xworm | 245240deb5ff9581c5f3cf06e1654ec09fe65b1b50c4603d436fef9d6d24072c

Analysis

max time kernel
136s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Size 239KB
Sample260718-a9cjpaa12r
SHA256 245240deb5ff9581c5f3cf06e1654ec09fe65b1b50c4603d436fef9d6d24072c
MD5 a1a45a8c49f81f0d755cfaa066a888f9
SHA1 2c64102d8ae3039b0d6eb0648c7a58173e224313
SHA512 32dfba14dfdee0c823596dca26b19f250a75df18bcff7a9a8c893b0a244dd2c19fc83a490e10d7721f3e1e22fad75a6977714a66ef4079e3c4a804de999f5982
SSDEEP 6144:/09ebj/5bTgVziHzZnSKrCbYMQWNNrpw8Aq:/09O/5/gVziHlBrCbYV89
TLSH
T155346D07B7E100B7E5BE827589B39A17F7B2F02603219BFF1A94459E1F537809D29B90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xworm rat trojan

Malware Config

Extracted

Family

xworm

Attributes

install_file
Mason.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral2/memory/944-1-0x000001FB93100000-0x000001FB93142000-memory.dmp	family_xworm
behavioral2/memory/944-11-0x000001FB94EE0000-0x000001FB94EF4000-memory.dmp	family_xworm
behavioral2/files/0x000d00000001c5e0-299.dat	family_xworm
behavioral2/memory/1832-306-0x00000270FD140000-0x00000270FD182000-memory.dmp	family_xworm
behavioral2/memory/1832-321-0x00000270FF9B0000-0x00000270FF9C4000-memory.dmp	family_xworm

Detects Windows executables referencing non-Windows User-Agents 5 IoCs

resource	yara_rule
behavioral2/memory/944-1-0x000001FB93100000-0x000001FB93142000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/944-11-0x000001FB94EE0000-0x000001FB94EF4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c5e0-299.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1832-306-0x00000270FD140000-0x00000270FD182000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1832-321-0x00000270FF9B0000-0x00000270FF9C4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.lnk	2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.lnk	2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe

Executes dropped EXE 3 IoCs

pid	Process
972	yxzxikji.lql.exe
1832	2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
5904	4xspmzgy.qud.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ProviderPasswordCharacterGroups = "2"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018C017D8351653"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Thu, 16 Jul 2026 04:13:33 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ProviderPasswordLength = "8"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1784336083"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={CA9429C2-6916-4B03-AC98-93B0F8ECFE4A}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
972	yxzxikji.lql.exe
5904	4xspmzgy.qud.exe
5904	4xspmzgy.qud.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5976	explorer.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	944	2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Token: SeDebugPrivilege	972	yxzxikji.lql.exe
Token: SeAuditPrivilege	3588	svchost.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeDebugPrivilege	1832	2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Token: SeDebugPrivilege	5904	4xspmzgy.qud.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe
Token: SeShutdownPrivilege	5976	explorer.exe
Token: SeCreatePagefilePrivilege	5976	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 972	944	2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe	88
PID 972 wrote to memory of 752	972	yxzxikji.lql.exe	5
PID 972 wrote to memory of 992	972	yxzxikji.lql.exe	9
PID 972 wrote to memory of 1000	972	yxzxikji.lql.exe	10
PID 972 wrote to memory of 1008	972	yxzxikji.lql.exe	11
PID 972 wrote to memory of 1032	972	yxzxikji.lql.exe	13
PID 972 wrote to memory of 1120	972	yxzxikji.lql.exe	14
PID 972 wrote to memory of 1180	972	yxzxikji.lql.exe	15
PID 972 wrote to memory of 1208	972	yxzxikji.lql.exe	16
PID 972 wrote to memory of 1256	972	yxzxikji.lql.exe	17
PID 972 wrote to memory of 1332	972	yxzxikji.lql.exe	18
PID 972 wrote to memory of 1440	972	yxzxikji.lql.exe	20
PID 972 wrote to memory of 1488	972	yxzxikji.lql.exe	22
PID 972 wrote to memory of 1596	972	yxzxikji.lql.exe	23
PID 972 wrote to memory of 1604	972	yxzxikji.lql.exe	24
PID 972 wrote to memory of 1716	972	yxzxikji.lql.exe	25
PID 972 wrote to memory of 1740	972	yxzxikji.lql.exe	26
PID 972 wrote to memory of 1780	972	yxzxikji.lql.exe	27
PID 972 wrote to memory of 1304	972	yxzxikji.lql.exe	28
PID 972 wrote to memory of 1724	972	yxzxikji.lql.exe	29
PID 972 wrote to memory of 1864	972	yxzxikji.lql.exe	30
PID 972 wrote to memory of 2080	972	yxzxikji.lql.exe	31
PID 972 wrote to memory of 2088	972	yxzxikji.lql.exe	32
PID 972 wrote to memory of 2244	972	yxzxikji.lql.exe	33
PID 972 wrote to memory of 2320	972	yxzxikji.lql.exe	34
PID 972 wrote to memory of 2396	972	yxzxikji.lql.exe	35
PID 972 wrote to memory of 2528	972	yxzxikji.lql.exe	36
PID 972 wrote to memory of 2540	972	yxzxikji.lql.exe	37
PID 972 wrote to memory of 2640	972	yxzxikji.lql.exe	38
PID 972 wrote to memory of 2688	972	yxzxikji.lql.exe	39
PID 972 wrote to memory of 2768	972	yxzxikji.lql.exe	40
PID 972 wrote to memory of 2784	972	yxzxikji.lql.exe	41
PID 972 wrote to memory of 2804	972	yxzxikji.lql.exe	42
PID 972 wrote to memory of 2944	972	yxzxikji.lql.exe	43
PID 972 wrote to memory of 2264	972	yxzxikji.lql.exe	44
PID 972 wrote to memory of 3108	972	yxzxikji.lql.exe	46
PID 972 wrote to memory of 3128	972	yxzxikji.lql.exe	47
PID 972 wrote to memory of 3208	972	yxzxikji.lql.exe	48
PID 972 wrote to memory of 3476	972	yxzxikji.lql.exe	50
PID 972 wrote to memory of 3556	972	yxzxikji.lql.exe	51
PID 972 wrote to memory of 3588	972	yxzxikji.lql.exe	52
PID 972 wrote to memory of 3620	972	yxzxikji.lql.exe	53
PID 972 wrote to memory of 3632	972	yxzxikji.lql.exe	54
PID 972 wrote to memory of 3652	972	yxzxikji.lql.exe	55
PID 972 wrote to memory of 3684	972	yxzxikji.lql.exe	56
PID 972 wrote to memory of 3144	972	yxzxikji.lql.exe	57
PID 972 wrote to memory of 1268	972	yxzxikji.lql.exe	58
PID 972 wrote to memory of 4400	972	yxzxikji.lql.exe	59
PID 972 wrote to memory of 4432	972	yxzxikji.lql.exe	60
PID 972 wrote to memory of 4500	972	yxzxikji.lql.exe	61
PID 972 wrote to memory of 4596	972	yxzxikji.lql.exe	62
PID 972 wrote to memory of 4848	972	yxzxikji.lql.exe	63
PID 972 wrote to memory of 4944	972	yxzxikji.lql.exe	64
PID 972 wrote to memory of 5136	972	yxzxikji.lql.exe	65
PID 972 wrote to memory of 5252	972	yxzxikji.lql.exe	66
PID 972 wrote to memory of 5292	972	yxzxikji.lql.exe	67
PID 972 wrote to memory of 5492	972	yxzxikji.lql.exe	70
PID 972 wrote to memory of 3460	972	yxzxikji.lql.exe	72
PID 972 wrote to memory of 3680	972	yxzxikji.lql.exe	74
PID 972 wrote to memory of 3004	972	yxzxikji.lql.exe	75
PID 972 wrote to memory of 5132	972	yxzxikji.lql.exe	78
PID 972 wrote to memory of 2780	972	yxzxikji.lql.exe	79
PID 972 wrote to memory of 2368	972	yxzxikji.lql.exe	80
PID 972 wrote to memory of 5976	972	yxzxikji.lql.exe	81

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:752
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:1000
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1208

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:992

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-fa6f0863-fea1-47ac-9fec-113d7da3a6fe -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5aa21c36-be47-427d-b13a-88638b15863a -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-6c3de275-789c-4c24-9ef1-b1b6dd8c8872 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-9e1a463d-dd2f-456e-9d60-6035dbc5ee2b -LifetimeId:f4a0d3ca-55d4-417b-824b-6fdb9d8c3f62 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:1120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1724
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2368
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe"
      4⤵
      Drops startup file
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:944
    - - C:\Users\Admin\AppData\Local\Temp\yxzxikji.lql.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yxzxikji.lql.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2080

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2640
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000260;000000000000026C;
  2⤵
  PID:4944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2944

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3208

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1268

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4400

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4596

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4848

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5136

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5252

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:3460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5132

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3196

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4988

C:\Users\Public\2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
C:\Users\Public\2026-0~1.EXE
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1832
- C:\Users\Admin\AppData\Local\Temp\4xspmzgy.qud.exe
  "C:\Users\Admin\AppData\Local\Temp\4xspmzgy.qud.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yxzxikji.lql.exe

Path C:\Users\Admin\AppData\Local\Temp\yxzxikji.lql.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.lnk
Size 1KB
SHA256 564c2c6beb0a665bb1d0d26b58d6fbc37e82e17adb61c94409ba2f7426824834
MD5 f2008603ba4604b4822754245e5a8f00
SHA1 53f64f67c36bb2bba2d44f587a6ceebad744ed36
SHA512 42b90df1e92bd517859159ce02a264ea64adb41135a83a1393eea78b944de2eb1e44c0d93670e368e88d3103d7e5f37dd9b58d13051d9001f9d1dfc92f6335d1
TLSH
T128219D0A4B822F63E2B24536F8F5A113EA627D83FAD41F4A02C1438C0C36247BA45D1F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe

Path C:\Users\Public\2026-07-18_a1a45a8c49f81f0d755cfaa066a888f9_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Size 239KB
SHA256 245240deb5ff9581c5f3cf06e1654ec09fe65b1b50c4603d436fef9d6d24072c
MD5 a1a45a8c49f81f0d755cfaa066a888f9
SHA1 2c64102d8ae3039b0d6eb0648c7a58173e224313
SHA512 32dfba14dfdee0c823596dca26b19f250a75df18bcff7a9a8c893b0a244dd2c19fc83a490e10d7721f3e1e22fad75a6977714a66ef4079e3c4a804de999f5982
SSDEEP 6144:/09ebj/5bTgVziHzZnSKrCbYMQWNNrpw8Aq:/09O/5/gVziHlBrCbYV89
TLSH
T155346D07B7E100B7E5BE827589B39A17F7B2F02603219BFF1A94459E1F537809D29B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-19-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/752-113-0x0000022B23BC0000-0x0000022B23BEB000-memory.dmp

Download

memory/752-18-0x0000022B23BC0000-0x0000022B23BEB000-memory.dmp

Download

memory/752-17-0x0000022B23B90000-0x0000022B23BB5000-memory.dmp

Download

memory/752-464-0x0000022B23BC0000-0x0000022B23BEB000-memory.dmp

Download

memory/944-472-0x000001FBAD8D0000-0x000001FBAD8E0000-memory.dmp

Download

memory/944-11-0x000001FB94EE0000-0x000001FB94EF4000-memory.dmp

Download

memory/944-2-0x000001FB94D50000-0x000001FB94D7C000-memory.dmp

Download

memory/944-4-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/944-1-0x000001FB93100000-0x000001FB93142000-memory.dmp

Download

memory/944-291-0x000001FBAD8D0000-0x000001FBAD8E0000-memory.dmp

Download

memory/944-459-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/944-14-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/944-16-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp

Download

memory/944-0-0x00007FFCFEB4F000-0x00007FFCFEB50000-memory.dmp

Download

memory/972-13-0x00007FFD21820000-0x00007FFD21A83000-memory.dmp

Download

memory/972-15-0x00007FFD20480000-0x00007FFD20547000-memory.dmp

Download

memory/992-23-0x0000022E7F260000-0x0000022E7F28B000-memory.dmp

Download

memory/992-465-0x0000022E7F260000-0x0000022E7F28B000-memory.dmp

Download

memory/992-24-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/992-114-0x0000022E7F260000-0x0000022E7F28B000-memory.dmp

Download

memory/1000-286-0x0000023A832C0000-0x0000023A832EB000-memory.dmp

Download

memory/1000-470-0x0000023A832C0000-0x0000023A832EB000-memory.dmp

Download

memory/1000-26-0x0000023A832C0000-0x0000023A832EB000-memory.dmp

Download

memory/1000-27-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1008-104-0x0000021225320000-0x000002122534B000-memory.dmp

Download

memory/1008-285-0x0000021225320000-0x000002122534B000-memory.dmp

Download

memory/1008-469-0x0000021225320000-0x000002122534B000-memory.dmp

Download

memory/1008-105-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1032-108-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1032-107-0x0000021B4EFB0000-0x0000021B4EFDB000-memory.dmp

Download

memory/1120-111-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1120-110-0x0000015353150000-0x000001535317B000-memory.dmp

Download

memory/1180-119-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1180-118-0x0000020E01D10000-0x0000020E01D3B000-memory.dmp

Download

memory/1208-115-0x000002B29EA70000-0x000002B29EA9B000-memory.dmp

Download

memory/1208-35-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1208-34-0x000002B29EA70000-0x000002B29EA9B000-memory.dmp

Download

memory/1208-466-0x000002B29EA70000-0x000002B29EA9B000-memory.dmp

Download

memory/1256-121-0x0000024AFBEB0000-0x0000024AFBEDB000-memory.dmp

Download

memory/1256-122-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1304-145-0x000001B0AD9C0000-0x000001B0AD9EB000-memory.dmp

Download

memory/1304-146-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1332-125-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1332-124-0x00000296FBDF0000-0x00000296FBE1B000-memory.dmp

Download

memory/1440-127-0x0000024C04A10000-0x0000024C04A3B000-memory.dmp

Download

memory/1440-128-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1488-467-0x0000021938300000-0x000002193832B000-memory.dmp

Download

memory/1488-116-0x0000021938300000-0x000002193832B000-memory.dmp

Download

memory/1488-42-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1488-41-0x0000021938300000-0x000002193832B000-memory.dmp

Download

memory/1596-130-0x00000288ED8F0000-0x00000288ED91B000-memory.dmp

Download

memory/1596-131-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1604-133-0x000001BDF3230000-0x000001BDF325B000-memory.dmp

Download

memory/1604-134-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1716-137-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1716-136-0x000002AF9E440000-0x000002AF9E46B000-memory.dmp

Download

memory/1724-149-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1724-148-0x000002ACC3BB0000-0x000002ACC3BDB000-memory.dmp

Download

memory/1740-140-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1740-139-0x0000020C4BC70000-0x0000020C4BC9B000-memory.dmp

Download

memory/1780-143-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1780-142-0x00000213AE5E0000-0x00000213AE60B000-memory.dmp

Download

memory/1832-321-0x00000270FF9B0000-0x00000270FF9C4000-memory.dmp

Download

memory/1832-306-0x00000270FD140000-0x00000270FD182000-memory.dmp

Download

memory/1864-152-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/1864-151-0x0000021AF6E40000-0x0000021AF6E6B000-memory.dmp

Download

memory/2080-154-0x000001B4ADA80000-0x000001B4ADAAB000-memory.dmp

Download

memory/2080-155-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/2088-157-0x000001D199450000-0x000001D19947B000-memory.dmp

Download

memory/2088-158-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/2244-160-0x000001F5F33C0000-0x000001F5F33EB000-memory.dmp

Download

memory/2244-162-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/2320-164-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/2320-161-0x0000025F1EED0000-0x0000025F1EEFB000-memory.dmp

Download

memory/2396-166-0x00000179A1EA0000-0x00000179A1ECB000-memory.dmp

Download

memory/2396-167-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/2528-169-0x000001EDABDA0000-0x000001EDABDCB000-memory.dmp

Download

memory/2528-170-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/2540-172-0x0000011148FB0000-0x0000011148FDB000-memory.dmp

Download

memory/2540-173-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/2640-175-0x000002833C760000-0x000002833C78B000-memory.dmp

Download

memory/2640-176-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/2688-178-0x000002AB6D520000-0x000002AB6D54B000-memory.dmp

Download

memory/4944-84-0x0000027A9A910000-0x0000027A9A93B000-memory.dmp

Download

memory/4944-468-0x0000027A9A910000-0x0000027A9A93B000-memory.dmp

Download

memory/4944-85-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/4944-117-0x0000027A9A910000-0x0000027A9A93B000-memory.dmp

Download

memory/5976-463-0x0000000000FD0000-0x0000000000FFB000-memory.dmp

Download

memory/5976-99-0x00007FFCE1960000-0x00007FFCE1970000-memory.dmp

Download

memory/5976-284-0x0000000000FD0000-0x0000000000FFB000-memory.dmp

Download

memory/5976-98-0x0000000000FD0000-0x0000000000FFB000-memory.dmp

Download