xworm | 56b2e827a8553d0ef48555984de1326e3de466a30d50ef7f8ca833fb28ef1567

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Executes dropped EXE 2 IoCs

pid	Process
3136	chel42s1.bnx.exe
3292	yqznhhk5.z1j.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 51 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\AuthRoot\AutoUp = 6854ee323de8dc01	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Microsoft\SystemCertificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\AuthRoot\AutoUp	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\AuthRoot	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3308	SCHTASKS.exe
2688	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3332	svchost.exe
3332	svchost.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe
3136	chel42s1.bnx.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
5016	Process not Found
3096	Process not Found
3484	Process not Found
1644	Process not Found
3640	Process not Found
1816	Process not Found
1496	Process not Found
848	Process not Found
2692	Process not Found
4196	Process not Found
2508	Process not Found
2576	Process not Found
4660	Process not Found
4204	Process not Found
4500	Process not Found
4532	Process not Found
3904	Process not Found
2424	Process not Found
2792	Process not Found
2896	Process not Found
3892	Process not Found
956	Process not Found
3972	Process not Found
1960	Process not Found
3344	Process not Found
4796	Process not Found
804	Process not Found
2088	Process not Found
2596	Process not Found
3836	Process not Found
652	Process not Found
3004	Process not Found
4192	Process not Found
1928	Process not Found
1348	Process not Found
612	Process not Found
1260	Process not Found
2460	Process not Found
5072	Process not Found
1872	Process not Found
3676	Process not Found
4612	Process not Found
1668	Process not Found
4804	Process not Found
2940	Process not Found
1656	Process not Found
3432	Process not Found
808	Process not Found
2768	Process not Found
2852	Process not Found
3060	Process not Found
3584	Process not Found
4208	Process not Found
1912	Process not Found
4184	Process not Found
2752	Process not Found
4668	Process not Found
752	Process not Found
680	Process not Found
2708	Process not Found
976	Process not Found
1932	Process not Found
5060	Process not Found
940	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	448	2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3136	chel42s1.bnx.exe
Token: SeDebugPrivilege	5100	RuntimeBroker.exe
Token: SeDebugPrivilege	5100	RuntimeBroker.exe
Token: SeAuditPrivilege	2644	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2368	svchost.exe
Token: SeIncreaseQuotaPrivilege	2368	svchost.exe
Token: SeSecurityPrivilege	2368	svchost.exe
Token: SeTakeOwnershipPrivilege	2368	svchost.exe
Token: SeLoadDriverPrivilege	2368	svchost.exe
Token: SeSystemtimePrivilege	2368	svchost.exe
Token: SeBackupPrivilege	2368	svchost.exe
Token: SeRestorePrivilege	2368	svchost.exe
Token: SeShutdownPrivilege	2368	svchost.exe
Token: SeSystemEnvironmentPrivilege	2368	svchost.exe
Token: SeUndockPrivilege	2368	svchost.exe
Token: SeManageVolumePrivilege	2368	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2368	svchost.exe
Token: SeIncreaseQuotaPrivilege	2368	svchost.exe
Token: SeSecurityPrivilege	2368	svchost.exe
Token: SeTakeOwnershipPrivilege	2368	svchost.exe
Token: SeLoadDriverPrivilege	2368	svchost.exe
Token: SeSystemtimePrivilege	2368	svchost.exe
Token: SeBackupPrivilege	2368	svchost.exe
Token: SeRestorePrivilege	2368	svchost.exe
Token: SeShutdownPrivilege	2368	svchost.exe
Token: SeSystemEnvironmentPrivilege	2368	svchost.exe
Token: SeUndockPrivilege	2368	svchost.exe
Token: SeManageVolumePrivilege	2368	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2368	svchost.exe
Token: SeIncreaseQuotaPrivilege	2368	svchost.exe
Token: SeSecurityPrivilege	2368	svchost.exe
Token: SeTakeOwnershipPrivilege	2368	svchost.exe
Token: SeLoadDriverPrivilege	2368	svchost.exe
Token: SeSystemtimePrivilege	2368	svchost.exe
Token: SeBackupPrivilege	2368	svchost.exe
Token: SeRestorePrivilege	2368	svchost.exe
Token: SeShutdownPrivilege	2368	svchost.exe
Token: SeSystemEnvironmentPrivilege	2368	svchost.exe
Token: SeUndockPrivilege	2368	svchost.exe
Token: SeManageVolumePrivilege	2368	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2368	svchost.exe
Token: SeIncreaseQuotaPrivilege	2368	svchost.exe
Token: SeSecurityPrivilege	2368	svchost.exe
Token: SeTakeOwnershipPrivilege	2368	svchost.exe
Token: SeLoadDriverPrivilege	2368	svchost.exe
Token: SeSystemtimePrivilege	2368	svchost.exe
Token: SeBackupPrivilege	2368	svchost.exe
Token: SeRestorePrivilege	2368	svchost.exe
Token: SeShutdownPrivilege	2368	svchost.exe
Token: SeSystemEnvironmentPrivilege	2368	svchost.exe
Token: SeUndockPrivilege	2368	svchost.exe
Token: SeManageVolumePrivilege	2368	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2368	svchost.exe
Token: SeIncreaseQuotaPrivilege	2368	svchost.exe
Token: SeSecurityPrivilege	2368	svchost.exe
Token: SeTakeOwnershipPrivilege	2368	svchost.exe
Token: SeLoadDriverPrivilege	2368	svchost.exe
Token: SeSystemtimePrivilege	2368	svchost.exe
Token: SeBackupPrivilege	2368	svchost.exe
Token: SeRestorePrivilege	2368	svchost.exe
Token: SeShutdownPrivilege	2368	svchost.exe
Token: SeSystemEnvironmentPrivilege	2368	svchost.exe
Token: SeUndockPrivilege	2368	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 3136	448	2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	85
PID 448 wrote to memory of 3308	448	2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	86
PID 3136 wrote to memory of 604	3136	chel42s1.bnx.exe	5
PID 3136 wrote to memory of 664	3136	chel42s1.bnx.exe	7
PID 3136 wrote to memory of 868	3136	chel42s1.bnx.exe	11
PID 3136 wrote to memory of 996	3136	chel42s1.bnx.exe	13
PID 3136 wrote to memory of 392	3136	chel42s1.bnx.exe	14
PID 3136 wrote to memory of 440	3136	chel42s1.bnx.exe	15
PID 3136 wrote to memory of 1028	3136	chel42s1.bnx.exe	16
PID 3136 wrote to memory of 1076	3136	chel42s1.bnx.exe	17
PID 3136 wrote to memory of 1092	3136	chel42s1.bnx.exe	18
PID 3136 wrote to memory of 1100	3136	chel42s1.bnx.exe	19
PID 3136 wrote to memory of 1216	3136	chel42s1.bnx.exe	21
PID 3136 wrote to memory of 1248	3136	chel42s1.bnx.exe	22
PID 3136 wrote to memory of 1288	3136	chel42s1.bnx.exe	23
PID 3136 wrote to memory of 1404	3136	chel42s1.bnx.exe	24
PID 3136 wrote to memory of 1440	3136	chel42s1.bnx.exe	25
PID 3136 wrote to memory of 1488	3136	chel42s1.bnx.exe	26
PID 3136 wrote to memory of 1588	3136	chel42s1.bnx.exe	27
PID 3136 wrote to memory of 1616	3136	chel42s1.bnx.exe	28
PID 3136 wrote to memory of 1632	3136	chel42s1.bnx.exe	29
PID 3136 wrote to memory of 1780	3136	chel42s1.bnx.exe	30
PID 3136 wrote to memory of 1820	3136	chel42s1.bnx.exe	31
PID 3136 wrote to memory of 1832	3136	chel42s1.bnx.exe	32
PID 3136 wrote to memory of 1916	3136	chel42s1.bnx.exe	33
PID 3136 wrote to memory of 1940	3136	chel42s1.bnx.exe	34
PID 3136 wrote to memory of 1448	3136	chel42s1.bnx.exe	35
PID 3136 wrote to memory of 360	3136	chel42s1.bnx.exe	36
PID 3136 wrote to memory of 1804	3136	chel42s1.bnx.exe	37
PID 3136 wrote to memory of 2092	3136	chel42s1.bnx.exe	38
PID 3136 wrote to memory of 2212	3136	chel42s1.bnx.exe	39
PID 3136 wrote to memory of 2284	3136	chel42s1.bnx.exe	41
PID 3136 wrote to memory of 2368	3136	chel42s1.bnx.exe	42
PID 3136 wrote to memory of 2476	3136	chel42s1.bnx.exe	44
PID 3136 wrote to memory of 2484	3136	chel42s1.bnx.exe	45
PID 3136 wrote to memory of 2616	3136	chel42s1.bnx.exe	46
PID 3136 wrote to memory of 2644	3136	chel42s1.bnx.exe	47
PID 3136 wrote to memory of 2716	3136	chel42s1.bnx.exe	48
PID 3136 wrote to memory of 2756	3136	chel42s1.bnx.exe	49
PID 3136 wrote to memory of 2780	3136	chel42s1.bnx.exe	50
PID 3136 wrote to memory of 3064	3136	chel42s1.bnx.exe	51
PID 3136 wrote to memory of 2844	3136	chel42s1.bnx.exe	52
PID 3136 wrote to memory of 660	3136	chel42s1.bnx.exe	53
PID 3136 wrote to memory of 764	3136	chel42s1.bnx.exe	54
PID 3136 wrote to memory of 3180	3136	chel42s1.bnx.exe	55
PID 3136 wrote to memory of 3236	3136	chel42s1.bnx.exe	56
PID 3136 wrote to memory of 3388	3136	chel42s1.bnx.exe	57
PID 3136 wrote to memory of 3576	3136	chel42s1.bnx.exe	58
PID 3136 wrote to memory of 3728	3136	chel42s1.bnx.exe	60
PID 3136 wrote to memory of 3976	3136	chel42s1.bnx.exe	62
PID 3136 wrote to memory of 4720	3136	chel42s1.bnx.exe	65
PID 3136 wrote to memory of 3512	3136	chel42s1.bnx.exe	66
PID 3136 wrote to memory of 4784	3136	chel42s1.bnx.exe	68
PID 3136 wrote to memory of 4536	3136	chel42s1.bnx.exe	69
PID 3136 wrote to memory of 2312	3136	chel42s1.bnx.exe	70
PID 3136 wrote to memory of 4396	3136	chel42s1.bnx.exe	71
PID 3136 wrote to memory of 4160	3136	chel42s1.bnx.exe	72
PID 3136 wrote to memory of 4888	3136	chel42s1.bnx.exe	73
PID 3136 wrote to memory of 1924	3136	chel42s1.bnx.exe	74
PID 3136 wrote to memory of 2684	3136	chel42s1.bnx.exe	76
PID 3136 wrote to memory of 2228	3136	chel42s1.bnx.exe	77
PID 3136 wrote to memory of 5100	3136	chel42s1.bnx.exe	78
PID 3136 wrote to memory of 448	3136	chel42s1.bnx.exe	84
PID 3136 wrote to memory of 3308	3136	chel42s1.bnx.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:392

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3f411ac1-3a1e-4fb0-ae19-c2dddc20f9c4 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-331021e8-b304-436f-a6c7-c596b0f14ab6 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-25c58538-f149-4a50-92c4-0a19c383990a -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-752ddc43-ccb9-4c2e-9434-de5961bb75da -LifetimeId:27feacd3-1b35-4940-b9e0-72e233ef1ac1 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1092
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1404
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3064
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1572
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3316
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1816
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2508
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:680
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2092

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3180

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3236
- C:\Users\Admin\AppData\Local\Temp\2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Users\Admin\AppData\Local\Temp\chel42s1.bnx.exe
    "C:\Users\Admin\AppData\Local\Temp\chel42s1.bnx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3136
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3308
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5060
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-05-18_091bce8fdb606938b0135ccc2f279b33_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2688
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2160
- - C:\Users\Admin\AppData\Local\Temp\yqznhhk5.z1j.exe
    "C:\Users\Admin\AppData\Local\Temp\yqznhhk5.z1j.exe"
    3⤵
    - Executes dropped EXE
    PID:3292
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3236 -s 6248
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3388

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3576

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3728

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3976

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3512

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:4396

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:4160

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2684

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2228

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3332

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery