f0963b41a5806087fe96d9f7b9290a6720ee4e7568c287a56b1b28d88346450c

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 19:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_5f4a6161ca79cc62a3d2f09ad0914074_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Size 804KB
Sample261104-xyc3eae18m
SHA256 f0963b41a5806087fe96d9f7b9290a6720ee4e7568c287a56b1b28d88346450c
MD5 5f4a6161ca79cc62a3d2f09ad0914074
SHA1 9eb411d3c5640e5b81500b0b5b2f68a990645817
SHA512 49ce4fb8c03a919fa2d6b06cd4616f2e8fd4dc9dcf5be8eb3aa1e5575d9dc811be8fecf21ee0a51796d31fb7c11112bda1eac477669a7016eaf1d177f7b8aca7
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouM:0NA1Yakeer5+nsoh
TLSH
T13C05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Contacts a large (1101) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Executes dropped EXE 9 IoCs

pid	Process
3928	hGv9ntBlt7bwKF.exe
4720	boWLCAOWOlOC3I.exe
4428	GmUshUY.exe
2420	o2TneowDi8kb7J.exe
2172	bAwWcw9pQ6eVI.exe
3640	0DvCNz5x6q.exe
3456	XdWNvejNcM.exe
3088	v10PZjQ1CC0.exe
2772	b92kJdp.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NISSERV = "C:\\Windows\\hGv9ntBlt7bwKF.exe"	2026-11-03_5f4a6161ca79cc62a3d2f09ad0914074_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICSUPPNT = "C:\\Windows\\boWLCAOWOlOC3I.exe"	hGv9ntBlt7bwKF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NUPGRADE = "C:\\Windows\\o2TneowDi8kb7J.exe"	GmUshUY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZONEALARM = "C:\\Windows\\0DvCNz5x6q.exe"	bAwWcw9pQ6eVI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCCIOMON = "C:\\Windows\\XdWNvejNcM.exe"	0DvCNz5x6q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SAFEWEB = "C:\\Windows\\v10PZjQ1CC0.exe"	XdWNvejNcM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ATCON = "C:\\Windows\\b92kJdp.exe"	v10PZjQ1CC0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\POPROXY = "C:\\Windows\\GmUshUY.exe"	boWLCAOWOlOC3I.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WRCTRL = "C:\\Windows\\bAwWcw9pQ6eVI.exe"	o2TneowDi8kb7J.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\GmUshUY.exe	boWLCAOWOlOC3I.exe
File opened for modification	C:\Windows\o2TneowDi8kb7J.exe	GmUshUY.exe
File created	C:\Windows\bAwWcw9pQ6eVI.exe	o2TneowDi8kb7J.exe
File opened for modification	C:\Windows\0DvCNz5x6q.exe	bAwWcw9pQ6eVI.exe
File created	C:\Windows\b92kJdp.exe	v10PZjQ1CC0.exe
File created	C:\Windows\hGv9ntBlt7bwKF.exe	2026-11-03_5f4a6161ca79cc62a3d2f09ad0914074_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\hGv9ntBlt7bwKF.exe	2026-11-03_5f4a6161ca79cc62a3d2f09ad0914074_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
File opened for modification	C:\Windows\boWLCAOWOlOC3I.exe	hGv9ntBlt7bwKF.exe
File created	C:\Windows\v10PZjQ1CC0.exe	XdWNvejNcM.exe
File opened for modification	C:\Windows\b92kJdp.exe	v10PZjQ1CC0.exe
File created	C:\Windows\boWLCAOWOlOC3I.exe	hGv9ntBlt7bwKF.exe
File created	C:\Windows\o2TneowDi8kb7J.exe	GmUshUY.exe
File opened for modification	C:\Windows\bAwWcw9pQ6eVI.exe	o2TneowDi8kb7J.exe
File created	C:\Windows\0DvCNz5x6q.exe	bAwWcw9pQ6eVI.exe
File created	C:\Windows\XdWNvejNcM.exe	0DvCNz5x6q.exe
File opened for modification	C:\Windows\XdWNvejNcM.exe	0DvCNz5x6q.exe
File opened for modification	C:\Windows\GmUshUY.exe	boWLCAOWOlOC3I.exe
File opened for modification	C:\Windows\v10PZjQ1CC0.exe	XdWNvejNcM.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
6736	4428	WerFault.exe	94
7096	2772	WerFault.exe	106
1284	2420	WerFault.exe	96

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-03_5f4a6161ca79cc62a3d2f09ad0914074_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-03_5f4a6161ca79cc62a3d2f09ad0914074_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bAwWcw9pQ6eVI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v10PZjQ1CC0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92kJdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	boWLCAOWOlOC3I.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GmUshUY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0DvCNz5x6q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XdWNvejNcM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_5f4a6161ca79cc62a3d2f09ad0914074_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hGv9ntBlt7bwKF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o2TneowDi8kb7J.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-03_5f4a6161ca79cc62a3d2f09ad0914074_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_5f4a6161ca79cc62a3d2f09ad0914074_cobalt-strike_elex_glassworm_gobot_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2800

C:\Windows\hGv9ntBlt7bwKF.exe
C:\Windows\hGv9ntBlt7bwKF.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3928

C:\Windows\boWLCAOWOlOC3I.exe
C:\Windows\boWLCAOWOlOC3I.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4720

C:\Windows\GmUshUY.exe
C:\Windows\GmUshUY.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 2196
  2⤵
  - Program crash
  PID:6736

C:\Windows\o2TneowDi8kb7J.exe
C:\Windows\o2TneowDi8kb7J.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 2416
  2⤵
  - Program crash
  PID:1284

C:\Windows\bAwWcw9pQ6eVI.exe
C:\Windows\bAwWcw9pQ6eVI.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2172

C:\Windows\0DvCNz5x6q.exe
C:\Windows\0DvCNz5x6q.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3640

C:\Windows\XdWNvejNcM.exe
C:\Windows\XdWNvejNcM.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3456

C:\Windows\v10PZjQ1CC0.exe
C:\Windows\v10PZjQ1CC0.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3088

C:\Windows\b92kJdp.exe
C:\Windows\b92kJdp.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 2228
  2⤵
  - Program crash
  PID:7096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4428 -ip 4428
1⤵
PID:6712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2772 -ip 2772
1⤵
PID:7076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2420 -ip 2420
1⤵
PID:2240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DvCNz5x6q.exe

Path C:\Windows\0DvCNz5x6q.exe
Size 804KB
SHA256 847d562794212894a9eae6d6d62d486f11f96ebe46a68d7888cfa66c3c55e7fa
MD5 cc952f16ee7bda413a351106afb08267
SHA1 8c236993f2a6f5555557272cca5b083f295b4058
SHA512 fb84ba7a25e2023b5c366724652f60fb19b6be63d79565dc61f703861107ca5d64f1b5c77a35bc13aa38b2ea6ffa65623fad2e3613abea08976a85a9d28d078a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFout:0NA1Yakeer5+nsoc
TLSH
T10F05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GmUshUY.exe

Path C:\Windows\GmUshUY.exe
Size 804KB
SHA256 7fbc4b3fbb16bb252d58a846e9f7eda2b4e8557925912a9b00bb769f14366c2b
MD5 f2d7fb664f98a4d1f31b25802a9ad032
SHA1 140d138f83b83bf3d8a60e05d28babfeee4dc4e8
SHA512 d99e1e1d168fbf99fde24f1bba28f77ad7033e9f4b010c6d60c225e5112861152f02c2c12060f84584eb72361ff84ab87855086a8b80ce0a855398a671c4b89e
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou3:0NA1Yakeer5+nsoy
TLSH
T1DB05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XdWNvejNcM.exe

Path C:\Windows\XdWNvejNcM.exe
Size 804KB
SHA256 d58ef768feb58b94beca07f4982e425183333537cd5ea35729f52db93c2e4447
MD5 c6db84c20e4e25fb2d2c151505f7f522
SHA1 f7c83afde63a7e07b22bc5466aafb015e15174f9
SHA512 90da820f3120d27c76cec4fb4e6ef6b2525b3c3a5394cd6e2f50e39674311eba284b7dbbb2c413aacc14ea5dab8a685efb90090b1135b304a2b6ef0561cf4df2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouB:0NA1Yakeer5+nsoM
TLSH
T1FE05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b92kJdp.exe

Path C:\Windows\b92kJdp.exe
Size 804KB
SHA256 f614eccb16c8aab15194ffda48e4e42c0f2c4f3804215f5fcf53a9b66abfe699
MD5 075383407eaf79c728baeba1887bd5fc
SHA1 9f9d936811691f145444852dda9e4cb9792ae349
SHA512 e63134e4155e99c491a36afe756124bf65a4998a2506f7a8508a0c9e3b4364a9d10f159064c8d16312efbf49bd40024eb643a7ed440612f9da3ebd3344f2c9c2
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou6:0NA1Yakeer5+nsoT
TLSH
T17705A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bAwWcw9pQ6eVI.exe

Path C:\Windows\bAwWcw9pQ6eVI.exe
Size 804KB
SHA256 1d98a5f9c27c8daef65f1db861a6ff2dc51225313be528f52886545ee83e555a
MD5 58d0f43f6c40f0c4e00e8400bfe7f198
SHA1 d7f20b403461eb814b8191c6da6d3742e2fa10df
SHA512 166db4a6d645d1456bdf3403ee5cd340e95b38009e2d28092686f446769784d7aedd4ffb920fcb1397bf67d3bf2576222f9969282bbbe13a4ca29118272513cf
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouE:0NA1Yakeer5+nsot
TLSH
T12705A4A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boWLCAOWOlOC3I.exe

Path C:\Windows\boWLCAOWOlOC3I.exe
Size 804KB
SHA256 b58d81495b6a2527584f12eb1d0bb0901333e04dbf2418eaa54037826e4da3de
MD5 7bf5a0d7830cd8dd246aee1300e848a6
SHA1 06b2f332e8923a36c454f90c1331c1475e887f66
SHA512 2f02c47516c4904410a0a399a2df2b82bbb205ca106ddf1ee87751f55563b8a9bc6b8e8e7aba147cf3ee42a41ef7a718b858faf6f6ca914e38308367d96a053d
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouX:0NA1Yakeer5+nsoE
TLSH
T1DC05A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hGv9ntBlt7bwKF.exe

Path C:\Windows\hGv9ntBlt7bwKF.exe
Size 804KB
SHA256 398cbd9748a949a2244a09b5f7b75f2ae8d11c141cd3b6c6483f0316b7297619
MD5 1e3ee82840a8f64a7891991c3dbd449e
SHA1 ebeeeb88442437d5570c4502963fb74cc81de3ae
SHA512 177c7e68618a53bc63bbc8ab90da76abe68b0f87ad6297539a947e79e4cad6e518c45cb8db7135177ad81cd9eefaee744cde4f1194ed0571cbc08a5ab057db0a
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFou/:0NA1Yakeer5+nsok
TLSH
T15505A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o2TneowDi8kb7J.exe

Path C:\Windows\o2TneowDi8kb7J.exe
Size 804KB
SHA256 3a9d07b01ed4685695ac9ecdba181f65d9d514c60efac173ae60ba819be3999b
MD5 6f3b371e7480726a93fdb50a383281ff
SHA1 f4f2205e3f464c95a9ab5229572c3235564b8820
SHA512 98fee7daa1bc699d906f0e55c138c99f93149836caf959fc67922a89f85575e63e8893e4749727aa8cd09b28bdd03a84d83e712d7793514bdd67ebd029aa6c2c
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouj:0NA1Yakeer5+nsou
TLSH
T1C805A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v10PZjQ1CC0.exe

Path C:\Windows\v10PZjQ1CC0.exe
Size 804KB
SHA256 535b65b53a4254f3f7c65d2eb8f9fd162c84ac0017bbb38cafb0e3ff6b9ac580
MD5 94887a6781f9fc094c04fc7ef1441a2b
SHA1 f3b2073845ae895cb8ba60d7fbc8b11a5c0ae5f8
SHA512 5f1be74cab9b9006c88911da957f60105abc2a7f6a10899cfb53e9fe4b491d26058d00fe4601cb3cefd8e90ee92ffcca396b119a394ea9e7eadb4fdfa112933f
SSDEEP 6144:QGKnJ7yE189/drLHgDe7eVvaDtZV7+TL7nqer5+nWFouH:0NA1Yakeer5+nso2
TLSH
T10305A3A7E7929AE8E65D44766F184140D72EF221AB0F6320786C120DCF5778B8F65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads