6c38ec68ef6ca6d8ca320a30f9808b48ce4fc1720f9388c9e631325e2258c394

Analysis

max time kernel
148s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 07:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_a5a6a90b4e1844172bfb3e29627bac54_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar.exe
Size 288KB
Sample260831-h1z8dsfb47
SHA256 6c38ec68ef6ca6d8ca320a30f9808b48ce4fc1720f9388c9e631325e2258c394
MD5 a5a6a90b4e1844172bfb3e29627bac54
SHA1 f1b2500739c6b475910735ac7db7fe56bc94ba1d
SHA512 8ba9cc926a81fc0605af61273097fdc283218c8f99c94daab31c1b96adc22e2b2615e9b0080f56e2b4fafa46c7432f41717b7f1df94fccbbc56ca01d10ed833f
SSDEEP 6144:xqF+9Y5Ws8zNJfx/5bTgVziHzZnSKrCbYMTAmgby8jq:cF3MsW/5/gVziHlBrCbYS82
TLSH
T1EF54A18B6E8002F7D66DE13444B3772D637BF43D2B928F9E8A5A6D590F733885C15680
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Abuse Elevation Control Mechanism: Bypass User Account Control 1 TTPs 1 IoCs

UAC Bypass Attempt via SilentCleanup Task.

defense_evasion privilege_escalation

Bypass User Account Control

T1548.002

pid	Process
2392	SCHTASKS.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2392	2100	2026-08-30_a5a6a90b4e1844172bfb3e29627bac54_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-30_a5a6a90b4e1844172bfb3e29627bac54_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_a5a6a90b4e1844172bfb3e29627bac54_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
  2⤵
  - Abuse Elevation Control Mechanism: Bypass User Account Control
  PID:2392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-0-0x000001FC2B3F0000-0x000001FC2B43E000-memory.dmp

Download

memory/2100-1-0x00007FFDE8B7F000-0x00007FFDE8B80000-memory.dmp

Download

memory/2100-2-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/2100-3-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads