7da52e8626fb0dfa9e1c238a79ad2d28a662a5a8625cb1ea636d39234efb9c9c

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_a255408824222716db5bbd69f848e823_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
Size 21.4MB
Sample260910-eanj5aeq2t
SHA256 7da52e8626fb0dfa9e1c238a79ad2d28a662a5a8625cb1ea636d39234efb9c9c
MD5 a255408824222716db5bbd69f848e823
SHA1 c576a779fcb311360881add6ced759c1b08e1c49
SHA512 56b812c9eee3692e169e3fe0efa35fa8678160925831cd3c30a5c881e2eb872653eb0224b14e281b3e7dbdd738b7020e3b818774af227b4c7279bc9d0800e6e0
SSDEEP 49152:U+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLcR+ES+ES+EWLE+ES+EW5+ES+ES+EV:Qp7Op7SA91pH2WpjHrgBFFu416AWvE
TLSH
T19A376C05F98750F5D96F90B04DDBD37ACA707D2282324BEBE65DD61B2E337A06C28612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2336	svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAAAACCCBCBBABAAAACACBACCCCBBCBCABCBBABCBBCBBACBAAAABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe"	2026-09-08_a255408824222716db5bbd69f848e823_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
720	sc.exe
5812	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4896	cmd.exe
1820	cmd.exe
3508	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_a255408824222716db5bbd69f848e823_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2200	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2392	2026-09-08_a255408824222716db5bbd69f848e823_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
2392	2026-09-08_a255408824222716db5bbd69f848e823_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
2392	2026-09-08_a255408824222716db5bbd69f848e823_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
2392	2026-09-08_a255408824222716db5bbd69f848e823_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
2336	svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe
2336	svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	2026-09-08_a255408824222716db5bbd69f848e823_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
Token: SeDebugPrivilege	2336	svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1820	2392	2026-09-08_a255408824222716db5bbd69f848e823_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe	92
PID 1820 wrote to memory of 2200	1820	cmd.exe	94
PID 2392 wrote to memory of 3508	2392	2026-09-08_a255408824222716db5bbd69f848e823_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe	95
PID 3508 wrote to memory of 720	3508	cmd.exe	97
PID 2392 wrote to memory of 4896	2392	2026-09-08_a255408824222716db5bbd69f848e823_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-09-08_a255408824222716db5bbd69f848e823_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_a255408824222716db5bbd69f848e823_cobalt-strike_elex_glassworm_icedid_njrat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCCBBCAAABAABABBBBCAABABCACACCAABBBBCABBABBCCAABACAAAABAACCBABABCABABBCBBBCACCCAABCCCCCACCBCCCCABCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCCBBCAAABAABABBBBCAABABCACACCAABBBBCABBABBCCAABACAAAABAACCBABABCABABBCBBBCACCCAABCCCCCACCBCCCCABCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBBBBCCABCCBABBACBCCBCCCAABCBCCCACCBAACCACBCCACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe" start= auto displayName= "UserDataSvc_BBBBBBBCCABCCBABBACBCCBCCCAABCBCCCACCBAACCACBCCACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBBBBBCCABCCBABBACBCCBCCCAABCBCCCACCBAACCACBCCACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe" start= auto displayName= "UserDataSvc_BBBBBBBCCABCCBABBACBCCBCCCAABCBCCCACCBAACCACBCCACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBBBBCCABCCBABBACBCCBCCCAABCBCCCACCBAACCACBCCACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4896
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBBBBBCCABCCBABBACBCCBCCCAABCBCCCACCBAACCACBCCACBB"
    3⤵
    - Launches sc.exe
    PID:5812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe
1⤵
PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7609a7fb9f4d3c6297291ed73264d1e186e5b8df387282cdfe6d05fc82a4cb85
MD5 37ea9557a6ee613f8fe8534cc88ff8ed
SHA1 0bd8cbfc3d27b1033325bb5f830efb7f6af10386
SHA512 4ba1fe32fe9ae096d3d833737fd259fc6419f872c709accf32798d21418d528437a1109f47270df4c878c52b63cadfaeeeb4a8e9051dd37cebee7a92a59c89f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8415fb5cb64653fd57f8a65ae70abbf504b9e24e8a2a7c0984c211ebdc9b82b8
MD5 08ff373f636e00fee33db2e2670a448b
SHA1 088aa3b80bd0c5758f08abb2bf6b9ce90b842bbc
SHA512 f6f209d11a61fc0558881af2916e1381c0ecaf0ec7249f6dd6230bcc2a4c55187bdb85fdafc02875dcdce0c377afc03904a5b76d4a9acafd9f0e618685eb0f17
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 656bca4ec8113858bcc9eedb933581792d8250b62eaf59e89d38cfcb8d782a69
MD5 585dcf326d10ffcfa9f3d6f71b10fbab
SHA1 a42ec64541ba40b8094dfbd67f33293ae2a9c507
SHA512 e81a23a1c4dd9f2316b369e3b599490576252224a0c9cf02b57af1b3480349642f366d2d380117511290ae1ba1fe6307ce2ba113eb0aefe595e6649d9821c978
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0f1f28c5a700c4a1feff7fa0d9dde1d02db1d72b5748e5343347ce7f40868111
MD5 a7a6a32048794803dd3f343a233da4d8
SHA1 4c008cd6be55f1d4c0b2e5cb8b78953d35bca761
SHA512 82756b0e456e3f22b4751c6a13bf794fa0e6e15469128454c0ee8a5ec73fb4f92f46869f5d2e238c7a3e0e9af1e9e76573141623a284213e093c76f7add3bf30
MD5 SHA1 SHA512

Submit Download

svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe
Size 21.4MB
SHA256 7da52e8626fb0dfa9e1c238a79ad2d28a662a5a8625cb1ea636d39234efb9c9c
MD5 a255408824222716db5bbd69f848e823
SHA1 c576a779fcb311360881add6ced759c1b08e1c49
SHA512 56b812c9eee3692e169e3fe0efa35fa8678160925831cd3c30a5c881e2eb872653eb0224b14e281b3e7dbdd738b7020e3b818774af227b4c7279bc9d0800e6e0
SSDEEP 49152:U+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLcR+ES+ES+EWLE+ES+EW5+ES+ES+EV:Qp7Op7SA91pH2WpjHrgBFFu416AWvE
TLSH
T19A376C05F98750F5D96F90B04DDBD37ACA707D2282324BEBE65DD61B2E337A06C28612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCABCBCCACBABBBCBCBCCBCACAABABCCCCAABAABACBABAABCCA.exe
Size 388KB
SHA256 334625229fdc843c6265cb40c0eb5f815857682407a9940a1a2949c3dda2393d
MD5 15c1e177d0e7368e79eff3b49cf0402a
SHA1 894a54b84dfcdc5e87b1f448e2cfba40c66b4f38
SHA512 d41eb0ae7ad9f6188c33cb309cd8a782f39ed03be2fee80290521b5632e309f68d2ba9c4fe15f28a328afe62ddbf1bb58d0b63ad0290a24520b8b209c9318487
SSDEEP 12288:mgUFgEsnojA9gUFgEsnojA9gUFgEsnojA9gUFgEsnojAdCa:m9+EM0q9+EM0q9+EM0q9+EM0cb
TLSH
T12D843A09F94340B1D92B51B04DCBE3BF8A60BB2583128EF7FA4DCB5B6933BA16438555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2336-25-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/2336-38-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/2392-0-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/2392-8-0x0000000000920000-0x0000000000941000-memory.dmp

Download