3184c4369140d8b9427b4283182d5f278463f0c555f1a2ab440b2017211a5541

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_f57d4b307c5519879388d1948743146f_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 9.5MB
Sample260815-n6345afe84
SHA256 3184c4369140d8b9427b4283182d5f278463f0c555f1a2ab440b2017211a5541
MD5 f57d4b307c5519879388d1948743146f
SHA1 35f0abf47f6599bebb261f89e6b9ad82a4c4a710
SHA512 6d7a3e4ee43edd1541de345177f872c6cb365f7ce2691ce7a9581140e119300adc5904016e609ff493929a7572489c2e031d482c773eb8ea02429782826af071
SSDEEP 49152:U+ES+Ef+ES+E7+ES+ES+E2+ES+ES+Ef+ES+E7+ES+ES+E2+ES+ES+Ef+ES+E7+EJ:ErA91pH2WpjHrgBFFu416AWv+
TLSH
T134A66B55F59720F9E46FD0B089ABC336D6707C134132879BA6BCC65B2E63B642D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5720	svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe
2324	svchost_CBBAABCCABAABBBACBBACBBBBCCBCAAACBAACCAAACBCCBCCBAACBAA.exe
2944	svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBBCCBCBABCBCBABCBBBBABBBBCACCCCAACBBCCBAACBBBBCCAACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe"	2026-08-15_f57d4b307c5519879388d1948743146f_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCCBBBCBCCAACCACBBCCABACCBBCBBABACBAAAACACAACCCABBBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBAABCCABAABBBACBBACBBBBCCBCAAACBAACCAAACBCCBCCBAACBAA.exe"	svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2084	sc.exe
4788	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
924	cmd.exe
4880	cmd.exe
1312	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_f57d4b307c5519879388d1948743146f_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBAABCCABAABBBACBBACBBBBCCBCAAACBAACCAAACBCCBCCBAACBAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4100	2026-08-15_f57d4b307c5519879388d1948743146f_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4100	2026-08-15_f57d4b307c5519879388d1948743146f_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4100	2026-08-15_f57d4b307c5519879388d1948743146f_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4100	2026-08-15_f57d4b307c5519879388d1948743146f_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
5720	svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe
5720	svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe
5720	svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe
5720	svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe
2324	svchost_CBBAABCCABAABBBACBBACBBBBCCBCAAACBAACCAAACBCCBCCBAACBAA.exe
2324	svchost_CBBAABCCABAABBBACBBACBBBBCCBCAAACBAACCAAACBCCBCCBAACBAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4100	2026-08-15_f57d4b307c5519879388d1948743146f_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5720	svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe
Token: SeDebugPrivilege	2324	svchost_CBBAABCCABAABBBACBBACBBBBCCBCAAACBAACCAAACBCCBCCBAACBAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 1312	4100	2026-08-15_f57d4b307c5519879388d1948743146f_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	92
PID 1312 wrote to memory of 4756	1312	cmd.exe	94
PID 5720 wrote to memory of 1948	5720	svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe	95
PID 4100 wrote to memory of 924	4100	2026-08-15_f57d4b307c5519879388d1948743146f_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	98
PID 924 wrote to memory of 2084	924	cmd.exe	100
PID 4100 wrote to memory of 4880	4100	2026-08-15_f57d4b307c5519879388d1948743146f_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	101
PID 4880 wrote to memory of 4788	4880	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_f57d4b307c5519879388d1948743146f_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_f57d4b307c5519879388d1948743146f_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACABBCABBACACBBBBAACBBBBACCAABBACBCAABCCACBCCBBBBCBCABCAABBBCAABACAAACBABACAAABCABACCACBCBBBBAACABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACABBCABBACACBBBBAACBBBBACCAABBACBCAABCCACBCCBBBBCBCABCAABBBCAABACAAACBABACAAABCABACCACBCBBBBAACABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABABAAAABBCBCCBBACBAACACAACABABABCBBCCABBBACABCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe" start= auto displayName= "UserDataSvc_AABABAAAABBCBCCBBACBAACACAACABABABCBBCCABBBACABCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABABAAAABBCBCCBBACBAACACAACABABABCBBCCABBBACABCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe" start= auto displayName= "UserDataSvc_AABABAAAABBCBCCBBACBAACACAACABABABCBBCCABBBACABCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABABAAAABBCBCCBBACBAACACAACABABABCBBCCABBBACABCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABABAAAABBCBCCBBACBAACACAACABABABCBBCCABBBACABCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAABCCABAABBBACBBACBBBBCCBCAAACBAACCAAACBCCBCCBAACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAABCCABAABBBACBBACBBBBCCBCAAACBAACCAAACBCCBCCBAACBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe
1⤵
- Executes dropped EXE
PID:2944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 653fa8479724d7bae16276ef4d160efeaa5bde75c3fd110886095f8f073f36b2
MD5 5f4eca487c3d2ee7304e0391920f8d45
SHA1 f65da2ae89a91f734c0680a306ada879f43ce2eb
SHA512 4465603d29a7a6df4ff3e86b4681d1aa01acee16ff3b4b67df3ea900b13eba6897a0eb4521073c821fa9e138970763d1284391f7dce551264cb506c7538a4125
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 57bdd254ac9f1e4e7725ec5ff42ef905237e4540bfdb7185817ef669b3133fee
MD5 c3ee4bd868ebbdc4a302e4a0a78952d9
SHA1 5d3684ef78a6be06c36e4af0db73870859fb8fcb
SHA512 3cbe875433dfe3784f3524552e388b6df54bdf5f69818367310948c1f3ea33a81effb8a89a54ff9eeb52e42da8f0f7f659d017eff54d6c21a71fe1e9193669ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d5a9b42b2bd08030f6000ffb6d2992a2b74e86f428d3a1c91485e82cad07bc5e
MD5 72394cfdaef982391af8bf4408a914a2
SHA1 8c96d1c9b5e936c31cfc09bcfd755d6ec9702d12
SHA512 233d9e3a679f585a67cc5d1080cc1ae6f2c4b8d341b0c76aea8cff050a8456506429e403a6cc1ecfa863008b80f02c70d284f13f0cec3e5396bad51662ae04f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 541680b55e98f23ad2da212af05189d0b1c602cbc9af428e80a0c109cbcff036
MD5 92c0297b8113357fcb0cdf0af69f0f5b
SHA1 34c4ab5c90215f64249c481bdba3cc729c54cead
SHA512 ab31e21154bfcf4274780661c043479c4fd666f432a5904cbf50cf2466d91c611d3042881e518434ca0690447a75f8c147584405c46b94c2123ff9c9439b8bdf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0b67628c5a25d1d3c2eb2bcf96d70e45df14ad3613501aa81cf4849f54b45a06
MD5 4739e02913620db32b1fd80993f3da42
SHA1 750df5e66888a9b0bf621c001740bdd591c4d0d3
SHA512 c10afee193306db7a2016cc82e8f84993714c75ba60b4c28873ead0a8d73c8c003a50e4a93836fec5de1ec8dd21b0a4e0e267398f696f41d2092e27ebff9924a
MD5 SHA1 SHA512

Submit Download

PingSync.exe

Path C:\Users\Admin\Downloads\PingSync.exe
Size 29.1MB
SHA256 ba18e12f2afe0958fc41814128dfc496058cd3ab19dd0bff5fc2bd54c707003d
MD5 89bfca988781bc7e257be824f2a7f74b
SHA1 d12399f314e0a768d9ee682f3fa032e54a170ad4
SHA512 a4c2b4b1273e5e33b5134a5de09071c2257be28bdc2b57d689e3b4fe35a7ea7066405be09a2ecd8dd8f2ac0fcc0ee48b0b5e2bf763fd76766dbe3aa1525d4c06
SSDEEP 196608:amHpn6F44IAWv/mHpn6F44IAWv/mHpn6F44IAWv9Iql:amHN6+Jrv/mHN6+Jrv/mHN6+Jrvem
TLSH
T186677B55F59720F9E46FD0B089ABC336D6707C134132879BA6BCC65B2E63B642D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingSync.exe

Path C:\Users\Admin\Downloads\PingSync.exe
Size 192KB
SHA256 2a7d67c8cb87e70a2a021f1ea607b4e64e514952c2c2095c293313bcacbc9279
MD5 7f806c996b0a8f55853c428a3d1519b5
SHA1 790aee1190ded98346f21d684c77555809c6b8e1
SHA512 daa40e7289386fcd0ea4a08d2f623c75aa172bf74fcde92b9d7261cb08e69bcac1174fdad94efdb4b8cb469a20f38474fae79f4241ff0b2384690429c6dd86d4
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdoNdtpUtI9vTTLoFpmEY13Xo2kxXI8fY:m+dTTUFgEs3XojAdP+dTTUFgEs3XozxM
TLSH
T155144C09F94350B5D92B50F00DCFD2BF8660BB25C6128DFAFB8ECB1B6923B616528355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBBBAABAABCACCACBCCCBBCCABABAACAAAABABCBAACAABBCACC.exe
Size 9.5MB
SHA256 3184c4369140d8b9427b4283182d5f278463f0c555f1a2ab440b2017211a5541
MD5 f57d4b307c5519879388d1948743146f
SHA1 35f0abf47f6599bebb261f89e6b9ad82a4c4a710
SHA512 6d7a3e4ee43edd1541de345177f872c6cb365f7ce2691ce7a9581140e119300adc5904016e609ff493929a7572489c2e031d482c773eb8ea02429782826af071
SSDEEP 49152:U+ES+Ef+ES+E7+ES+ES+E2+ES+ES+Ef+ES+E7+ES+ES+E2+ES+ES+Ef+ES+E7+EJ:ErA91pH2WpjHrgBFFu416AWv+
TLSH
T134A66B55F59720F9E46FD0B089ABC336D6707C134132879BA6BCC65B2E63B642D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5916de683f4ac31f7f5c526304ae63e35e295bb14cea8a8efc1da1dded48ffae
MD5 c2028468e42ba9e496f92028e511570e
SHA1 b69ab5687693f16b7dca63bb2d2faa6b6c04ea52
SHA512 d628c8161b5889732d29afa1d7e56e831497b1027c40d0508ecbe073110870e59ec139a3df3c53ca06be6ffa0c54e329b66074af881d0eb640029a06dbbfabbd
TLSH
T154118257D5B5DC67B87238CB4E69AA930DB83F9F582C6E5413084218E7D5C318E198B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2324-107-0x0000000000A10000-0x0000000000A31000-memory.dmp

Download

memory/4100-48-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4100-70-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4100-0-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4100-23-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4100-12-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/5720-49-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/5720-71-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/5720-34-0x0000000000480000-0x00000000004A1000-memory.dmp

Download