9f1495b8dc8902b4aab33c0cf78cd53c77a61c1c60d693297dabdc004f382c38

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 12:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 31.7MB
Sample260910-p1c67axtew
SHA256 9f1495b8dc8902b4aab33c0cf78cd53c77a61c1c60d693297dabdc004f382c38
MD5 9fa85b8ad7e9af790bd5db2869723734
SHA1 e1c7a25dc11f30622c673bffee5008d8173474cd
SHA512 6daef300abac0a28907a8516be10e993a4dcc9c6fbf27a08f446bdcb367c2da4185eabf4a95097215c0a2fbdda40f07431861aed16fbb584d796a3d7821ccb5d
SSDEEP 49152:U+ES+ES+ES+ES+ES+ET+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+EY:rA91pH2WpjHrgBFFu416AWvP
TLSH
T18C772A09F94340F1D92B51B049DBD3BFCA707A2683228EE7E65DC75B6D23BA16C38215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3000	svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe
4460	svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe
752	svchost_CCCBCCABCABAACBACBCBCCCABBCABACACAACCBCBBACCAAAAACCBCAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACCABBCCAACCCAABCCACAAABACAAABCCCACABABBBBABBBCBABBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe"	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABABCCCCCCBBAABACCBBBACAAACBBACACABCABACCCCBACCAABCACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBCCABCABAACBACBCBCCCABBCABACACAACCBCBBACCAAAAACCBCAC.exe"	svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3900	sc.exe
464	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2536	cmd.exe
1772	cmd.exe
3612	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBCCABCABAACBACBCBCCCABBCABACACAACCBCBBACCAAAAACCBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5456	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
5456	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
5456	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
5456	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
3000	svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe
3000	svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe
3000	svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe
3000	svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5456	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3000	svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5456 wrote to memory of 2536	5456	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	91
PID 2536 wrote to memory of 4572	2536	cmd.exe	93
PID 5456 wrote to memory of 1772	5456	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	94
PID 1772 wrote to memory of 3900	1772	cmd.exe	96
PID 5456 wrote to memory of 3612	5456	2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	97
PID 3612 wrote to memory of 464	3612	cmd.exe	99
PID 3000 wrote to memory of 2972	3000	svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_9fa85b8ad7e9af790bd5db2869723734_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACABABCABCCBBAAACCCBBAABBBBBCCCCCBBACACAAACACCCBBBCACBBAACCCCBAABBCBCBCABCABBACCACBCAAAAAABBCACCCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACABABCABCCBBAAACCCBBAABBBBBCCCCCBBACACAAACACCCBBBCACBBAACCCCBAABBCBCBCABCABBACCACBCAAAAAABBCACCCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACBABCCABABBCCCBCAACCBABACACAACCACBABACBABBACABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe" start= auto displayName= "UserDataSvc_BCACBABCCABABBCCCBCAACCBABACACAACCACBABACBABBACABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACBABCCABABBCCCBCAACCBABACACAACCACBABACBABBACABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe" start= auto displayName= "UserDataSvc_BCACBABCCABABBCCCBCAACCBABACACAACCACBABACBABBACABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACBABCCABABBCCCBCAACCBABACACAACCACBABACBABBACABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACBABCCABABBCCCBCAACCBABACACAACCACBABACBABBACABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe
1⤵
- Executes dropped EXE
PID:4460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCABCABAACBACBCBCCCABBCABACACAACCBCBBACCAAAAACCBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCABCABAACBACBCBCCCABBCABACACAACCBCBBACCAAAAACCBCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8d5ede5d11ce6b1b50cba5d5d42d209d9d8b1e84a869ae13e8a0050dbf254f8d
MD5 a322bdba6920b2311cffc328043925bc
SHA1 0a1b0f7e68a9c696964d1084538ee2d25618ad8c
SHA512 f8a38efad0654a9c2cef2169ccd4ee9b43defde67b984f8c78bffbee85ea131bdef3a660c2955f6145cff2cb7b613efde99e92ea4db8c0aff23e095309c14211
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b542e2f755a98cc66f01b2c362eaf4dfa9dc3229492a975e924ab1f5677198e3
MD5 e2407dc8ff0d21b0d28fb0db5c37f7ac
SHA1 b950ef2b10f5ef0e632fd47f42379f7f3b4e0c9f
SHA512 5551f565612d9f6615e07468fe6ab74d9fa7aba5bbce7bd6ca71b6a23ee479ae720d8caa468f93eff9de9189bc1c067d11ab7a3e0279e594b64dddfa788a76fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ac36a3218fac41264bb9a51d77bf7e7eed2aa568fbd8df9b793bf628889314f7
MD5 f54dbac21a7a92af650606f7c9146bf6
SHA1 42a14905b3ee8d1fb22af8bfad43d7dd562a6c35
SHA512 7826c1eab702c705ab570652348d337b34e6b009af3eb8297482505f3e670d18128443d644a4fb11bae1d3183d0a7c1a0dcb9b2d380934d70b7cc05224bc339f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9f48307a8210f00c366eae3fbb2cbeb2a7f27738c2f7dc7ee70baf4104f2166c
MD5 d1a96f5ef18d85e8d5e95e5524f93428
SHA1 dfd592ae1a6152634f07d066bd892af88585b73d
SHA512 1e6f3c0219cdb707bcf2e5820674abadf3bee62a97fc180898bed9f0f9b0b2b3fe9e89f83f9d4a74d3867047ba76e1c67e4501e540f4245358652a9e3c33b52b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a7e5de9b265f28484230c25ab1ba45edb298d04654c3e0d6012450ff11874a51
MD5 fa4fdb4271fa0ac1596015df38011ce3
SHA1 44cfaacb736fb7cffbf144b7fde3a1103ef997fc
SHA512 d182278efa4167b33a74ce0b1e2243aacfb1432642e7f53e020d8507c74023c9bcb56de177faa586ae3e7e2f8acf0c667191b3fc0cee46e524e04da4aab628fc
MD5 SHA1 SHA512

Submit Download

svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBAABBABCBCBBCCBBAACCCBBBACACCBBBCBAAAABCCCAABAABBA.exe
Size 31.7MB
SHA256 9f1495b8dc8902b4aab33c0cf78cd53c77a61c1c60d693297dabdc004f382c38
MD5 9fa85b8ad7e9af790bd5db2869723734
SHA1 e1c7a25dc11f30622c673bffee5008d8173474cd
SHA512 6daef300abac0a28907a8516be10e993a4dcc9c6fbf27a08f446bdcb367c2da4185eabf4a95097215c0a2fbdda40f07431861aed16fbb584d796a3d7821ccb5d
SSDEEP 49152:U+ES+ES+ES+ES+ES+ET+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+EY:rA91pH2WpjHrgBFFu416AWvP
TLSH
T18C772A09F94340F1D92B51B049DBD3BFCA707A2683228EE7E65DC75B6D23BA16C38215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3000-23-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/3000-36-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/4460-66-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/5456-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5456-7-0x0000000000400000-0x0000000000421000-memory.dmp

Download