00109f27655b798dba785e1977979f3661a3daa41c947637b21e7af9544b30cc

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 08:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_f238cd4f2e91aa0fb54cbd1c80f8ccc9_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar.exe
Size 34.1MB
Sample260910-ks3dwstvhs
SHA256 00109f27655b798dba785e1977979f3661a3daa41c947637b21e7af9544b30cc
MD5 f238cd4f2e91aa0fb54cbd1c80f8ccc9
SHA1 93f203e4f1a44b1346ea6fdb1b2abdd310ca229e
SHA512 37546a4b7b2cd23afcfea9aff51c05a50f6e3088cb7d33d74864308d27c4cea32b1eea87a94d093140b1a9628d5896c2b22bc576b256f51a39e62571e17f08c4
SSDEEP 49152:U+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+ET+Ee+ES+ES+ES+ES+ES+ES+ES+ES+EH:H7pI7pxA91pH2WpjHrgBFFu416AWvb
TLSH
T1E3773B09F94340F1D92B51B04DDBD3BFCA707A2682228EE7F64DCB5B6D23B616C28255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5720	svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe
920	svchost_CBCACAABCCCACBCCABBBABCBBCCACCCCACCCACBACCCCBBBAAACABBB.exe
5248	svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABBBBCCABBCBBAAAAAAACCACCAAABCBBAAABCCCCABCBBACBACABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe"	2026-09-10_f238cd4f2e91aa0fb54cbd1c80f8ccc9_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCAAABBBBBBACCACABABCACBABAABABAABBCABCAAACAAABABABCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCACAABCCCACBCCABBBABCBBCCACCCCACCCACBACCCCBBBAAACABBB.exe"	svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2016	sc.exe
1624	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4680	cmd.exe
5876	cmd.exe
4776	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_f238cd4f2e91aa0fb54cbd1c80f8ccc9_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACAABCCCACBCCABBBABCBBCCACCCCACCCACBACCCCBBBAAACABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3216	2026-09-10_f238cd4f2e91aa0fb54cbd1c80f8ccc9_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar.exe
3216	2026-09-10_f238cd4f2e91aa0fb54cbd1c80f8ccc9_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar.exe
3216	2026-09-10_f238cd4f2e91aa0fb54cbd1c80f8ccc9_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar.exe
3216	2026-09-10_f238cd4f2e91aa0fb54cbd1c80f8ccc9_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar.exe
5720	svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe
5720	svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe
5720	svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe
5720	svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe
920	svchost_CBCACAABCCCACBCCABBBABCBBCCACCCCACCCACBACCCCBBBAAACABBB.exe
920	svchost_CBCACAABCCCACBCCABBBABCBBCCACCCCACCCACBACCCCBBBAAACABBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3216	2026-09-10_f238cd4f2e91aa0fb54cbd1c80f8ccc9_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar.exe
Token: SeDebugPrivilege	5720	svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe
Token: SeDebugPrivilege	920	svchost_CBCACAABCCCACBCCABBBABCBBCCACCCCACCCACBACCCCBBBAAACABBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4680	3216	2026-09-10_f238cd4f2e91aa0fb54cbd1c80f8ccc9_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar.exe	93
PID 4680 wrote to memory of 2292	4680	cmd.exe	95
PID 5720 wrote to memory of 6636	5720	svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe	96
PID 3216 wrote to memory of 5876	3216	2026-09-10_f238cd4f2e91aa0fb54cbd1c80f8ccc9_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar.exe	99
PID 5876 wrote to memory of 2016	5876	cmd.exe	101
PID 3216 wrote to memory of 4776	3216	2026-09-10_f238cd4f2e91aa0fb54cbd1c80f8ccc9_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar.exe	102
PID 4776 wrote to memory of 1624	4776	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-09-10_f238cd4f2e91aa0fb54cbd1c80f8ccc9_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_f238cd4f2e91aa0fb54cbd1c80f8ccc9_cobalt-strike_elex_glassworm_hawkeye_icedid_njrat_remcos_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAABBBBAAABABABACCCCBBBCCBCAABBABABBAAAABBCBBCBABABBBACBCABBBACCBBBABAACACBCBCCBABBBAABCCBBBBCABAACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAABBBBAAABABABACCCCBBBCCBCAABBABABBAAAABBCBBCBABABBBACBCABBBACCBBBABAACACBCBCCBABBBAABCCBBBBCABAACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCBCCCBCCBABACBCAACABAABABCACBCAABCBAACCCBBBCBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe" start= auto displayName= "UserDataSvc_CACCBCCCBCCBABACBCAACABAABABCACBCAABCBAACCCBBBCBCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5876
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCBCCCBCCBABACBCAACABAABABCACBCAABCBAACCCBBBCBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe" start= auto displayName= "UserDataSvc_CACCBCCCBCCBABACBCAACABAABABCACBCAABCBAACCCBBBCBCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCBCCCBCCBABACBCAACABAABABCACBCAABCBAACCCBBBCBCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCBCCCBCCBABACBCAACABAABABCACBCAABCBAACCCBBBCBCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1624

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6636

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACAABCCCACBCCABBBABCBBCCACCCCACCCACBACCCCBBBAAACABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACAABCCCACBCCABBBABCBBCCACCCCACCCACBACCCCBBBAAACABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe
1⤵
- Executes dropped EXE
PID:5248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c7d70cd4d02de7b223bc416d1f3e79b64b7c3c5228134d05349b039b97e910c2
MD5 54ded752f29421fb69e1d744821024e9
SHA1 190f6d4ad4b841076f6c4435ae94d95b25565ab9
SHA512 21c9830664e7ffa9baeb785d7ade4762f94bfca2cf925b726e6a405282f36032220580671dcc633d69e780184b305d95366b47f3a67b78da0ab1a3540ae43a53
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0715b35f1c7e590522cc026f88add25872053719c199d8fc874033068774da33
MD5 f715105f7aeb6bda30df06be929534b7
SHA1 681a9af1126ac53fd62e3ac13b529f8b13fb67d9
SHA512 4f63912f4840e65055c3e83d6d4e49758dd49e85bb747d6083d1dce457739b7949c25359fe765e8d61be65348ced3bc431dca3afbd65efc7185d278df4cf0f42
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9d336f770021f318c61d46be7f15340e3ee4ecf467bf74433676c7c6e23434a5
MD5 b72d375aea8cffbb76e9b31008fc3974
SHA1 4dce181769f6f9be9c70fdcb9994491948ea31ed
SHA512 9efc08fb2c7f6d55718bb58e01a199c46b159bd50d309ef28be1cecb4b3ba1066170d31c0d6cd0d408c607fcbb05bc0684ca6e311a8b99106a819927c073646e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 86b54ea4052779801eb2446cd9ee12597aef63a2d36adde3481c81e7ad070b89
MD5 5c5ae31196c563a5f054cc266fbf29b8
SHA1 6d2d8b8970cb7308d43f2c9e561e5be2ab406f40
SHA512 a08d792e3c24ae84d483cc7c9bdca593115a67a9d5d6740f1672e034ec4c30bcc335965c1f1c1331ea5d95287e29f6d8cb42c28a21cff7876986a09995f786e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 eed20377ea9113e0b0223699eea577412e73fdf3036f833597432d42898da5f1
MD5 45ec1c9bbf70392022ee1c40560de55a
SHA1 4db7d502c85e26086289780d81f30a785189e793
SHA512 c63385f16cf592dca341c372ddfc31673127c49730d8ef5c0c3ca47a08e96ea7a7d5f99726ebb273a8e082de4d48e654234455cfd5174d1ee75f934b993741ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4f7105efea45bc0cfb1c5bbf602eba6c2d178c2ee871de10b74f0cdfcf72de8d
MD5 fa28c35942bcee1fb0288ccba2c7c245
SHA1 7411cad81e3e5a017858252402b566a5619777e4
SHA512 0fb5b0f094842ad7751556fc0700fddf6c69a59525fe8d045273d99acc11d2a1871afea98b36e12612af7b86fdc5108f19faffdb55ce3e920b98ae311a4dddd5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 05440e5387a2db40214b1727d0c4f80bfaa24d9cd03e741da6f0c88ac78a8f6e
MD5 4c5abb76c59e7ae194e0de4cfa42dc93
SHA1 7b052c209c77eec3dd15845548fecf9439d74e35
SHA512 6f28bca3169c28db75c1ea8c007871e7bce69daaccc7e41787d89d0349112fbbe7545d538c8e47d84860babeb03e768a8f04b31c825180514b00d80f954a79ce
MD5 SHA1 SHA512

Submit Download

svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBACCBCAABBCAABCBACBCCBCCBAAACCACBACCACBAACBBCBCAAC.exe
Size 34.1MB
SHA256 00109f27655b798dba785e1977979f3661a3daa41c947637b21e7af9544b30cc
MD5 f238cd4f2e91aa0fb54cbd1c80f8ccc9
SHA1 93f203e4f1a44b1346ea6fdb1b2abdd310ca229e
SHA512 37546a4b7b2cd23afcfea9aff51c05a50f6e3088cb7d33d74864308d27c4cea32b1eea87a94d093140b1a9628d5896c2b22bc576b256f51a39e62571e17f08c4
SSDEEP 49152:U+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+ET+Ee+ES+ES+ES+ES+ES+ES+ES+ES+EH:H7pI7pxA91pH2WpjHrgBFFu416AWvb
TLSH
T1E3773B09F94340F1D92B51B04DDBD3BFCA707A2682228EE7F64DCB5B6D23B616C28255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 884161a543ca2b2dee70ad0e2fdd9216d8f694fe2cdb14932ac4e584131f2ba6
MD5 7c5ba7b5441bc7f5eb7d981fca02e61d
SHA1 ee3e278d7b41cda79ee9d5c651ae61020e72c2cf
SHA512 9cbe96427aa12e6d501b27a6ff0e06a8e57ee1963b8d6bb03551b38e9529724eb9accbe8d792de6d856b27356ec349cf3161307f5b61017367ddfc7c5af0dcfa
TLSH
T181117351F0A9D873F0312D9E6529CB970CE4778F7898AB583348A118BF59C39DE1A0E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/920-64-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/920-82-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/3216-0-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/3216-8-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/5720-34-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download