096e5a03e1b3f0dac710cf1e0d9191e144ea104b366205f725c0f9d40d38d14e

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Size 25.3MB
Sample260810-eewraszhqg
SHA256 096e5a03e1b3f0dac710cf1e0d9191e144ea104b366205f725c0f9d40d38d14e
MD5 e310276326af08b02c14c27c325cd994
SHA1 c6fbbc2d50cfb6a91c2e998e9fd7595906f9de6d
SHA512 269d9095d4a1b2b87cec2693eb40958369c17c8a71ac9b9c05cd23a8b867afbbb1f752cef8b28882fc79a82bde32afd1fe527d6236ab8bfcb722f47f32f6c554
SSDEEP 196608:kFlfFlVFlfFl27FlfFlVFlfFl2FmHpn6F44IAWvh:i3Z3sB3Z3sFmHN6+Jrvh
TLSH
T15947D046AAAA50E8C46ED0748867D733E6313C1B4230979B46EDF61B2F737606D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000243b7-22.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2760	svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe
4432	svchost_CAACCAAAAABCBABBBCCCBBACACAABABBAABBCCBABBABACBABCBCBBC.exe
2704	svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AACCBCCCABAABCABBBBBBABCCCAACCCBABABCCBCCABCBBCBCCCABACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe"	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBBABAABBCBCBACABBABAACBCCCCABCCABCABCBCACACACBBBBBCAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACCAAAAABCBABBBCCCBBACACAABABBAABBCCBABBABACBABCBCBBC.exe"	svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
832	sc.exe
2744	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5076	cmd.exe
3456	cmd.exe
632	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACCAAAAABCBABBBCCCBBACACAABABBAABBCCBABBABACBABCBCBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4116	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
4116	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
4116	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
4116	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
2760	svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe
2760	svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe
2760	svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe
2760	svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe
4432	svchost_CAACCAAAAABCBABBBCCCBBACACAABABBAABBCCBABBABACBABCBCBBC.exe
4432	svchost_CAACCAAAAABCBABBBCCCBBACACAABABBAABBCCBABBABACBABCBCBBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2760	svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe
Token: SeDebugPrivilege	4432	svchost_CAACCAAAAABCBABBBCCCBBACACAABABBAABBCCBABBABACBABCBCBBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4668	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 3456	4116	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe	96
PID 3456 wrote to memory of 1292	3456	cmd.exe	98
PID 2760 wrote to memory of 4308	2760	svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe	99
PID 4308 wrote to memory of 3560	4308	notepad.exe	101
PID 4116 wrote to memory of 632	4116	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe	105
PID 632 wrote to memory of 2744	632	cmd.exe	107
PID 4116 wrote to memory of 5076	4116	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe	108
PID 5076 wrote to memory of 832	5076	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACABBACABCCCCCBABBCABAACABACBABBBACBBAABABCBCCBAACAAAAABCCBCCACACCCABCBABACAACCBCABBBCBACABBCCABBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACABBACABCCCCCBABBCABAACABACBABBBACBBAABABCBCCBAACAAAAABCCBCCACACCCABCBABACAACCBCABBBCBACABBCCABBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBACACAACCABBCAABAAACCAAACCCBAACCCCCCCBAAABAABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe" start= auto displayName= "UserDataSvc_CCBBACACAACCABBCAABAAACCAAACCCBAACCCCCCCBAAABAABAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBACACAACCABBCAABAAACCAAACCCBAACCCCCCCBAAABAABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe" start= auto displayName= "UserDataSvc_CCBBACACAACCABBCAABAAACCAAACCCBAACCCCCCCBAAABAABAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBACACAACCABBCAABAAACCAAACCCBAACCCCCCCBAAABAABAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBACACAACCABBCAABAAACCAAACCCBAACCCCCCCBAAABAABAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCAAAAABCBABBBCCCBBACACAABABBAABBCCBABBABACBABCBCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCAAAAABCBABBBCCCBBACACAABABBAABBCCBABBABACBABCBCBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe
1⤵
- Executes dropped EXE
PID:2704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c1177962efe4c1d373ebb2ede1083cfff978388cb651abd95480c0e28ac3b8f
MD5 07b0c0d40c404f3d4cb4128df9e15de1
SHA1 1e5c85a75f595a20885b48ebb14d6c104568d949
SHA512 abac40356c4667c507cfeecb1a4e7f2fa6918730e475833617044113f0d531083eaa983bea4fb5f99e59bd6d9b30b57dbdfcb2d5ac29f94d867cbdc8ae06a828
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e5a9a10bfc082cae974df6a3a1c8177dd36e56bc4cccecfef2d8f1257ab8d124
MD5 3a381301ae7b8f77589c20e7ccdc0256
SHA1 9787727f92c9f20af80960312c3e193225b6e78d
SHA512 3fc5199656d5894eb241309f32f93aaaff41d15783560b2aff131706f7f6946dbc09b38950eea83a7c4db3813dd5cb79ea1a6ce65fc9c283dbf08ccf0994b183
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c929bb5be7ad5f51b52858bc6f48a2de519d02604ddc747a4081b6332d3d5df5
MD5 1149e8f1175c1a56213f261b3d303522
SHA1 ca62aa8a0724a5a309c2a38e86369c7ecf1bd1f1
SHA512 9703b9286ff70906df2282a623fbd7323c4e22a308286e8fe1459e896208f9947e7885bb6cc5afb418a9c7cf4260d4704e23b83c7cee432aefb31edf4d9dc1ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b6ade6dbebf948bb9b5ef173e9bcb3e6a0b53f3eb39b2d41cb98a311f02889a
MD5 90146eadc3768b86de695aa9d053a407
SHA1 d4a537de694cc8f43388a871b637313d4e3095fc
SHA512 5b0797b743dcb80f4123a0fd9ba4f52d5a662361cd8781820a2ad066e6dc32422059326d121888c9f97876fe4e42a1d94dfee178b5124733d346f4a42b55cc71
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a0b0cc5e8d552573b91a660fc575b32164cc8d8ab42440c5c1997b22643c0d83
MD5 b0160475415b1762190eabdf48b956b3
SHA1 0283e63ec82e8260759ab02c99584355268b08be
SHA512 588e089cfba9ae4ac9f4f2a2f087916ce6a0c34793037cd0d6cd320011036e5907edc07db448f3ef64011638f46bc4fd524a8b6e3debdc34d43b740d3e688456
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b6cbdff08bc6edc3c9676af17263b84b0f5baac8f78b0b7e1c7980ac07c234c7
MD5 c4b578c5c611b057fc4f9e35b8302d7e
SHA1 b1bc5b1333275badf93d05671b97b4e63327a546
SHA512 2f4814ea0e070597301db6c53e8c371f5a9d419cfb274d4fe628478582a0839a0dde28e0f4968103d8fceabb70563bb72b7ecddd6f545296eb3523a3c83b676a
MD5 SHA1 SHA512

Submit Download

svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCACBBCCABBCACBCCBBBBCBABACBCCBCCCCBCCBABBCCBCCAABABC.exe
Size 25.3MB
SHA256 096e5a03e1b3f0dac710cf1e0d9191e144ea104b366205f725c0f9d40d38d14e
MD5 e310276326af08b02c14c27c325cd994
SHA1 c6fbbc2d50cfb6a91c2e998e9fd7595906f9de6d
SHA512 269d9095d4a1b2b87cec2693eb40958369c17c8a71ac9b9c05cd23a8b867afbbb1f752cef8b28882fc79a82bde32afd1fe527d6236ab8bfcb722f47f32f6c554
SSDEEP 196608:kFlfFlVFlfFl27FlfFlVFlfFl2FmHpn6F44IAWvh:i3Z3sB3Z3sFmHN6+Jrvh
TLSH
T15947D046AAAA50E8C46ED0748867D733E6313C1B4230979B46EDF61B2F737606D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 33d54fdfe91db739ea1ec344405c885df43589f2b502661a0a9da20761073daa
MD5 bf996de0390edc551b88ee3f19e2f7bb
SHA1 3e657b314ef5cd509318661cd5b4b98a9f103b6f
SHA512 7db6ceb2d96e014338c874e6fe29d4a9120e19b92248f14f0091fc71986bbcbfd06179a5c11fae967120c5382fb03aaed183be4630c963f7a3e88862f04a2e31
TLSH
T17A11CBB2D4A9DC53E83268DF521AEAD20CDC37DB781C5A24138A451C7B88C32CD594D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2760-37-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/4116-8-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/4116-0-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/4308-60-0x00000000030D0000-0x00000000030D1000-memory.dmp

Download

memory/4432-73-0x0000000000770000-0x0000000000791000-memory.dmp

Download