335be2f3a16921c813f49e0c361d7deed5efd99658d03a6e45d7b47403eca97f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_10cc13452753cc863440eacf14c12d81_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 3.4MB
Sample260910-ym3dlagk2v
SHA256 335be2f3a16921c813f49e0c361d7deed5efd99658d03a6e45d7b47403eca97f
MD5 10cc13452753cc863440eacf14c12d81
SHA1 b7a98f61a425d856eb42cb75b21c18a344ed061e
SHA512 7d5f2ddfda7bb31736f235a188885e0cf6378713c80a453ca664b0d1ca50686b660f1efaa2b621ee313142123fd6e1a237d8d2c71c7805e6f0a74c3d03ea344a
SSDEEP 49152:U+ES+E7+EBqatglK+E/0vn+ES+E7+EBqatglK+E/0vp7hy/JgUlOntOpa/:5NAwNApExlyN
TLSH
T1DAF55A4ABA4500F1D16A81304897A27ED771B825DB138F8F92949EEEFFF37905E25630
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3948	svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe
1816	svchost_BCABCACACBBCBACBAABBACBBBCABAABCBCBCCCCBBCBCCBCBBABAAAA.exe
3416	svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCACBBAACAAABBBCAACCBCCAAACAAACBABBACBBAAABCCABCBAAABCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCACACBBCBACBAABBACBBBCABAABCBCBCCCCBBCBCCBCBBABAAAA.exe"	svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCABCBCCBBACACBBBACACCAABCABAAACACCBBBCACAABCCCAAABBABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe"	2026-09-10_10cc13452753cc863440eacf14c12d81_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
980	sc.exe
2552	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
800	cmd.exe
2592	cmd.exe
1064	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABCACACBBCBACBAABBACBBBCABAABCBCBCCCCBBCBCCBCBBABAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_10cc13452753cc863440eacf14c12d81_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2568	2026-09-10_10cc13452753cc863440eacf14c12d81_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
2568	2026-09-10_10cc13452753cc863440eacf14c12d81_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
2568	2026-09-10_10cc13452753cc863440eacf14c12d81_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
2568	2026-09-10_10cc13452753cc863440eacf14c12d81_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
3948	svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe
3948	svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe
3948	svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe
3948	svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	2026-09-10_10cc13452753cc863440eacf14c12d81_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	3948	svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2932	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 800	2568	2026-09-10_10cc13452753cc863440eacf14c12d81_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	96
PID 800 wrote to memory of 3132	800	cmd.exe	98
PID 3948 wrote to memory of 3524	3948	svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe	99
PID 3524 wrote to memory of 4312	3524	notepad.exe	100
PID 2568 wrote to memory of 2592	2568	2026-09-10_10cc13452753cc863440eacf14c12d81_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	104
PID 2592 wrote to memory of 980	2592	cmd.exe	106
PID 2568 wrote to memory of 1064	2568	2026-09-10_10cc13452753cc863440eacf14c12d81_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	107
PID 1064 wrote to memory of 2552	1064	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-10_10cc13452753cc863440eacf14c12d81_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_10cc13452753cc863440eacf14c12d81_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBBACCAAACACBCAABBBCBACCBAABBCCBBCCAACBCBCCCCABAACABBAABBBBACACCBACBABCABCCACACCBCCACBBAACBCCBACBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACBBACCAAACACBCAABBBCBACCBAABBCCBBCCAACBCBCCCCABAACABBAABBBBACACCBACBABCABCCACACCBCCACBBAACBCCBACBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAABBCACCAACBBBACAAAABCCABACCAACABAABBABCABACBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe" start= auto displayName= "UserDataSvc_BCAABBCACCAACBBBACAAAABCCABACCAACABAABBABCABACBAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAABBCACCAACBBBACAAAABCCABACCAACABAABBABCABACBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe" start= auto displayName= "UserDataSvc_BCAABBCACCAACBBBACAAAABCCABACCAACABAABBABCABACBAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAABBCACCAACBBBACAAAABCCABACCAACABAABBABCABACBAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAABBCACCAACBBBACAAAABCCABACCAACABAABBABCABACBAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4312

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2932

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCACACBBCBACBAABBACBBBCABAABCBCBCCCCBBCBCCBCBBABAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCACACBBCBACBAABBACBBBCABAABCBCBCCCCBBCBCCBCBBABAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe
1⤵
- Executes dropped EXE
PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 78270d4c48806a50e6a937ffc79888f7a65797ebcb92b65f310c72deb6675215
MD5 550821f15a521c83453e58eaa504781e
SHA1 5fb8694bc5b0e46a2448051459f4f286aaf4a623
SHA512 be81c076f138eb1990a471c107f3c5edc3737f42582f5e88a09b5ab8735b1cc532a9cc784db163c540d81aae329d39ad6b8026697433093bc79fd79c99a9d3c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8f1896cd019c8e58828df9f20b2b1b40cd338c8d4f0a66270586a37cf62b8554
MD5 b3ebb32bf3dab2d906d7878925a87062
SHA1 933f902a30d9229015ca86636f45a971257f57b5
SHA512 936d27d9fc5f5407aae358c8d0fb2dd909bef52087a0dff7c400be3e3bad78b116143c80afb843326233655cc86d73a9c1dba95c1728ab4ea9b10e33148d3f1b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a540987c59332462124c8c3a6cbfb867285344c85c657c94edbc2f963cf3605f
MD5 e07ad7241bf6e1f9b80f87933a5d4137
SHA1 45e79c695a04f7d88402b60bfbf626c591a497ab
SHA512 6719eaef89c281f32e3fc3c3a84162ce97405a21b81659ab1fe14a63bee42c6cb5886ec5ccac05dded8e7c811a6f198a2ec5bcbd6a6204b5c976a8949b2fe546
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 af3e2c4e505b01ec419277f0d3784b275823c10d73d6587ff07cf46bfee96a11
MD5 d890adb301e4259a23f61876a2fce436
SHA1 7f24ad8b7362d5b201e06d82da0a1cafbedbb86b
SHA512 3d4b323b9b0e137851225dae0867d1597bb244699066f823cf14a2392400ddcd346b5b27394b24103f4a690329496ab17d7689a1c63e9c302bdd8b08c821712c
MD5 SHA1 SHA512

Submit Download

svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCCBACCBCACABCACCAAABCCBABCCAABABCBBCCCCCCBCACBBBCAA.exe
Size 3.4MB
SHA256 335be2f3a16921c813f49e0c361d7deed5efd99658d03a6e45d7b47403eca97f
MD5 10cc13452753cc863440eacf14c12d81
SHA1 b7a98f61a425d856eb42cb75b21c18a344ed061e
SHA512 7d5f2ddfda7bb31736f235a188885e0cf6378713c80a453ca664b0d1ca50686b660f1efaa2b621ee313142123fd6e1a237d8d2c71c7805e6f0a74c3d03ea344a
SSDEEP 49152:U+ES+E7+EBqatglK+E/0vn+ES+E7+EBqatglK+E/0vp7hy/JgUlOntOpa/:5NAwNApExlyN
TLSH
T1DAF55A4ABA4500F1D16A81304897A27ED771B825DB138F8F92949EEEFFF37905E25630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2568-0-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/2568-8-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/3524-61-0x00000000054B0000-0x00000000054B1000-memory.dmp

Download

memory/3948-27-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/3948-37-0x0000000000520000-0x0000000000541000-memory.dmp

Download