9f1495b8dc8902b4aab33c0cf78cd53c77a61c1c60d693297dabdc004f382c38

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 31.7MB
Sample260910-p1c67axtew
SHA256 9f1495b8dc8902b4aab33c0cf78cd53c77a61c1c60d693297dabdc004f382c38
MD5 9fa85b8ad7e9af790bd5db2869723734
SHA1 e1c7a25dc11f30622c673bffee5008d8173474cd
SHA512 6daef300abac0a28907a8516be10e993a4dcc9c6fbf27a08f446bdcb367c2da4185eabf4a95097215c0a2fbdda40f07431861aed16fbb584d796a3d7821ccb5d
SSDEEP 49152:U+ES+ES+ES+ES+ES+ET+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+EY:rA91pH2WpjHrgBFFu416AWvP
TLSH
T18C772A09F94340F1D92B51B049DBD3BFCA707A2683228EE7E65DC75B6D23BA16C38215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
724	svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe
3120	svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe
3824	svchost_ABBCAABABAAAABCCACAACBBBCCCCABCBABAABBBABCCABABACCABBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBBCBBBBBAAABCACABBAACCABBAAAAAACAAAAABBCCCACBBACCAABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe"	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABBCCACBABBBABACAABBACCBBBCABABBACABBCACBBAACCCBBCCBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCAABABAAAABCCACAACBBBCCCCABCBABAABBBABCCABABACCABBAC.exe"	svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1784	sc.exe
2264	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4664	cmd.exe
2688	cmd.exe
2728	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCAABABAAAABCCACAACBBBCCCCABCBABAABBBABCCABABACCABBAC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3400	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3400	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3400	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3400	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
724	svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe
724	svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe
724	svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe
724	svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3400	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	724	svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5068	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 4664	3400	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	94
PID 4664 wrote to memory of 824	4664	cmd.exe	96
PID 3400 wrote to memory of 2688	3400	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	99
PID 2688 wrote to memory of 1784	2688	cmd.exe	101
PID 3400 wrote to memory of 2728	3400	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	102
PID 2728 wrote to memory of 2264	2728	cmd.exe	104
PID 724 wrote to memory of 3228	724	svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe	106
PID 3228 wrote to memory of 864	3228	notepad.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCABABAACBABBCCCCBAABBBBCAABACBCBABBCCBABCCCBBCAABBBACBCBBAAAACCBACACACBCBABBBCCABBCACCAABAAABCCAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCABABAACBABBCCCCBAABBBBCAABACBCBABBCCBABCCCBBCAABBBACBCBBAAAACCBACACACBCBABBBCCABBCACCAABAAABCCAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBAABBBCCCBCACAAACCCAAABCBACABBBBCCCCCACAACCAABCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe" start= auto displayName= "UserDataSvc_BBBAABBBCCCBCACAAACCCAAABCBACABBBBCCCCCACAACCAABCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBAABBBCCCBCACAAACCCAAABCBACABBBBCCCCCACAACCAABCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe" start= auto displayName= "UserDataSvc_BBBAABBBCCCBCACAAACCCAAABCBACABBBBCCCCCACAACCAABCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBAABBBCCCBCACAAACCCAAABCBACABBBBCCCCCACAACCAABCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBAABBBCCCBCACAAACCCAAABCBACABBBBCCCCCACAACCAABCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:724
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe
1⤵
- Executes dropped EXE
PID:3120

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5068

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAABABAAAABCCACAACBBBCCCCABCBABAABBBABCCABABACCABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAABABAAAABCCACAACBBBCCCCABCBABAABBBABCCABABACCABBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4adde3728263b179479f7627ef970cd48375f5a33e5fc2bd53150b284027a8df
MD5 56ce3d42d5917205035b4682ae82b50b
SHA1 9536f963a87ae593c0ae0bdce91d3efa9ddcc823
SHA512 d92ac5ee2b2edb8bf1f23ee4222a24b7b2aafbf82ac74aafbb9154eaa5f4b7f21fa7fc7fa5312932c2aa2168ca5322278cfca26be004ff5eb57e312d52c1c7c1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 96447c53404877fda1dac56b8287942afc5eff5819995aa1f17072fcb9ef27f9
MD5 001dda4889493e7ad8d07e8f9178ee66
SHA1 8faa6cd9897f4ca367f80c19b4a88543edad7f2b
SHA512 c9832ca6392104b13ae3f5c98056988560d32950b002f16fa7406dd641321611012dbf2ed48c4e0fe85c7442af443e625b2dac97348c0f93b52362ae58095164
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 682b425b571652e2e99fb1b95e520b084d25cd468b3b53393faa0a4e2fd7e25a
MD5 aba48d1b8177eda56ba61603b873a304
SHA1 ecb2341e0d9d26ab64246e03014ba00496096b1f
SHA512 0cecbd4232553c1240905a71f9a9fa43ed0eca979afa159a2840aebedad217a01e684d77958e5ce21fca1a2c6464824f83bd1d9d73b986b894de0d854987aec0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 094598185799b200132a94f0cefd08b9d1ca9deb5ded4f3a84b443f2d278acd7
MD5 f27f258ff2f1411ddbaa8bcd1d8ef73e
SHA1 462409a964b9f9a0e6fd602df1f0874559e7465a
SHA512 ca5208b44ee7565145d5f7df5dd44bc3e859d0013c9dce3c152be15e185878b36a132ed77c225ab560e6607260e30c33914ad1d90fd32f809d3155fdf6a9099f
MD5 SHA1 SHA512

Submit Download

svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBBBCCAAAACCAAABBCABCABABBCBBBAACABBBACCBBCCACACACC.exe
Size 31.7MB
SHA256 9f1495b8dc8902b4aab33c0cf78cd53c77a61c1c60d693297dabdc004f382c38
MD5 9fa85b8ad7e9af790bd5db2869723734
SHA1 e1c7a25dc11f30622c673bffee5008d8173474cd
SHA512 6daef300abac0a28907a8516be10e993a4dcc9c6fbf27a08f446bdcb367c2da4185eabf4a95097215c0a2fbdda40f07431861aed16fbb584d796a3d7821ccb5d
SSDEEP 49152:U+ES+ES+ES+ES+ES+ET+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+EY:rA91pH2WpjHrgBFFu416AWvP
TLSH
T18C772A09F94340F1D92B51B049DBD3BFCA707A2683228EE7E65DC75B6D23BA16C38215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/724-26-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/724-39-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/3120-75-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/3228-67-0x0000000002E60000-0x0000000002E61000-memory.dmp

Download

memory/3400-0-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/3400-7-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download