d638657616429c72762ba8165b8e24efd604216bbe4c339d7d7ccf3810285f58

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_7c64f5bdb83d8a7b9039a84691e0cb41_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Size 29.7MB
Sample260810-e8xkpavzhw
SHA256 d638657616429c72762ba8165b8e24efd604216bbe4c339d7d7ccf3810285f58
MD5 7c64f5bdb83d8a7b9039a84691e0cb41
SHA1 9afb02cbd20a57508341e05e1fd435c6c94c6a1e
SHA512 5024cb6321a595627f6fd204c0b44a411a6318ba2e6a5b6b840c43c4a1fa6529039f2e06a9e805288090a924bede8ceacca69d9d4f2917cd8775c40b6bd20510
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSsmHpn6F44IAWvW1tIDewjqkjiqMN:i33333333sLmHN6+JrvW8KwekyN
TLSH
T17867BF59FAA690E8EC6FE43488B7C332D5327D234432934B59E9F60A6F33A515C19732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c437-20.dat	UPX
behavioral2/files/0x000d00000001c437-61.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
3100	svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBAACBCCABABAABAAABBBCBCBBCABCCBAABACBCBAABCCACCBCCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe"	2026-08-10_7c64f5bdb83d8a7b9039a84691e0cb41_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
492	sc.exe
6068	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
956	cmd.exe
4980	cmd.exe
1636	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_7c64f5bdb83d8a7b9039a84691e0cb41_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5904	2026-08-10_7c64f5bdb83d8a7b9039a84691e0cb41_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
5904	2026-08-10_7c64f5bdb83d8a7b9039a84691e0cb41_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
5904	2026-08-10_7c64f5bdb83d8a7b9039a84691e0cb41_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
5904	2026-08-10_7c64f5bdb83d8a7b9039a84691e0cb41_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
3100	svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe
3100	svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5904	2026-08-10_7c64f5bdb83d8a7b9039a84691e0cb41_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3100	svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5904 wrote to memory of 956	5904	2026-08-10_7c64f5bdb83d8a7b9039a84691e0cb41_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	92
PID 956 wrote to memory of 6112	956	cmd.exe	94
PID 5904 wrote to memory of 4980	5904	2026-08-10_7c64f5bdb83d8a7b9039a84691e0cb41_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	95
PID 4980 wrote to memory of 492	4980	cmd.exe	97
PID 5904 wrote to memory of 1636	5904	2026-08-10_7c64f5bdb83d8a7b9039a84691e0cb41_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-10_7c64f5bdb83d8a7b9039a84691e0cb41_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_7c64f5bdb83d8a7b9039a84691e0cb41_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCCCCCAAAACABCBAAABCBAABACBABABCACABBBCCCCBCBACCCABBABBAACCAABCAACAABBBAABACAAAACCCCABBABBACCAAAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCCCCCAAAACABCBAAABCBAABACBABABCACABBBCCCCBCBACCCABBABBAACCAABCAACAABBBAABACAAAACCCCABBABBACCAAAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCCBCABBABCBBCAABAAAAABCAACACBBABBCBABCBACBCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe" start= auto displayName= "UserDataSvc_CBACCCBCABBABCBBCAABAAAAABCAACACBBABBCBABCBACBCCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACCCBCABBABCBBCAABAAAAABCAACACBBABBCBABCBACBCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe" start= auto displayName= "UserDataSvc_CBACCCBCABBABCBBCAABAAAAABCAACACBBABBCBABCBACBCCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCCBCABBABCBBCAABAAAAABCAACACBBABBCBABCBACBCCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1636
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACCCBCABBABCBBCAABAAAAABCAACACBBABBCBABCBACBCCAAA"
    3⤵
    - Launches sc.exe
    PID:6068

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe
1⤵
PID:3220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 42e32f1c306f342cf1be042eecb8f91cba65bbfac4df4b9f7c3e64913d933ee8
MD5 d3cec5d8115048b41789dc8122f19fae
SHA1 5fd35bab9dfb043c3fda1eb91cd284fd69ab26b2
SHA512 3203b4f8cdddd02d634e0e555344ccec3f853898f15535e02fccc8e9f8ff9f59b6be13d4556504bb675b0ebce8bafcfad9fad49bd7d07e558ee7731580a77a79
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bbdef98cf9a46d53f5e3c96e485c24ab6ce05c6314b26b77449dc715018a02ba
MD5 f8786cd371e4b2b51d6c50290f98c0af
SHA1 b3a2f701695153c3652c81c628e3e497fa680573
SHA512 22f5d5acf75a2d98277a8ee673c20b754a891ded4ca109bd6c61660ca01b3919115a7dc03280eea8f0126a90de79c84f8a32b90f7dce2c68e80d54e29b117064
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aa3102bc16376dac8a678d80dd95ba618d57dd445662da5b42c2bc73282ec12c
MD5 1d8bfefec425b3708d07a1c2d4f85c56
SHA1 73cf749a05409dd15088ddc78fc30184c3435d15
SHA512 cbc9cc643f3f88b12338060793e1ce03cc899ac2c6884e0fae6c9f4d1744a1b431c5dfb2bab99f276bc4eac541cd70bb360de3f531230936e74558c317d693b1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b9d2650ac0fcd7295da82516a74b1282cac8d389c8e24433a9b5185c7eea7d60
MD5 0b458133046fff0a8b864c754fb84273
SHA1 0d5f3617b633f967b6674a15fcade611118978f3
SHA512 77c881fdbd00ee86e37df713d934ac515bd7dbf92a1f44ffd9d766e6ec48b350fc3aa7c34d7e5a7c72f321785874105b49b1754b8ed5b23b231435bffc83e8d4
MD5 SHA1 SHA512

Submit Download

svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe
Size 29.7MB
SHA256 d638657616429c72762ba8165b8e24efd604216bbe4c339d7d7ccf3810285f58
MD5 7c64f5bdb83d8a7b9039a84691e0cb41
SHA1 9afb02cbd20a57508341e05e1fd435c6c94c6a1e
SHA512 5024cb6321a595627f6fd204c0b44a411a6318ba2e6a5b6b840c43c4a1fa6529039f2e06a9e805288090a924bede8ceacca69d9d4f2917cd8775c40b6bd20510
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSsmHpn6F44IAWvW1tIDewjqkjiqMN:i33333333sLmHN6+JrvW8KwekyN
TLSH
T17867BF59FAA690E8EC6FE43488B7C332D5327D234432934B59E9F60A6F33A515C19732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAAABBCCBBBBACAAACCBBBAAACCCBBABCAACABAACCACCABCAACA.exe
Size 10.1MB
SHA256 f4bb1deef93c51c01fad5bc8ce114823abc64d49376aac29b238309daab218fd
MD5 d1e61e450072ead3c778815432aa74d0
SHA1 8d978a629a205a0f2afa89cdd86e3ed39552630d
SHA512 bc089e9927da71ce38e16949b3567a26d000be4e49b475455fbc6edd99976541b7e214acdbfd122f1eb6cf41cff43da33ac35bce590d803d698e8e0469f94594
SSDEEP 49152:U+Ei+Ei+Ei+EEuY5YaRCQxkxydLwQ+Ei+Ei+Ei+EEuY5YaRCQxkxydLwQ+Ei+Ein:kFPdLbFPdLbFPdLbFPdLbFPdLbFT
TLSH
T191B6E14AFC4650B0DD3A64700CDBE27B4935BF3AC0268A59F9CA7B067B37E61540F45A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3100-25-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/3100-38-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/5904-0-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download

memory/5904-8-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download