c68270a22a889b1f461d16d9ae04a8876ed20341f12dda432a4bd41522cf5ba1

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.7MB
Sample260816-v4tw1atvbx
SHA256 c68270a22a889b1f461d16d9ae04a8876ed20341f12dda432a4bd41522cf5ba1
MD5 85993b8114b5fe60a2efc47fa1fbf0f6
SHA1 8cae46c3969be228f69afac73071e3182a10de8e
SHA512 0b4f0c36ec29d4561c3913f9e211a8b8835e8c8ed68c6154c1caff77ee468d129c7d4fee9b919da237e7a1cf282dc82a8486542668c7daf2c17f29e9d4ea2632
SSDEEP 49152:U+ES+ES+E2+ES+ES+EZC5WU+ES+ES+E2+ES+ES+EZC5Wib6LgA97HrsdochZVNhr:a5/5lA91pH2WpjHrgBFFu416AWvE
TLSH
T187865AA5A2E720ECE0BFD175897AC332EA717C130231935F167CD64A2F636646D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
240	svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe
5520	svchost_BACABAACAACCCCBABACCABCACBBACACBCCCABBCBACCACAACABBBBBA.exe
2236	svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACCCBCAABBACABABABACCABABBABACABCABABBBBACACBCCCBCBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACABAACAACCCCBABACCABCACBBACACBCCCABBCBACCACAACABBBBBA.exe"	svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCABACBBBCCBABCCBAAABAAAAACBAAAAABABBACCBAABCBAACCBBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe"	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2652	sc.exe
1832	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5456	cmd.exe
2192	cmd.exe
2536	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACABAACAACCCCBABACCABCACBBACACBCCCABBCBACCACAACABBBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4788	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4788	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4788	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4788	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
240	svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe
240	svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe
240	svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe
240	svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe
5520	svchost_BACABAACAACCCCBABACCABCACBBACACBCCCABBCBACCACAACABBBBBA.exe
5520	svchost_BACABAACAACCCCBABACCABCACBBACACBCCCABBCBACCACAACABBBBBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4788	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	240	svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe
Token: SeDebugPrivilege	5520	svchost_BACABAACAACCCCBABACCABCACBBACACBCCCABBCBACCACAACABBBBBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 5456	4788	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	92
PID 5456 wrote to memory of 1716	5456	cmd.exe	94
PID 240 wrote to memory of 1392	240	svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe	95
PID 4788 wrote to memory of 2192	4788	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	98
PID 2192 wrote to memory of 2652	2192	cmd.exe	100
PID 4788 wrote to memory of 2536	4788	2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	101
PID 2536 wrote to memory of 1832	2536	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_85993b8114b5fe60a2efc47fa1fbf0f6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBAACBCCACCBACCBACBCBBBABBBACBCCCCBACACBABCACCABCAABAAACBBCACBBCCAACBAACBBBABBBCCBCAACACBABBCBABBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBAACBCCACCBACCBACBCBBBABBBACBCCCCBACACBABCACCABCAABAAACBBCACBBCCAACBAACBBBABBBCCBCAACACBABBCBABBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBCABCCCCCCABBAACABBBBABCBBCCAACABCABCAABCBCACBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe" start= auto displayName= "UserDataSvc_CBCBCABCCCCCCABBAACABBBBABCBBCCAACABCABCAABCBCACBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBCABCCCCCCABBAACABBBBABCBBCCAACABCABCAABCBCACBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe" start= auto displayName= "UserDataSvc_CBCBCABCCCCCCABBAACABBBBABCBBCCAACABCABCAABCBCACBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBCABCCCCCCABBAACABBBBABCBBCCAACABCABCAABCBCACBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBCABCCCCCCABBAACABBBBABCBBCCAACABCABCAABCBCACBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:240
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAACAACCCCBABACCABCACBBACACBCCCABBCBACCACAACABBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAACAACCCCBABACCABCACBBACACBCCCABBCBACCACAACABBBBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe
1⤵
- Executes dropped EXE
PID:2236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 39d2bfe57e8444db11f3b0c0cbaaea4035c74512a867e969e16733e08e52a634
MD5 ca75301582367993dff21eac9ca63fc2
SHA1 4c825cb27653aacadb24142db6c29ee62e61c759
SHA512 c9790cd363ef7b100a89dc1c69c495e32f988fab59b4195d2cf306409066c2b54a54446fa1f9b3a293331285be2d141b14c493178670ad482a5ff6d13cf60b01
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9f7fb9e9e8d4dbfeb74faf2a62330e92d5e514cb90b6b23f74a1fd9d5a500fcb
MD5 d4c1504d503b908902be6fd780bcf7a6
SHA1 a14ec80b83def8c9cbe5e419f0c690cd333f944a
SHA512 db0b4676aec5fcd4ab7b1d01789edc6826fd9099c98780757f6e896337b9fda4e850b02ccee1604262a4511bc72185bd494fdf7bf4ac99ef49d288af2e4c74d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4e94792c57d4f4d2943d844476f63a8e28c7879348cd10ce73718824370a5175
MD5 bbee1eee0b09dd94330362d37129738d
SHA1 318fafc9a89766114471b4848bd10560071eab99
SHA512 1a9e46bcc893855331631da127b3de51232d989accee9f23a47a908384ccacc1fe7da671ab5454503b15dc2aec431e617af2400e4c3922f0c0d99160507a2c66
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0af01670981ac561a516b127639b4b7c6bb600b2f06d2b7baba443ef6f8fb46d
MD5 c4b4655dbb3e94f322ad28d5381b0043
SHA1 84ba1befd39de5c16e72d423ca13722512edfb39
SHA512 a565b11fc899867a3a821bc38957943a31efed2b0961c35ad1f1f39d345bc9bd61255fb9747b1c0ace3e367248e17d149f0d62123ddc5d8e7af0a74fc1161a8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1854d020bf636e8ab693217594e14954d66beba934070e34661f2e995ef4ae4d
MD5 cc435d566b8a5e6c2c5fb4770f4823e5
SHA1 5a4228a6128edb4b537c24ae41d579dad1d002d8
SHA512 c5330132dc1127706f597d650067ac057b547d2100fb84bb56034f9ab912fed9544c296fce89e9ca71fc8491f6944fc75b0d286ebd626cb5468cda3962fb1772
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0020b4f87ab068ffe18e1c1e60a5bb14a7d507849f1f3fc40983e1a1b515f0d5
MD5 563333e021f4457523e80913023e370a
SHA1 0cfb6e9c069e983360a8af48da1927943eb66d27
SHA512 098d09eeddaff88e3e2648473e66c0bfaaa3604f9e0c7bc08e0a9f4e75b1ec91087c37b2526247a0f4424349b62f6951056a14ea7c0156c36dc3768bb7d647be
MD5 SHA1 SHA512

Submit Download

svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCCABBABCCCCBBBACBABCBBCCBBBAABBCBAAABBAAAACCACBAB.exe
Size 7.7MB
SHA256 c68270a22a889b1f461d16d9ae04a8876ed20341f12dda432a4bd41522cf5ba1
MD5 85993b8114b5fe60a2efc47fa1fbf0f6
SHA1 8cae46c3969be228f69afac73071e3182a10de8e
SHA512 0b4f0c36ec29d4561c3913f9e211a8b8835e8c8ed68c6154c1caff77ee468d129c7d4fee9b919da237e7a1cf282dc82a8486542668c7daf2c17f29e9d4ea2632
SSDEEP 49152:U+ES+ES+E2+ES+ES+EZC5WU+ES+ES+E2+ES+ES+EZC5Wib6LgA97HrsdochZVNhr:a5/5lA91pH2WpjHrgBFFu416AWvE
TLSH
T187865AA5A2E720ECE0BFD175897AC332EA717C130231935F167CD64A2F636646D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 bbac133305be1fea01a3df67fe86b2096c286967472964890e5f15391e00fd95
MD5 2958a831b95fef5549d31f4916d2c857
SHA1 4430e5b061f6830a50a6ab2e961d60d9982a10d6
SHA512 1ae1a830b3872a07546da1f0b7013dd0aa72cdd4b169bf7c48499ac11be2325c6dcf9b8f481af54f100fef1b1557429b42836f3526b0aa8f3eb7f3377711563c
TLSH
T10F11086094E5EC77FD72644FA63EEF830CF533B7AD98BA1433488518B6898318D190E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-31-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/4788-0-0x00000000004B0000-0x00000000004D1000-memory.dmp

Download

memory/4788-7-0x00000000004B0000-0x00000000004D1000-memory.dmp

Download

memory/5520-70-0x0000000000580000-0x00000000005A1000-memory.dmp

Download