9663c159bfdbcd72dbb5c9efde92ec3f47cf48c384ed9517d0cf4d9c95354825

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-17_947c02b55dd1c882bda57b87c9ce916e_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample261018-3vsatabz61
SHA256 9663c159bfdbcd72dbb5c9efde92ec3f47cf48c384ed9517d0cf4d9c95354825
MD5 947c02b55dd1c882bda57b87c9ce916e
SHA1 f96586b308dae5779ce084759e8fdd49636f60de
SHA512 1b8724c552fcdbb425dda7cdf22908105f7c7b61555655e0d89b45703168a5e1ff1922e3e9ca5981112cdd4e854bd0a0e064cef4a664f2cfeb62bbc71627bfd6
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouA:0NA1Yakeer5+nsoF
TLSH
T19E05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (1810) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 19 IoCs

pid	Process
1692	GtKwG.exe
2244	9QaG6G9pcOaGT.exe
2412	nutEXadzeYMCeH.exe
1796	BcFnyuvo3.exe
5952	Bjd8JR48j.exe
2276	awU7GgzMuO.exe
6052	4Bzum.exe
3680	noSktXZhwcqV.exe
5784	ww5Jstrm5.exe
4588	PWWYZIsBpLK.exe
4316	qMQJHuSwQH.exe
3156	ylSbHpOkjuEBP.exe
6372	NZSagl.exe
6672	QzyFq0F2Qz.exe
6920	ogXw0FV07VxE4Ub.exe
1244	4qzwkxp.exe
3844	2ZOjHwzHdyN5.exe
3952	qWbaTJ.exe
7220	BtJOvRq9BVz.exe

Adds Run key to start application 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PERSFW = "C:\\Windows\\9QaG6G9pcOaGT.exe"	GtKwG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MONITOR = "C:\\Windows\\ww5Jstrm5.exe"	noSktXZhwcqV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LOOKOUT = "C:\\Windows\\QzyFq0F2Qz.exe"	NZSagl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVW32 = "C:\\Windows\\Bjd8JR48j.exe"	BcFnyuvo3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SPYXX = "C:\\Windows\\BtJOvRq9BVz.exe"	qWbaTJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SWNETSUP = "C:\\Windows\\nutEXadzeYMCeH.exe"	9QaG6G9pcOaGT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CPDCLNT = "C:\\Windows\\awU7GgzMuO.exe"	Bjd8JR48j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVXQUAR = "C:\\Windows\\PWWYZIsBpLK.exe"	ww5Jstrm5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCANPM = "C:\\Windows\\qMQJHuSwQH.exe"	PWWYZIsBpLK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DEFSCANGUI = "C:\\Windows\\NZSagl.exe"	ylSbHpOkjuEBP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SPHINX = "C:\\Windows\\4qzwkxp.exe"	ogXw0FV07VxE4Ub.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RESCUE = "C:\\Windows\\2ZOjHwzHdyN5.exe"	4qzwkxp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CMGRDIAN = "C:\\Windows\\qWbaTJ.exe"	2ZOjHwzHdyN5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVXW = "C:\\Windows\\BcFnyuvo3.exe"	nutEXadzeYMCeH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FINDVIRU = "C:\\Windows\\4Bzum.exe"	awU7GgzMuO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NAVW32 = "C:\\Windows\\noSktXZhwcqV.exe"	4Bzum.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MCVSRTE = "C:\\Windows\\ylSbHpOkjuEBP.exe"	qMQJHuSwQH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LDPROMEN = "C:\\Windows\\ogXw0FV07VxE4Ub.exe"	QzyFq0F2Qz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AVKPOP = "C:\\Windows\\GtKwG.exe"	2026-10-17_947c02b55dd1c882bda57b87c9ce916e_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

Drops file in Windows directory 38 IoCs

description	ioc	Process
File created	C:\Windows\9QaG6G9pcOaGT.exe	GtKwG.exe
File opened for modification	C:\Windows\BcFnyuvo3.exe	nutEXadzeYMCeH.exe
File created	C:\Windows\4Bzum.exe	awU7GgzMuO.exe
File opened for modification	C:\Windows\2ZOjHwzHdyN5.exe	4qzwkxp.exe
File opened for modification	C:\Windows\BtJOvRq9BVz.exe	qWbaTJ.exe
File opened for modification	C:\Windows\9QaG6G9pcOaGT.exe	GtKwG.exe
File created	C:\Windows\ylSbHpOkjuEBP.exe	qMQJHuSwQH.exe
File opened for modification	C:\Windows\ylSbHpOkjuEBP.exe	qMQJHuSwQH.exe
File opened for modification	C:\Windows\QzyFq0F2Qz.exe	NZSagl.exe
File created	C:\Windows\qWbaTJ.exe	2ZOjHwzHdyN5.exe
File opened for modification	C:\Windows\qWbaTJ.exe	2ZOjHwzHdyN5.exe
File opened for modification	C:\Windows\Bjd8JR48j.exe	BcFnyuvo3.exe
File opened for modification	C:\Windows\awU7GgzMuO.exe	Bjd8JR48j.exe
File opened for modification	C:\Windows\ww5Jstrm5.exe	noSktXZhwcqV.exe
File opened for modification	C:\Windows\PWWYZIsBpLK.exe	ww5Jstrm5.exe
File created	C:\Windows\nutEXadzeYMCeH.exe	9QaG6G9pcOaGT.exe
File created	C:\Windows\BcFnyuvo3.exe	nutEXadzeYMCeH.exe
File opened for modification	C:\Windows\4Bzum.exe	awU7GgzMuO.exe
File created	C:\Windows\qMQJHuSwQH.exe	PWWYZIsBpLK.exe
File opened for modification	C:\Windows\GtKwG.exe	2026-10-17_947c02b55dd1c882bda57b87c9ce916e_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\noSktXZhwcqV.exe	4Bzum.exe
File created	C:\Windows\ww5Jstrm5.exe	noSktXZhwcqV.exe
File created	C:\Windows\PWWYZIsBpLK.exe	ww5Jstrm5.exe
File opened for modification	C:\Windows\qMQJHuSwQH.exe	PWWYZIsBpLK.exe
File created	C:\Windows\2ZOjHwzHdyN5.exe	4qzwkxp.exe
File opened for modification	C:\Windows\nutEXadzeYMCeH.exe	9QaG6G9pcOaGT.exe
File created	C:\Windows\Bjd8JR48j.exe	BcFnyuvo3.exe
File opened for modification	C:\Windows\NZSagl.exe	ylSbHpOkjuEBP.exe
File opened for modification	C:\Windows\ogXw0FV07VxE4Ub.exe	QzyFq0F2Qz.exe
File created	C:\Windows\4qzwkxp.exe	ogXw0FV07VxE4Ub.exe
File created	C:\Windows\NZSagl.exe	ylSbHpOkjuEBP.exe
File created	C:\Windows\ogXw0FV07VxE4Ub.exe	QzyFq0F2Qz.exe
File created	C:\Windows\BtJOvRq9BVz.exe	qWbaTJ.exe
File created	C:\Windows\GtKwG.exe	2026-10-17_947c02b55dd1c882bda57b87c9ce916e_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File created	C:\Windows\awU7GgzMuO.exe	Bjd8JR48j.exe
File opened for modification	C:\Windows\noSktXZhwcqV.exe	4Bzum.exe
File opened for modification	C:\Windows\4qzwkxp.exe	ogXw0FV07VxE4Ub.exe
File created	C:\Windows\QzyFq0F2Qz.exe	NZSagl.exe

Program crash 10 IoCs

pid	pid_target	Process	procid_target
5168	828	WerFault.exe	89
1532	1692	WerFault.exe	91
5032	1796	WerFault.exe	102
6276	4588	WerFault.exe	116
6576	4316	WerFault.exe	118
7748	2244	WerFault.exe	93
7828	2276	WerFault.exe	106
7840	3680	WerFault.exe	112
3172	5784	WerFault.exe	114
1432	1244	WerFault.exe	132

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-17_947c02b55dd1c882bda57b87c9ce916e_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-17_947c02b55dd1c882bda57b87c9ce916e_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BcFnyuvo3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BcFnyuvo3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	4Bzum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	4Bzum.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GtKwG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nutEXadzeYMCeH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BcFnyuvo3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NZSagl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ogXw0FV07VxE4Ub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qWbaTJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PWWYZIsBpLK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QzyFq0F2Qz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BtJOvRq9BVz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjd8JR48j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	awU7GgzMuO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4Bzum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	noSktXZhwcqV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ww5Jstrm5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4qzwkxp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-17_947c02b55dd1c882bda57b87c9ce916e_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9QaG6G9pcOaGT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qMQJHuSwQH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ylSbHpOkjuEBP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2ZOjHwzHdyN5.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-17_947c02b55dd1c882bda57b87c9ce916e_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-17_947c02b55dd1c882bda57b87c9ce916e_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 2164
  2⤵
  - Program crash
  PID:5168

C:\Windows\GtKwG.exe
C:\Windows\GtKwG.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 2100
  2⤵
  - Program crash
  PID:1532

C:\Windows\9QaG6G9pcOaGT.exe
C:\Windows\9QaG6G9pcOaGT.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 2196
  2⤵
  - Program crash
  PID:7748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 828 -ip 828
1⤵
PID:3912

C:\Windows\nutEXadzeYMCeH.exe
C:\Windows\nutEXadzeYMCeH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1692 -ip 1692
1⤵
PID:5016

C:\Windows\BcFnyuvo3.exe
C:\Windows\BcFnyuvo3.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 2200
  2⤵
  - Program crash
  PID:5032

C:\Windows\Bjd8JR48j.exe
C:\Windows\Bjd8JR48j.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5952

C:\Windows\awU7GgzMuO.exe
C:\Windows\awU7GgzMuO.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 2196
  2⤵
  - Program crash
  PID:7828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1796 -ip 1796
1⤵
PID:2536

C:\Windows\4Bzum.exe
C:\Windows\4Bzum.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:6052

C:\Windows\noSktXZhwcqV.exe
C:\Windows\noSktXZhwcqV.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 2416
  2⤵
  - Program crash
  PID:7840

C:\Windows\ww5Jstrm5.exe
C:\Windows\ww5Jstrm5.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 2420
  2⤵
  - Program crash
  PID:3172

C:\Windows\PWWYZIsBpLK.exe
C:\Windows\PWWYZIsBpLK.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 2092
  2⤵
  - Program crash
  PID:6276

C:\Windows\qMQJHuSwQH.exe
C:\Windows\qMQJHuSwQH.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 2096
  2⤵
  - Program crash
  PID:6576

C:\Windows\ylSbHpOkjuEBP.exe
C:\Windows\ylSbHpOkjuEBP.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4588 -ip 4588
1⤵
PID:6256

C:\Windows\NZSagl.exe
C:\Windows\NZSagl.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4316 -ip 4316
1⤵
PID:6556

C:\Windows\QzyFq0F2Qz.exe
C:\Windows\QzyFq0F2Qz.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6672

C:\Windows\ogXw0FV07VxE4Ub.exe
C:\Windows\ogXw0FV07VxE4Ub.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6920

C:\Windows\4qzwkxp.exe
C:\Windows\4qzwkxp.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 2416
  2⤵
  - Program crash
  PID:1432

C:\Windows\2ZOjHwzHdyN5.exe
C:\Windows\2ZOjHwzHdyN5.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3844

C:\Windows\qWbaTJ.exe
C:\Windows\qWbaTJ.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3952

C:\Windows\BtJOvRq9BVz.exe
C:\Windows\BtJOvRq9BVz.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2244 -ip 2244
1⤵
PID:7728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2276 -ip 2276
1⤵
PID:7808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 164 -p 3680 -ip 3680
1⤵
PID:7212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5784 -ip 5784
1⤵
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1244 -ip 1244
1⤵
PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2ZOjHwzHdyN5.exe

Path C:\Windows\2ZOjHwzHdyN5.exe
Size 804KB
SHA256 1bc127e94629e0ad79833b3fb5917cd69954fd1008d07cd6026a24b5f5f8a2bd
MD5 3c1975187f8586c324b45cef9b912452
SHA1 59ea6f4a267f8985d157bc3fea7c91b64d639646
SHA512 3d71660a253466683a1b755ac0c69af396adca0b7c64b44ce8042363dc8b87202e75a7e4176645b2292e1f1a449282dc43391a77960178114c324642b77af673
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nsoY
TLSH
T16C05A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4Bzum.exe

Path C:\Windows\4Bzum.exe
Size 804KB
SHA256 12745fc3514fcb3ddaf6dabb99fb4abc1ada3f30173086803112800ff54a74df
MD5 1350ab74103802fa61b3e77726dc0471
SHA1 f3490740d6ba8fdbe02ae7fd2708d2501f82d49f
SHA512 1bea054cd336b19f61f140173f06255f9f358b8faa3a09a475803a64d7cb5c3a31ab800b208cae70c807de14d36826e9ab8dfaf3e3670c347d1ff6e415e43d09
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou3:0NA1Yakeer5+nsoQ
TLSH
T17105A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4qzwkxp.exe

Path C:\Windows\4qzwkxp.exe
Size 804KB
SHA256 289a1d736d49e15fe67db64519739b71ffc3a46babb11b256eedda342beb6067
MD5 f84dd92be06d9dba5eeb53c42b1f2c79
SHA1 8b450f0c0f35f813904d5fe9cd41f7a742b2e344
SHA512 c28f4dc965ff75164a51bc49dadf2df3cb8c68f40effb2c2dbaaa63e984db02bae2040b0aadbffb3857aa958daedc1bb46a2c1b8e790742370df846e883cb77d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouu:0NA1Yakeer5+nsox
TLSH
T10905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9QaG6G9pcOaGT.exe

Path C:\Windows\9QaG6G9pcOaGT.exe
Size 804KB
SHA256 e523d6939c5d32cf2050dbd065cf895d8960161b0de27981e2b123d092d9f0e4
MD5 9f9d34c33edbcf50dbcb260f9571b403
SHA1 69897ffeb893f3149d92dcea80525c2b66b0cf95
SHA512 4d6ed9e6b074e6223eb54c3fcbc04373c428f2b2dea1ccd072619551f07e9847b51b16e22a4a537528429ed781c457a86cf4d33ca0763ae993d3c15bb434e125
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou3:0NA1Yakeer5+nso2
TLSH
T15705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BcFnyuvo3.exe

Path C:\Windows\BcFnyuvo3.exe
Size 804KB
SHA256 47284d64c9c7e2336bdcfecddaedcb7e78e904751fb8da41f8257d2418fe8912
MD5 103f50ae63961a7994380140bc90fd00
SHA1 f9d80899d4e3c2eda7ac81711a3d8c09aa1d0b42
SHA512 39a2eaa2be796d9521ce10d40f21788a7dd838d1747f9103b68ace88eb1d34265178cf434a0f6b6bd531384b2a72c4d0854c4c3b5d441e518cd53458cbfbb23f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouh:0NA1Yakeer5+nso0
TLSH
T10005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bjd8JR48j.exe

Path C:\Windows\Bjd8JR48j.exe
Size 804KB
SHA256 11b4e294853701c84a34fc7aa1e404abd9de5cd658db69ddaea959ae5ec70fff
MD5 eb68b385efbafdee91be06d4f6e766fc
SHA1 c292e074b11a82887d0d1883171a4beea375a4b5
SHA512 7bf027a0e754fd67df672ec375bfd582b501de1c92439cacbb576d02194f937ee5c1a6d0f2ed3c323ccaf3296ea2bd528968c59bf2ec4aa703a3b8f6ee528c47
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouE:0NA1Yakeer5+nsoP
TLSH
T1BE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BtJOvRq9BVz.exe

Path C:\Windows\BtJOvRq9BVz.exe
Size 804KB
SHA256 6f877c1f6f549ede9a78d620f425a1f3713d3fc70951aafbe5fc0ed9a7f192bd
MD5 63c67a089dd162b14aba4242d726a918
SHA1 cb0276d4cb33cf0bc3fe8140194253390962cb76
SHA512 ff88b5a0feb94ed56dc167e63d7fdfd90eede2bb851cfd4aa42c8fba3a140bf3fad19b9baf1de8bcdbc299929b50a7982b227eaa616509250da5b18055153d96
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouU:0NA1Yakeer5+nso9
TLSH
T15905A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GtKwG.exe

Path C:\Windows\GtKwG.exe
Size 804KB
SHA256 7362bed8a6067563fe536e1c2c6ddd6aadce100f023cc44d0e9faafeb7c05da2
MD5 d2696c9f8ff6dd111309f4cad7075601
SHA1 ec895296159a02343086156a9b511e8bba9b8e28
SHA512 ad0d62bc4aaad5e1693df5e10e0f46c1f9093fda3069b291f1e1407b2b0274be5e9a5786fedbcb8ed4e176cb218e4c98e73c0c78697cbf736921872eb2ba8e69
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouq:0NA1Yakeer5+nson
TLSH
T10905A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NZSagl.exe

Path C:\Windows\NZSagl.exe
Size 804KB
SHA256 a59def03f571b068ce1e8aa5583221fe3206f3eeaafbebfc30e863c9c19353fa
MD5 a6f0d37f62f1edcddadce196ba338889
SHA1 0740dffce5a5bc05c7234410c432f16eb942c6fe
SHA512 43d41be437c2504a0e6ccf41dbb22338378c65478e76f7067875248b33862bb14c982893180d28de3522005fb7f7fc93034687747a6fe0e9959ac59e32632691
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouT:0NA1Yakeer5+nsoi
TLSH
T1DA05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PWWYZIsBpLK.exe

Path C:\Windows\PWWYZIsBpLK.exe
Size 804KB
SHA256 e7364bd7024e450a0740826a337a712fb213f9b571875aedcfe6d30dc334d059
MD5 187db7146d60c9c446ef91dfb4b1260f
SHA1 e4cb6dcb30d3e3e8b396178d7099aa88797ccf1d
SHA512 761ba2e912e0dd20bec519b1243de848ea2c2cc0f6cb70d8a6e956afcb3fda540d0a773b18005b61d6e982ef40512b037ad1a24af635caf12ece6338e45f8cd0
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouK:0NA1Yakeer5+nsox
TLSH
T10E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QzyFq0F2Qz.exe

Path C:\Windows\QzyFq0F2Qz.exe
Size 804KB
SHA256 da3723b3d96f1a05277414deb0e09470c171dee3c06f9e18c84950f5bf41f995
MD5 ea1cea2909a81ff13ee8de5529b4987e
SHA1 13c01605e58480f0a43f8406389c95e24360e198
SHA512 e72b6418bc14847790f6ee97f54e456923f5d27389e8c1b3b4cf678cdd402bf663a80d582ba06302a3d40dea4f0d27e4897eab70ae1e60ec97154bfb46316bb3
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFous:0NA1Yakeer5+nsoX
TLSH
T12605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

awU7GgzMuO.exe

Path C:\Windows\awU7GgzMuO.exe
Size 804KB
SHA256 140029614add3ffcfb1b787fe600ccd3d7fc10172119fbe8d7e909c24869e541
MD5 a6c1a25d202139e9351a24b4b8db0f64
SHA1 651c466ff604cff59ceb6254f9b04f80ae0b43db
SHA512 2dfbd20c2960c79c4ab0c5b56509cb3fcb9da69b842da0b2d89774e9cafa8479c0391d867fb22f21fcd10449d045e2d7b1aa99cf126df960dbcc45c39d86d9da
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou0:0NA1Yakeer5+nso/
TLSH
T1D305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

noSktXZhwcqV.exe

Path C:\Windows\noSktXZhwcqV.exe
Size 804KB
SHA256 a557ee0f8fa08a32a95e8232f85b95931003eeee1484d8f357399953f005c79a
MD5 2919cbcaf1f9548c924289975d134fa1
SHA1 88b20bfd4d2f22db44a78e1c6551e8de365a3150
SHA512 a9cee797bfed4e9631749817ce88b83b9f84e3d36dea703e5def19cf73797cd875ad404eece8e0e1783a9e004056917a26f4d57c09721718e84e1c6a0cc7b0b4
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouR:0NA1Yakeer5+nsom
TLSH
T1E305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nutEXadzeYMCeH.exe

Path C:\Windows\nutEXadzeYMCeH.exe
Size 804KB
SHA256 4ec89e639841d58a3741def0505536fc3f1fba094512d6c1596f94747a5c1b82
MD5 3f4c46672315e2b09bac746f53dbd753
SHA1 f00345f7b25d795bb929f6a528fe5eaea8c5f675
SHA512 6dee1109694bfef0ae90d107a2463375bc7a240a04c73e3f0d004b259127b5cd43cce722df13ff67d7e3929ee8fdaf2adef42af10405503d3df274cf812b4f8f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouk:0NA1Yakeer5+nsol
TLSH
T10305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ogXw0FV07VxE4Ub.exe

Path C:\Windows\ogXw0FV07VxE4Ub.exe
Size 804KB
SHA256 c3b598c768526e8e6129f09d088a337ff6c32acf9e6cd8701f240b4779d24ef4
MD5 df38392501639d5e69e4ba74771e7d9c
SHA1 170a8d1b302c89d3f9d6c3cff9a802d1d2b98047
SHA512 05c7268257a4d48616e5fec008e78d8bc3f98bb197b6b94b61013e8d9cb65043d33d5cce64651f3c7df8fd411c2ed917ec88849c15d83dced67d64cc18082694
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoue:0NA1Yakeer5+nsov
TLSH
T14605A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qMQJHuSwQH.exe

Path C:\Windows\qMQJHuSwQH.exe
Size 804KB
SHA256 67f64defba9ca89bb0cea978d4dfe1d42ea6b6a100c54432bd2836a1f16687b4
MD5 7ffe3a7b1564ebb9f25a2308d822fcff
SHA1 854c72013899b9a75a737ab6dc4181a31b64431d
SHA512 a66f1c8b4a8278088ada85e6d8ee3308e4a50bd40609976207d33d031566e07db0ff8e8b2a4faaea2aa525c89eb0e0b48bc1219a6227fa5b7b74c8ad531e5dff
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouY:0NA1Yakeer5+nsot
TLSH
T1B005A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qWbaTJ.exe

Path C:\Windows\qWbaTJ.exe
Size 804KB
SHA256 381b13e159795b8729ffa2238a83e8c8e5f46cd1367fa3ee254948299b73257b
MD5 222108098d98397d69b935f7f738978b
SHA1 ccc31b170a1391dc2357df4a04e9e764a7e0f828
SHA512 40f45558bebc6d9781276772e5e0726bfa4c47d4d058607ccf10863652e950b342832ba3cd5e2e1f4c97d00e94d3d5579ba31b73f461f80febb45ea9842db615
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou9:0NA1Yakeer5+nsok
TLSH
T17E05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ww5Jstrm5.exe

Path C:\Windows\ww5Jstrm5.exe
Size 804KB
SHA256 b753278cb4d83a253de196347edb8492dcc4cdd994592c58c13cc7c75f10a851
MD5 14e23e35a23d4dcbfb8ba50061945720
SHA1 63101293ffb62a665f65a69c568ba75d25ca4eb2
SHA512 671ec84ad2eeb91e4229fa7cc969aa152d54b27d7e76506e9602b7103fa3453cd83c2f1840e932a4ee17c797eb1998ec22185887b01c98c8635a5fb5dca4469e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouE:0NA1Yakeer5+nso9
TLSH
T1F805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ylSbHpOkjuEBP.exe

Path C:\Windows\ylSbHpOkjuEBP.exe
Size 804KB
SHA256 8251ce9a5663c1bb2a6715c7152cf1a48965830158edc76701e8ac503ad329bc
MD5 ac666b013080a62fc2b307210e0be918
SHA1 466caf8e561d96799ad6e02a51dddc3cefdce751
SHA512 4bd086544c372761b5552142d6e7769714c5bf5d15d21910e3844e4b9ef9fec825772a35af872aab585cf8cfdfe5d56875a051734ba0dbd50dde2a5432cf2393
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFoup:0NA1Yakeer5+nsoc
TLSH
T18705A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads