dcc8d6562f7d387c4ae64cf58a750e248efa0b166ec3ebdc3a7f6866a4c60c89

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 08:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 11.5MB
Sample260816-jv21gatthy
SHA256 dcc8d6562f7d387c4ae64cf58a750e248efa0b166ec3ebdc3a7f6866a4c60c89
MD5 48fcb2c3d202e28dee789fa3b2d7021c
SHA1 5da7c5744473b0a66487c5674c141e8478664718
SHA512 6efff81332ccb6711c57c534ddbefc7ce5e0f317a9b526f9538b59968c8d51ba63c52bb4c94268a207df574593b3122f074eaef45c4b0db88c491301ba45980e
SSDEEP 98304:85U5U5H5j5U5U5H5dA91pH2WpjHrgBFFu416AWv0:85U5U5H5j5U5U5H5dmHpn6F44IAWv0
TLSH
T1DFC66D58B7E710E8F57BD5B488BAC376DE717C124231879F562CD60A2E23690AC39723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1188	svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe
3132	svchost_CBBAACABCCAACACCBACCACCBBCBBBBBACCACAACBABAACBACCBAAABB.exe
2800	svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAACABABAABCCBABCACBBAACAAABCCBCCAACCACCCCCBCABBCCBCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe"	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACACCACAABBACBBABACCBCCCCCCBACCABBCCCACBABCACCBACBAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBAACABCCAACACCBACCACCBBCBBBBBACCACAACBABAACBACCBAAABB.exe"	svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4224	sc.exe
5444	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5944	cmd.exe
1276	cmd.exe
4764	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBAACABCCAACACCBACCACCBBCBBBBBACCACAACBABAACBACCBAAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4152	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4152	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4152	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4152	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
1188	svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe
1188	svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe
1188	svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe
1188	svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe
3132	svchost_CBBAACABCCAACACCBACCACCBBCBBBBBACCACAACBABAACBACCBAAABB.exe
3132	svchost_CBBAACABCCAACACCBACCACCBBCBBBBBACCACAACBABAACBACCBAAABB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4152	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1188	svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe
Token: SeDebugPrivilege	3132	svchost_CBBAACABCCAACACCBACCACCBBCBBBBBACCACAACBABAACBACCBAAABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 5944	4152	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	92
PID 5944 wrote to memory of 5588	5944	cmd.exe	94
PID 1188 wrote to memory of 2068	1188	svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe	95
PID 4152 wrote to memory of 1276	4152	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	98
PID 1276 wrote to memory of 4224	1276	cmd.exe	100
PID 4152 wrote to memory of 4764	4152	2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	101
PID 4764 wrote to memory of 5444	4764	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_48fcb2c3d202e28dee789fa3b2d7021c_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBBCCBCABACBCBBCABCCABBBABCABBACCCCCBACBBCCABBAACCCBBAAAABCBCCBCAACCBABBACBCBCBBABCBAABBCCCCABBBCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBBCCBCABACBCBBCABCCABBBABCABBACCCCCBACBBCCABBAACCCBBAAAABCBCCBCAACCBABBACBCBCBBABCBAABBCCCCABBBCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCABABBCBABBCBCABACAABACCACCBAAAACACACABCACCCBCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe" start= auto displayName= "UserDataSvc_CBCABABBCBABBCBCABACAABACCACCBAAAACACACABCACCCBCCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCABABBCBABBCBCABACAABACCACCBAAAACACACABCACCCBCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe" start= auto displayName= "UserDataSvc_CBCABABBCBABBCBCABACAABACCACCBAAAACACACABCACCCBCCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCABABBCBABBCBCABACAABACCACCBAAAACACACABCACCCBCCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCABABBCBABBCBCABACAABACCACCBAAAACACACABCACCCBCCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2068

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACABCCAACACCBACCACCBBCBBBBBACCACAACBABAACBACCBAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAACABCCAACACCBACCACCBBCBBBBBACCACAACBABAACBACCBAAABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe
1⤵
- Executes dropped EXE
PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1dcb265614bebc5406b7d5e87aa888ba71bbb6c0476dd869c121156da3cfd200
MD5 c781a909528728abc397cb5475c4ebb2
SHA1 735956558c696b2d435439db1fab9052624d5192
SHA512 3bbf78c4dcf94574edfcd96bc4802ff3e0636a530588139c11e43c87abf77471c71ca226a9fe6bba1d3f1c0b21a4f6a8f7173489c277721ff371c3064fb6ee6a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4d0b39c2dd1813591019cf175b65ccbc893f7442c1c799774fa22ffff4911648
MD5 801e0c43f22184e32b17f8f8708584f8
SHA1 3a60dd9420e83a933e6bb67497ac0e13c2f9e914
SHA512 f06d97e19f0ef23432c01b4fcf8d88b6ddd552f58f4fea738cb6e6d35c57a87042e2ddb880673c7602d4f62b57bd9dab212457ade1e4e9e178e008dc53374b62
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1e6b07391dbf30da1b25a817ea361ea605090c49a535bd7d6746ca28e4cd907b
MD5 beb6dcc46de44223ab516a3b8183da59
SHA1 4b9c685128284af6d5bf72b0c49527e09a50da8f
SHA512 998e35c43e11bacf479f0ff8dc4d90c63b3ff89a2c8399b6ae85d3824792858fa9f3b5943089ba102807e15715f3a4efe92e24a535fc8f3cf4979668fa680890
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41674080260244019a146b9f1f54737ec9421872fb192d6606c6d9242e739c3c
MD5 9b6b29e762f6b2ad252769b3697d12a0
SHA1 c571211ab07621d595f9eb0a370b19b15d08d431
SHA512 58b5ca7374ebe9f3291fe8800e2d985b47c528026f4e60fc315056a17ebf109f19fa4dae32f0785153b9ae3f78117910115e621d7255aff60b6a57513641cc50
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f20c49b79ef65990fabeb5357519e3e229f7f60f19c5eac7b7b86b586b5067e0
MD5 c9ece5261c8a8e098e14d96607184317
SHA1 f9dc2d0ffe197a4ac9a780648588f2be69ff765a
SHA512 7e890cc7ca531a842a5c4d044e8b73ed38a390eba2a17a49c3d8111473fbe0a9feac6be707bc4396cf01a578547638a78d325ea3c53dd26ad699283fcb22dccd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 74723ccc9345d3b4476983212694004e68f20d59c81807d905b3b16029b13110
MD5 65701368608de15d9ec4be7cb15a6385
SHA1 5c996a7d99a3664c21af58a30ee908189fef18ef
SHA512 711761af9903886c9fab89fbc11b33563a9d6a43c8b7ca767dcb8bd31da94d8d24b77039bf1d749d11069cf22ffe1cf11ae0697bc12279ef4fc7224e688a48de
MD5 SHA1 SHA512

Submit Download

svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCBAAABCCBBBCBBBBABACACCAACCBAABCCCCCCCCAAACAABAAB.exe
Size 11.5MB
SHA256 dcc8d6562f7d387c4ae64cf58a750e248efa0b166ec3ebdc3a7f6866a4c60c89
MD5 48fcb2c3d202e28dee789fa3b2d7021c
SHA1 5da7c5744473b0a66487c5674c141e8478664718
SHA512 6efff81332ccb6711c57c534ddbefc7ce5e0f317a9b526f9538b59968c8d51ba63c52bb4c94268a207df574593b3122f074eaef45c4b0db88c491301ba45980e
SSDEEP 98304:85U5U5H5j5U5U5H5dA91pH2WpjHrgBFFu416AWv0:85U5U5H5j5U5U5H5dmHpn6F44IAWv0
TLSH
T1DFC66D58B7E710E8F57BD5B488BAC376DE717C124231879F562CD60A2E23690AC39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2c8f9f4eab2864b9559d3c69d55d9be60257d59badac03f0822635ccff713228
MD5 bf6a7a2670e1b6f7eec8d3fc7f17273e
SHA1 25b6256f4811aec61485d1d5d512a015d8907978
SHA512 5ce9526f92d754ccf316e52bdf7ebcb9bb0cf07fd1ed1c0084d68477ed54a7b323d3d5bd377cde159a8fa0c757ec84659dbf031105fdac5e5bb99faa9a51a8f6
TLSH
T11D11C450D5E5D8B3F93368CE863DAF8308E93B5F9C58AF5422494218E6E5C328E154F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1188-32-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/3132-79-0x0000000000940000-0x0000000000961000-memory.dmp

Download

memory/4152-0-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/4152-8-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download