3cda933134dd9ef9e8cd0a569f84965406ff7621c6069fbfabb78e89f9eb71b1

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 9.1MB
Sample260812-akd18avdpc
SHA256 3cda933134dd9ef9e8cd0a569f84965406ff7621c6069fbfabb78e89f9eb71b1
MD5 0c0bd4154420793ccecc7d8df627d138
SHA1 ae3b6c041f2cc4045c07e8abee37054e43052952
SHA512 c633072a6c82b487493a80496e144ca1237ae784709ca3a20c874d9fcf322bf2dab5fc9451b9f5524334c37d7fac0306244f3618f22aec612bb3d28c63a6e566
SSDEEP 49152:U+ES+ES+ES+EpqatglxhO0+ES+Epqatglk+ES+ES+ES+ES+ES+ES+ES+ES+ES+EA:vUIsUVA91pH2WpjHrgBFFu416AWvu
TLSH
T1EFA66B95B2A720FDE06FD175896B8332D6717C130632938F12BCD66A2F237946D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
5552	svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe
5208	svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBAACABCACABCCCAAABCCBCACCBCAAABCCABCBAACBAABBCBACCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe"	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4936	sc.exe
5096	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5080	cmd.exe
2464	cmd.exe
1348	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4856	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4856	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4856	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4856	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
5552	svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe
5552	svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe
5552	svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe
5552	svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5552	svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 2464	4856	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	92
PID 2464 wrote to memory of 5568	2464	cmd.exe	94
PID 5552 wrote to memory of 3412	5552	svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe	95
PID 4856 wrote to memory of 1348	4856	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	96
PID 1348 wrote to memory of 5096	1348	cmd.exe	98
PID 4856 wrote to memory of 5080	4856	2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	99
PID 5080 wrote to memory of 4936	5080	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_0c0bd4154420793ccecc7d8df627d138_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBBBBABABBBBAABCACCABBBCCACCBBBCCACBBBACAACACABCBABBBBAABCCCAAABAAAAAACCACCAACABCCCCAAABBACABBAAACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBBBBABABBBBAABCACCABBBCCACCBBBCCACBBBACAACACABCBABBBBAABCCCAAABAAAAAACCACCAACABCCCCAAABBACABBAAACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABACCACAAAABABCACAAABABBCCCCBCAACCBBAABBBAACACAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe" start= auto displayName= "UserDataSvc_CABACCACAAAABABCACAAABABBCCCCBCAACCBBAABBBAACACAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABACCACAAAABABCACAAABABBCCCCBCAACCBBAABBBAACACAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe" start= auto displayName= "UserDataSvc_CABACCACAAAABABCACAAABABBCCCCBCAACCBBAABBBAACACAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABACCACAAAABABCACAAABABBCCCCBCAACCBBAABBBAACACAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABACCACAAAABABCACAAABABBCCCCBCAACCBBAABBBAACACAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe
1⤵
- Executes dropped EXE
PID:5208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3af141c14d195fb20eceb2b447f663b8c0844353c5964810d23c89c61ce29a61
MD5 db662f725f17aea3426c23ede818870a
SHA1 41d5660e9aae166d120491b15df21347d4618c53
SHA512 2c6a33a43e2ba2075cb4ecfa65c8c3feaebb8c937a1a1aca62ec17bf642e2d09c8ff317661cfbdb76c696991085e1de5bc9550cb977987216627bb618b399bf1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0a3e0c90ce9c5289f322dc10640526d7422d6145533db155169f9485061e60b5
MD5 138799dbe9736bf1b232e447ecd0a08f
SHA1 02bb54f6f4ff58fba8c3be8e598abeb8cb6558ee
SHA512 a3db5459c8411966a3a3b56a8c4e19521de3f98968c329891b7fbb36c2281606bbf96396ab75c6425118202eb3e5833e210eadbba646578b90e985bd4ff6c4e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bd764d433445f799e08a376727f97b8a2b1c81ac4cd3d43e8fecdd2a74e17e7c
MD5 6fe52aa947bd2d6dbca1fe2995e97074
SHA1 fbf681c280c7cf9e6235c4f1f37217817096d257
SHA512 1178461513f8390e696b05bded1605acf51f6b9f7c603dc88dd9c586859ae30e03a67f3527624a4bdc3b4ed81e7b14af45cf48d3314bd414afe2bbf399514eb6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 316950cee3a4a7677cb39a4de9deb1cc9395c68ae1c8d38c11f9f43b6dfe1f93
MD5 e307f01d2be1f6015b7d32c9e9efbd0a
SHA1 4310fe2ceb73814ff47bff2340b11a36ebbb75dc
SHA512 7de099be8a9a3991a494fb352e6899100b58b6502a1a5236d8f5f0ce7d5636ccc2b001e46ba9781dff86354a5a2662c5446afdd35c4deb54dd11ef8e72e91920
MD5 SHA1 SHA512

Submit Download

svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBACACCAACACBABACCBCACBCABBAABCBCACBCACAACCACABBB.exe
Size 9.1MB
SHA256 3cda933134dd9ef9e8cd0a569f84965406ff7621c6069fbfabb78e89f9eb71b1
MD5 0c0bd4154420793ccecc7d8df627d138
SHA1 ae3b6c041f2cc4045c07e8abee37054e43052952
SHA512 c633072a6c82b487493a80496e144ca1237ae784709ca3a20c874d9fcf322bf2dab5fc9451b9f5524334c37d7fac0306244f3618f22aec612bb3d28c63a6e566
SSDEEP 49152:U+ES+ES+ES+EpqatglxhO0+ES+Epqatglk+ES+ES+ES+ES+ES+ES+ES+ES+ES+EA:vUIsUVA91pH2WpjHrgBFFu416AWvu
TLSH
T1EFA66B95B2A720FDE06FD175896B8332D6717C130632938F12BCD66A2F237946D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4856-0-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/4856-8-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/5552-24-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download

memory/5552-37-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download