84545c6a7d6f3a9d5314071c8f6060561ffa362b7a52dac5bfd976c8a4121202

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_ff7a5ea3d793e348c2eaa3cb19629fd2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Size 22.1MB
Sample260825-3spf5sxtd1
SHA256 84545c6a7d6f3a9d5314071c8f6060561ffa362b7a52dac5bfd976c8a4121202
MD5 ff7a5ea3d793e348c2eaa3cb19629fd2
SHA1 89b292a36d19d6157c4118917bdfb36b92676a20
SHA512 79c1db8940b62d6104e588c536d88b939239363542e59fae239a7dc3f93bf8dd0d98c5e6ce2902e92d26a384bd9b511b2888400f90eabfc0caf16713baad679c
SSDEEP 98304:i/i//t//fA91pH2WpjHrgBFFu416AWva//t//i//t//fA91pH2WpjHrgBFFu416r:lmHpn6F44IAWv1mHpn6F44IAWvLjH
TLSH
T143376B5A62AA10F9D46FD176C6A6C332D6707823033117DB527CCA3E2F676906D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3444	svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe
4256	svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe
5988	svchost_BABCCCBBBCABBBCBCAABACBAAAABACACCBACACAAABCBBABBACBCABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCBBBABAAABCCBCBABCACCACCABABBAACAACABACCBBBBACAABAAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe"	2026-08-25_ff7a5ea3d793e348c2eaa3cb19629fd2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCABABCABAAAACACBABBAACBBCBCBBACBCACACBAABBABBCACCAABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCCCBBBCABBBCBCAABACBAAAABACACCBACACAAABCBBABBACBCABA.exe"	svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4360	sc.exe
4496	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2864	cmd.exe
720	cmd.exe
4616	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_ff7a5ea3d793e348c2eaa3cb19629fd2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCCCBBBCABBBCBCAABACBAAAABACACCBACACAAABCBBABBACBCABA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5572	2026-08-25_ff7a5ea3d793e348c2eaa3cb19629fd2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
5572	2026-08-25_ff7a5ea3d793e348c2eaa3cb19629fd2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
5572	2026-08-25_ff7a5ea3d793e348c2eaa3cb19629fd2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
5572	2026-08-25_ff7a5ea3d793e348c2eaa3cb19629fd2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
3444	svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe
3444	svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe
3444	svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe
3444	svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5572	2026-08-25_ff7a5ea3d793e348c2eaa3cb19629fd2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Token: SeDebugPrivilege	3444	svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5572 wrote to memory of 2864	5572	2026-08-25_ff7a5ea3d793e348c2eaa3cb19629fd2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	92
PID 2864 wrote to memory of 1820	2864	cmd.exe	94
PID 3444 wrote to memory of 3388	3444	svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe	95
PID 5572 wrote to memory of 720	5572	2026-08-25_ff7a5ea3d793e348c2eaa3cb19629fd2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	96
PID 720 wrote to memory of 4360	720	cmd.exe	98
PID 5572 wrote to memory of 4616	5572	2026-08-25_ff7a5ea3d793e348c2eaa3cb19629fd2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe	99
PID 4616 wrote to memory of 4496	4616	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-25_ff7a5ea3d793e348c2eaa3cb19629fd2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_ff7a5ea3d793e348c2eaa3cb19629fd2_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBBCBBACACCCCABBCACACBAAACABBCAAAACAACCCBAAACCABCABACBCCCAABACBBBCBACBBBABCBACCACCBBCAABCABACABCCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBBCBBACACCCCABBCACACBAAACABBCAAAACAACCCBAAACCABCABACBCCCAABACBBBCBACBBBABCBACCACCBBCAABCABACABCCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAAACAABABABACBBCBBCBBAACBABCAACACABAAAAAABCBCABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe" start= auto displayName= "UserDataSvc_BCAAACAABABABACBBCBBCBBAACBABCAACACABAAAAAABCBCABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAAACAABABABACBBCBBCBBAACBABCAACACABAAAAAABCBCABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe" start= auto displayName= "UserDataSvc_BCAAACAABABABACBBCBBCBBAACBABCAACACABAAAAAABCBCABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAAACAABABABACBBCBBCBBAACBABCAACACABAAAAAABCBCABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAAACAABABABACBBCBBCBBAACBABCAACACABAAAAAABCBCABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4496

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe
1⤵
- Executes dropped EXE
PID:4256

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCCBBBCABBBCBCAABACBAAAABACACCBACACAAABCBBABBACBCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCCBBBCABBBCBCAABACBAAAABACACCBACACAAABCBBABBACBCABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6b839206acabe771a6c649d9420e8f761773181a9f35e0e8db1a4c983565d62f
MD5 75ca831563cc5eb6d9365061f1f507a8
SHA1 9836bc59d9fed1d96d944e2ffdb37fc36d146261
SHA512 74c7143d7a5f43f2b9ef099f9d4a3efb0f8676019ac9d1b9ff2772298623dec53096f640528271b1f3984cc1095ba86a3ee647286591389f04376ab14040272a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9fbdb0048ef6c80f05455e623e7141b75d878b159c8bfd2631a90e0b4561fd79
MD5 b6ea106a4f0395b575c64f067ed766ce
SHA1 31fb4f6851734b196e67a110dae3855ff2568f90
SHA512 170a6028081ee6adbe4fed7f29da120a1a6ff7213cd2be93633ce3207cdae680334036f994b015c5aceae7328bb0472160f9aaa0363f6b3f86c6ad725afabd23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 15b25975c9fe719dad83ea1eb18937a24b511ea48e0bdfee8828afaf9d131d2d
MD5 f1a18257bdfe89990ee04c4421731416
SHA1 efbd1f5dd22584178e1bb92fd5eb50c6036919d5
SHA512 5521677a09571330f04a8195a625334af012c3f7723705759e311e99a4b50b247ddd912df438be64bf8e26cd16074449ff5c1594783e7aa1f021cd30435270ad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0f9c663e7bc9e9e89995a710d8b2f35c669cec40845bbe36c236738967279b30
MD5 57184893b286641889c715fb793026dd
SHA1 c3b37daf0b82b1f868d86b0e29a97e01029cae56
SHA512 a1f660eb367bbf4727e30a0f3f65be03b8e7e115082d976f89aa249d8877b87954c72d80e54cd5afffc0e339712a83e007e28a3d5e70265d5b7fe94bc7337f91
MD5 SHA1 SHA512

Submit Download

svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABCABCAACABBBBBCBCCBAABABAABBCAACCBAABCABCAACCCAB.exe
Size 22.1MB
SHA256 84545c6a7d6f3a9d5314071c8f6060561ffa362b7a52dac5bfd976c8a4121202
MD5 ff7a5ea3d793e348c2eaa3cb19629fd2
SHA1 89b292a36d19d6157c4118917bdfb36b92676a20
SHA512 79c1db8940b62d6104e588c536d88b939239363542e59fae239a7dc3f93bf8dd0d98c5e6ce2902e92d26a384bd9b511b2888400f90eabfc0caf16713baad679c
SSDEEP 98304:i/i//t//fA91pH2WpjHrgBFFu416AWva//t//i//t//fA91pH2WpjHrgBFFu416r:lmHpn6F44IAWv1mHpn6F44IAWvLjH
TLSH
T143376B5A62AA10F9D46FD176C6A6C332D6707823033117DB527CCA3E2F676906D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BABCCCBBBCABBBCBCAABACBAAAABACACCBACACAAABCBBABBACBCABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCCBBBCABBBCBCAABACBAAAABACACCBACACAAABCBBABBACBCABA.exe
Size 20.8MB
SHA256 943c6602ea2ebd71fe9333146654d7703ec708712a5f9c99da59ea55563f4746
MD5 5877d7b5bd177731c06f0b944c78b023
SHA1 7ac4dca03d911ed2966efa92e5f7f3003da0cb4a
SHA512 74138fcfbf82b70644b20ffe0285d76a528c0aeb693c4e2c0c6e8dbf3c99cb2b5b0ae633dcabf5466b9a1e1408c2c7679e23747c3fc870b779b395dc05c7a286
SSDEEP 98304:i/i//t//fA91pH2WpjHrgBFFu416AWva//t//i//t//fA91pH2WpjHrgBFFu416Z:lmHpn6F44IAWv1mHpn6F44IAWvN
TLSH
T19C275B5A62AA10F9D46FD176C6A58332D670782303311BDB527CCA7E2F6B5906C3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3444-24-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/3444-34-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/5572-0-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/5572-8-0x0000000000340000-0x0000000000361000-memory.dmp

Download