.exe
File created	C:\Windows\xQ2rW87.exe	4yuMmAeGGO.exe
File created	C:\Windows\iijhSSxbxTJQD.exe	etKNp.exe
File opened for modification	C:\Windows\JHdXK.exe	0tCuic6rgY.exe
File opened for modification	C:\Windows\huEvB77xEgwQ.exe	nvjVjKmIzsr.exe
File opened for modification	C:\Windows\ibFSvCaUReAv9.exe	oIvp4.exe
File created	C:\Windows\vCKUVOpRCjK80Zv.exe	odcUs3oGLlIc.exe
File opened for modification	C:\Windows\Hrvc16ElUo0p013.exe	vCKUVOpRCjK80Zv.exe
File created	C:\Windows\ibFSvCaUReAv9.exe	oIvp4.exe
File created	C:\Windows\0Fs02.exe	o6wVFbk2MM09LJd.exe
File opened for modification	C:\Windows\vCKUVOpRCjK80Zv.exe	odcUs3oGLlIc.exe
File opened for modification	C:\Windows\SM2UrbRHa4g.exe	iijhSSxbxTJQD.exe
File opened for modification	C:\Windows\wa5QmvC.exe	agWlX4vvqaFuSA.exe
File created	C:\Windows\e1zdeiTVzvHIL.exe	JblmVp6y.exe
File opened for modification	C:\Windows\5peUNR.exe	Hrvc16ElUo0p013.exe
File created	C:\Windows\Ht73Z8.exe	WH7ijXx6OvY.exe
File opened for modification	C:\Windows\xQ2rW87.exe	4yuMmAeGGO.exe

Program crash 15 IoCs

pid	pid_target	Process	procid_target
4780	4728	WerFault.exe	87
2420	4672	WerFault.exe	101
5832	6516	WerFault.exe	117
10208	9476	WerFault.exe	147
10348	10856	WerFault.exe	164
10984	2640	WerFault.exe	99
2384	7080	WerFault.exe	121
11036	5048	WerFault.exe	135
1688	10608	WerFault.exe	162
8884	6240	WerFault.exe	115
3004	6676	WerFault.exe	125
5996	7692	WerFault.exe	131
4052	11104	WerFault.exe	166
7980	5552	WerFault.exe	90
7984	3948	WerFault.exe	97

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-10_b79d80187db3840efabf3a4ead94d8eb_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-10_b79d80187db3840efabf3a4ead94d8eb_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	1TnXw2TXLIxG.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	1TnXw2TXLIxG.exe

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0Fs02.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nvjVjKmIzsr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JblmVp6y.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ht73Z8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vTLKWoH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oIvp4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZJ5zEhSVl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odcUs3oGLlIc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0tCuic6rgY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4yuMmAeGGO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kVwpdEED.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huEvB77xEgwQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1zdeiTVzvHIL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5peUNR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_b79d80187db3840efabf3a4ead94d8eb_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WH7ijXx6OvY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mp4oJIYlE4aIEO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xQ2rW87.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	etKNp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SM2UrbRHa4g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1TnXw2TXLIxG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hFYuKsNyyFj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yoEQtUhwpvUaV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wa5QmvC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KgnsTey5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vCKUVOpRCjK80Zv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hrvc16ElUo0p013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ibFSvCaUReAv9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cQzJ6uVaXS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JHdXK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o6wVFbk2MM09LJd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ELPB427Gd38e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vvXg3I0j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iijhSSxbxTJQD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agWlX4vvqaFuSA.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-10_b79d80187db3840efabf3a4ead94d8eb_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_b79d80187db3840efabf3a4ead94d8eb_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2168
  2⤵
  - Program crash
  PID:4780

C:\Windows\vTLKWoH.exe
C:\Windows\vTLKWoH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5552 -s 2424
  2⤵
  - Program crash
  PID:7980

C:\Windows\oIvp4.exe
C:\Windows\oIvp4.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4728 -ip 4728
1⤵
PID:4816

C:\Windows\ibFSvCaUReAv9.exe
C:\Windows\ibFSvCaUReAv9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 2424
  2⤵
  - Program crash
  PID:7984

C:\Windows\1TnXw2TXLIxG.exe
C:\Windows\1TnXw2TXLIxG.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 2312
  2⤵
  - Program crash
  PID:10984

C:\Windows\6cQzJ6uVaXS.exe
C:\Windows\6cQzJ6uVaXS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 2096
  2⤵
  - Program crash
  PID:2420

C:\Windows\ZJ5zEhSVl.exe
C:\Windows\ZJ5zEhSVl.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2892

C:\Windows\0tCuic6rgY.exe
C:\Windows\0tCuic6rgY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4672 -ip 4672
1⤵
PID:5440

C:\Windows\JHdXK.exe
C:\Windows\JHdXK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4244

C:\Windows\hFYuKsNyyFj.exe
C:\Windows\hFYuKsNyyFj.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4308

C:\Windows\o6wVFbk2MM09LJd.exe
C:\Windows\o6wVFbk2MM09LJd.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5236

C:\Windows\0Fs02.exe
C:\Windows\0Fs02.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6240 -s 2316
  2⤵
  - Program crash
  PID:8884

C:\Windows\yoEQtUhwpvUaV.exe
C:\Windows\yoEQtUhwpvUaV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6516 -s 2096
  2⤵
  - Program crash
  PID:5832

C:\Windows\nvjVjKmIzsr.exe
C:\Windows\nvjVjKmIzsr.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6812

C:\Windows\huEvB77xEgwQ.exe
C:\Windows\huEvB77xEgwQ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 2216
  2⤵
  - Program crash
  PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6516 -ip 6516
1⤵
PID:5324

C:\Windows\agWlX4vvqaFuSA.exe
C:\Windows\agWlX4vvqaFuSA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6676 -s 2312
  2⤵
  - Program crash
  PID:3004

C:\Windows\wa5QmvC.exe
C:\Windows\wa5QmvC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6460

C:\Windows\JblmVp6y.exe
C:\Windows\JblmVp6y.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7428

C:\Windows\e1zdeiTVzvHIL.exe
C:\Windows\e1zdeiTVzvHIL.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7692 -s 2312
  2⤵
  - Program crash
  PID:5996

C:\Windows\KgnsTey5.exe
C:\Windows\KgnsTey5.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7952

C:\Windows\odcUs3oGLlIc.exe
C:\Windows\odcUs3oGLlIc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 2216
  2⤵
  - Program crash
  PID:11036

C:\Windows\vCKUVOpRCjK80Zv.exe
C:\Windows\vCKUVOpRCjK80Zv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8340

C:\Windows\Hrvc16ElUo0p013.exe
C:\Windows\Hrvc16ElUo0p013.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8604

C:\Windows\5peUNR.exe
C:\Windows\5peUNR.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8856

C:\Windows\WH7ijXx6OvY.exe
C:\Windows\WH7ijXx6OvY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9108

C:\Windows\Ht73Z8.exe
C:\Windows\Ht73Z8.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9120

C:\Windows\ELPB427Gd38e.exe
C:\Windows\ELPB427Gd38e.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9476 -s 2096
  2⤵
  - Program crash
  PID:10208

C:\Windows\mp4oJIYlE4aIEO.exe
C:\Windows\mp4oJIYlE4aIEO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9744

C:\Windows\4yuMmAeGGO.exe
C:\Windows\4yuMmAeGGO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 9476 -ip 9476
1⤵
PID:10188

C:\Windows\xQ2rW87.exe
C:\Windows\xQ2rW87.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9728

C:\Windows\vvXg3I0j.exe
C:\Windows\vvXg3I0j.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10232

C:\Windows\etKNp.exe
C:\Windows\etKNp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10356

C:\Windows\iijhSSxbxTJQD.exe
C:\Windows\iijhSSxbxTJQD.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10608 -s 2200
  2⤵
  - Program crash
  PID:1688

C:\Windows\SM2UrbRHa4g.exe
C:\Windows\SM2UrbRHa4g.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:10856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10856 -s 2096
  2⤵
  - Program crash
  PID:10348

C:\Windows\kVwpdEED.exe
C:\Windows\kVwpdEED.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:11104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 11104 -s 2224
  2⤵
  - Program crash
  PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 10856 -ip 10856
1⤵
PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2640 -ip 2640
1⤵
PID:10956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 7080 -ip 7080
1⤵
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5048 -ip 5048
1⤵
PID:6808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 10608 -ip 10608
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6240 -ip 6240
1⤵
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6676 -ip 6676
1⤵
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 7692 -ip 7692
1⤵
PID:6468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 11104 -ip 11104
1⤵
PID:10352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5552 -ip 5552
1⤵
PID:8240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3948 -ip 3948
1⤵
PID:8208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0Fs02.exe

Path C:\Windows\0Fs02.exe
Size 804KB
SHA256 67af346c831693870e8a8138a87030fb754d6c4de638d35471d71d8dfc6275d1
MD5 24142e05eb5db582d067e9deb595de7c
SHA1 54e6c08d96ac2f4e55cc51c4cbe3dea84178a470
SHA512 4ae91470de77fc566e617793b106cec37f065c98c3d26a43af48cc96c84dee96f0b20f1116ae8b829db62fb9ffe315b2826fcd33756283a92b9c97cf5a96fa1d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nsoK
TLSH
T17A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0tCuic6rgY.exe

Path C:\Windows\0tCuic6rgY.exe
Size 804KB
SHA256 05789ac25ef80179f5eb35651194d2e3fd26f0851ac61b3ea9597fc9362a0363
MD5 f5ff8e60be5525e67b83fc64fff71f68
SHA1 8a7d806c6caad37ed03b903007551c56c13079e8
SHA512 fe282d71be106c346287daf6deef85a8cc4d418cc40b0e7efc2b79ee92f30f09bd3d0f1db4ba12fd58f00943dc3ff4a886afea6a587e8657486abbcd2376c45b
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouk:0NA1Yakeer5+nso7
TLSH
T10105A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1TnXw2TXLIxG.exe

Path C:\Windows\1TnXw2TXLIxG.exe
Size 804KB
SHA256 29a5d1fcd80918f4e11ea0da8f8de9b4062e5de793a95746fae5150243eb8167
MD5 e1e6cac30dc08aff0cc25cada2ca0ae9
SHA1 de1c8ade7d34d77cba93ee79086c4399c596f33a
SHA512 6b6b3fd9c8abf4f3df521977b5082c83efb1b259d06bf374e09591798f92ee4a61068260f53aae86402dea55d7cd878400aa7a5d836512cc64482906d3f3139e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nsow
TLSH
T13D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4yuMmAeGGO.exe

Path C:\Windows\4yuMmAeGGO.exe
Size 804KB
SHA256 c9631f5fa20cd93663dd2a5bcd7ed4d7ca742d92ef89a5d173799551400a146d
MD5 70bbefdd39c00dc88b693a4836b52897
SHA1 545d5bc13fc55c7131658f8e210d01242d140f68
SHA512 ed89686e64d5c2a4132bde48bfd683d85a1c11b79bb8c1b3144cb1c6dc7248652250e5b6283d8350224e78aba9bec42f6bba3d7bd129381bdec7cc08144bacc9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou5:0NA1Yakeer5+nsoQ
TLSH
T1D705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5peUNR.exe

Path C:\Windows\5peUNR.exe
Size 804KB
SHA256 54a167136e693a4262de1d16cc1ab6408be0ea41830cfe3f2a983bee65793227
MD5 30c4d6fe6bc86e576d60c168bd8b0457
SHA1 5acec4f40f9501f0a47a510bf1ea0f22c2d454fb
SHA512 443179d84c738f30ceddfda683c99c1f3db9dab5ddde482b98d4d8ffc03bb1384c347cd65ffc491ba8f8455d542bd8982a40a0011c4f62f4d426d7788248909e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouB:0NA1Yakeer5+nsoi
TLSH
T1C805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cQzJ6uVaXS.exe

Path C:\Windows\6cQzJ6uVaXS.exe
Size 804KB
SHA256 e487be93510d836a55797ef3ca76c92314f959f810a0eaea165abe10cc5002f9
MD5 da8de36361384e90a316921b341b788f
SHA1 985205a2a7be35afee89edccff2e158a3975b628
SHA512 85f27c0815840490fc6b316bdc50d999a85352bf226c3dc91d92ba06f4ae25341a12a96508e0f95c2196c31eb1e09367425b514d2fd041c920fd1bdf39ed896d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsoS
TLSH
T1B905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ELPB427Gd38e.exe

Path C:\Windows\ELPB427Gd38e.exe
Size 804KB
SHA256 fba355b7c6edd0913ef78c67d1c71ecec828be2afe1da5464752614f0df92acb
MD5 29d9582425024f6ee4892e7e5a9c3ff7
SHA1 e204840dbd8565ed6561006ec449d5c9ce7c5db1
SHA512 0bf511e3bad02ad5564011aff856416000a01b4a96f6ed23e354a03a1051fa324aceb0ae10e56755249cffd367680163be470cb68a3d2bb23b8c70dcab3292dc
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nsoX
TLSH
T1E005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hrvc16ElUo0p013.exe

Path C:\Windows\Hrvc16ElUo0p013.exe
Size 804KB
SHA256 aafa8e02c04601db81b603e0a1c7aabfeb508c1bc40913c0433d7032578264c7
MD5 9bb37e01fed4024348dbef5845870ba7
SHA1 ea4b736e68ba55306e30d7305186ad3563fa203c
SHA512 5b506d8bfd63c443af87517b3a4204cce18b639f26e8c57c1aa480a57a6b23b4a8ebc4b91b4ee7b825ec382cb69a75670b45cee25a52f132b27e65358dc0d1d4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouz:0NA1Yakeer5+nsoG
TLSH
T14D05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ht73Z8.exe

Path C:\Windows\Ht73Z8.exe
Size 804KB
SHA256 387b6878622bd450021e4898629ba1db0bf6442c012cdc6e64d491d2d3b0d5c7
MD5 bb519d29f406e42efee9bca21b670cc1
SHA1 4487fda94627a74fddd23e6e6610aa00b4534b85
SHA512 69c79dd7659aa333fe26a0feab6a388956aa48e1f1a869fd9531bb054b0d3780bcf102ff1b78c8cc188e4d547c9fe551b6b89fd6bdb12a8d482f10f984401359
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouo:0NA1Yakeer5+nsop
TLSH
T1F105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JHdXK.exe

Path C:\Windows\JHdXK.exe
Size 804KB
SHA256 f5ffdf5d35b9ddc3d7eb1636fead9aa379f78aa0d1798b6948371da15536b58d
MD5 e529f3d0654341e61fdd05d7df750e88
SHA1 629cee4844cd338485f10b4adf8c01f5213231eb
SHA512 6993d4bf3b85caa355e0edf22c4cc1a7e9c94c54f95d94a725dcefae892bce0cc1a204bf9173aaee695d9763b9697680798937a8838865f9ca84be873b58e2a9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQ:0NA1Yakeer5+nsoz
TLSH
T16C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JblmVp6y.exe

Path C:\Windows\JblmVp6y.exe
Size 804KB
SHA256 0b7f7158be57c2f4b38b422acca2232fa822ba4a427e87b7dc2521958dd44597
MD5 244d3d9a405d813242e4b78992c0f6a8
SHA1 21a56ac74d754dffe6fda8f6453a32c5b129a644
SHA512 4709abf502cb47b168d7ab64df078dba9b7f326212c964e505ec3eb32a8cdd0ddd20e4a2ca3ddcab328fb9edbac23584c9e3db8c10dc1af44661493a18add4f7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouG:0NA1Yakeer5+nsoP
TLSH
T11505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KgnsTey5.exe

Path C:\Windows\KgnsTey5.exe
Size 804KB
SHA256 d7cbaab1a8a622c98418947ba729d7be90c7d03d3b11f64a16da5429f25608e7
MD5 ab711266f2cf04959c751c133f302f08
SHA1 efce97e964f20a3628959a3cf81ab2787c295080
SHA512 1537767574825c4d7de5ddd4e60b63adba5c2fe92cb71b98be4e0acc47459484c274e96cb6baee38362d9ff4102dab3230796bc586bbcf726bf37c93ae92e8c0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouV:0NA1Yakeer5+nsoO
TLSH
T17005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WH7ijXx6OvY.exe

Path C:\Windows\WH7ijXx6OvY.exe
Size 804KB
SHA256 76b9f2f2f0b04ac95b210963381c53f4d172b69d4b7632c840833a9244bac768
MD5 8dfbaac44e6f4060f0ccaa1d06800b17
SHA1 f749d76ac7d02eece5ace3a3cecbce7719984557
SHA512 e95e30d693f98fda373850f93bc7bf73382a511b8cc12f1dbbbaf856849ddebecb76726b7e1f07cfa84272503f14a68045847157a1584a6e19088b14efcc75e1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouL:0NA1Yakeer5+nsoK
TLSH
T12905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZJ5zEhSVl.exe

Path C:\Windows\ZJ5zEhSVl.exe
Size 804KB
SHA256 ff22379f5b4c648669f60eb1705ff23e90d814607440f5765e882d0b81e7be21
MD5 9a9b37a0360293a96a9b086bc1b942d4
SHA1 6dec0255eebb3fadcdf9b7676f8146127968690e
SHA512 f54d6dbdee62fd696590ed135f24e3234c1cdc321ba38d941c4be6fafcc31ef397fb1fe21c2f4867f3fc1930c4367f6c76c70d5ec87c764d3aad01b8d97e79bd
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouP:0NA1Yakeer5+nsoU
TLSH
T18C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agWlX4vvqaFuSA.exe

Path C:\Windows\agWlX4vvqaFuSA.exe
Size 804KB
SHA256 4b5d7761e7edfbb2615fd5245f0faae8a757b6870a06429a7c4ca7c373717514
MD5 97a43197b7b79fd6e30fc88bbdc19089
SHA1 1105fa6ec7f6d7568658ebf08ee59e13c63410eb
SHA512 14c73a1de872fdcde2712cbf03a889103e841ce1119b4805123f2373d382d9649e184eeed9d58dbe7e9697ae140032b12e86b47100d01c35f84187ad5ae22f12
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nsoc
TLSH
T13805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1zdeiTVzvHIL.exe

Path C:\Windows\e1zdeiTVzvHIL.exe
Size 804KB
SHA256 5913ca0f5c71f60c98c89a0998c6e6778c7f0739180e2f4c25e7480fd6f8eefb
MD5 e49d71d5e73a10198f4f66dfa3d557c3
SHA1 74cb7808c32a279846a4a0d88089c09c3726b9aa
SHA512 5ab2e03b6866c5fc2c191229ef99c9050073faaa6dcf188ebc53eb45ed405deb8842c6248671ecc12736d206302b52b5a62030b5d6b0b8a0816bbe2e2620f6ed
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsok
TLSH
T14A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

etKNp.exe

Path C:\Windows\etKNp.exe
Size 804KB
SHA256 275e6620cd7e2d387317cf46bce21b2b197202b00815a3ea512c2da2eca1f3f3
MD5 466158b36782abf6f926df028eab543b
SHA1 8385199400ac3aa323e6af329312e5e55e1da049
SHA512 ff7c5b84cb901d5b377df4fb53eb710d1b283d322d0cc38f8f49c8ac0133146ab7d14260f47c9e1853fe71049a1f0694f4c2b39d2b3b9953cb9878ddf9d6a207
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nsox
TLSH
T18C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hFYuKsNyyFj.exe

Path C:\Windows\hFYuKsNyyFj.exe
Size 804KB
SHA256 d2f42498a2d5ef9110e8a0865282129098e2a9ddbfc2e0b3c8c7bf2a6b8bac52
MD5 d1d071a4b7a5374500e2eaa15ea29248
SHA1 ddc128b033056ea2f2b355e661b3feb0c36d723f
SHA512 0deda94b7b5bcb05e3d8a053c541dbc9f0ee3f241f8b8ac5aa8d6e6cfefbf93d2b218fee6cef0642412bffa9cc8254e8766555ceb4d692988841b6e75d8e04b4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouI:0NA1Yakeer5+nsoz
TLSH
T1F105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

huEvB77xEgwQ.exe

Path C:\Windows\huEvB77xEgwQ.exe
Size 804KB
SHA256 f0ccca493a502cde893d50ec8c3769c4e91658781c2ee64d0f5ea6654f3d541b
MD5 7c83d1bfb60bc25b8af7591c34cb1537
SHA1 f5f136ea26a0139de8fdb03ec7bcd4a7495d651e
SHA512 190b24c04868ead680eacf8ccaf15d89a1d4a648cdf2180dd189714e1fede91a6acb2dbb590c42275473e7ac9303a3f2aff415a2039256692942870be62b57bd
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nsoV
TLSH
T16805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ibFSvCaUReAv9.exe

Path C:\Windows\ibFSvCaUReAv9.exe
Size 804KB
SHA256 27d2479895263e0f2410ec83c367d88827f726bce775d332a54cbc89cf8303a0
MD5 c6f767ef4ca896739143989538395eed
SHA1 bf481101ea74eea786dd4af0be1c60e3a9103322
SHA512 85bdc39760e9478f7f269526a548adae63b6d4f1ad77e6aaa75f30f3aab85173d73260feb78711a79eea4191de4dc23a3596a3c71be8973ff4a513cc5dec60e2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouE:0NA1Yakeer5+nsop
TLSH
T11705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iijhSSxbxTJQD.exe

Path C:\Windows\iijhSSxbxTJQD.exe
Size 804KB
SHA256 708f4d1924597f9ce098a872c2df2ad0c96f296456500260e931f8029ca204b6
MD5 46b77f39d385c3a80088de3a70b9e34c
SHA1 fd698a4710a527727e49bd4efc425b6f080ab409
SHA512 19b87c405f3cb5d77edd0806bd60e5c584a0b6a282a7a0628d14e885f4ee118edb932f8c0436894efaa570f5803606d6fe7b6c7f7e1aca43e9313cba5c1ccfb8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou4:0NA1Yakeer5+nsoT
TLSH
T18005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mp4oJIYlE4aIEO.exe

Path C:\Windows\mp4oJIYlE4aIEO.exe
Size 804KB
SHA256 8264e3943444cd8741236115756220280d968226d2ea4bcb47b25f5ea888b903
MD5 bde9d99210290814d92d53a78730f201
SHA1 8ce038de1b391f8c93669ef35afe24097161ae66
SHA512 3f02cb31406a5d65dd2338f3178be7d31851ecff344b32a1b62deb9a7429c0fda3f9165a1ae5d0804d9049267b2f2de10f5ded8556884cc3cdd63fc25bbacca2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouY:0NA1Yakeer5+nsov
TLSH
T10805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvjVjKmIzsr.exe

Path C:\Windows\nvjVjKmIzsr.exe
Size 804KB
SHA256 1dcbf8d9ddbbe5cccc3890279c9177b188f359b1695db869041cacd6a376b075
MD5 e81dbb655980c8a53a65b97bfbe2ce7f
SHA1 0df4696a4cafe029c69ec5b44d33f7abe9b59fa8
SHA512 96d62c31f74da8088670f7525ce919699f5e9d242fd63aacd6804cc1a648eefe7a07823e042fb2940834ff8583465037ac6de21caadf6d8bec2663921eb8f2d4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsok
TLSH
T1C205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o6wVFbk2MM09LJd.exe

Path C:\Windows\o6wVFbk2MM09LJd.exe
Size 804KB
SHA256 9a79e66c8c7366a577a9460fd1021c19253cbc423702ecbd104d9a92512e9cb5
MD5 2ed651b9cbfd1c9c519055f002381c44
SHA1 98982533ad0c979b897eff8019d70ac7e8de7cb7
SHA512 9156f42cf59fe40088463b731b274885013e287eb45879defff7ccac76436f4de823b172a115e98a9c95c94265bb6598e0f53f84cba972977d3cc7276e68ab1c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouf:0NA1Yakeer5+nsoW
TLSH
T1ED05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oIvp4.exe

Path C:\Windows\oIvp4.exe
Size 804KB
SHA256 2a614207ff45d3b2d11d3ae172e6ab0fccde3b7af69e3b63b6eac1a7a18d43dc
MD5 a5b0cf2ae9e5e6a5ba92b6a9eb919951
SHA1 99f24fadc515c7a3acbf8a22e253b5e9dc02600f
SHA512 c25553de6a4f00942e1f6e1bdb29f2ee472439498424fd9fc609ea6a81289e045d5ae480ffa94aa1cbb718dc1c0810707b5ba8bbee0d3a9c8abfcdb50ebbbac7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou2:0NA1Yakeer5+nso1
TLSH
T1E805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

odcUs3oGLlIc.exe

Path C:\Windows\odcUs3oGLlIc.exe
Size 804KB
SHA256 db6d96eeadde70bb96a90e10299ee887b2829be549ab3f53545b6d31aa369839
MD5 9b13baa4298b4c28e1836c8a4b53013e
SHA1 8f3eb36260e0820d07c8bae2481a18f4fb31b523
SHA512 9914f7dca20a077b65beb95949059a40566b21cf4a54f74669604c8351d39f6edecf791e099e59094510de35d49383a601e9b961b8f36670a708d55f21e526ff
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nsoK
TLSH
T11B05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vCKUVOpRCjK80Zv.exe

Path C:\Windows\vCKUVOpRCjK80Zv.exe
Size 804KB
SHA256 792bf81902fe1e345d00d344a1bc5c660b5d76b4d721d06b7469d1265b081216
MD5 7f2016b6e5d67929017c4a79f1092e20
SHA1 6f5253fb5ff78b9297282dd6a1cd63c736457fd7
SHA512 ca9a7892bd25d59bf1ced4fc926b977b8e34cfbbea3f4faf6320d21819b4d5e376f84d9f3215ff77894650ccea4c38090b7741961377e34775983b02e0629b36
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouz:0NA1Yakeer5+nsoS
TLSH
T13F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vTLKWoH.exe

Path C:\Windows\vTLKWoH.exe
Size 804KB
SHA256 61f90638e483a77b69394b8e6d10a76b008b813a66b32b5481f4429b4fb1e0f3
MD5 a2bbcb8d8f953e8ed30810684ed02141
SHA1 cbf6c453bced6e218744d5db686bb52a150ea47c
SHA512 65e56943877246dfd3ff07288617fe6ef019f8dedcd1334cfe7f7b83eb9d48b7128364eaacca61b1f3e62ae56f27d7ff5205da80c67cd0065e598062a11c34b1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouQ:0NA1Yakeer5+nsoV
TLSH
T1E305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vvXg3I0j.exe

Path C:\Windows\vvXg3I0j.exe
Size 804KB
SHA256 48cc7c1c6ec204345e44052781d0482ad7d9921a7917e6b3fb7d337803868e3a
MD5 11f55332c9668ceafabff9603e3ae594
SHA1 0d29abb9074d93844242d8e7d819effede93e991
SHA512 8795abe7e4d06c7ead7aa547bc3368dacc46e6b3da82ae9cd149d1f2c45be94a614179420139723009f9b5e456f8eb643ebe3d9148054dc0297d6ac498ebb0a1
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouY:0NA1Yakeer5+nsoh
TLSH
T10205A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wa5QmvC.exe

Path C:\Windows\wa5QmvC.exe
Size 804KB
SHA256 70ce8198d4289a9433935373a7a4c51aad332a1300c7291097a898671b670be6
MD5 769c1af905ed013fec7d410960ba5969
SHA1 8d22e0ea4ec8f0c456f60fbd427f88bade3bd662
SHA512 e9bb0e7712ba64deef1de559550774a090e298234ac9d1dd4b7a3b2a012e264e713143b33f0e4c6574fa99451b3a036ad224985cc6cdba96856cd5b3840b0f4d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouG:0NA1Yakeer5+nsoV
TLSH
T18405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xQ2rW87.exe

Path C:\Windows\xQ2rW87.exe
Size 804KB
SHA256 1d9ef0d315a02204264a15b285a5982cb4a6ab3b343c0fb44e620c34b2eeaded
MD5 3638d6ab3ae1e581d54b7c8d8d6944bb
SHA1 755adea44d3460efac454b4d01b4154c38e5fd8a
SHA512 091892cd4b0c2d2c2076ac595f992cc0ab36fc41f9f4b6f5a9bed3b2f1c1f5cfabc7a727b8d27ab8ffb311363c821708a2e6231027c78a4dc5cdda16ec98b4b9
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoun:0NA1Yakeer5+nsoE
TLSH
T16405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yoEQtUhwpvUaV.exe

Path C:\Windows\yoEQtUhwpvUaV.exe
Size 804KB
SHA256 4d765d8d247c81c0509a09e78f7c6883d0f77c560789a0a83b6cbecafbaf8e9d
MD5 e16dfd63bcd42f7bed06b2b49add1c7b
SHA1 6dd80fb43b9c736e8bdcf3067f7b2b83eaaea80b
SHA512 251de884307a25c6c48b43bf502ee26132c0b2970f2faa3e4bd1984c472555751b271556a6004ba695806cec0161fbebbc2319ff1477d626cc537f704fd64f3f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouU:0NA1Yakeer5+nso7
TLSH
T11805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads