5068003aa8214d1e283ece7b013418aeea838255ebc9ebe2d7495093bb3f79da

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_252939b0580d10ce3f76d986472126dd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.9MB
Sample260810-dd8tsstyb1
SHA256 5068003aa8214d1e283ece7b013418aeea838255ebc9ebe2d7495093bb3f79da
MD5 252939b0580d10ce3f76d986472126dd
SHA1 e32ce42203df2b715aa30b812568c57986e3740e
SHA512 a51af6c97a710a68757c2da3c73fc6d58f699c1df912b5225ce45c9637e53ffddfd8e24d7a6f6f59051cde5cf4411e42db42e544e0a218539144300a4a3c50c2
SSDEEP 49152:U+EPiw21D+EPiw21D+EPiw21D+EPiw213b6LgA97HrsdochZVNhcOgs0F2oHN8k3:0A91pH2WpjHrgBFFu416AWvV
TLSH
T147865C5562EB20ECE0BFE17989768731E6B27C530231938F127CD65A2F636946D38723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1512	svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe
4476	svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe
1740	svchost_BCCABACAAAAABCCACCCABAACAAABACACBABCBBBCABABCBAAAACBAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCBAABCAACBCCCBBCBCBBACCBAABBBCABCABBBBCBBBAAABACABCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe"	2026-08-10_252939b0580d10ce3f76d986472126dd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCBBBBAABCBAABCAACCABCABBAABBAAACCBABCBCBABCBCACBBABCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCABACAAAAABCCACCCABAACAAABACACBABCBBBCABABCBAAAACBAAB.exe"	svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3968	sc.exe
4508	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1400	cmd.exe
3780	cmd.exe
1000	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCABACAAAAABCCACCCABAACAAABACACBABCBBBCABABCBAAAACBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_252939b0580d10ce3f76d986472126dd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4584	2026-08-10_252939b0580d10ce3f76d986472126dd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4584	2026-08-10_252939b0580d10ce3f76d986472126dd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4584	2026-08-10_252939b0580d10ce3f76d986472126dd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4584	2026-08-10_252939b0580d10ce3f76d986472126dd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
1512	svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe
1512	svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe
1512	svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe
1512	svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe
1740	svchost_BCCABACAAAAABCCACCCABAACAAABACACBABCBBBCABABCBAAAACBAAB.exe
1740	svchost_BCCABACAAAAABCCACCCABAACAAABACACBABCBBBCABABCBAAAACBAAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	2026-08-10_252939b0580d10ce3f76d986472126dd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1512	svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe
Token: SeDebugPrivilege	1740	svchost_BCCABACAAAAABCCACCCABAACAAABACACBABCBBBCABABCBAAAACBAAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3492	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 1400	4584	2026-08-10_252939b0580d10ce3f76d986472126dd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	102
PID 1400 wrote to memory of 5100	1400	cmd.exe	104
PID 4584 wrote to memory of 3780	4584	2026-08-10_252939b0580d10ce3f76d986472126dd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	110
PID 3780 wrote to memory of 3968	3780	cmd.exe	112
PID 4584 wrote to memory of 1000	4584	2026-08-10_252939b0580d10ce3f76d986472126dd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	113
PID 1000 wrote to memory of 4508	1000	cmd.exe	115
PID 1512 wrote to memory of 1860	1512	svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe	117
PID 1860 wrote to memory of 4248	1860	notepad.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-10_252939b0580d10ce3f76d986472126dd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_252939b0580d10ce3f76d986472126dd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBACABAAACCCCCBBACBACBBACABCABBAAABCABABBABCBCABAABCCAAAABBBABBCACBBBCBCBCABBBCBABACBACACBCCCACCBCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBACABAAACCCCCBBACBACBBACABCABBAAABCABABBABCBCABAABCCAAAABBBABBCACBBBCBCBCABBBCBABACBACACBCCCACCBCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCABCABCBABCCBBAAABCCCBABACACCCABBABABBBBACBBBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe" start= auto displayName= "UserDataSvc_CABCABCABCBABCCBBAAABCCCBABACACCCABBABABBBBACBBBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCABCABCBABCCBBAAABCCCBABACACCCABBABABBBBACBBBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe" start= auto displayName= "UserDataSvc_CABCABCABCBABCCBBAAABCCCBABACACCCABBABABBBBACBBBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCABCABCBABCCBBAAABCCCBABACACCCABBABABBBBACBBBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCABCABCBABCCBBAAABCCCBABACACCCABBABABBBBACBBBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe
1⤵
- Executes dropped EXE
PID:4476

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABACAAAAABCCACCCABAACAAABACACBABCBBBCABABCBAAAACBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABACAAAAABCCACCCABAACAAABACACBABCBBBCABABCBAAAACBAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8e9cbf7effba3f04537b60cd15ed76bbf3abe65e3621d10f5bc8d92179a37e6d
MD5 fbe8b1ff2cafab0b01680f4661e92281
SHA1 ed110fcc846712443b26f4130137ad8dfd49eb04
SHA512 9eec0d90228c7639bdbb9a96cde502eee0c4848784b64260e057b4354d9956ce49c54b083eb48d0e5b8a6c6d0d62ffc2748cef6ac605c6191a740b6da2bd3552
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 50b2dde94b95ac5b80c55b952c65d6304f8d5bb0f0f540d61b07059aa06cc845
MD5 42128839ef51a2c7eaa404c9c235c595
SHA1 5b453707779c1f260e3fe148dc8423d63f7659e4
SHA512 af8a32246cdb719415de161ca925afc82088ee932ef1e5aa0a176f394a26c6ba8596ebffda93841206a37ef0f5d9bfbaf08cdfc38f85217d0a87140867b9fcf1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5466876f257193097477b8c69c016f74315f79ee6fc571f315d9c53b73d0265b
MD5 0a7de794c88197a64b39cb0f43e7481c
SHA1 67a2d337842ce29a3f4949bb3ebce2e73fca1b08
SHA512 70612fc5b172e610d19601be4f79884c9d8a28d803c9fbc5c6f050b307a5369b6e32ff4ea54a2a82b68382fc18838e8a33f34f1653ed5b9fb6c73c8fa372b440
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b883ca388f3be46fd69bbcd73f7f0578a429c568e477021d26cedde1da5551cc
MD5 4efa85b0de72aaa619b4065bc781ef86
SHA1 50178252dc34520d8959874fa47ff61f1b5835c6
SHA512 de285f0901021c6065e4f960feb2a01a3b35e7c565d951ba9036595f3bb3d400a63c3e2ac90ff966d1e8c765dd992f5fef3f2c7cde95fd18e21bec1a2fbff3db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be14b3fa28f372bae3f4c18790c68a368eec72ca73239bda493c1aeb305c5ebd
MD5 eb18e34f55c03d18b365e034673794f6
SHA1 7df9647125dd49e7ec1ca30f5be30c36d95a0f94
SHA512 df815d596e605311ffcc0185a4b39c8af3d7bc6aeab8a0716111bcd2c4a421067fc68a41544c926f958c5705ddbafe6407b34f71250a9b35e4c1463fcd0bbd3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 99c7af54e424ee38abb7079e06d1167c929a2d8746568d0a93a8cdb1bd7556d3
MD5 437ef9e0c2242db72fb04aba74b24e15
SHA1 a2316fa9e4368ff7ce0004fc4d27431ec442482a
SHA512 32795b9f430ae1a9bb91c708cd9ddadf705d1108ece8e6c258dadd06f172a2ae4f4fc0a11eff15bdf22cb8c2654edcf6d9989aa6fc1ea316d685760ed2068c95
MD5 SHA1 SHA512

Submit Download

svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABABCBCBCABAAAABCCAABCCBCCCCAAABCCCAAAACABBAAAABBAC.exe
Size 7.9MB
SHA256 5068003aa8214d1e283ece7b013418aeea838255ebc9ebe2d7495093bb3f79da
MD5 252939b0580d10ce3f76d986472126dd
SHA1 e32ce42203df2b715aa30b812568c57986e3740e
SHA512 a51af6c97a710a68757c2da3c73fc6d58f699c1df912b5225ce45c9637e53ffddfd8e24d7a6f6f59051cde5cf4411e42db42e544e0a218539144300a4a3c50c2
SSDEEP 49152:U+EPiw21D+EPiw21D+EPiw21D+EPiw213b6LgA97HrsdochZVNhcOgs0F2oHN8k3:0A91pH2WpjHrgBFFu416AWvV
TLSH
T147865C5562EB20ECE0BFE17989768731E6B27C530231938F127CD65A2F636946D38723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 053f31883e603fceb4c1db8d9e58559fd8ee0e1ad305bb9ff5cd2ed238d49742
MD5 53f036d953ce146b8d322f79baad06b2
SHA1 aa9333b8248b72a8421731e4b61e313af986f77a
SHA512 b8c8b57d72661a08bc5cee0765476e66348a8120c558624b5c6027140c395fbb49ae798a2e229593efbb0144f502b42bd1c37dfd3a040402e6f540791c6573d1
TLSH
T10511C47154B9DC93EA2369DBD61DABA30CD0369F789C6E041349421C6FD4C22CE598E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1512-25-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/1512-38-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/1860-67-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/4476-75-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/4584-6-0x0000000000130000-0x0000000000151000-memory.dmp

Download