7fb112eaa84a606b02759d4f15c14860cee6f6b2202783aab1d3307e042bbec3

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_5ae6e02a08418a75d1329aa32c935989_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Size 44.3MB
Sample260831-ym94faac52
SHA256 7fb112eaa84a606b02759d4f15c14860cee6f6b2202783aab1d3307e042bbec3
MD5 5ae6e02a08418a75d1329aa32c935989
SHA1 88ebace90c1063aa1629c3c6a0325a7d68336191
SHA512 6dfd7c31e9ac184e492890b63bf6c38721712883485ba8814871b7a0cf1fdcb9860ee2fbea84c071e69418a63d07f2f7bfa27c781163b3e9e08de81c54aa3895
SSDEEP 393216:0mHN6+JrvD9mHN6+JrvD9mHN6+JrvD9mHN6+JrvDox:FbrkbrkbrkbrUx
TLSH
T17BA78C5662AA10E9D0AFD079C566C332E6717C17033157DB02BCC67A2FA77A06D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024693-22.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4752	svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe
4280	svchost_ABABACCABCABBAAACACAABAAACBABAAACBACACBBBCCBBABCAACCACB.exe
5108	svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBABAAAAAAAACBBABCAABBAAAABACBABBAAAABBCAACCCCACCACBCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe"	2026-08-31_5ae6e02a08418a75d1329aa32c935989_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CACBACCCABACCBAABAABBAAAAACACBBCCACCABACCCBACBAAAAAAACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABACCABCABBAAACACAABAAACBABAAACBACACBBBCCBBABCAACCACB.exe"	svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4716	sc.exe
4768	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
568	cmd.exe
3600	cmd.exe
4708	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABACCABCABBAAACACAABAAACBABAAACBACACBBBCCBBABCAACCACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_5ae6e02a08418a75d1329aa32c935989_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4460	2026-08-31_5ae6e02a08418a75d1329aa32c935989_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4460	2026-08-31_5ae6e02a08418a75d1329aa32c935989_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4460	2026-08-31_5ae6e02a08418a75d1329aa32c935989_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4460	2026-08-31_5ae6e02a08418a75d1329aa32c935989_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
4752	svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe
4752	svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe
4752	svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe
4752	svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe
4280	svchost_ABABACCABCABBAAACACAABAAACBABAAACBACACBBBCCBBABCAACCACB.exe
4280	svchost_ABABACCABCABBAAACACAABAAACBABAAACBACACBBBCCBBABCAACCACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	2026-08-31_5ae6e02a08418a75d1329aa32c935989_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	4752	svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe
Token: SeDebugPrivilege	4280	svchost_ABABACCABCABBAAACACAABAAACBABAAACBACACBBBCCBBABCAACCACB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1804	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 568	4460	2026-08-31_5ae6e02a08418a75d1329aa32c935989_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	99
PID 568 wrote to memory of 2204	568	cmd.exe	101
PID 4752 wrote to memory of 1848	4752	svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe	102
PID 1848 wrote to memory of 1732	1848	notepad.exe	103
PID 4460 wrote to memory of 3600	4460	2026-08-31_5ae6e02a08418a75d1329aa32c935989_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	107
PID 3600 wrote to memory of 4716	3600	cmd.exe	109
PID 4460 wrote to memory of 4708	4460	2026-08-31_5ae6e02a08418a75d1329aa32c935989_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe	110
PID 4708 wrote to memory of 4768	4708	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-31_5ae6e02a08418a75d1329aa32c935989_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_5ae6e02a08418a75d1329aa32c935989_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABACBABBCBAAABBABCBACCBCBBACBCCABBAACACCAABBABCCAACABCBAACBCABCBCCBCABBBBBBBCBCBCBBACBACACCCCAAACCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABACBABBCBAAABBABCBACCBCBBACBCCABBAACACCAABBABCCAACABCBAACBCABCBCCBCABBBBBBBCBCBCBBACBACACCCCAAACCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBAAAACABAABAACACCAAABAABCCCAACCABABABABAAACABACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe" start= auto displayName= "UserDataSvc_BCBAAAACABAABAACACCAAABAABCCCAACCABABABABAAACABACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBAAAACABAABAACACCAAABAABCCCAACCABABABABAAACABACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe" start= auto displayName= "UserDataSvc_BCBAAAACABAABAACACCAAABAABCCCAACCABABABABAAACABACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBAAAACABAABAACACCAAABAABCCCAACCABABABABAAACABACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBAAAACABAABAACACCAAABAABCCCAACCABABABABAAACABACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACCABCABBAAACACAABAAACBABAAACBACACBBBCCBBABCAACCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACCABCABBAAACACAABAAACBABAAACBACACBBBCCBBABCAACCACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe
1⤵
- Executes dropped EXE
PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fc8c4249558b574742e1a5557432892129e7356a9d079cdb8f84ecb3d06c0e9e
MD5 a6d7829db90299686031ccd6a9bf28dd
SHA1 39e5a9b0cf35a720a462f7423e9d07b3a4eeadb4
SHA512 00b891d4240d3b8061a48a3428c454d1d865c0e5027e1432c2419ecc7c06c005f6f1277649dbf21d74cac3c9df921b444fa50a80463246e824c44dcd3b244a77
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 82ab76aa249610a4a5daa959a9442c27d2e282d0193345c3f00f5fe036e230a8
MD5 b450bd1fca0d3749f3a880bbca84a547
SHA1 2861929bc2e3b0abd84ae75441d0a19fe8c61dfd
SHA512 6d5d253024486f80777bb7a5929fe5130f55a726ab757c59f2b0373b03a71c34ae934e9a1f706263f1fd21b065378fa577bec48a7c05e7e504faf1f19f0711c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4717dbc5473b3e3fdc5d2ff6f03dc8a047929677d9b63a4941e098bb67bd4c68
MD5 64f2f5e7c74464c837f711e804c73ea6
SHA1 409c29795d6b9748e331137cdf0d09b90102b4dd
SHA512 48daec4757f2e48a2bc81cc9ce0b84d72edf529dd989fd224489bce614608fe7cbf655b34fdd10fc3ff79ae9f804c29f80d0d83914099be72b67cd1b1024c2bc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b0cec4b0136515cfd6bb4a1dcd728f467ba59c20797dca646c798698372375ff
MD5 8516d8f2ec7a0b119fbbffed1149d255
SHA1 a2db1c3f7e4ea5791e9d637357ae45c9d451b99d
SHA512 94dceb3b968841735e5c66ab26ece7c122a4171d0f9f95a82d0f8952a5e76a498f0dc3dc16c64ef0311bf6da4287252590abb1435ffc6e3f517181c46ce59650
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b0d58c4d48406aed4356e7d5291a7414d338753b710aa6c63f83221caabf13d2
MD5 73574d00266d18780c8172a040b90a44
SHA1 e6cd61d7cdcd940d1c1f06791ced9a5c7012ba3a
SHA512 198fd884f357de0b945d2692a75ac804b12add148854d2d6b5a1026ab8c8a4029f51e9725f4912c93a8c29079f6705c72de536ffe1839f9dd99a386cb17bba4b
MD5 SHA1 SHA512

Submit Download

svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe
Size 44.3MB
SHA256 7fb112eaa84a606b02759d4f15c14860cee6f6b2202783aab1d3307e042bbec3
MD5 5ae6e02a08418a75d1329aa32c935989
SHA1 88ebace90c1063aa1629c3c6a0325a7d68336191
SHA512 6dfd7c31e9ac184e492890b63bf6c38721712883485ba8814871b7a0cf1fdcb9860ee2fbea84c071e69418a63d07f2f7bfa27c781163b3e9e08de81c54aa3895
SSDEEP 393216:0mHN6+JrvD9mHN6+JrvD9mHN6+JrvD9mHN6+JrvDox:FbrkbrkbrkbrUx
TLSH
T17BA78C5662AA10E9D0AFD079C566C332E6717C17033157DB02BCC67A2FA77A06D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACBBCCAACCBBBCABCACACABBAABCBACAAABABAACBABBBABCCA.exe
Size 34.3MB
SHA256 6bee1022933a47b293416661452b1ff00127c56e5a13d609005898951209a283
MD5 28af840a7f9a8a19127e716faf5cbf17
SHA1 c57884d3554e88cdfbdd2260b98454e3e6d601a6
SHA512 524bf7ee963d563f1034324edc2c00f725c0ceafcd8708921e9487de0fa6339a56097283e2ea1b86a7f0d844b2f30da7c814a6df1277afeabc030478e1d511e4
SSDEEP 196608:0mHpn6F44IAWvD9mHpn6F44IAWvD9mHpn6F44IAWvDn:0mHN6+JrvD9mHN6+JrvD9mHN6+JrvDn
TLSH
T185877C5A62AA10E9D0AFD079C566C332E6717C17033157DB02BCC67A2F677A06D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 74ee219b58ec9f86fc7e3730f4a37e3cf37cb2487b8c64c0cbddbacfff53a180
MD5 e8bd0dec20cb6d903fde969a30bba793
SHA1 a6ccfb7a81a535538893076b66648ecd3e79b24b
SHA512 e1ef99c463916db84de852bfb265c6f55c15756b9058ef12e77ab735e7ee83441436b6ba972683f923046307d8e92239e4d42968c57d06f58c1c98705341ddc2
TLSH
T131118661C0E5DCA3F4326CCBF225EA8B4CF1364FAC5CAA54631A421DB799D718D650F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1848-59-0x0000000005310000-0x0000000005311000-memory.dmp

Download

memory/4460-0-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/4460-8-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/4752-37-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/4752-27-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download