a25ed6034ce0cde425f38a876c3997150d4cd03ff754f460583a980f41302c7b

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 07:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_15f59009f6919dbf34ac00ed00bb798e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 6.2MB
Sample260910-h6vvvszdnd
SHA256 a25ed6034ce0cde425f38a876c3997150d4cd03ff754f460583a980f41302c7b
MD5 15f59009f6919dbf34ac00ed00bb798e
SHA1 f01b41481d2a66c402eb4c4e6553442f256c9593
SHA512 3e49eb9561240d971e37f3f94096118ecff764b2972c93248ebcac1471a3033741c3042734323503a04b53f4c43d2a642aa1df8c1d2e04c4ebc95b981d2b846e
SSDEEP 49152:U+Ek+Eyb6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwypJ:UA91pH2WpjHrgBFFu416AWvb
TLSH
T1AC565AA562A720FDE0AFE179893AC732E6B17C130131530F167CD6562FA36686D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1748	svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe
1952	svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe
1504	svchost_CBCCBBBBCAACCBACABBCAACBBABCBCBBCBCBBCBCCBABCCACCABBABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCAAACACCBBAABCCCCCBBAACACAABCABABCBCCABCACCABAACACCCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe"	2026-09-08_15f59009f6919dbf34ac00ed00bb798e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BABBABAAAAABACBBACACABCAABBCABABACBBBBCABACACBACBBBACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCBBBBCAACCBACABBCAACBBABCBCBBCBCBBCBCCBABCCACCABBABC.exe"	svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4192	sc.exe
1856	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4908	cmd.exe
3800	cmd.exe
2544	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCBBBBCAACCBACABBCAACBBABCBCBBCBCBBCBCCBABCCACCABBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_15f59009f6919dbf34ac00ed00bb798e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4132	2026-09-08_15f59009f6919dbf34ac00ed00bb798e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4132	2026-09-08_15f59009f6919dbf34ac00ed00bb798e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4132	2026-09-08_15f59009f6919dbf34ac00ed00bb798e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
4132	2026-09-08_15f59009f6919dbf34ac00ed00bb798e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
1748	svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe
1748	svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe
1748	svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe
1748	svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	2026-09-08_15f59009f6919dbf34ac00ed00bb798e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1748	svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3512	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 3800	4132	2026-09-08_15f59009f6919dbf34ac00ed00bb798e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	101
PID 3800 wrote to memory of 4888	3800	cmd.exe	103
PID 4132 wrote to memory of 2544	4132	2026-09-08_15f59009f6919dbf34ac00ed00bb798e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	104
PID 2544 wrote to memory of 4192	2544	cmd.exe	106
PID 4132 wrote to memory of 4908	4132	2026-09-08_15f59009f6919dbf34ac00ed00bb798e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	107
PID 4908 wrote to memory of 1856	4908	cmd.exe	109
PID 1748 wrote to memory of 3580	1748	svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe	111
PID 3580 wrote to memory of 2948	3580	notepad.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-09-08_15f59009f6919dbf34ac00ed00bb798e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_15f59009f6919dbf34ac00ed00bb798e_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABBAACBBBBAABACABAABCCBCAAACCCBABCAAACACCAACBACCACABBCBBBBCCCAACACAABAABACBCCBCCCBACBAABAAABCBBCCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABBAACBBBBAABACABAABCCBCAAACCCBABCAAACACCAACBACCACABBCBBBBCCCAACACAABAABACBCCBCCCBACBAABAAABCBBCCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACBCCCBCACACBACBAACABBBCBBACBBCBACCCBBBBBCBCAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe" start= auto displayName= "UserDataSvc_BCACBCCCBCACACBACBAACABBBCBBACBBCBACCCBBBBBCBCAACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACBCCCBCACACBACBAACABBBCBBACBBCBACCCBBBBBCBCAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe" start= auto displayName= "UserDataSvc_BCACBCCCBCACACBACBAACABBBCBBACBBCBACCCBBBBBCBCAACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACBCCCBCACACBACBAACABBBCBBACBBCBACCCBBBBBCBCAACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACBCCCBCACACBACBAACABBBCBBACBBCBACCCBBBBBCBCAACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe
1⤵
- Executes dropped EXE
PID:1952

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3512

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBBBBCAACCBACABBCAACBBABCBCBBCBCBBCBCCBABCCACCABBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBBBBCAACCBACABBCAACBBABCBCBBCBCBBCBCCBABCCACCABBABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c78d9f529aa09b6ace69f2c82aad3e4a2aa234fdff67a8d36be3aabf6e10d0d7
MD5 1d7f87b5410d2b11db29b71e4b0eec9f
SHA1 06e06d73e05676765aac1f37223f4cc9f84bf37c
SHA512 75359ada58636991499c3b48e4f23b301a29ea8303108663f9fb829703308dbca1084fa1cfb57724dd7dc7be7a97901fbdc882dbded8738e485c18ea0a082f5d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 746ea39e60c80dd44a0d367a1e20bab3f24219fa418edcd57d5345008a9492c5
MD5 097e6f2fd906862aed2c2b86201d2c32
SHA1 6e9ded6e63339f7dd6073c1edb5190b982663654
SHA512 e7ec74e9f7aa80eb3473d12584221dad9d227c9f19710a7877a2b4a3e7adde1c6ec3fe7eb86bb4ff08b32f09e8609b93984ef1261097cf36daaddbaa426fb5b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 72bc885af152bfade1d91df57122a506bc0c94f13522b778e22f7cc729af7e73
MD5 c6b84226a47373af24aca8781320cb3c
SHA1 6d7395d9854f99ecff30714a4b6fe06cf1781057
SHA512 cb12959116991cf2e45351e63df3101e4ec38179085a1820a318600f42f82aeccc8a197ad9d24f474fe289fa3a9637903e3767f919481f84d6d176e6dd3ec0ef
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3af06711d1dccef0244d78a1be15fba08ac79671b6ddf8d0f36de31e3c3a632d
MD5 35bd85a9d3790c798112fd8abf70e32f
SHA1 89fe784118bccbf02dd87ccc9c7596e235cbbef5
SHA512 031b176431e66e7591ececd9b29faeba10c6b49446069b76caa42bed63c1f18f77d64912b957844e114d1905d24a2bbef5c2731f32f56f65ebab2206f401268d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b5ed4d57675d06fea260d5cc84d5e562f8e8ec18c8df1a64938f38d08c3ff8b8
MD5 33f748542f5d353bedc1a2be35e7afec
SHA1 ca2d32c5a1aff7b53f98317304314127490a2984
SHA512 98df13a0a28190c77d2c084318011cafc949d8eae6c9d2107e6185789a3b279e88911be6467c168b7b9bfa469d60eb03cf14cc32d92edb8cafac711112ff381f
MD5 SHA1 SHA512

Submit Download

svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCABBACCCAAAABBBBCBAABBCAAABCBBACBAABACABCBBCCAACA.exe
Size 6.2MB
SHA256 a25ed6034ce0cde425f38a876c3997150d4cd03ff754f460583a980f41302c7b
MD5 15f59009f6919dbf34ac00ed00bb798e
SHA1 f01b41481d2a66c402eb4c4e6553442f256c9593
SHA512 3e49eb9561240d971e37f3f94096118ecff764b2972c93248ebcac1471a3033741c3042734323503a04b53f4c43d2a642aa1df8c1d2e04c4ebc95b981d2b846e
SSDEEP 49152:U+Ek+Eyb6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwypJ:UA91pH2WpjHrgBFFu416AWvb
TLSH
T1AC565AA562A720FDE0AFE179893AC732E6B17C130131530F167CD6562FA36686D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1504-80-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/1748-25-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/1748-38-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/1952-74-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/3580-67-0x0000000004B20000-0x0000000004B21000-memory.dmp

Download

memory/4132-6-0x0000000000260000-0x0000000000281000-memory.dmp

Download