350cac16fab1f666c604d70d2b30506a3aab6db47082e1b8beebcaee48060c16

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.9MB
Sample260905-e4ybesen4s
SHA256 350cac16fab1f666c604d70d2b30506a3aab6db47082e1b8beebcaee48060c16
MD5 885762f5f734a68fe5c6d1d0c12dffd7
SHA1 9e6143bbde472298e95755909219672642eddb68
SHA512 de908781f53d02e01f15e123a1fdcd0cd23e48d9c0e4f93648241634fb0b304b95337b10ada903e6de96758d995517480e18d7436140f3b6ff4e703dc12108d7
SSDEEP 49152:U+En+En+En+En+En+En+En+En+En+ELG+En+En+En+En+En+En+En+En+En+ELAT:uA91pH2WpjHrgBFFu416AWv+
TLSH
T16E867AA5A1A720FCE0AFD075896BC336E6717C130232879F567CD6572F63A642D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4284	svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe
5632	svchost_BBBAACBACBACABBBBAAAACBCBACCAACBCACCACCBBCAABAACCCCAAAA.exe
1784	svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBAABAAACABAABCCACBCCCCAABCCABCCAABABBCBCBCBAACCAABBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBAACBACBACABBBBAAAACBCBACCAACBCACCACCBBCAABAACCCCAAAA.exe"	svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABBCABCAABBACCACACABCCCABCCCCBAAACCACBACAABCCBBACBBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe"	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2284	sc.exe
3736	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2980	cmd.exe
3756	cmd.exe
1992	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBAACBACBACABBBBAAAACBCBACCAACBCACCACCBBCAABAACCCCAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3716	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3716	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3716	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3716	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4284	svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe
4284	svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe
4284	svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe
4284	svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe
5632	svchost_BBBAACBACBACABBBBAAAACBCBACCAACBCACCACCBBCAABAACCCCAAAA.exe
5632	svchost_BBBAACBACBACABBBBAAAACBCBACCAACBCACCACCBBCAABAACCCCAAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3716	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4284	svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe
Token: SeDebugPrivilege	5632	svchost_BBBAACBACBACABBBBAAAACBCBACCAACBCACCACCBBCAABAACCCCAAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 2980	3716	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	91
PID 2980 wrote to memory of 4084	2980	cmd.exe	93
PID 4284 wrote to memory of 1320	4284	svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe	94
PID 3716 wrote to memory of 3756	3716	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	97
PID 3756 wrote to memory of 3736	3756	cmd.exe	99
PID 3716 wrote to memory of 1992	3716	2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	100
PID 1992 wrote to memory of 2284	1992	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_885762f5f734a68fe5c6d1d0c12dffd7_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBACAAACBACBBBAACBAAACBCBBBAAABBBBAACACACBCBCBBAACACABAABAAAACBBBBACCACCBCBABBBCCBCBBACCCAABBABCABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBACAAACBACBBBAACBAAACBCBBBAAABBBBAACACACBCBCBBAACACABAABAAAACBBBBACCACCBCBABBBCCBCBBACCCAABBABCABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBABBBABACBAABABCBBAAAAAABCCBCBCABBCCAAAACBBBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe" start= auto displayName= "UserDataSvc_CCCBABBBABACBAABABCBBAAAAAABCCBCBCABBCCAAAACBBBACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBABBBABACBAABABCBBAAAAAABCCBCBCABBCCAAAACBBBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe" start= auto displayName= "UserDataSvc_CCCBABBBABACBAABABCBBAAAAAABCCBCBCABBCCAAAACBBBACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBABBBABACBAABABCBBAAAAAABCCBCBCABBCCAAAACBBBACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBABBBABACBAABABCBBAAAAAABCCBCBCABBCCAAAACBBBACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2284

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1320

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACBACBACABBBBAAAACBCBACCAACBCACCACCBBCAABAACCCCAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACBACBACABBBBAAAACBCBACCAACBCACCACCBBCAABAACCCCAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe
1⤵
- Executes dropped EXE
PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8298fd611f505db6757d42df76847bcfec2244a886c6c856d37bc15065385d80
MD5 eca2be6d486b244cb0b04ca680e52a41
SHA1 a4780ee750ddec74a9dc82995072ca459e2dd77b
SHA512 7829b72f00df25ee5e95793ad161b6b9cf1d6963066302390a252c10b982c69bc5ae94dc1624c7f4d2ff06bccdb0d6997a4a6155da60b72e6ffd5da0824d28df
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ad164b4acfdfbaa4052b53296747a2051873cc01b497304a84ff8d2b05137e63
MD5 e92b3f6604294b0c0b8379d4f98665b1
SHA1 5f195c196b8ab943974c5b40f89d17b33776aebd
SHA512 5c15686bbc32e621865f9044a8668f89829cc4d4fdf88d14f9cb93f94bb0b77addc1077926bd2af7fe5aa2fed87b9add474a8cf40d309eda7e5fdafc2abb9a1a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 682842e729dad6c59fd8961ada7842e55b7a7cda9ac3fd8d8f793cf21446bbca
MD5 e76676eeeb769f781eefef477cdcd95b
SHA1 beb10b7bc53fd003d0d4468ddace98ba7520a987
SHA512 849afde044299b0bdaa33891c7ba02d49e0f000ed33a64e8738cb9ead2d7376a46b42202f697b1e901641b7f989870c7f893f86c36bc3c59123615f777f82d8e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 56415ae8d78b74b795d475bef315cd3dbdd5b44c0f6a1bb8c83c3b8f888c794b
MD5 ce57207a9869c72574c445e71acf31b0
SHA1 3187d879c6849b8705c22836035120e96eb3f2a8
SHA512 57fcfb8c43f209ce709535405a015405e9a0e5be411546e6079000397c4c587f7b4ce1a495dd8d432e2ea9cb2b88ee92f8d0f21dd32317f9ddda368866aafcbc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d7f05ead13353516b4889fe29abdd5d64c6abd28db09efacac8013261b8c8e8d
MD5 bccc69397a8e6283244266c53df82de0
SHA1 90c8a33ec6b14d8d0d27dbc9ccb582909151dfcd
SHA512 2325e2336fa1f3f1fb8e8af91677cea3add8183d4d0dc384ed0f07953daaa94364ebb6c87b81da66e2417fc6f224f9d7fd63f74fc350e35b7c6fa36d2f44f6e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1777d714c89e11b1348a647f489c139fad8b344e20b8803f6b25d9eb9bee61f8
MD5 58938c8524fa8e4f078afca0bc0ab0c5
SHA1 92d72f834a628fe4566243ab3e27e5981e81ddbb
SHA512 a91bafe1f57a7f41ebf2bd7685fe11e8b8244412a7204969ac7e96a053782d480659244ad9e55fe8e6c88f41cc759b11b2ade9a68465553ff2e8f2e65eb8803d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a11a04181322c074cc7ca7e29c678afc0f25be470dd79f6d761c33541fd52819
MD5 5d22b84883b3c0dca26417e39295ba07
SHA1 bca661d778aeb96296ed41392ce63a7ce76bdb5e
SHA512 590b2afd77c7e606528d596979ce0f1df56cfb257e71c886cdad07a6c4be4335685e88d3c64d9134fc92bb9eab82fc96e7a8950875eb17a93e9e79a181446997
MD5 SHA1 SHA512

Submit Download

svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBACBCBCBACAAABAABBBBBCACBCACCBACABBCBABACAABCACAA.exe
Size 7.9MB
SHA256 350cac16fab1f666c604d70d2b30506a3aab6db47082e1b8beebcaee48060c16
MD5 885762f5f734a68fe5c6d1d0c12dffd7
SHA1 9e6143bbde472298e95755909219672642eddb68
SHA512 de908781f53d02e01f15e123a1fdcd0cd23e48d9c0e4f93648241634fb0b304b95337b10ada903e6de96758d995517480e18d7436140f3b6ff4e703dc12108d7
SSDEEP 49152:U+En+En+En+En+En+En+En+En+En+ELG+En+En+En+En+En+En+En+En+En+ELAT:uA91pH2WpjHrgBFFu416AWv+
TLSH
T16E867AA5A1A720FCE0AFD075896BC336E6717C130232879F567CD6572F63A642D28723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1ec33cfc9404fa3969f2f238b715fea6ade9cd8a87c604d1dec84405fa59f1a0
MD5 928380d3f9493905304441a2c1689573
SHA1 82dcacd5e49432efe5af973d19723434e347734c
SHA512 5edd9540304646ed92e4e9d906669f0df834b96814012e68af149271f0385d30e5a11e7f9701e83e7e2e6eedd2251ed7f4ac2762853474ef2aa4f4af9a51b384
TLSH
T1B411E779E4E59873F132288B95176E470CA43B8F9854EB14130C8218BB79939AE5DCE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3716-8-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/3716-0-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/4284-34-0x0000000000640000-0x0000000000661000-memory.dmp

Download

memory/5632-74-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download