c27e13989bf7a0253f5a6d3369e07e6745afb5095fd4ee69353d627c8ef4440c

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 9.7MB
Sample260901-2e37pscj6w
SHA256 c27e13989bf7a0253f5a6d3369e07e6745afb5095fd4ee69353d627c8ef4440c
MD5 00ec40eda02aa21b3faded618713e588
SHA1 8619b82276f517a8e17421e51a637a34fa59cc73
SHA512 3f9dd7372ed3ea0f350bfecd503a18be2ebe0e0eb8e59a61a75fc27818cc2ee3d9130a0c5a5cd4851966e7e50a4173e8db0b86c885b3c4d2cdee78a387597e73
SSDEEP 49152:U+ES+ES+ETqatgl4+ES+ES+ES+ETqatgl4+ES+ES+ES+ETqatglwXpH+ES+ES+Ed:oaaraa9A91pH2WpjHrgBFFu416AWvM
TLSH
T1F8A68C91B59720F9E06FD07589ABC372D6717C130632874B667CE25E2F33A906E29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5720	svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe
940	svchost_ABBACBAABACBBCBAAAABAACAABCBACCCACBCAABCCBCBBCCBCABCCAB.exe
2600	svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCABAACCCACABABBAAACBBCAABBABBCABCBACBCCABACCCACBABBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe"	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCCABCCCAAAAAACCACBBABCACBBCBCCBCCCBBCABAAAABACABBBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBACBAABACBBCBAAAABAACAABCBACCCACBCAABCCBCBBCCBCABCCAB.exe"	svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4084	sc.exe
5696	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3200	cmd.exe
5544	cmd.exe
2176	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBACBAABACBBCBAAAABAACAABCBACCCACBCAABCCBCBBCCBCABCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3576	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3576	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3576	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3576	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
5720	svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe
5720	svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe
5720	svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe
5720	svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe
940	svchost_ABBACBAABACBBCBAAAABAACAABCBACCCACBCAABCCBCBBCCBCABCCAB.exe
940	svchost_ABBACBAABACBBCBAAAABAACAABCBACCCACBCAABCCBCBBCCBCABCCAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3576	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5720	svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe
Token: SeDebugPrivilege	940	svchost_ABBACBAABACBBCBAAAABAACAABCBACCCACBCAABCCBCBBCCBCABCCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 3200	3576	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	92
PID 3200 wrote to memory of 3940	3200	cmd.exe	94
PID 5720 wrote to memory of 3788	5720	svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe	95
PID 3576 wrote to memory of 5544	3576	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	98
PID 5544 wrote to memory of 4084	5544	cmd.exe	100
PID 3576 wrote to memory of 2176	3576	2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	101
PID 2176 wrote to memory of 5696	2176	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_00ec40eda02aa21b3faded618713e588_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCCCBACACBACBAABBCBCBBCABBBBCCCBABCBBAABBCCBBACACAACCCAABBBABAAACBBCBCCCBACBABABAABCAAAABCBBBACCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCCCBACACBACBAABBCBCBBCABBBBCCCBABCBBAABBCCBBACACAACCCAABBBABAAACBBCBCCCBACBABABAABCAAAABCBBBACCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACAABACCAACABBBABACABBBABBABABBCABCABABABCCBBCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe" start= auto displayName= "UserDataSvc_CACAABACCAACABBBABACABBBABBABABBCABCABABABCCBBCCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5544
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACAABACCAACABBBABACABBBABBABABBCABCABABABCCBBCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe" start= auto displayName= "UserDataSvc_CACAABACCAACABBBABACABBBABBABABBCABCABABABCCBBCCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACAABACCAACABBBABACABBBABBABABBCABCABABABCCBBCCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACAABACCAACABBBABACABBBABBABABBCABCABABABCCBBCCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBAABACBBCBAAAABAACAABCBACCCACBCAABCCBCBBCCBCABCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBAABACBBCBAAAABAACAABCBACCCACBCAABCCBCBBCCBCABCCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe
1⤵
- Executes dropped EXE
PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b1ebb3424e81ce3d39486d874bd052b6f419e209ff25d2619a3103dbc117df10
MD5 349c869e8aca1fca0e02c1a27e73c9ab
SHA1 1d554f8e844958f83c94d55d97f06cf6a007a83b
SHA512 5a654121448b58213a535e905707c39e2889cc7197ddf583db914e4323a07d7cde5578904f0ed07380224e9b23cfede79f902f479ab7ffdda8276eabd55d7d45
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 67aac39cd168622dd2605c61912efa6da2a3a79bf96ac153187a7e19cc0c989d
MD5 9ce6509eeeb177663b74610f347ba176
SHA1 f93e9d062b2110a84d0d9bd9855a48a45fa5ab9d
SHA512 708705a9e4ec28a099349b4487e3c88cc4df778669f8ac23557fe86ca1741592790214586d840540db71726859e6318aa1f28e679a3697c86e86d4f12407cbe6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a09fa8addcc8ca380c08733da1f95aa3b36057868969ba369c644bd3aa5aae2
MD5 7b0a8123dfe766de0413ae47ac4fbc3d
SHA1 4b8341d83861b2e0c705fddb7d0e6a64c84e40ab
SHA512 cd291c0d1da02411ee376d456057544de80083e9e1cbf19a0eac1ed66bf8b58aff141217447df8bf9db96e3d337b34cb23849b200c599dbc95dc68c75aae250c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7da92135eeaebe6d742e9aaf7147b3b808b367a72a627baa1cf6e82fa01ee1b0
MD5 334fcb629310c79b52440ef74f765077
SHA1 510cfcc23026c624e0cc5c25d971e4c48cc810f3
SHA512 e015fe29aa74bae3ec9459a2131543ceed9cc377e87f3f6a5739dbe26bd13672b8195fc51dfcdc1a1568f13f97f9190e5fdcb63a9799b08004b532b27bd468f3
MD5 SHA1 SHA512

Submit Download

PingSync.exe

Path C:\Users\Admin\Downloads\PingSync.exe
Size 320KB
SHA256 5e3a324a610c519b787c7efce13fa6484bc52a1457627b68963b7947b1520215
MD5 6b8aceae9d41d52575e2e5daafed3c31
SHA1 f759acd3c4fe6bc2023feb88a0f8ef1e80216021
SHA512 658da7124fa7a99907095687d7630c5b7a031faa7e9450e83726d19431130166914cff06930c362edfae5ad0ed956b70daa3e28754e885d975ec0cf2c8b110b9
SSDEEP 6144:m+dTTUFgEs3XojAdP+dTTUFgEs3XojAdP+dTTUFgEs3XojAdtofOiYlrOF7ojDuH:mgUFgEsnojA9gUFgEsnojA9gUFgEsnoN
TLSH
T11B643B09F94740B1D96B41B048CBD3BF8630BE2587128EFBEA4DE75BA933BE16438515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingSync.exe

Path C:\Users\Admin\Downloads\PingSync.exe
Size 59.1MB
SHA256 0ed10227e8c2a8aaec0387ec82fabecb13e1b2d054ae81d1403c69c5c9851524
MD5 ba0f1fcdf58d484468e1cb44de253f7b
SHA1 3282c38cfbe5b39547044d44c1ead1015e001c0c
SHA512 d05b94ecea085575baa380dd29d3f57101f5584a97845909c7d9399991e3af710c027745c61425ab36814e8d097d059c2cfe89c7a05e640c041098b0d0445828
SSDEEP 393216:EmHN6+JrvHmHN6+JrvHmHN6+JrvHmHN6+JrvHmHN6+JrvHmHN6+Jrv8u:Vbrebrebrebrebrebr0u
TLSH
T1D4D78C91B59720F9E06FD07589ABC372D6717C130632874B667CE25E2F33A906E29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 843cffdda6cb4e2a1ec37ea269a5db96f725833848e7e38d53ffef1b87936134
MD5 c2775ef398dee2d50ed1ce4f376f1d60
SHA1 39c273aaec7992ffab17593e624276eb4a9d7d95
SHA512 724efcfc7e4a2405e8fae9d198d5a7a7c4dbe2c6b7d04e267556bbf85ceb17709b9b0add19b83c33f7d239760c0028d43d588d1acedced1d199ccc63d445e321
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c981bc0af709e8c546522086e0b447055cc575ecd7108d0d60b4799120627254
MD5 a6e653e96aea0e557a5ccee5b2a18aaf
SHA1 564573bf3738d4b1ef94217b1cf2023fa89cfb8c
SHA512 67ac96a85f216079ce4384ffa246934fed9f0d63a7c48fb465cbbb807a76062c32dfd35fa1429a33fc2efb78a3a6ce01339878e37ae3187d51772a59691be3ce
MD5 SHA1 SHA512

Submit Download

svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBCCACBAACABAACCCABCBABBBACBAACABABCBCABCBCACAAAAB.exe
Size 9.7MB
SHA256 c27e13989bf7a0253f5a6d3369e07e6745afb5095fd4ee69353d627c8ef4440c
MD5 00ec40eda02aa21b3faded618713e588
SHA1 8619b82276f517a8e17421e51a637a34fa59cc73
SHA512 3f9dd7372ed3ea0f350bfecd503a18be2ebe0e0eb8e59a61a75fc27818cc2ee3d9130a0c5a5cd4851966e7e50a4173e8db0b86c885b3c4d2cdee78a387597e73
SSDEEP 49152:U+ES+ES+ETqatgl4+ES+ES+ES+ETqatgl4+ES+ES+ES+ETqatglwXpH+ES+ES+Ed:oaaraa9A91pH2WpjHrgBFFu416AWvM
TLSH
T1F8A68C91B59720F9E06FD07589ABC372D6717C130632874B667CE25E2F33A906E29723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 901f9e3dc396e6ed4606998871f9757ec133fe7844f4f8b03d66f355127675e5
MD5 1edccc01e1b9c68f95a7b74d25b10aa3
SHA1 c4ac9a5cd4a6a10169eb659712f842eb8665b7f8
SHA512 a18dd80fae1d537393fcc42c78f5465b58259f6edaecc81d52ca60c85154b08c310ab9a1762a4af3323d9c6e481c471ec66cacfa0e7e27e752c469cb4882f1bc
TLSH
T1B1118E71B0F5DC37F133288B9515AAC708962BFBAC5CEB181B4C4318A7A5C798D154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/940-98-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/3576-71-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/3576-0-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/3576-49-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/3576-23-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/3576-12-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/5720-70-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/5720-48-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/5720-108-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download