xworm | 1c883961efcc82bd3b7b52abd69f51a91d20f245bc487c3d88eeae3a512722ea

Analysis

max time kernel
150s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/04/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Size 229KB
Sample260403-erxt5ahv2n
SHA256 1c883961efcc82bd3b7b52abd69f51a91d20f245bc487c3d88eeae3a512722ea
MD5 993d9279d102b31bc792e6f5e27d93fe
SHA1 2c54283a160eac2590dd3802de7450e65c0d1ac5
SHA512 2041aca90d6b4053beb02761bcee5bf9b467e5bcaed2d5d4fd88abfb09a9cc3bd45fca14312769bf6a2ce67cfad6f500f9a8b7c5faaf00a2c2fb5c55e02d696d
SSDEEP 3072:9l4FE9RWOqOGLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xNo:90E9O/5bTgVziHzZnSKrCbYMJFbh8Lq
TLSH
T1C6344A66F6A000FBD4BA42358D636B02B7B2F03617219BEF1B94495D7F637E04D29B90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

2.56.165.69:911

Attributes

install_file
Mason.exe

aes.plain

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral2/memory/648-0-0x000001EB463A0000-0x000001EB463DE000-memory.dmp	family_xworm
behavioral2/memory/4512-285-0x00000232A9AB0000-0x00000232A9AEE000-memory.dmp	family_xworm
behavioral2/memory/648-454-0x000001EB60C00000-0x000001EB60C0E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Detects Windows executables referencing non-Windows User-Agents 3 IoCs

resource	yara_rule
behavioral2/memory/648-0-0x000001EB463A0000-0x000001EB463DE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4512-285-0x00000232A9AB0000-0x00000232A9AEE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/648-454-0x000001EB60C00000-0x000001EB60C0E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 2 IoCs

pid	Process
1656	1tjh2caa.icf.exe
2920	aju1r2jr.xie.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1775189557"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 03 Apr 2026 04:12:38 GMT"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={2ADA3869-6833-4E23-B72E-62C6DD9F1F6D}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3292	SCHTASKS.exe
3148	SCHTASKS.exe
3228	SCHTASKS.exe
2264	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1656	1tjh2caa.icf.exe
1656	1tjh2caa.icf.exe
1656	1tjh2caa.icf.exe
1656	1tjh2caa.icf.exe
1656	1tjh2caa.icf.exe
1656	1tjh2caa.icf.exe
1656	1tjh2caa.icf.exe
1656	1tjh2caa.icf.exe
1656	1tjh2caa.icf.exe
1656	1tjh2caa.icf.exe
1656	1tjh2caa.icf.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
1656	1tjh2caa.icf.exe
1656	1tjh2caa.icf.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe
2920	aju1r2jr.xie.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3132	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	648	2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Token: SeDebugPrivilege	1656	1tjh2caa.icf.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeDebugPrivilege	4512	2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Token: SeDebugPrivilege	2920	aju1r2jr.xie.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeAssignPrimaryTokenPrivilege	2628	svchost.exe
Token: SeIncreaseQuotaPrivilege	2628	svchost.exe
Token: SeSecurityPrivilege	2628	svchost.exe
Token: SeTakeOwnershipPrivilege	2628	svchost.exe
Token: SeLoadDriverPrivilege	2628	svchost.exe
Token: SeSystemtimePrivilege	2628	svchost.exe
Token: SeBackupPrivilege	2628	svchost.exe
Token: SeRestorePrivilege	2628	svchost.exe
Token: SeShutdownPrivilege	2628	svchost.exe
Token: SeSystemEnvironmentPrivilege	2628	svchost.exe
Token: SeUndockPrivilege	2628	svchost.exe
Token: SeManageVolumePrivilege	2628	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2628	svchost.exe
Token: SeIncreaseQuotaPrivilege	2628	svchost.exe
Token: SeSecurityPrivilege	2628	svchost.exe
Token: SeTakeOwnershipPrivilege	2628	svchost.exe
Token: SeLoadDriverPrivilege	2628	svchost.exe
Token: SeSystemtimePrivilege	2628	svchost.exe
Token: SeBackupPrivilege	2628	svchost.exe
Token: SeRestorePrivilege	2628	svchost.exe
Token: SeShutdownPrivilege	2628	svchost.exe
Token: SeSystemEnvironmentPrivilege	2628	svchost.exe
Token: SeUndockPrivilege	2628	svchost.exe
Token: SeManageVolumePrivilege	2628	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2628	svchost.exe
Token: SeIncreaseQuotaPrivilege	2628	svchost.exe
Token: SeSecurityPrivilege	2628	svchost.exe
Token: SeTakeOwnershipPrivilege	2628	svchost.exe
Token: SeLoadDriverPrivilege	2628	svchost.exe
Token: SeSystemtimePrivilege	2628	svchost.exe
Token: SeBackupPrivilege	2628	svchost.exe
Token: SeRestorePrivilege	2628	svchost.exe
Token: SeShutdownPrivilege	2628	svchost.exe
Token: SeSystemEnvironmentPrivilege	2628	svchost.exe
Token: SeUndockPrivilege	2628	svchost.exe
Token: SeManageVolumePrivilege	2628	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2628	svchost.exe
Token: SeIncreaseQuotaPrivilege	2628	svchost.exe
Token: SeSecurityPrivilege	2628	svchost.exe
Token: SeTakeOwnershipPrivilege	2628	svchost.exe
Token: SeLoadDriverPrivilege	2628	svchost.exe
Token: SeSystemtimePrivilege	2628	svchost.exe
Token: SeBackupPrivilege	2628	svchost.exe
Token: SeRestorePrivilege	2628	svchost.exe
Token: SeShutdownPrivilege	2628	svchost.exe
Token: SeSystemEnvironmentPrivilege	2628	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 1656	648	2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe	79
PID 648 wrote to memory of 3292	648	2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe	80
PID 1656 wrote to memory of 640	1656	1tjh2caa.icf.exe	5
PID 1656 wrote to memory of 696	1656	1tjh2caa.icf.exe	7
PID 1656 wrote to memory of 904	1656	1tjh2caa.icf.exe	11
PID 1656 wrote to memory of 408	1656	1tjh2caa.icf.exe	13
PID 1656 wrote to memory of 764	1656	1tjh2caa.icf.exe	14
PID 1656 wrote to memory of 1040	1656	1tjh2caa.icf.exe	15
PID 1656 wrote to memory of 1068	1656	1tjh2caa.icf.exe	16
PID 1656 wrote to memory of 1128	1656	1tjh2caa.icf.exe	17
PID 1656 wrote to memory of 1144	1656	1tjh2caa.icf.exe	18
PID 1656 wrote to memory of 1176	1656	1tjh2caa.icf.exe	19
PID 1656 wrote to memory of 1264	1656	1tjh2caa.icf.exe	21
PID 1656 wrote to memory of 1280	1656	1tjh2caa.icf.exe	22
PID 1656 wrote to memory of 1288	1656	1tjh2caa.icf.exe	23
PID 1656 wrote to memory of 1460	1656	1tjh2caa.icf.exe	24
PID 1656 wrote to memory of 1480	1656	1tjh2caa.icf.exe	25
PID 1656 wrote to memory of 1544	1656	1tjh2caa.icf.exe	26
PID 1656 wrote to memory of 1660	1656	1tjh2caa.icf.exe	27
PID 1656 wrote to memory of 1688	1656	1tjh2caa.icf.exe	28
PID 1656 wrote to memory of 1716	1656	1tjh2caa.icf.exe	29
PID 1656 wrote to memory of 1828	1656	1tjh2caa.icf.exe	30
PID 1656 wrote to memory of 1856	1656	1tjh2caa.icf.exe	31
PID 1656 wrote to memory of 1964	1656	1tjh2caa.icf.exe	32
PID 1656 wrote to memory of 2004	1656	1tjh2caa.icf.exe	33
PID 1656 wrote to memory of 1952	1656	1tjh2caa.icf.exe	34
PID 1656 wrote to memory of 2092	1656	1tjh2caa.icf.exe	35
PID 1656 wrote to memory of 2100	1656	1tjh2caa.icf.exe	36
PID 1656 wrote to memory of 2188	1656	1tjh2caa.icf.exe	37
PID 1656 wrote to memory of 2212	1656	1tjh2caa.icf.exe	38
PID 1656 wrote to memory of 2348	1656	1tjh2caa.icf.exe	39
PID 1656 wrote to memory of 2392	1656	1tjh2caa.icf.exe	41
PID 1656 wrote to memory of 2528	1656	1tjh2caa.icf.exe	42
PID 1656 wrote to memory of 2548	1656	1tjh2caa.icf.exe	43
PID 1656 wrote to memory of 2584	1656	1tjh2caa.icf.exe	44
PID 1656 wrote to memory of 2604	1656	1tjh2caa.icf.exe	45
PID 1656 wrote to memory of 2612	1656	1tjh2caa.icf.exe	46
PID 1656 wrote to memory of 2628	1656	1tjh2caa.icf.exe	47
PID 1656 wrote to memory of 2664	1656	1tjh2caa.icf.exe	48
PID 1656 wrote to memory of 2904	1656	1tjh2caa.icf.exe	50
PID 1656 wrote to memory of 2524	1656	1tjh2caa.icf.exe	51
PID 1656 wrote to memory of 720	1656	1tjh2caa.icf.exe	52
PID 1656 wrote to memory of 3132	1656	1tjh2caa.icf.exe	53
PID 1656 wrote to memory of 3260	1656	1tjh2caa.icf.exe	54
PID 1656 wrote to memory of 3312	1656	1tjh2caa.icf.exe	55
PID 1656 wrote to memory of 3644	1656	1tjh2caa.icf.exe	58
PID 1656 wrote to memory of 3712	1656	1tjh2caa.icf.exe	59
PID 1656 wrote to memory of 3748	1656	1tjh2caa.icf.exe	60
PID 1656 wrote to memory of 3788	1656	1tjh2caa.icf.exe	61
PID 1656 wrote to memory of 3328	1656	1tjh2caa.icf.exe	62
PID 1656 wrote to memory of 4236	1656	1tjh2caa.icf.exe	63
PID 1656 wrote to memory of 2568	1656	1tjh2caa.icf.exe	67
PID 1656 wrote to memory of 4164	1656	1tjh2caa.icf.exe	68
PID 1656 wrote to memory of 4692	1656	1tjh2caa.icf.exe	70
PID 1656 wrote to memory of 2312	1656	1tjh2caa.icf.exe	71
PID 1656 wrote to memory of 4600	1656	1tjh2caa.icf.exe	72
PID 1656 wrote to memory of 3236	1656	1tjh2caa.icf.exe	73
PID 1656 wrote to memory of 5064	1656	1tjh2caa.icf.exe	74
PID 1656 wrote to memory of 1916	1656	1tjh2caa.icf.exe	75
PID 1656 wrote to memory of 4852	1656	1tjh2caa.icf.exe	76
PID 1656 wrote to memory of 648	1656	1tjh2caa.icf.exe	78
PID 3132 wrote to memory of 3980	3132	Explorer.EXE
PID 1656 wrote to memory of 3980	1656	1tjh2caa.icf.exe
PID 1656 wrote to memory of 3980	1656	1tjh2caa.icf.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1040

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:696

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ea5641a9-f373-4b74-a5ba-4baff1874663 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5db00d43-f776-4649-9fe3-b6680db4dd71 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-797aae1a-ba61-4d68-91e5-b6fe909ed010 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b217d5b5-15c4-4c38-a0ac-888e141b008e -LifetimeId:2132fa9b-f979-4f9f-824e-0bcb6c85678e -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1660
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2212

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:720

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Users\Admin\AppData\Local\Temp\2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Users\Admin\AppData\Local\Temp\1tjh2caa.icf.exe
    "C:\Users\Admin\AppData\Local\Temp\1tjh2caa.icf.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1656
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3292
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3148
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3312

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3644

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3712

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3788

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:3328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4164

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:4600

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5064

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4852

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1796

C:\Users\Admin\AppData\Local\Temp\2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4512
- C:\Users\Admin\AppData\Local\Temp\aju1r2jr.xie.exe
  "C:\Users\Admin\AppData\Local\Temp\aju1r2jr.xie.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\system32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Mason2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3228
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2232
- C:\Windows\system32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Mason2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-04-03_993d9279d102b31bc792e6f5e27d93fe_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2264
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3012

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1tjh2caa.icf.exe

Path C:\Users\Admin\AppData\Local\Temp\1tjh2caa.icf.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-173-0x000001FFBD360000-0x000001FFBD38B000-memory.dmp

Download

memory/408-32-0x000001FFBD360000-0x000001FFBD38B000-memory.dmp

Download

memory/408-28-0x000001FFBD360000-0x000001FFBD38B000-memory.dmp

Download

memory/408-29-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/640-20-0x0000027564C80000-0x0000027564CAB000-memory.dmp

Download

memory/640-13-0x0000027564C80000-0x0000027564CAB000-memory.dmp

Download

memory/640-12-0x0000027564C50000-0x0000027564C75000-memory.dmp

Download

memory/640-21-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/648-477-0x000001EB60C60000-0x000001EB60C70000-memory.dmp

Download

memory/648-454-0x000001EB60C00000-0x000001EB60C0E000-memory.dmp

Download

memory/648-1-0x000001EB480D0000-0x000001EB480FC000-memory.dmp

Download

memory/648-501-0x000001EB60C60000-0x000001EB60C70000-memory.dmp

Download

memory/648-0-0x000001EB463A0000-0x000001EB463DE000-memory.dmp

Download

memory/696-18-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/696-17-0x0000016FE9D80000-0x0000016FE9DAB000-memory.dmp

Download

memory/696-22-0x0000016FE9D80000-0x0000016FE9DAB000-memory.dmp

Download

memory/764-40-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/764-450-0x000001F7E00E0000-0x000001F7E010B000-memory.dmp

Download

memory/764-39-0x000001F7E00E0000-0x000001F7E010B000-memory.dmp

Download

memory/764-43-0x000001F7E00E0000-0x000001F7E010B000-memory.dmp

Download

memory/904-25-0x000001F2F11F0000-0x000001F2F121B000-memory.dmp

Download

memory/904-172-0x000001F2F11F0000-0x000001F2F121B000-memory.dmp

Download

memory/904-26-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/904-31-0x000001F2F11F0000-0x000001F2F121B000-memory.dmp

Download

memory/1040-35-0x0000012BC8D20000-0x0000012BC8D4B000-memory.dmp

Download

memory/1040-42-0x0000012BC8D20000-0x0000012BC8D4B000-memory.dmp

Download

memory/1040-36-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1068-47-0x0000021AEF340000-0x0000021AEF36B000-memory.dmp

Download

memory/1068-473-0x0000021AEF340000-0x0000021AEF36B000-memory.dmp

Download

memory/1068-44-0x0000021AEF340000-0x0000021AEF36B000-memory.dmp

Download

memory/1068-45-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1128-51-0x00000269ED920000-0x00000269ED94B000-memory.dmp

Download

memory/1128-60-0x00000269ED920000-0x00000269ED94B000-memory.dmp

Download

memory/1128-474-0x00000269ED920000-0x00000269ED94B000-memory.dmp

Download

memory/1128-52-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1144-61-0x000001D7A1CB0000-0x000001D7A1CDB000-memory.dmp

Download

memory/1144-475-0x000001D7A1CB0000-0x000001D7A1CDB000-memory.dmp

Download

memory/1144-55-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1144-54-0x000001D7A1CB0000-0x000001D7A1CDB000-memory.dmp

Download

memory/1176-57-0x000002A430D10000-0x000002A430D3B000-memory.dmp

Download

memory/1176-58-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1176-476-0x000002A430D10000-0x000002A430D3B000-memory.dmp

Download

memory/1176-62-0x000002A430D10000-0x000002A430D3B000-memory.dmp

Download

memory/1264-483-0x0000018924750000-0x000001892477B000-memory.dmp

Download

memory/1264-68-0x0000018924750000-0x000001892477B000-memory.dmp

Download

memory/1264-69-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1264-83-0x0000018924750000-0x000001892477B000-memory.dmp

Download

memory/1280-484-0x0000020B73200000-0x0000020B7322B000-memory.dmp

Download

memory/1280-72-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1280-71-0x0000020B73200000-0x0000020B7322B000-memory.dmp

Download

memory/1280-84-0x0000020B73200000-0x0000020B7322B000-memory.dmp

Download

memory/1288-85-0x00000224D3E90000-0x00000224D3EBB000-memory.dmp

Download

memory/1288-485-0x00000224D3E90000-0x00000224D3EBB000-memory.dmp

Download

memory/1288-74-0x00000224D3E90000-0x00000224D3EBB000-memory.dmp

Download

memory/1288-75-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1460-77-0x000002030DA60000-0x000002030DA8B000-memory.dmp

Download

memory/1460-86-0x000002030DA60000-0x000002030DA8B000-memory.dmp

Download

memory/1460-486-0x000002030DA60000-0x000002030DA8B000-memory.dmp

Download

memory/1460-78-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1480-487-0x000001DC074D0000-0x000001DC074FB000-memory.dmp

Download

memory/1480-81-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1480-87-0x000001DC074D0000-0x000001DC074FB000-memory.dmp

Download

memory/1480-80-0x000001DC074D0000-0x000001DC074FB000-memory.dmp

Download

memory/1544-489-0x000001AC9E560000-0x000001AC9E58B000-memory.dmp

Download

memory/1544-109-0x000001AC9E560000-0x000001AC9E58B000-memory.dmp

Download

memory/1544-174-0x000001AC9E560000-0x000001AC9E58B000-memory.dmp

Download

memory/1544-110-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1656-10-0x00007FFB42080000-0x00007FFB42289000-memory.dmp

Download

memory/1656-11-0x00007FFB40870000-0x00007FFB4092D000-memory.dmp

Download

memory/1660-490-0x00000289D05D0000-0x00000289D05FB000-memory.dmp

Download

memory/1660-113-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1660-112-0x00000289D05D0000-0x00000289D05FB000-memory.dmp

Download

memory/1660-175-0x00000289D05D0000-0x00000289D05FB000-memory.dmp

Download

memory/1688-491-0x0000018D34F70000-0x0000018D34F9B000-memory.dmp

Download

memory/1688-116-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1688-115-0x0000018D34F70000-0x0000018D34F9B000-memory.dmp

Download

memory/1688-176-0x0000018D34F70000-0x0000018D34F9B000-memory.dmp

Download

memory/1716-177-0x000001FEB7AE0000-0x000001FEB7B0B000-memory.dmp

Download

memory/1716-118-0x000001FEB7AE0000-0x000001FEB7B0B000-memory.dmp

Download

memory/1716-119-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1716-492-0x000001FEB7AE0000-0x000001FEB7B0B000-memory.dmp

Download

memory/1828-493-0x0000017DDFB70000-0x0000017DDFB9B000-memory.dmp

Download

memory/1828-121-0x0000017DDFB70000-0x0000017DDFB9B000-memory.dmp

Download

memory/1828-122-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1828-178-0x0000017DDFB70000-0x0000017DDFB9B000-memory.dmp

Download

memory/1856-124-0x0000016B97E90000-0x0000016B97EBB000-memory.dmp

Download

memory/1856-125-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1952-134-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/1952-133-0x000001EC1D690000-0x000001EC1D6BB000-memory.dmp

Download

memory/1964-127-0x00000268E87C0000-0x00000268E87EB000-memory.dmp

Download

memory/1964-128-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/2004-131-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/2004-130-0x0000027B26F60000-0x0000027B26F8B000-memory.dmp

Download

memory/2092-137-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/2092-136-0x00000196CD100000-0x00000196CD12B000-memory.dmp

Download

memory/2100-139-0x000001FC61180000-0x000001FC611AB000-memory.dmp

Download

memory/2100-140-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/2188-142-0x0000025B15290000-0x0000025B152BB000-memory.dmp

Download

memory/2188-143-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/2212-145-0x000002A8B4DD0000-0x000002A8B4DFB000-memory.dmp

Download

memory/2212-146-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/2348-148-0x00000000009D0000-0x00000000009FB000-memory.dmp

Download

memory/2348-149-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/2392-151-0x000002B68AF60000-0x000002B68AF8B000-memory.dmp

Download

memory/2392-152-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/2528-155-0x00007FFB02110000-0x00007FFB02120000-memory.dmp

Download

memory/2528-154-0x0000027CF6BE0000-0x0000027CF6C0B000-memory.dmp

Download

memory/4512-285-0x00000232A9AB0000-0x00000232A9AEE000-memory.dmp

Download