de0246f9f9394a314bae6db7e618b16498b092adb6694d4b79cbe5f1cd1748e2

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_2b93d1ce709517993250d49bed7c4413_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 5.4MB
Sample261003-sthd4ssv2j
SHA256 de0246f9f9394a314bae6db7e618b16498b092adb6694d4b79cbe5f1cd1748e2
MD5 2b93d1ce709517993250d49bed7c4413
SHA1 c282dba6639310339aae4471aa5219135e5a754d
SHA512 e5dbcf875904b8538372da4d64cfad532f9c07868aea0e1d771e0af96b1bd19688e00d41484a3ab4cf2a425939402db3888f8bdef50dee9edf74733313eba76c
SSDEEP 49152:U+ES+ES+Ek+ES+ES+E2+ES+ES+ElOV+E2+ES+EM+ES+ETqatglu+ES+ES+Ek+ESK:3mgExlye
TLSH
T1EC464C09F94640F1D96B517048CBD3BF8630BE2587128EEFE789DA2F6E337906839615
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1896	svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe
2592	svchost_ACBABBCAACACABACCBCBCCBCCCCCBCBCACCACCABAACCABAABBAACBB.exe
5984	svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBCABBABACACBBBBAABABCABCCBBCBBBBABAAAACBBCCCBABCABABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe"	2026-10-02_2b93d1ce709517993250d49bed7c4413_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBACBAABAACABCBACCBBCCCCBCACACAACBBABCCABACBBACBBCBABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBABBCAACACABACCBCBCCBCCCCCBCBCACCACCABAACCABAABBAACBB.exe"	svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2932	sc.exe
5700	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4208	cmd.exe
5248	cmd.exe
1400	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_2b93d1ce709517993250d49bed7c4413_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBABBCAACACABACCBCBCCBCCCCCBCBCACCACCABAACCABAABBAACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2468	2026-10-02_2b93d1ce709517993250d49bed7c4413_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
2468	2026-10-02_2b93d1ce709517993250d49bed7c4413_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
2468	2026-10-02_2b93d1ce709517993250d49bed7c4413_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
2468	2026-10-02_2b93d1ce709517993250d49bed7c4413_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
1896	svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe
1896	svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe
1896	svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe
1896	svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	2026-10-02_2b93d1ce709517993250d49bed7c4413_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	1896	svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 4208	2468	2026-10-02_2b93d1ce709517993250d49bed7c4413_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	92
PID 4208 wrote to memory of 2988	4208	cmd.exe	94
PID 1896 wrote to memory of 4140	1896	svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe	95
PID 2468 wrote to memory of 5248	2468	2026-10-02_2b93d1ce709517993250d49bed7c4413_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	98
PID 5248 wrote to memory of 5700	5248	cmd.exe	100
PID 2468 wrote to memory of 1400	2468	2026-10-02_2b93d1ce709517993250d49bed7c4413_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	101
PID 1400 wrote to memory of 2932	1400	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-10-02_2b93d1ce709517993250d49bed7c4413_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_2b93d1ce709517993250d49bed7c4413_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAAABCCCCCCCBCBCAAACAABCAACCCCCAAABAAAABABCBBCCBCAAACCABCCACBCBACBBABBBBCBAAACBCACBAABACBCBBAACBBCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAAABCCCCCCCBCBCAAACAABCAACCCCCAAABAAAABABCBBCCBCAAACCABCCACBCBACBBABBBBCBAAACBCACBAABACBCBBAACBBCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABBAABABABCACBACCBACAABCBBACABAABCBCCCCAAABCACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe" start= auto displayName= "UserDataSvc_CAABBAABABABCACBACCBACAABCBBACABAABCBCCCCAAABCACAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5248
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABBAABABABCACBACCBACAABCBBACABAABCBCCCCAAABCACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe" start= auto displayName= "UserDataSvc_CAABBAABABABCACBACCBACAABCBBACABAABCBCCCCAAABCACAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABBAABABABCACBACCBACAABCBBACABAABCBCCCCAAABCACAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABBAABABABCACBACCBACAABCBBACABAABCBCCCCAAABCACAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2932

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABBCAACACABACCBCBCCBCCCCCBCBCACCACCABAACCABAABBAACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABBCAACACABACCBCBCCBCCCCCBCBCACCACCABAACCABAABBAACBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe
1⤵
- Executes dropped EXE
PID:5984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a06f565c2fee173376d4f0ff0f3736eb04f308162394133a2e6610aec8f9d28c
MD5 810ef7e44764490e715b68e0f79b6d74
SHA1 48696a8231dd2fb9c9c46822019e1273893ff4cb
SHA512 f37e8e2784034978c6dd43b160cfb0191c355f5aa21d52a92398152d8652d72723f696611193505911788b2ee8c6debbfc85aa81b8c1a6bfdcf3ded877a265eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e148e35b43a5094262aab6b9bfd709367b50048e98d50d6b18675c86542ae78c
MD5 98a26e1cd79a2bb8e88a3137f4bccdd3
SHA1 0a77c8a885e8f5335acc173e5beeac49ccbdacc5
SHA512 155a5569954426bd69ee371414192939e6343c6a14d7f5a1b394c6c3b71e3bedfcf407bdc66f631741caa5d780a195f9ab31ea64b5028eb2863e61491cd25d0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bcc3627b496152578e2d73b71dec06e98d08d4443940f2ada55c6a789f8943bf
MD5 883bc1e3c591dadfe47df8ba69e5ea7c
SHA1 03cc6b76e09ae4a1983ae2943b8f0d8089739b8b
SHA512 1dfdfae045adf1ba69f6e9e57a595f2f5bddd63def4154c6802b07744953e98c80111e7f07a7061af8bf64ed47e3b91751606fcd408784e6537cc67b070d5253
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6623fbcc46acf9dd19ac182c742ab412bf45d3b2d23907062edfdc6f9ed6f2ae
MD5 17f340b54ec1d702956ac9cac85269b3
SHA1 7da6a39fb25709bcb6fc015939c05432da9330e2
SHA512 54df46a1ec4f404cce2b8ecd22780b2cdf77191ff6108aa488d4673c4f8c5eea81f07fc5c0c72756005ea23af74d4a20ea8e5301771517c04ca67621ab51ce78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4fcd8b02fa29782db94f6e49dce4562b8c1533c754dc22148ca9a68b38a2a2a9
MD5 cb257db0da704b19289dd5da46bce896
SHA1 39b467b6c61d82ec2a11f2ff41dacb255527822f
SHA512 65b23c9f3bc2f710ee0d26b43394151a31fab49b0006aa0704ceb3932da927e24fe56954527eef758652f9d591bdf410bcec3729bab78317578ba8afcaabd113
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5dc3fbf7edc91979ce1766a77d2c18f08c478cd318a6ce23b6be6cf723b144a5
MD5 d87c2b83310f3a9b93fc05cb0fb8b1d9
SHA1 b615fda5acb68233fca46a6ac71c132f46ab77d6
SHA512 2f083581d8ff09839ec7cc081d90ebf33d0a4c6aca57b890d39b5431ba20f29218c1678e1d8f893007bc1c7003926e007e7ba5807fa076a8ae717197b05509bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 86c5d45fc3eb693bd957036e3da6a8ec6acf5163f7b9b34c87af37b4a00e289d
MD5 0a25c8a06452b9d58142d422bbe4f47b
SHA1 92e14f5373e851e480b7f670915b1dbfd3f882f8
SHA512 b920b2ebbbaf8d73b5e42de32a4b225b9c1d4995afc9da3d371956ff4a2383b0299b63d85e9fcaf719d1135cdf728acae2018d0ae9297d0c888514dbd28ac0bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8575ac96c00841946c1045e8dda62ab6811d5c8cf2177b0273be6550cc162b82
MD5 662f61fbcbe85672b1195f8157361861
SHA1 d193449631252c036a773e7829f26e245f1d5122
SHA512 31fed6e8a3fd26b92e8d2ec3640b4c4bed1d89b87b5ebb08583e5db44f40ae52c4f3c72ece8ca75d9593ee162b97a01d5885493dc36015f849fb0b3818a79946
MD5 SHA1 SHA512

Submit Download

svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCABAACCAABCABCBBACAAAACACAACACCCBBCCACCABBCBBBAAAAA.exe
Size 5.4MB
SHA256 de0246f9f9394a314bae6db7e618b16498b092adb6694d4b79cbe5f1cd1748e2
MD5 2b93d1ce709517993250d49bed7c4413
SHA1 c282dba6639310339aae4471aa5219135e5a754d
SHA512 e5dbcf875904b8538372da4d64cfad532f9c07868aea0e1d771e0af96b1bd19688e00d41484a3ab4cf2a425939402db3888f8bdef50dee9edf74733313eba76c
SSDEEP 49152:U+ES+ES+Ek+ES+ES+E2+ES+ES+ElOV+E2+ES+EM+ES+ETqatglu+ES+ES+Ek+ESK:3mgExlye
TLSH
T1EC464C09F94640F1D96B517048CBD3BF8630BE2587128EEFE789DA2F6E337906839615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1896-24-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/1896-34-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/2468-0-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/2468-8-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/2592-70-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download