4f3166f2eec80acb4c554ab332b227fdcd596db694c57085cac5ef290698a7f1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 05:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_142c82993411598caae3973bb12ca168_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.2MB
Sample260816-frffhsbd42
SHA256 4f3166f2eec80acb4c554ab332b227fdcd596db694c57085cac5ef290698a7f1
MD5 142c82993411598caae3973bb12ca168
SHA1 5ab6aa63b39c7750c42f405f2d65b58d707f9711
SHA512 42095e47f874437e86fcf30db9be78cfd9bcc2e8cf503a387f7f4a74452dc3a597da85c9c78f0feaf1adeb3d993c1ee9a284aa17d082aa506c945988f53ce6fb
SSDEEP 49152:U+ES+ES+ES+EWLg8+ES+ES+ES+EWLg6b6LgA97HrsdochZVNhcOgs0F2oHN8kVpy:UA91pH2WpjHrgBFFu416AWvE
TLSH
T157766BA5A2A720FCE0AFE179897AC332E6717C130131934F167CD6562F636686D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3380	svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe
3888	svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe
3128	svchost_CBCABCCBABAACBCCBCBABABABCCCBBCBCABCCACBBCCBBAAABBACBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCCBBABBBAACBBAABBBCBACABABABAAAABBCCBACBBCCBAAACABACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe"	2026-08-16_142c82993411598caae3973bb12ca168_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCACACBCBCCBACCBBBBCBBBCCBBBBBCAABAACBACBACCAACBACBCBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCABCCBABAACBCCBCBABABABCCCBBCBCABCCACBBCCBBAAABBACBAB.exe"	svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4068	sc.exe
3720	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4072	cmd.exe
4488	cmd.exe
1396	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_142c82993411598caae3973bb12ca168_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCABCCBABAACBCCBCBABABABCCCBBCBCABCCACBBCCBBAAABBACBAB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3272	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1524	2026-08-16_142c82993411598caae3973bb12ca168_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
1524	2026-08-16_142c82993411598caae3973bb12ca168_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
1524	2026-08-16_142c82993411598caae3973bb12ca168_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
1524	2026-08-16_142c82993411598caae3973bb12ca168_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3380	svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe
3380	svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe
3380	svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe
3380	svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1524	2026-08-16_142c82993411598caae3973bb12ca168_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3380	svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4368	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 4072	1524	2026-08-16_142c82993411598caae3973bb12ca168_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	102
PID 4072 wrote to memory of 3272	4072	cmd.exe	104
PID 3380 wrote to memory of 4692	3380	svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe	105
PID 1524 wrote to memory of 4488	1524	2026-08-16_142c82993411598caae3973bb12ca168_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	106
PID 4488 wrote to memory of 4068	4488	cmd.exe	108
PID 1524 wrote to memory of 1396	1524	2026-08-16_142c82993411598caae3973bb12ca168_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	109
PID 1396 wrote to memory of 3720	1396	cmd.exe	111
PID 4692 wrote to memory of 4196	4692	notepad.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-16_142c82993411598caae3973bb12ca168_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_142c82993411598caae3973bb12ca168_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBABAACBABABCACCCBCACACCAACCACABAABAABACBCBBBCCAAACAACCCBAABACABCCCACAACBBCAACCAAACAAAABBAAAAABBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBABAACBABABCACCCBCACACCAACCACABAABAABACBCBBBCCAAACAACCCBAABACABCCCACAACBBCAACCAAACAAAABBAAAAABBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBAAABAABCABAACAACAABCCBBACBCBCBCBCCBACBCBCCACBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe" start= auto displayName= "UserDataSvc_BBBBAAABAABCABAACAACAABCCBBACBCBCBCBCCBACBCBCCACBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBBAAABAABCABAACAACAABCCBBACBCBCBCBCCBACBCBCCACBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe" start= auto displayName= "UserDataSvc_BBBBAAABAABCABAACAACAABCCBBACBCBCBCBCCBACBCBCCACBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBAAABAABCABAACAACAABCCBBACBCBCBCBCCBACBCBCCACBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBBAAABAABCABAACAACAABCCBBACBCBCBCBCCBACBCBCCACBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4196

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe
1⤵
- Executes dropped EXE
PID:3888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4368

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCBABAACBCCBCBABABABCCCBBCBCABCCACBBCCBBAAABBACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCBABAACBCCBCBABABABCCCBBCBCABCCACBBCCBBAAABBACBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 31b40f34253065e1922e88e03f69b9c6ece8ec7f525606dc6f0475b637973f4e
MD5 2c0cdde941c99b05d52f1884d1bd4270
SHA1 16e2ac0a2887be8bf608f2fd69b97010915360ae
SHA512 1b7d535a2eba834a45527077af0b56cac73f5fb683578b5bff189b5272f99e2569d46b18dbb50c84d66fb8a8b4d5a93cbaf7f1700c47eb2e2c21878ae6b4d576
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2127cf0ae0ca35fef636e10ff988f000f7bb75ffda2ffd9416c5dc22c32781f6
MD5 58071e4bce1d9aeea85b515d9ad7395f
SHA1 96290b01301c0e8072e6e5e469426abf75d267c8
SHA512 224a4bad8ac6736895c5d610f20d3a5f9dee50d7490dda905e1b2ae4ea8b9174ace421543b72ad3e9b76cfe68341f8e5218b8b8a403ae6c51d6a02dcf8cba8f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 893d48972844f3431d05dbeb36fbe2140850215c5e3bdb9ff8133d3bc5ea17e8
MD5 d4dc54f985d48481a9b2abf959d5caa0
SHA1 40ade220a551e622dd1824a5763d0653222c857a
SHA512 74b09852584fafdf07ac823b412b57e9015544991c62cd96e708488f62776a4ead6c7b6e92f2fb9dfdeb89f1e87c1afdd735639eecfed95b76f633602ec842f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2d420dac51cce86bf073929863a7fa5fefdace64f5d7ae8198a06c6ae66445ae
MD5 0338e34ba0aa1f1556c09240fb849604
SHA1 0f7a6a2e398034b4ffdb1aa1248023a8ca002622
SHA512 596f3dae986506285f8accd0e40a3f184f20410930a6952752cc9fe68a011fdeb1b7e166c312f1c8ddf736be3257d6c7594cc4a058cc49b8e75d925e77fbf3cf
MD5 SHA1 SHA512

Submit Download

svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBAABBABABBBCBCABCACACBBBBACBCABCBCACBCCCBCACBABBBC.exe
Size 7.2MB
SHA256 4f3166f2eec80acb4c554ab332b227fdcd596db694c57085cac5ef290698a7f1
MD5 142c82993411598caae3973bb12ca168
SHA1 5ab6aa63b39c7750c42f405f2d65b58d707f9711
SHA512 42095e47f874437e86fcf30db9be78cfd9bcc2e8cf503a387f7f4a74452dc3a597da85c9c78f0feaf1adeb3d993c1ee9a284aa17d082aa506c945988f53ce6fb
SSDEEP 49152:U+ES+ES+ES+EWLg8+ES+ES+ES+EWLg6b6LgA97HrsdochZVNhcOgs0F2oHN8kVpy:UA91pH2WpjHrgBFFu416AWvE
TLSH
T157766BA5A2A720FCE0AFE179897AC332E6717C130131934F167CD6562F636686D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1524-0-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/1524-8-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/3380-27-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/3380-40-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/4692-67-0x0000000002960000-0x0000000002961000-memory.dmp

Download