8f5d03ce93d26ae3ce7ca2a0f7332c9ac6643cdccce89c33e5b2a55658abb1d9

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 13:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_e20cca1b4545b9b523017bb7bd8d7710_cobalt-strike_elex_glassworm_icedid_njrat_stealc_stop_vidar.exe
Size 34.2MB
Sample260831-qwdgtsshla
SHA256 8f5d03ce93d26ae3ce7ca2a0f7332c9ac6643cdccce89c33e5b2a55658abb1d9
MD5 e20cca1b4545b9b523017bb7bd8d7710
SHA1 fdb462fe75148a80177f8d2337f6fcab344a5788
SHA512 84a785d49c19b1f57120352eb28d7fb0bb4f9561a7e6600181d4c46d6389ec588a2e39fc2fb5ed3a5a0b6d3e5e7f2d77370a8b2e0987680ae45d454247860503
SSDEEP 786432:25P5P5P5P5j5P5P5P5P5P5j5P5P5P5P5P5o5P5P5P5P5j5P5P5P5P5P5j5P5P5PB:dbrQbrE
TLSH
T1AA773A6CB79721D5DA2BD0B4889AC3F6FD703921033147AF6A19F6152E176E0AC3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5840	svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe
4364	svchost_CCACCBCBACCCBCCACBBBBBABAACABABBCBABBAAAAABBACBCBABAAAC.exe
616	svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCBCCAACCACCACACBAAABCABCABCCACCCBACBCBBAACABCACCBCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe"	2026-08-31_e20cca1b4545b9b523017bb7bd8d7710_cobalt-strike_elex_glassworm_icedid_njrat_stealc_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCBBCABCCCCBCABCAAACABBABCAABCACCCBCBACBBACBABAAACBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACCBCBACCCBCCACBBBBBABAACABABBCBABBAAAAABBACBCBABAAAC.exe"	svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3976	sc.exe
4688	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5452	cmd.exe
1060	cmd.exe
5036	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACCBCBACCCBCCACBBBBBABAACABABBCBABBAAAAABBACBCBABAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_e20cca1b4545b9b523017bb7bd8d7710_cobalt-strike_elex_glassworm_icedid_njrat_stealc_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3656	2026-08-31_e20cca1b4545b9b523017bb7bd8d7710_cobalt-strike_elex_glassworm_icedid_njrat_stealc_stop_vidar.exe
3656	2026-08-31_e20cca1b4545b9b523017bb7bd8d7710_cobalt-strike_elex_glassworm_icedid_njrat_stealc_stop_vidar.exe
3656	2026-08-31_e20cca1b4545b9b523017bb7bd8d7710_cobalt-strike_elex_glassworm_icedid_njrat_stealc_stop_vidar.exe
3656	2026-08-31_e20cca1b4545b9b523017bb7bd8d7710_cobalt-strike_elex_glassworm_icedid_njrat_stealc_stop_vidar.exe
5840	svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe
5840	svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe
5840	svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe
5840	svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe
4364	svchost_CCACCBCBACCCBCCACBBBBBABAACABABBCBABBAAAAABBACBCBABAAAC.exe
4364	svchost_CCACCBCBACCCBCCACBBBBBABAACABABBCBABBAAAAABBACBCBABAAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3656	2026-08-31_e20cca1b4545b9b523017bb7bd8d7710_cobalt-strike_elex_glassworm_icedid_njrat_stealc_stop_vidar.exe
Token: SeDebugPrivilege	5840	svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe
Token: SeDebugPrivilege	4364	svchost_CCACCBCBACCCBCCACBBBBBABAACABABBCBABBAAAAABBACBCBABAAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 5452	3656	2026-08-31_e20cca1b4545b9b523017bb7bd8d7710_cobalt-strike_elex_glassworm_icedid_njrat_stealc_stop_vidar.exe	92
PID 5452 wrote to memory of 908	5452	cmd.exe	94
PID 5840 wrote to memory of 5848	5840	svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe	95
PID 3656 wrote to memory of 1060	3656	2026-08-31_e20cca1b4545b9b523017bb7bd8d7710_cobalt-strike_elex_glassworm_icedid_njrat_stealc_stop_vidar.exe	98
PID 1060 wrote to memory of 4688	1060	cmd.exe	100
PID 3656 wrote to memory of 5036	3656	2026-08-31_e20cca1b4545b9b523017bb7bd8d7710_cobalt-strike_elex_glassworm_icedid_njrat_stealc_stop_vidar.exe	101
PID 5036 wrote to memory of 3976	5036	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-31_e20cca1b4545b9b523017bb7bd8d7710_cobalt-strike_elex_glassworm_icedid_njrat_stealc_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_e20cca1b4545b9b523017bb7bd8d7710_cobalt-strike_elex_glassworm_icedid_njrat_stealc_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCACCBCABACAABCBABABCCCABCAAACCBBBABAACAACBBABCBABCBCACBCABBCBBCAACBCCCAAACABBAAACBCBCBABCBCBBCCAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCACCBCABACAABCBABABCCCABCAAACCBBBABAACAACBBABCBABCBCACBCABBCBBCAACBCCCAAACABBAAACBCBCBABCBCBBCCAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACACBCAAAACCCCBBAABACCBBCCCABCBAAAAAABBCCABBBABAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe" start= auto displayName= "UserDataSvc_BACACBCAAAACCCCBBAABACCBBCCCABCBAAAAAABBCCABBBABAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACACBCAAAACCCCBBAABACCBBCCCABCBAAAAAABBCCABBBABAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe" start= auto displayName= "UserDataSvc_BACACBCAAAACCCCBBAABACCBBCCCABCBAAAAAABBCCABBBABAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACACBCAAAACCCCBBAABACCBBCCCABCBAAAAAABBCCABBBABAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACACBCAAAACCCCBBAABACCBBCCCABCBAAAAAABBCCABBBABAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3976

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5848

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBCBACCCBCCACBBBBBABAACABABBCBABBAAAAABBACBCBABAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCBCBACCCBCCACBBBBBABAACABABBCBABBAAAAABBACBCBABAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe
1⤵
- Executes dropped EXE
PID:616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0458a12051d81d9b6e6f04613077f70dd80f86276c71d90f793488411618e5ce
MD5 80257bc2d7a7c8230b5af3ad4b30bea3
SHA1 6610ed10d0a377729ea53c4939c9f40286c33714
SHA512 61152ece19ce79a23845109f5a874f95508e7f3755c5dd14cd6fad5073e7debd70edb87b6b5a15203ca256c9080fd63d5f7b4105ce44101204a17dac46c762cd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a9a2bb27ee814507c588fbc7324ffb048b80c7587dbdf5cc7e850ec266435082
MD5 3dff09644a6b883f4708cbe7a3567501
SHA1 4d46ba8b635366043f7cd30caa4022f3b634ff1e
SHA512 efdc2a8f757cb8f260909b13d08cfcc3d1f70936c7b94d4654919100eef239ce5399afba0fc067ede9461d45d3cb6ce5cf3d6f84dddef814f8b46b3e7aaab687
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a2e91a90d05d225d87e99a08433dda309b63f1f3b1ac02107d5c62d0d44cbd09
MD5 a0dcebb2e44d5b0b6a187d8e1c66cc17
SHA1 e2f20b52713487fc796655786f5c86a78f62957f
SHA512 92b1407edf5ed1aed7fe647cbc2f88916300087d1e3eab36dfebfb363ff16a402cfc9c69fc41c21491ed3ec7cd6dcebbb58d2c27a6d0984b9ae519184c670564
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bd2c447e0a458b090fa60cb98b1e76b017522a5f5ad988f0b597cadc4ccd85de
MD5 dbceaf069de185d06e9c6e8382c5aac9
SHA1 3a0c2a2366450c2a08f3a02005a0ce1a3d22e4fa
SHA512 0117071f3df3a3750b6c3d4531be8a9f9fd322b3500e0c13495e4f41705505107948aea2ccbc3806220e3194c9755e20e49a8c70b62c9d0696c6b026195cd1ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8585ebe31c12b2c5b21fef3edcf1160bdd7e5ec2b8b906ac064195be0152af61
MD5 9529d835bb78be6416c5bf08229e8537
SHA1 53d55106b283f02371f2c07292ac535a154f3417
SHA512 284c6341ec8e58562f8f1ca259cb8a77fbbd54aa582156aa42cf4e850a7e8d02a161d6d263f5c3954d7497a18c3d768cd5dcbfcb9327f17365998529bd7f69e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 98e17dcb40ebd438244fcd8a85588ef1fa006a83e88ff84cccb5f6b0a555a6cc
MD5 49076a5bd293bb6fcf28cd9512b0eb6e
SHA1 422af1ed01450e489c1fbc1c128203392d66faf1
SHA512 8e1a59e74b2c94293c8535e5e8e46ab45872f0071579d5c2c9f79add340f5fa957d815f6b06f1c41ef24d0500ea26ad5530775293e8dca0b14a438892ba9e7a2
MD5 SHA1 SHA512

Submit Download

svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCAABBBBACBCAABCAACABBBCBBBCBCBBCCAACAABCBCBBBABCCA.exe
Size 34.2MB
SHA256 8f5d03ce93d26ae3ce7ca2a0f7332c9ac6643cdccce89c33e5b2a55658abb1d9
MD5 e20cca1b4545b9b523017bb7bd8d7710
SHA1 fdb462fe75148a80177f8d2337f6fcab344a5788
SHA512 84a785d49c19b1f57120352eb28d7fb0bb4f9561a7e6600181d4c46d6389ec588a2e39fc2fb5ed3a5a0b6d3e5e7f2d77370a8b2e0987680ae45d454247860503
SSDEEP 786432:25P5P5P5P5j5P5P5P5P5P5j5P5P5P5P5P5o5P5P5P5P5j5P5P5P5P5P5j5P5P5PB:dbrQbrE
TLSH
T1AA773A6CB79721D5DA2BD0B4889AC3F6FD703921033147AF6A19F6152E176E0AC3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 fc450a547f2011380a5fb0f8d30544e600bd94cf77380e7eb2392a63f55e9573
MD5 5cb476b94d03c295b833d3cc27d3eee0
SHA1 2a7110783daabdb4cc65aef4980d7eb774c886b9
SHA512 081cfba564583794cd24d4c84d5763530135102e25f98b878cbe9139934607d70d0caecb70e108bf72c1509bde6b7016d982ed93a0380d149dce3078a64fb8b1
TLSH
T14111E3A2E0E6D8B7B432388F9215C9C71CE837876D6CBA15631A4119B7CEC31AD1D0E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/616-81-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/3656-0-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/3656-7-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/4364-79-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/5840-33-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/5840-23-0x00000000001E0000-0x0000000000201000-memory.dmp

Download