d916099e0779b4451a11bc99f0e09b50bdb63abeb7c287456784a0f43cf50810

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_c91d51668ef87f00312a8078c417433c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 10.2MB
Sample260813-d2vxvaan2z
SHA256 d916099e0779b4451a11bc99f0e09b50bdb63abeb7c287456784a0f43cf50810
MD5 c91d51668ef87f00312a8078c417433c
SHA1 5332abef25ecf0980139b275b04c6b1794b95512
SHA512 40c5472b105fcda1e66b3c88b5f90225ea6b90d90744dc7b48635eee2c9b4f4451492053742d3187e0ece57f2e410cd508f2e0f5eb2ad8bdc4086b756301b3b7
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+Efy6i1zuajsauZjR6:Ntst7A91pH2WpjHrgBFFu416AWvo
TLSH
T155B66B59B59710F9D46FD07589ABC336D6717C23033287DF666CC66A2F23AA06C38722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5556	svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe
3188	svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe
5864	svchost_CBABAABCABBCAAAAACABABCCCCCAAACACCBBBAAAABCCCBACBACBACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCABAABCCABABCACBBBAABBBCCAACCACCBABBCBCCBCBCBCCAABCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe"	2026-08-13_c91d51668ef87f00312a8078c417433c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAABBCCBBBBBCACCCCBACBCABABCBCBABCBBABBABBBAAAACCACCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABAABCABBCAAAAACABABCCCCCAAACACCBBBAAAABCCCBACBACBACC.exe"	svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2508	sc.exe
876	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1440	cmd.exe
3292	cmd.exe
5668	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABAABCABBCAAAAACABABCCCCCAAACACCBBBAAAABCCCBACBACBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_c91d51668ef87f00312a8078c417433c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1716	2026-08-13_c91d51668ef87f00312a8078c417433c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
1716	2026-08-13_c91d51668ef87f00312a8078c417433c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
1716	2026-08-13_c91d51668ef87f00312a8078c417433c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
1716	2026-08-13_c91d51668ef87f00312a8078c417433c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
5556	svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe
5556	svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe
5556	svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe
5556	svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	2026-08-13_c91d51668ef87f00312a8078c417433c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5556	svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1440	1716	2026-08-13_c91d51668ef87f00312a8078c417433c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	91
PID 1440 wrote to memory of 5908	1440	cmd.exe	93
PID 1716 wrote to memory of 3292	1716	2026-08-13_c91d51668ef87f00312a8078c417433c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	94
PID 3292 wrote to memory of 876	3292	cmd.exe	96
PID 1716 wrote to memory of 5668	1716	2026-08-13_c91d51668ef87f00312a8078c417433c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	97
PID 5668 wrote to memory of 2508	5668	cmd.exe	99
PID 5556 wrote to memory of 920	5556	svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-13_c91d51668ef87f00312a8078c417433c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_c91d51668ef87f00312a8078c417433c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACCABBABAAAAACABCCACACCBBCBCBBCBCCACACAAACAAABABBCBBCCCBBAACAABAABCBABABCACCAABBBBBCBBCBBBACCBBABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACCABBABAAAAACABCCACACCBBCBCBBCBCCACACAAACAAABABBCBBCCCBBAACAABAABCBABABCACCAABBBBBCBBCBBBACCBBABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACBBACACAAABCCCABBAAAACCCACBBCACBCABCACACACAAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe" start= auto displayName= "UserDataSvc_ABACBBACACAAABCCCABBAAAACCCACBBCACBCABCACACACAAAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACBBACACAAABCCCABBAAAACCCACBBCACBCABCACACACAAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe" start= auto displayName= "UserDataSvc_ABACBBACACAAABCCCABBAAAACCCACBBCACBCABCACACACAAAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACBBACACAAABCCCABBAAAACCCACBBCACBCABCACACACAAAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5668
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACBBACACAAABCCCABBAAAACCCACBBCACBCABCACACACAAAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe
1⤵
- Executes dropped EXE
PID:3188

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAABCABBCAAAAACABABCCCCCAAACACCBBBAAAABCCCBACBACBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAABCABBCAAAAACABABCCCCCAAACACCBBBAAAABCCCBACBACBACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 28f666f54eaa55c53b71cdbdcb8111b183420153d059a5bc607885920ba0433d
MD5 094ecef3c62008dfd87fe021670f88ed
SHA1 17620b3b4009057b3e7e9967635debbc6f061179
SHA512 364be0e4faaccf4e3464e28ecc8b287ee2b9c65c2f7d1009988d6c78d081c51e3316b154fd83ba726796c88d51604ea5b4e84877405ec61b1c22cd85b709506a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 88c58c156b71e7f31d2ea5441f09d46ac39e0438ae7e8a970eb45ef29657fbab
MD5 c7a84d99c26cc8a4b6a0078e12bb0d09
SHA1 679610340ea2e51b665979b137fa964644604820
SHA512 7f6877b9cd755c0de5e02067e4deb2bda64d69ff0cc6bde8340b057bc35e83b1fdbffa7f398a482d8d857ff516324b3173c90331c69d7c02214d513b06348a4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5bf83391245a9798cc0e4efb7f5ccf59b6f9f9157727fd0904fd51f00b11c99a
MD5 c70abb6f79d32c9f93067a6c40c4f027
SHA1 b690f4f8af8cf423842c0f1ed63051cba69094d8
SHA512 b0d11d95eaead4c6ded591c243ca664c102b1b2d01230b30f65ec930ad5d0e2334cc81cbaf8b856f1e37d3f463961776147f6be585d22cf2caefee07c6ab1658
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ecd71e3962cb010c1b6e7488ef8ed8d25a28851c35da432671f8e6f48fd9f522
MD5 d210bac4eab77cdbdbbe531ec9e9949c
SHA1 c750494844ee5f1cbfca5a959aaf1e2a7ba9a972
SHA512 ec4994c072cb9f85043c54791785c19d0e30ec600fde52a4db27061a1d8c608687f28743139a5491b1beef6aaafd5912fcbdb897d6e18a625dcdcda7eeb379a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f61d00f69fc96f95c6e8599984c26ed210dccc14045d891e4f3ad5b1dde1fb3c
MD5 ceedd0d71aad02403f1eefa45ecdbc91
SHA1 e8481e88c08b328979785913ea7ad6dde829cf2d
SHA512 c289cdbef1b3c917113a982f421586176afac44c3aa8bf57d9f36e95e6547e89c3b901c08d4cc5d50011b297bf213f8c9e1b91fef839dcac7dda709c72cf7d0e
MD5 SHA1 SHA512

Submit Download

svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBCCBCABCCBCAABAABCCAACCCCBBCBCBCCCACCBCABACAABCCBC.exe
Size 10.2MB
SHA256 d916099e0779b4451a11bc99f0e09b50bdb63abeb7c287456784a0f43cf50810
MD5 c91d51668ef87f00312a8078c417433c
SHA1 5332abef25ecf0980139b275b04c6b1794b95512
SHA512 40c5472b105fcda1e66b3c88b5f90225ea6b90d90744dc7b48635eee2c9b4f4451492053742d3187e0ece57f2e410cd508f2e0f5eb2ad8bdc4086b756301b3b7
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+Efy6i1zuajsauZjR6:Ntst7A91pH2WpjHrgBFFu416AWvo
TLSH
T155B66B59B59710F9D46FD07589ABC336D6717C23033287DF666CC66A2F23AA06C38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1716-0-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download

memory/1716-7-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download

memory/3188-67-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/5556-23-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/5556-36-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download