c27e13989bf7a0253f5a6d3369e07e6745afb5095fd4ee69353d627c8ef4440c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 9.7MB
Sample260901-2e37pscj6w
SHA256 c27e13989bf7a0253f5a6d3369e07e6745afb5095fd4ee69353d627c8ef4440c
MD5 00ec40eda02aa21b3faded618713e588
SHA1 8619b82276f517a8e17421e51a637a34fa59cc73
SHA512 3f9dd7372ed3ea0f350bfecd503a18be2ebe0e0eb8e59a61a75fc27818cc2ee3d9130a0c5a5cd4851966e7e50a4173e8db0b86c885b3c4d2cdee78a387597e73
SSDEEP 49152:U+ES+ES+ETqatgl4+ES+ES+ES+ETqatgl4+ES+ES+ES+ETqatglwXpH+ES+ES+Ed:oaaraa9A91pH2WpjHrgBFFu416AWvM
TLSH
T1F8A68C91B59720F9E06FD07589ABC372D6717C130632874B667CE25E2F33A906E29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2656	svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe
4032	svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe
3492	svchost_CBABCCACBABABBCBCBBABCAAABACBBABCBCACCABCBCAAABACABAACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBABCACCACCBAAABBACACCBBABABACBCCABABCABBCACCBAACBBAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe"	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABAAAAABBAAABCBBCAACCCBBBCBAABCBACBBCBABACBBCBCCACCBACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABCCACBABABBCBCBBABCAAABACBBABCBCACCABCBCAAABACABAACA.exe"	svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1988	sc.exe
4596	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3828	cmd.exe
760	cmd.exe
2288	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABCCACBABABBCBCBBABCAAABACBBABCBCACCABCBCAAABACABAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4800	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4800	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4800	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4800	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2656	svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe
2656	svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe
2656	svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe
2656	svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2656	svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4652	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 760	4800	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	96
PID 760 wrote to memory of 3544	760	cmd.exe	98
PID 2656 wrote to memory of 4684	2656	svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe	99
PID 4684 wrote to memory of 4156	4684	notepad.exe	100
PID 4800 wrote to memory of 2288	4800	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	102
PID 2288 wrote to memory of 1988	2288	cmd.exe	104
PID 4800 wrote to memory of 3828	4800	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	105
PID 3828 wrote to memory of 4596	3828	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBACBBCACBCCBAAAAAACACABBBAACCBAAABABBBAABABBABBBBCAABCBABCABACAABCBCABCCACCBAACABBBAACCCACBAAAACACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBACBBCACBCCBAAAAAACACABBBAACCBAAABABBBAABABBABBBBCAABCBABCABACAABCBCABCCACCBAACABBBAACCCACBAAAACACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACABBCBBCABBAABCCBAABACCCABAACAACCCAAABABABCBACCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe" start= auto displayName= "UserDataSvc_CACABBCBBCABBAABCCBAABACCCABAACAACCCAAABABABCBACCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACABBCBBCABBAABCCBAABACCCABAACAACCCAAABABABCBACCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe" start= auto displayName= "UserDataSvc_CACABBCBBCABBAABCCBAABACCCABAACAACCCAAABABABCBACCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACABBCBBCABBAABCCBAABACCCABAACAACCCAAABABABCBACCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACABBCBBCABBAABCCBAABACCCABAACAACCCAAABABABCBACCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4652

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe
1⤵
- Executes dropped EXE
PID:4032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCACBABABBCBCBBABCAAABACBBABCBCACCABCBCAAABACABAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCACBABABBCBCBBABCAAABACBBABCBCACCABCBCAAABACABAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2a03d5daee990f707e59fdab7aa5c07b06be2c1b36ca1f466ee141ee3eb7ec0e
MD5 7e6a683c5d4230f8b72e3f1246e9795e
SHA1 475c4fcfdb4ff2abbed7e92ced3ea08da1856964
SHA512 3f3e4ecbb98aeb3ebac42f28ae89eefe5ec96a8c06a84d1708c92febcab31131de86990a30b6bd3ec8ca0a4ae2f1e00f36463aea3bd621816e6def0da630be09
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5d949e902bb07ed1bef36e6204e0a336f71275574b531cf2fe50892a82f9ce92
MD5 738ac091ee772800125be71d97c11b21
SHA1 633077554ccc181351b6905fc5ea2e2ac52857bb
SHA512 33e5fe0cdbca49d138f30557498d9c748a3cc6074a76621a276e27aad70d0f96251b6d5222a8b908fa0d56a11ad9513234c112dc7e77791559721692d4499853
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f0edc3f0a6a3dc2e18c0b465e5e32afc0f65fea2924381cbe302eaebbc795c6e
MD5 97fe93685da69ec4f19768a62643037c
SHA1 51b3dfafa4241f20213ae2d9f7e0fdd4d50da423
SHA512 bb3b5d3755c31b94c83b69bbe28a653ab5b8e49de892f52f2e92115bb61c7033b7e6db44a705928b9d16ddd0f9ede598877096c78878abe26c7e70de3c1f7f55
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 38443a3adb467a2d318773cea86a88387b5747a71e203fd008eea34cc67f2456
MD5 c350af5fd6a0f33fecaa976893da0b07
SHA1 635af3a173f2199817e5a63d9eb01e282f7f3096
SHA512 e73df1f9378ab767ae8fabf9b5e7a7ca5dde66cb909fd68d4f0c0d0bb37cf82b1978add32e75f2acfc7d0be92e7ab8bb091641ce38b1aa797ceb8fda27148e67
MD5 SHA1 SHA512

Submit Download

svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAACBABAACABCACCBAABBAABBACBCCAAABBCCBABCBBBACACBCAAC.exe
Size 9.7MB
SHA256 c27e13989bf7a0253f5a6d3369e07e6745afb5095fd4ee69353d627c8ef4440c
MD5 00ec40eda02aa21b3faded618713e588
SHA1 8619b82276f517a8e17421e51a637a34fa59cc73
SHA512 3f9dd7372ed3ea0f350bfecd503a18be2ebe0e0eb8e59a61a75fc27818cc2ee3d9130a0c5a5cd4851966e7e50a4173e8db0b86c885b3c4d2cdee78a387597e73
SSDEEP 49152:U+ES+ES+ETqatgl4+ES+ES+ES+ETqatgl4+ES+ES+ES+ETqatglwXpH+ES+ES+Ed:oaaraa9A91pH2WpjHrgBFFu416AWvM
TLSH
T1F8A68C91B59720F9E06FD07589ABC372D6717C130632874B667CE25E2F33A906E29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CBABCCACBABABBCBCBBABCAAABACBBABCBCACCABCBCAAABACABAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCACBABABBCBCBBABCAAABACBBABCBCACCABCBCAAABACABAACA.exe
Size 5.3MB
SHA256 187d7cff6c7970421bef0ad5010b8f6b6934942c2e3924c7e39bb44fc807e6ff
MD5 14d3810155d69053aa9aa9e94004f227
SHA1 ffea9463ec87406f6d350aca5f8192b264c1b058
SHA512 8223f7fa7c2227ba77faa0083026a38573c336b86555acb3e9a475406756294fac8c0b9d289299f9f3a93aa4446fc23d7bad0801cf85980ae616fbd9da4bd4d2
SSDEEP 49152:U+ES+ES+ETqatgl4+ES+ES+ES+ETqatgl4+ES+ES+ES+ETqatglwXpH+ES+ES+EX:oaaraa9A91pH2WpQ
TLSH
T1F5468C46F68140B1E86B40B18D9FD2BBD7B0BC114B214B9BE699E72F2F33B905639351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CBABCCACBABABBCBCBBABCAAABACBBABCBCACCABCBCAAABACABAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCACBABABBCBCBBABCAAABACBBABCBCACCABCBCAAABACABAACA.exe
Size 5.4MB
SHA256 648108f4cdb603ef0eccb08bfcf2dc02d6c9fe56cf55f9109a364a70e4aaedf6
MD5 cea7f2611472e55ad0ba658df50f550d
SHA1 cdf7d6b3b01f8caeefd301ea375c483d158e85b1
SHA512 feb350e86358a1dfed0c7c034b94f5a0de410d52ca06cf5661df83ce31d5ee94054d3d5b1afd8d755884c1eb63feb59cf8af071f2e03ef0e46d28004e3c37033
SSDEEP 49152:U+ES+ES+ETqatgl4+ES+ES+ES+ETqatgl4+ES+ES+ES+ETqatglwXpH+ES+ES+ED:oaaraa9A91pH2Wpjw
TLSH
T11D468C46F68140B1E86B40B18D9FD2BBD7B0BC114B218B9BE699D72F2F33B905639351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2656-27-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/2656-40-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/4684-61-0x0000000002750000-0x0000000002751000-memory.dmp

Download

memory/4800-0-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/4800-8-0x0000000000360000-0x0000000000381000-memory.dmp

Download