3fe2d2a1fc19d29fd2ddd034ad28f8b10aead5dc7aef160b79c837729462e17d

Analysis

max time kernel
134s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_25e54ae912b518376eee693da7a54da3_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample261011-xehtjseh63
SHA256 3fe2d2a1fc19d29fd2ddd034ad28f8b10aead5dc7aef160b79c837729462e17d
MD5 25e54ae912b518376eee693da7a54da3
SHA1 ab88a93e9e7f8ca77f3bf2def2a72debf1eb3c56
SHA512 82e229976b094cd01463130a53fad78f77816406b6b5c758860ea31215a9208d55cb9940eb0d0a1079c9137b34ad4c3ed425fee0a22609afb0d84741e7e734a6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoub:0NA1Yakeer5+nsoM
TLSH
T1ED05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (1073) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 9 IoCs

pid	Process
3684	7zFqWELXg.exe
3736	GmoGzIZ2Fkd.exe
5780	TDZT69.exe
3468	zX247To.exe
1616	Nz9V0TTDHP.exe
5980	dAMvhkld7eoLZ2J.exe
1296	p6lQoRtoIdAoUV.exe
860	yW0tqlIiYvWLTsZ.exe
2600	yLq7G0kD2wjSn.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NEOWATCHLOG = "C:\\Windows\\GmoGzIZ2Fkd.exe"	7zFqWELXg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVPCC = "C:\\Windows\\TDZT69.exe"	GmoGzIZ2Fkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DVP95 = "C:\\Windows\\dAMvhkld7eoLZ2J.exe"	Nz9V0TTDHP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NVSVC32 = "C:\\Windows\\p6lQoRtoIdAoUV.exe"	dAMvhkld7eoLZ2J.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ANTS = "C:\\Windows\\yLq7G0kD2wjSn.exe"	yW0tqlIiYvWLTsZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EFPEADM = "C:\\Windows\\zX247To.exe"	TDZT69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWEEP95 = "C:\\Windows\\Nz9V0TTDHP.exe"	zX247To.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DVP95 = "C:\\Windows\\yW0tqlIiYvWLTsZ.exe"	p6lQoRtoIdAoUV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RAPAPP = "C:\\Windows\\7zFqWELXg.exe"	2026-10-10_25e54ae912b518376eee693da7a54da3_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\7zFqWELXg.exe	2026-10-10_25e54ae912b518376eee693da7a54da3_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\GmoGzIZ2Fkd.exe	7zFqWELXg.exe
File created	C:\Windows\zX247To.exe	TDZT69.exe
File created	C:\Windows\dAMvhkld7eoLZ2J.exe	Nz9V0TTDHP.exe
File opened for modification	C:\Windows\p6lQoRtoIdAoUV.exe	dAMvhkld7eoLZ2J.exe
File created	C:\Windows\yW0tqlIiYvWLTsZ.exe	p6lQoRtoIdAoUV.exe
File created	C:\Windows\yLq7G0kD2wjSn.exe	yW0tqlIiYvWLTsZ.exe
File opened for modification	C:\Windows\zX247To.exe	TDZT69.exe
File opened for modification	C:\Windows\dAMvhkld7eoLZ2J.exe	Nz9V0TTDHP.exe
File created	C:\Windows\7zFqWELXg.exe	2026-10-10_25e54ae912b518376eee693da7a54da3_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\GmoGzIZ2Fkd.exe	7zFqWELXg.exe
File created	C:\Windows\TDZT69.exe	GmoGzIZ2Fkd.exe
File opened for modification	C:\Windows\TDZT69.exe	GmoGzIZ2Fkd.exe
File opened for modification	C:\Windows\yW0tqlIiYvWLTsZ.exe	p6lQoRtoIdAoUV.exe
File opened for modification	C:\Windows\yLq7G0kD2wjSn.exe	yW0tqlIiYvWLTsZ.exe
File created	C:\Windows\Nz9V0TTDHP.exe	zX247To.exe
File opened for modification	C:\Windows\Nz9V0TTDHP.exe	zX247To.exe
File created	C:\Windows\p6lQoRtoIdAoUV.exe	dAMvhkld7eoLZ2J.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
6744	5780	WerFault.exe	94
6880	860	WerFault.exe	104

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-10_25e54ae912b518376eee693da7a54da3_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-10_25e54ae912b518376eee693da7a54da3_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dAMvhkld7eoLZ2J.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	p6lQoRtoIdAoUV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yW0tqlIiYvWLTsZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yLq7G0kD2wjSn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_25e54ae912b518376eee693da7a54da3_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TDZT69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zX247To.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nz9V0TTDHP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zFqWELXg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GmoGzIZ2Fkd.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-10_25e54ae912b518376eee693da7a54da3_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_25e54ae912b518376eee693da7a54da3_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3000

C:\Windows\7zFqWELXg.exe
C:\Windows\7zFqWELXg.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3684

C:\Windows\GmoGzIZ2Fkd.exe
C:\Windows\GmoGzIZ2Fkd.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3736

C:\Windows\TDZT69.exe
C:\Windows\TDZT69.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 2196
  2⤵
  - Program crash
  PID:6744

C:\Windows\zX247To.exe
C:\Windows\zX247To.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3468

C:\Windows\Nz9V0TTDHP.exe
C:\Windows\Nz9V0TTDHP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1616

C:\Windows\dAMvhkld7eoLZ2J.exe
C:\Windows\dAMvhkld7eoLZ2J.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5980

C:\Windows\p6lQoRtoIdAoUV.exe
C:\Windows\p6lQoRtoIdAoUV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1296

C:\Windows\yW0tqlIiYvWLTsZ.exe
C:\Windows\yW0tqlIiYvWLTsZ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 2284
  2⤵
  - Program crash
  PID:6880

C:\Windows\yLq7G0kD2wjSn.exe
C:\Windows\yLq7G0kD2wjSn.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5780 -ip 5780
1⤵
PID:6720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 860 -ip 860
1⤵
PID:6860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zFqWELXg.exe

Path C:\Windows\7zFqWELXg.exe
Size 804KB
SHA256 b2e4963d74aa6fa0d8ad82ba567d9df21134561b9faa3f2eec0badd975b2b2ec
MD5 225ecdf7eabae4308399e807a9b612ad
SHA1 646d6ccef717fa46da89fa25e6046a19466ae9e1
SHA512 491f002e76b6aa2592a6f178013f9db19282a1cff6e868ec2d2acfe1d30d09f6d59d94f87470c471c553d5b838502d7b3fa53b54c9d3d66fb8426997912d7cf7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouo:0NA1Yakeer5+nsoF
TLSH
T16A05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GmoGzIZ2Fkd.exe

Path C:\Windows\GmoGzIZ2Fkd.exe
Size 804KB
SHA256 535e508855c2d3d511d9831590f2c8d3bf77246e24d77a239cf7210b8a3ae25c
MD5 fb49e237fa5118cc22356f0c40cdbec8
SHA1 fa6acf3756d345a51f2e34fee039225dd73f82c1
SHA512 e9034383460a3ac3eef4f9f737cd0b86a1c7cb9982747412860508b88b194d068e7aee0fc121f10e790399ac6cd66ce6940bb57060a25e5bc34cde731c74ee57
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouy:0NA1Yakeer5+nsoX
TLSH
T1CB05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nz9V0TTDHP.exe

Path C:\Windows\Nz9V0TTDHP.exe
Size 804KB
SHA256 e3f73b55bed8a87ad3b9d74c3996a17d5815a225f7f873fbfc342b7b4de5d331
MD5 026138eaecfa87d78231cb092bd3f65c
SHA1 965884c595b5e8db64f6ba55509042f9db720acc
SHA512 18e927ae969ddcfd5263dc8957ac570acbf8d042dc830a0405753f9f6b861e9207e856e6faaca258a8075ad782cb59d87417f190feaefe5111340b5f2b02bef6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nsod
TLSH
T1DA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TDZT69.exe

Path C:\Windows\TDZT69.exe
Size 804KB
SHA256 ee2f43045750c7428c37ac3af12de09aa4b5340f5907cb3e01587dc86840b35a
MD5 459e53eb5f1790bd8369c8a52c043e20
SHA1 331d96b9c4bd5eb9338fb95b1f1efcec319446b6
SHA512 c9678a4bd7579a8b6177c5611d8d66841549e058662ff8a5b2c0dfae194abbd5e9bfb885e0ab22a360b60c3b1646f76f073ab9356ba8f0c3924f59b305537c6d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou0:0NA1Yakeer5+nsob
TLSH
T19505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dAMvhkld7eoLZ2J.exe

Path C:\Windows\dAMvhkld7eoLZ2J.exe
Size 804KB
SHA256 257f5316e96d28fb03d563f40beb866de9ba9a23848176820c6c21b70c6444bc
MD5 4e54cb55ebbf67c3cdfd5aad0cc03b6e
SHA1 d7fa59e7c76a5b1b32e516eaee8f82f452fc5f03
SHA512 b4a37d798767fdae3f741943d21540aedeed8a91b3446f0b13eadbf4d297f1d9cb5f5c0fe9b853f5457d2f6069565fd3ba7f05dbe2cf4061417d3d2012b38cb8
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouv:0NA1Yakeer5+nso4
TLSH
T1D805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p6lQoRtoIdAoUV.exe

Path C:\Windows\p6lQoRtoIdAoUV.exe
Size 804KB
SHA256 5935805bacd4ec0bac265d66940635e46b81f37569f3cf23d763bd740c51f01a
MD5 c8ebea87901aa56f04b3cb821f66caaf
SHA1 15073cc093e05e517cd9e947dbd0d5c2f5fe1139
SHA512 3202fca9f4e90171fa1a980c54f26a01f61d35b3271412be8a6051a4262cef05907df09f0683c7899958b6c560ad4b06a32b84e7862d73faadd552ff8e10f019
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouW:0NA1Yakeer5+nsoj
TLSH
T1D405A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yLq7G0kD2wjSn.exe

Path C:\Windows\yLq7G0kD2wjSn.exe
Size 804KB
SHA256 f06c0c63e886fcc57c411dce1341036ed11a627cecbd3f72b20646548d2b626b
MD5 51a28f9267550eefed19866ab4a44d6a
SHA1 ad7636d743a7e1bdd229f3604bb4577d15ec5d87
SHA512 0548700178b70a465da957d8260140d39f7821d7c89e8ae1fd16580934d4ca425e3898a1f9cdb44b4ce0828ddcff8b56c116066cec87434c9f201dbf15c6e97c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nso5
TLSH
T18305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yW0tqlIiYvWLTsZ.exe

Path C:\Windows\yW0tqlIiYvWLTsZ.exe
Size 804KB
SHA256 a3fabfc5373a54c06483e81371e5bdf345b4ebbc3d55aacdf1f3c07a936cc68b
MD5 ad7a0784ea8a4394f7aa8379464d274d
SHA1 7975a078194ca4b68d90dfbe39885449cdceb450
SHA512 86d1f90cfc17d7b5cb333f1626a1f2b2c74ff975e703ded6f908ebc2d1f222672ff73cbbfce869d010dfb0051057e1fe9173ea5179f3a33c9d15b8667f01a201
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouf:0NA1Yakeer5+nsoO
TLSH
T1F505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zX247To.exe

Path C:\Windows\zX247To.exe
Size 804KB
SHA256 e0c8774de21ff343b37f34bbd1d925412fab38ef68b63a40be28d75a286e6a85
MD5 7e897217e0af62fd5c095e0201d26ed3
SHA1 c7f493eba3a625c0dd9235684129822678ef27a0
SHA512 c13669de24351978374c290d8962662f7a7dc20e1fd7f2124ecdd5b4f9d5c5df60ff074a9369796cfc149421ea13ca6caec09377908cf6d9c4d2c2c6a28d1c34
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouD:0NA1Yakeer5+nsoG
TLSH
T1F605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads