2f3fdf259a9425b8314a55f064e91e4ac898347de731cbe9c764915eb4245365

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_884d66f13b620fb5bfa7bf1ef965491f_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Size 42.3MB
Sample260810-e4ybes1dqc
SHA256 2f3fdf259a9425b8314a55f064e91e4ac898347de731cbe9c764915eb4245365
MD5 884d66f13b620fb5bfa7bf1ef965491f
SHA1 49f01106f779292df659c6f211e5fca8de6ca4f6
SHA512 655d77e41f128913847ecb186d5e5dafd6fd3c0719822acb99597a846ff4026a9ed8416c6e42f62b7dc301a2e9b940c668ccb242327878e61b13da85aabdc999
SSDEEP 393216:iZahvQHrc8u3xXqZahvQHrc8u3xXqZahvQHrc8u3xXqZahvQHrc8u3xXRk:iSvQHrKaSvQHrKaSvQHrKaSvQHrKBk
TLSH
T1F7A79D27F29900E5C42ED178C75B8623DA7A7C554724AADF06A076252F33BF01B3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024232-21.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2208	svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe
4160	svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe
2532	svchost_BACAAACCCACACCBCABBCBCAACACCCBCBBBCBAABCCAACBAAABAAABAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBAACBBCCBCCAAACCCBABAAACCCABBBBCCBABBBCCBBBBABABBCAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe"	2026-08-10_884d66f13b620fb5bfa7bf1ef965491f_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBCBCAACBCCBBBABCBAABBABABBCACACCBACAAAAACBCAAABBBBAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACAAACCCACACCBCABBCBCAACACCCBCBBBCBAABCCAACBAAABAAABAC.exe"	svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3336	sc.exe
3688	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3924	cmd.exe
4564	cmd.exe
1984	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACAAACCCACACCBCABBCBCAACACCCBCBBBCBAABCCAACBAAABAAABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_884d66f13b620fb5bfa7bf1ef965491f_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4704	2026-08-10_884d66f13b620fb5bfa7bf1ef965491f_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4704	2026-08-10_884d66f13b620fb5bfa7bf1ef965491f_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4704	2026-08-10_884d66f13b620fb5bfa7bf1ef965491f_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4704	2026-08-10_884d66f13b620fb5bfa7bf1ef965491f_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
2208	svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe
2208	svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe
2208	svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe
2208	svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	2026-08-10_884d66f13b620fb5bfa7bf1ef965491f_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2208	svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4984	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4564	4704	2026-08-10_884d66f13b620fb5bfa7bf1ef965491f_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	100
PID 4564 wrote to memory of 4288	4564	cmd.exe	102
PID 2208 wrote to memory of 3332	2208	svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe	103
PID 3332 wrote to memory of 4420	3332	notepad.exe	104
PID 4704 wrote to memory of 1984	4704	2026-08-10_884d66f13b620fb5bfa7bf1ef965491f_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	106
PID 1984 wrote to memory of 3336	1984	cmd.exe	108
PID 4704 wrote to memory of 3924	4704	2026-08-10_884d66f13b620fb5bfa7bf1ef965491f_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	109
PID 3924 wrote to memory of 3688	3924	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-10_884d66f13b620fb5bfa7bf1ef965491f_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_884d66f13b620fb5bfa7bf1ef965491f_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABBCACABACBCABBACBCCAABCBBACBACCCBCCCABCCCACBACAABBBAAACBCABBCBCBBBBABBBABCCBBBCBCBBBBBBBCCAACABCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABBCACABACBCABBACBCCAABCBBACBACCCBCCCABCCCACBACAABBBAAACBCABBCBCBBBBABBBABCCBBBCBCBBBBBBBCCAACABCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBABABBBCCCBAAAABBACBAABBBAABCCABABCCCBACCABACABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe" start= auto displayName= "UserDataSvc_CBBABABBBCCCBAAAABBACBAABBBAABCCABABCCCBACCABACABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBABABBBCCCBAAAABBACBAABBBAABCCABABCCCBACCABACABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe" start= auto displayName= "UserDataSvc_CBBABABBBCCCBAAAABBACBAABBBAABCCABABCCCBACCABACABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBABABBBCCCBAAAABBACBAABBBAABCCABABCCCBACCABACABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBABABBBCCCBAAAABBACBAABBBAABCCABABCCCBACCABACABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3688

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4420

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4984

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe
1⤵
- Executes dropped EXE
PID:4160

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAAACCCACACCBCABBCBCAACACCCBCBBBCBAABCCAACBAAABAAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAAACCCACACCBCABBCBCAACACCCBCBBBCBAABCCAACBAAABAAABAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e120468d5ba58fbc3e0e4dc6e3eddd0450c9cf94ba491eea4cdf7ad6ac812582
MD5 ab077412d484f972854790965307b65f
SHA1 cc2b375cd9a3943709ac113de6415afef6beff55
SHA512 ec26e8dee69a6b45dee80afd722a3c78d7c8b6f04edbefefcba17fe8d2052f15fdf00f4f91f685b3adbfb83766372e382c0682ba51116014f66cb2fdad5031d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6d89918b34d42e8b513abde5fb1008fb81c00da03741610f41cdeafb7cbe802f
MD5 e944e7b1c9de01939568aeee9fe78fea
SHA1 6e3efacf66523bc144d6a03d8127af1d8f769d66
SHA512 3af469703c3de1fa8c212d8ed54211419677b2857bc45ade9059b785211c9b2935d95ad50d0185b365814f32f90414907c4904558129300a92ae00db0470ddc3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6780bfaa00e78fd5bd549fb2a94f09efbe4b1ff0c9565b36cf90815300d768fa
MD5 b7bf4986025120391c2d11f7e2e6cf21
SHA1 d22978a2ebe626cd25f4c1af4ed0b729a2e98f04
SHA512 adea1c40e9dc4462d80abdcec4b752d3d3a4d7ea80933b4faa61ca78c4e763f86976de0c1422f101c56c9f4838ae8d2e45394c7f29630772a2dc095a39feaf60
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a7d452d3d0fac7474248933762e43fb5d5758aec80c386844cc4d5c1cd3efe8c
MD5 fd0ce0e15a131afcd0306da380b64ce8
SHA1 de273bae7b6a79ad802172468c58803fa7199096
SHA512 b07b6d8938ab234656cac0303317c669dca119fa2bee41c379400a47fb217cfeb1b1db524d24d580cd5e86aad3a1d728edc84ff3cf22b68f8d77ac36d3d5e977
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 80a057c31d1416f0311f72ca9986725b1c2d423e942adc975be5febebed0b76b
MD5 4593891e88006d0e88dfbbd6f82c9146
SHA1 8ff7e60f34bd143b6111bde1a4ecf71407de34e5
SHA512 895d6dcac43f19140831aac4ee8b79aff44de2e19070dd447a656bfd2816b34b5b2313d5a3883af5ba2f7cdd81f9904d5c0ab950527a0b20ab9feb8ee3d16736
MD5 SHA1 SHA512

Submit Download

svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAAACBCBAABBABBBAABABACBBABAAACABBBBCAACCACBCCBBACAA.exe
Size 42.3MB
SHA256 2f3fdf259a9425b8314a55f064e91e4ac898347de731cbe9c764915eb4245365
MD5 884d66f13b620fb5bfa7bf1ef965491f
SHA1 49f01106f779292df659c6f211e5fca8de6ca4f6
SHA512 655d77e41f128913847ecb186d5e5dafd6fd3c0719822acb99597a846ff4026a9ed8416c6e42f62b7dc301a2e9b940c668ccb242327878e61b13da85aabdc999
SSDEEP 393216:iZahvQHrc8u3xXqZahvQHrc8u3xXqZahvQHrc8u3xXqZahvQHrc8u3xXRk:iSvQHrKaSvQHrKaSvQHrKaSvQHrKBk
TLSH
T1F7A79D27F29900E5C42ED178C75B8623DA7A7C554724AADF06A076252F33BF01B3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2208-27-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/2208-37-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/3332-60-0x0000000005190000-0x0000000005191000-memory.dmp

Download

memory/4704-0-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/4704-7-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download