82ea101ccc9a771a89ae8f78bf9eeb9726f0b4869e7b4791dd5fbcc722939f49

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 06:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_45af196fe57c5cd32aff2380895ef481_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 6.6MB
Sample260910-gs73la1zev
SHA256 82ea101ccc9a771a89ae8f78bf9eeb9726f0b4869e7b4791dd5fbcc722939f49
MD5 45af196fe57c5cd32aff2380895ef481
SHA1 d67a78463873b0bb33d0535215c3dc446c38b41c
SHA512 bdf9361a540efd7e50fa00cdf9fa275ed091f03a6474f60bfccc52cd60b66bf2cd137cd3ce00ee9f04eccab17b33ca9adb54c2d0cb7637605aafed793ad1281d
SSDEEP 49152:U+E9Bn++E9oqatglzb6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpX:0oA91pH2WpjHrgBFFu416AWvg
TLSH
T1D3665AA562EB20FDE0AFD179893A8732E6717C130131934F127CD6562F636686E29733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3748	svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe
1900	svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe
5216	svchost_AAAABBAABBACBBAABABBCCCAABACACABCABABACBBCCACBBBABACABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBCBBAAACCAACBBBAACBACCCBBABBAABABACAACBCCCAAABAAABBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe"	2026-09-08_45af196fe57c5cd32aff2380895ef481_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACAABCAABBBCBACAAABBABACAABBBBAAAABCABBCBACACBBCACCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAABBAABBACBBAABABBCCCAABACACABCABABACBBCCACBBBABACABB.exe"	svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1984	sc.exe
1596	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3940	cmd.exe
4516	cmd.exe
760	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAABBAABBACBBAABABBCCCAABACACABCABABACBBCCACBBBABACABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_45af196fe57c5cd32aff2380895ef481_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4836	2026-09-08_45af196fe57c5cd32aff2380895ef481_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4836	2026-09-08_45af196fe57c5cd32aff2380895ef481_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4836	2026-09-08_45af196fe57c5cd32aff2380895ef481_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4836	2026-09-08_45af196fe57c5cd32aff2380895ef481_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3748	svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe
3748	svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe
3748	svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe
3748	svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe
5216	svchost_AAAABBAABBACBBAABABBCCCAABACACABCABABACBBCCACBBBABACABB.exe
5216	svchost_AAAABBAABBACBBAABABBCCCAABACACABCABABACBBCCACBBBABACABB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	2026-09-08_45af196fe57c5cd32aff2380895ef481_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3748	svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe
Token: SeDebugPrivilege	5216	svchost_AAAABBAABBACBBAABABBCCCAABACACABCABABACBBCCACBBBABACABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 760	4836	2026-09-08_45af196fe57c5cd32aff2380895ef481_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	91
PID 760 wrote to memory of 3792	760	cmd.exe	93
PID 3748 wrote to memory of 6064	3748	svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe	94
PID 4836 wrote to memory of 3940	4836	2026-09-08_45af196fe57c5cd32aff2380895ef481_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	95
PID 3940 wrote to memory of 1984	3940	cmd.exe	97
PID 4836 wrote to memory of 4516	4836	2026-09-08_45af196fe57c5cd32aff2380895ef481_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	98
PID 4516 wrote to memory of 1596	4516	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-09-08_45af196fe57c5cd32aff2380895ef481_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_45af196fe57c5cd32aff2380895ef481_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABABCBCBCABBCCBCBAACBABACBBCCBCCAABBAABABABCBCAAAABBABBBACCCBCACABBBCBACCCBCCBBBBACBCBCCCBBCBCACBACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABABCBCBCABBCCBCBAACBABACBBCCBCCAABBAABABABCBCAAAABBABBBACCCBCACABBBCBACCCBCCBBBBACBCBCCCBBCBCACBACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACBCBACCBBBCAACACBABCBCCCCBACCABAACBACCBBABABABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe" start= auto displayName= "UserDataSvc_CCACBCBACCBBBCAACACBABCBCCCCBACCABAACBACCBBABABABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACBCBACCBBBCAACACBABCBCCCCBACCABAACBACCBBABABABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe" start= auto displayName= "UserDataSvc_CCACBCBACCBBBCAACACBABCBCCCCBACCABAACBACCBBABABABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACBCBACCBBBCAACACBABCBCCCCBACCABAACBACCBBABABABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACBCBACCBBBCAACACBABCBCCCCBACCABAACBACCBBABABABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6064

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe
1⤵
- Executes dropped EXE
PID:1900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBAABBACBBAABABBCCCAABACACABCABABACBBCCACBBBABACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBAABBACBBAABABBCCCAABACACABCABABACBBCCACBBBABACABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 68ece50d4f9cc716608fc914bd08daee09445519f882415cc161a5313ca97929
MD5 ce94d6366bda656b69d5c03994ac8dbb
SHA1 718e87a16b99a2079224da968e545c94b957dceb
SHA512 4db4a561482c67a08adbf58984b06c59080aa1e366431e2aae592f3cb27f60146f6a53a811389938ac9a73b2112f41c872ca4da1821175ca9dcdbcc4fa588484
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9cccf1b7861843273899e43d690062b55ac855e2dd42c3e1cda5a3e874b399c9
MD5 c13048bdd81916565c72302133068401
SHA1 e5505d15577a96d9582b41457facc794f2383f4b
SHA512 b24a8469846ac9a631b5a279308a922ab616c970050fd741bb7fb2596b076ededa5aeb9113a92450ab259dea3ea2d6369d511c3274eb9baf784452beecb464e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ef7e19ffe572f6b65261bb2abb113c8c11c7e8eed0641130e962d80b9e2e5e40
MD5 0378c84bff6ff5d68b54055552f6b584
SHA1 c607aeac4ae6bf4c24f9075e67c9f97888daf606
SHA512 881e4f7091eb00e734f15d8f1e18ad361f126f80e6bd19947ed7aae2d25d1af19bc68382c7dd235e97f96b449cfd0870372a37ee3fe2d516669ed3b87dd82e20
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c2a3e81a60f99aedb97c4e20dbada8d9f35db17f65ee92b76fe47dee3d9fdd9b
MD5 5ed2b22725c6a814f41e1eb1f240ef6d
SHA1 4dd42ec79e314b12d116da96213473f5d37c5996
SHA512 dfcad56b8ed129cb89e0635673b419cfb10c586aac38a0312ed9a71dbc47107669cf79168c1b6597f3b4ecb32c95cc78726d103bb65ce59b50ad8db2271883d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a2953c0deba66bd79baf399aed589ced7dc343d50f8b8c85d9f48c243b9c266b
MD5 a23adfa02e5e1dcf9ee662abce6616c8
SHA1 8d5444e35b8a29d73718b161ebfd9bc018cf0a8a
SHA512 d30fb75968e6b288fa626914ea2f9d9a2fc4741e3b5729db2e0c605f58230f5a51f0096832fae97340d539400cce03d9012374b440bbc711fa34a25d0efb471f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d706b92c651e753fecff41c9bb07fcf9586d57efc98db34e11972826b75857b3
MD5 4cf53799f1973484082a59cd68b46e27
SHA1 e389f958538a1988bd0f45cd1e11cc18a3da9276
SHA512 8eabf479a8467b18ccec175d520bd56b0efdd9190338df57f5cb2c8bbd2b64d9c0bd44b5d2b97572c7b781b51b974935dba8cf3e978a944298ee6276c6646598
MD5 SHA1 SHA512

Submit Download

svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCCBCBBBCCACCABCBAABCCBCCAABCCBBBABCCBBBBCBACCCABCC.exe
Size 6.6MB
SHA256 82ea101ccc9a771a89ae8f78bf9eeb9726f0b4869e7b4791dd5fbcc722939f49
MD5 45af196fe57c5cd32aff2380895ef481
SHA1 d67a78463873b0bb33d0535215c3dc446c38b41c
SHA512 bdf9361a540efd7e50fa00cdf9fa275ed091f03a6474f60bfccc52cd60b66bf2cd137cd3ce00ee9f04eccab17b33ca9adb54c2d0cb7637605aafed793ad1281d
SSDEEP 49152:U+E9Bn++E9oqatglzb6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpX:0oA91pH2WpjHrgBFFu416AWvg
TLSH
T1D3665AA562EB20FDE0AFD179893A8732E6717C130131934F127CD6562F636686E29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d599249121ba57569586924140337e2668000899334b329d74eb03a6c93b8577
MD5 92bb4cdab073d8ec16735092ba0c87dc
SHA1 282a3441c8ccb883ba2ac143db148eafec196e57
SHA512 02a28498f8b38c69c2f2dc11af84b401c824b5d7aa539a0dcc0e46a469410a4c858e7bc5ba8e60b551859f87300e01ea1a7326d925dc1d830edcc061cce3a40f
TLSH
T1C311A3A2F165DC57E43164DBA229CBC708A637A7685CAB2423058318FF89C37DE250E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1900-66-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/3748-22-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/3748-35-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/4836-6-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/5216-72-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download