fe8c3a9e704fb833715e95bc0f7db934ff73452670184e23d2adb9e1f49300fc

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_2e5eba42a7ea7940361f82f15ef9e1a8_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Size 27.3MB
Sample260905-sng66axdkd
SHA256 fe8c3a9e704fb833715e95bc0f7db934ff73452670184e23d2adb9e1f49300fc
MD5 2e5eba42a7ea7940361f82f15ef9e1a8
SHA1 610161e824381b7bc8055550eb0b2d87a2db627b
SHA512 dbd4b0936695bd8dad39faa3796fb83f8c5cc4f45c5a9b8330507526812ba1a832ae961295ce77ff1a2e8ad46dac78fa683ea5b3c3128e345b4655444e12a7b6
SSDEEP 49152:U+Ef+Eg+ES+ES+Eg+ES+ES+EYiw2D+ES+ES+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+R:Wn7Own7OSA91pH2WpjHrgBFFu416AWvd
TLSH
T171575A09F99644E5E87B5070489BC3BAD6707D128B328BEFE658D72E6E336D06C34712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c42e-20.dat	UPX
behavioral2/files/0x000d00000001c431-65.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1384	svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe
1960	svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe
1400	svchost_AACBCCABCBCBABBABABAAABBBABBACCAAAACBAABBABBCBACACCBBBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBABBBCCBCACCBACBCABCBCBBBBAAAAABABCACCBCAACBCBCCCBABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe"	2026-09-04_2e5eba42a7ea7940361f82f15ef9e1a8_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCABCBBCBBACBACBAACAABCCBCBAABCABCCBBACBAACABCBBBCBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBCCABCBCBABBABABAAABBBABBACCAAAACBAABBABBCBACACCBBBC.exe"	svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2036	sc.exe
1864	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5132	cmd.exe
3876	cmd.exe
4276	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBCCABCBCBABBABABAAABBBABBACCAAAACBAABBABBCBACACCBBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_2e5eba42a7ea7940361f82f15ef9e1a8_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1396	2026-09-04_2e5eba42a7ea7940361f82f15ef9e1a8_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
1396	2026-09-04_2e5eba42a7ea7940361f82f15ef9e1a8_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
1396	2026-09-04_2e5eba42a7ea7940361f82f15ef9e1a8_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
1396	2026-09-04_2e5eba42a7ea7940361f82f15ef9e1a8_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
1384	svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe
1384	svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe
1384	svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe
1384	svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1396	2026-09-04_2e5eba42a7ea7940361f82f15ef9e1a8_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1384	svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 3876	1396	2026-09-04_2e5eba42a7ea7940361f82f15ef9e1a8_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	92
PID 3876 wrote to memory of 2064	3876	cmd.exe	94
PID 1396 wrote to memory of 4276	1396	2026-09-04_2e5eba42a7ea7940361f82f15ef9e1a8_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	95
PID 4276 wrote to memory of 2036	4276	cmd.exe	97
PID 1396 wrote to memory of 5132	1396	2026-09-04_2e5eba42a7ea7940361f82f15ef9e1a8_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	98
PID 5132 wrote to memory of 1864	5132	cmd.exe	100
PID 1384 wrote to memory of 1348	1384	svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-04_2e5eba42a7ea7940361f82f15ef9e1a8_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_2e5eba42a7ea7940361f82f15ef9e1a8_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBACBBCABAACBCBABCCCACCBAAAACCBCBCAABABCCABAABAABCCCBCCCABCCBACCABCBBCAAAABBABBAAABBCACABCACACACACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBACBBCABAACBCBABCCCACCBAAAACCBCBCAABABCCABAABAABCCCBCCCABCCBACCABCBBCAAAABBABBAAABBCACABCACACACACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCBCACABACAAAACAABCBCBABBCABAAACCCCCCAACABBCCCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe" start= auto displayName= "UserDataSvc_ACCCBCACABACAAAACAABCBCBABBCABAAACCCCCCAACABBCCCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCBCACABACAAAACAABCBCBABBCABAAACCCCCCAACABBCCCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe" start= auto displayName= "UserDataSvc_ACCCBCACABACAAAACAABCBCBABBCABAAACCCCCCAACABBCCCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCBCACABACAAAACAABCBCBABBCABAAACCCCCCAACABBCCCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCBCACABACAAAACAABCBCBABBCABAAACCCCCCAACABBCCCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe
1⤵
- Executes dropped EXE
PID:1960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCCABCBCBABBABABAAABBBABBACCAAAACBAABBABBCBACACCBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCCABCBCBABBABABAAABBBABBACCAAAACBAABBABBCBACACCBBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bc08ffccdd8ef13d4c36386b3699f682c093c4ff3839843497a9ea41a209798d
MD5 0f2aa87e922454d05e144fc92c521be8
SHA1 df52e699f5b7b4e97d4bb63eacd480049c4d1c33
SHA512 90bc02508bb99f6d40c417971f29d3198b9aa22f3ac3205dc6a2e00b95e386bae3a91e235ac08cc62b60197de7f05dc6a140a5ea17a410f467c898a393b639c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7bda6575f00e4eb018b760dc4d7fc9664deace3a3fe64b77340f994d3955b67d
MD5 86e8268e9dd555c1d929c0e18014da24
SHA1 d4698acd8b33968c5a977490ab97f7402a48bfc9
SHA512 18cd5641c9d1456e0ddc39ef00bad40fb9fc928ea6eb8d53ec1f8e9df96b132ea22e1226976e9688674b94c84e359f294e364550e87c4fc998c86a9cf09c2fcb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 75a15077838f8bfc068f2e9c2066ca4c7420f4d8f0fb4da4bce0cebd8ac4d099
MD5 4a5725a4a0c94c5d83650bf599266040
SHA1 f5ffc7e1f7b0b160d5ff3b20c2348bc7da35400f
SHA512 3a0505acdcd2afa664e9ee92a79dec037c71e50931b8b791ea847a96afb253ac817d73ec6b57b6de30de711af734f5a5ba5ede1c723d092234ef6d21bd759a50
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fd634a2910b3111a93015d77af07821655850dad828c0e81785538c280dc1205
MD5 e58b01f9542f77eb509a1611b9486dac
SHA1 2fa40ff3d4d6af4d49948b15c1446aadde87b1d2
SHA512 5a3fb0a208b1dfd8a127de26299ffb751f74b36acee04b34b54524dffea5e3c59acc5ee15286b9d242fc742e9a7ecca106eb8fc07f3dedf175f56ac40d7eded4
MD5 SHA1 SHA512

Submit Download

svchost_AACBCCABCBCBABBABABAAABBBABBACCAAAACBAABBABBCBACACCBBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCCABCBCBABBABABAAABBBABBACCAAAACBAABBABBCBACACCBBBC.exe
Size 13.5MB
SHA256 7c1d5754d477e60a64687fc8e27fc6c4c5f9ef35871556d6aa3dada4900bdc67
MD5 401b4864df7edc1dbe7764a177d2c527
SHA1 4cd024570880181b1619f1885b7ddbd00ee24579
SHA512 6d59162bd6232bc3486b454982a10768c648d69765e56dc776700d76eb46581d8f9e29edf7e4b205f6cfdfa903bec32bd48c31a10f8e3be7133d60e5671036f3
SSDEEP 49152:U+Ef+Eg+ES+ES+Eg+ES+ES+EYiw2D+ES+ES+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+M:Wn7O4
TLSH
T18CE64B09F98644A1E97B51704CDBC2BE8670BD218B228AEFF649E72F6D33BD06434715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCCACAAACABCBABACCACCBBAAACBBCBABCACBBBCBBAAAACBBC.exe
Size 27.3MB
SHA256 fe8c3a9e704fb833715e95bc0f7db934ff73452670184e23d2adb9e1f49300fc
MD5 2e5eba42a7ea7940361f82f15ef9e1a8
SHA1 610161e824381b7bc8055550eb0b2d87a2db627b
SHA512 dbd4b0936695bd8dad39faa3796fb83f8c5cc4f45c5a9b8330507526812ba1a832ae961295ce77ff1a2e8ad46dac78fa683ea5b3c3128e345b4655444e12a7b6
SSDEEP 49152:U+Ef+Eg+ES+ES+Eg+ES+ES+EYiw2D+ES+ES+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+R:Wn7Own7OSA91pH2WpjHrgBFFu416AWvd
TLSH
T171575A09F99644E5E87B5070489BC3BAD6707D128B328BEFE658D72E6E336D06C34712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1384-24-0x0000000000630000-0x0000000000651000-memory.dmp

Download

memory/1384-37-0x0000000000630000-0x0000000000651000-memory.dmp

Download

memory/1396-0-0x0000000000150000-0x0000000000171000-memory.dmp

Download

memory/1396-8-0x0000000000150000-0x0000000000171000-memory.dmp

Download