f17a6de78e37b2d4e021f4a1585623cfb474ecb0956a1a1c2224f58b6192d506

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_8ae4b493ebfb8db89715ded7e6dac113_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Size 16.5MB
Sample260810-e3q6qabj4x
SHA256 f17a6de78e37b2d4e021f4a1585623cfb474ecb0956a1a1c2224f58b6192d506
MD5 8ae4b493ebfb8db89715ded7e6dac113
SHA1 76fcdf7106b10cd5e11f12cbd5ad3394be15fb9a
SHA512 dcc264b72112caf4d511174bb8a624c0d4060686eb61f1f4c35d98fccb2561dc25f9848fe81f43915c861c52f1041eddb83e98ddf45678787140cfaeea3a09eb
SSDEEP 98304:T7pW7pW7pW7pW7pW7pW7pW7pW7pW7pk7pW7pW7pW7pW7pW7pW7pW7pW7pW7pnA9W:EmHpn6F44IAWvO
TLSH
T107074A11B3EA60F8F1B757319E758275DA767C629C31870F23A8960E1E72A50AD34B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2972	svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe
3700	svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe
3272	svchost_AABCACCBABBACCCABBCCCABBBCBCBCCBAACCAAABCBBCABBCBCBBAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCCABABBCCBBBAABBBABBBCCCCBAABCBABBAABBBACCBACABABAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe"	2026-08-10_8ae4b493ebfb8db89715ded7e6dac113_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACAAABBAAAACBACCAAACBAACBBBACCCAAACBCBCABBABACCCAAACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCACCBABBACCCABBCCCABBBCBCBCCBAACCAAABCBBCABBCBCBBAAC.exe"	svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3236	sc.exe
3592	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5876	cmd.exe
1444	cmd.exe
5364	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_8ae4b493ebfb8db89715ded7e6dac113_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCACCBABBACCCABBCCCABBBCBCBCCBAACCAAABCBBCABBCBCBBAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1448	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3876	2026-08-10_8ae4b493ebfb8db89715ded7e6dac113_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
3876	2026-08-10_8ae4b493ebfb8db89715ded7e6dac113_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
3876	2026-08-10_8ae4b493ebfb8db89715ded7e6dac113_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
3876	2026-08-10_8ae4b493ebfb8db89715ded7e6dac113_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
2972	svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe
2972	svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe
2972	svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe
2972	svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3876	2026-08-10_8ae4b493ebfb8db89715ded7e6dac113_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	2972	svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 5364	3876	2026-08-10_8ae4b493ebfb8db89715ded7e6dac113_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe	92
PID 5364 wrote to memory of 1448	5364	cmd.exe	94
PID 3876 wrote to memory of 5876	3876	2026-08-10_8ae4b493ebfb8db89715ded7e6dac113_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe	95
PID 5876 wrote to memory of 3592	5876	cmd.exe	97
PID 3876 wrote to memory of 1444	3876	2026-08-10_8ae4b493ebfb8db89715ded7e6dac113_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe	98
PID 1444 wrote to memory of 3236	1444	cmd.exe	100
PID 2972 wrote to memory of 1676	2972	svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_8ae4b493ebfb8db89715ded7e6dac113_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_8ae4b493ebfb8db89715ded7e6dac113_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBCCCBCAABAABCBCBCAABACCABCBACCACACBCCBACAAAABCCCACABBBABCAABCACBAAAACBABCBBAAAACCCACBCCCCCCBAACAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBCCCBCAABAABCBCBCAABACCABCBACCACACBCCBACAAAABCCCACABBBABCAABCACBAAAACBABCBBAAAACCCACBCCCCCCBAACAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACACCBCCBCCCCCBAABAABCBBBACBACAACCCCBABAAACABCBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe" start= auto displayName= "UserDataSvc_BACACCBCCBCCCCCBAABAABCBBBACBACAACCCCBABAAACABCBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5876
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACACCBCCBCCCCCBAABAABCBBBACBACAACCCCBABAAACABCBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe" start= auto displayName= "UserDataSvc_BACACCBCCBCCCCCBAABAABCBBBACBACAACCCCBABAAACABCBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACACCBCCBCCCCCBAABAABCBBBACBACAACCCCBABAAACABCBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACACCBCCBCCCCCBAABAABCBBBACBACAACCCCBABAAACABCBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1676

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe
1⤵
- Executes dropped EXE
PID:3700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCBABBACCCABBCCCABBBCBCBCCBAACCAAABCBBCABBCBCBBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCBABBACCCABBCCCABBBCBCBCCBAACCAAABCBBCABBCBCBBAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 13b14a21c775b2f02170ed7880adb07bfdc11d4b8ef56f3a90ae76b239af626f
MD5 c2a1e7dc79bb8f978c2e88a0a4ba56f0
SHA1 f6925db4313c40fab378481654e30c3e6c544e75
SHA512 44ecfa37ccd47869ddd85463e292eb85bdafa78a78f889b4e64ee6f55e04b349b90b6f2924e30efa384f337487429dc321d8aa849d70d1e5487260e3ae919949
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a3cdd448c6980be2ecc030875b97cfa5f65c68406d9b31d9a713f6b18e08ed05
MD5 0b080b1705c053f0738738bb180c20bd
SHA1 b0c8bc6b650a2db35fe1830f339fd5b061cbd0b8
SHA512 f4fcb1b4e106130054fd1f712326188dcc1823e19d18036fe8119665085b6b4339b4566a0362892c6eaf2118a5a2dc6f33956d76afbe2f2bae185af41579b2da
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 726020785ab325eba10d6684ee6bff9f41a7ff5a6edeb006cf03b218c2a8d5c8
MD5 596bb4ed4753c1387cc75c0e6f7b8335
SHA1 9c2c6d60f5442f9b38bf71c6a8584ef931459e5c
SHA512 c31f3865aa2f54eb4dc2a2d2c8417fbd76fb20a005836512a78c0940c6a4625efc698f7a38c84f7877914e43e1e58928e4ef21937d6bf9b10c8ca139a8ae88cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dca7316764c384159819bf8728de09164fb4aa2f8c5e5686e3fbb433cbb6209c
MD5 8592aeca8dbec53722ea04669605a0cc
SHA1 2355ba47481034242f35530af1fcaa4fcf661a6c
SHA512 a25aa4a0125bbf698b74b3f6fa6ee8e345b2f661f4953cd4efb58017379f3a4e0c0f06f410feec08dbd5a425e5226d3a9feec6a9eb5124408735e56a27b97d5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fe19a621368a55f2fa55d5a25bb4847a21ebc82a98e7ef3d853f01e1d4e01e95
MD5 c9a77e000cf160fc7f3eb8600d9a1522
SHA1 96f64b152d2fc293562e66faa22a1f2d7108d1b5
SHA512 241656249c9017ab6e89f7b99eda21e0ba3b38a239a01bbde470add4dbebd18582968bc78eb03a1574a421c29cacb2c88640e9c4265c4d4a67e44ea6be54d0ed
MD5 SHA1 SHA512

Submit Download

svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCBCBCCBCABBAACAAACABBABCCBCBBCACACACCCACAABAAABACAA.exe
Size 16.5MB
SHA256 f17a6de78e37b2d4e021f4a1585623cfb474ecb0956a1a1c2224f58b6192d506
MD5 8ae4b493ebfb8db89715ded7e6dac113
SHA1 76fcdf7106b10cd5e11f12cbd5ad3394be15fb9a
SHA512 dcc264b72112caf4d511174bb8a624c0d4060686eb61f1f4c35d98fccb2561dc25f9848fe81f43915c861c52f1041eddb83e98ddf45678787140cfaeea3a09eb
SSDEEP 98304:T7pW7pW7pW7pW7pW7pW7pW7pW7pW7pk7pW7pW7pW7pW7pW7pW7pW7pW7pW7pnA9W:EmHpn6F44IAWvO
TLSH
T107074A11B3EA60F8F1B757319E758275DA767C629C31870F23A8960E1E72A50AD34B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2972-23-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/2972-36-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/3700-66-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/3876-0-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/3876-7-0x0000000000460000-0x0000000000481000-memory.dmp

Download