ba4c01ffddecbfa021e1eb2cc3a53e6b389ac97dea7047808c84a501ae47f53f

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_63e269fe21fc84109b69ad51a98a3ea1_elex_glassworm_icedid_vidar.exe
Size 938KB
Sample260809-k5aveavbkd
SHA256 ba4c01ffddecbfa021e1eb2cc3a53e6b389ac97dea7047808c84a501ae47f53f
MD5 63e269fe21fc84109b69ad51a98a3ea1
SHA1 98d3e5fac49535ca7e064835863248615351665e
SHA512 484aa07c06d06730d9d5d76f06fc3308c659c8f550a5ba5758fa485918a420dfaa51d7587b8ea7c52fa04705717ebf499cc65603c9e16a87a040881fa7eea5fe
SSDEEP 24576:m9+EM0Hb9+EM0q9+EM0HdExqatgl8bRAhY9:U+E9B+ES+E9oqatgl4T
TLSH
T11015E746BA8580B1E467063049A792BE5730B915CB139E9BB2449FDEFFF27C09E31631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5404	svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe
4328	svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe
3560	svchost_BCBABCCAAABBBBCBCBBBACCCBACBACCAAABCACBAAACBCABAAABBCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABACABBCBBCBCACCBBCBCABBBBAABBCABCCCCBBCBCAACBCCAABCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBABCCAAABBBBCBCBBBACCCBACBACCAAABCACBAAACBCABAAABBCBB.exe"	svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACACCBCABCAABABCACBACBBBAAABBBAAABBCACBCAABCBBBCCAACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe"	2026-08-09_63e269fe21fc84109b69ad51a98a3ea1_elex_glassworm_icedid_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5240	sc.exe
4528	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3844	cmd.exe
3092	cmd.exe
1920	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBABCCAAABBBBCBCBBBACCCBACBACCAAABCACBAAACBCABAAABBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_63e269fe21fc84109b69ad51a98a3ea1_elex_glassworm_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6076	2026-08-09_63e269fe21fc84109b69ad51a98a3ea1_elex_glassworm_icedid_vidar.exe
6076	2026-08-09_63e269fe21fc84109b69ad51a98a3ea1_elex_glassworm_icedid_vidar.exe
6076	2026-08-09_63e269fe21fc84109b69ad51a98a3ea1_elex_glassworm_icedid_vidar.exe
6076	2026-08-09_63e269fe21fc84109b69ad51a98a3ea1_elex_glassworm_icedid_vidar.exe
5404	svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe
5404	svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe
5404	svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe
5404	svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe
3560	svchost_BCBABCCAAABBBBCBCBBBACCCBACBACCAAABCACBAAACBCABAAABBCBB.exe
3560	svchost_BCBABCCAAABBBBCBCBBBACCCBACBACCAAABCACBAAACBCABAAABBCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6076	2026-08-09_63e269fe21fc84109b69ad51a98a3ea1_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	5404	svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe
Token: SeDebugPrivilege	3560	svchost_BCBABCCAAABBBBCBCBBBACCCBACBACCAAABCACBAAACBCABAAABBCBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 1920	6076	2026-08-09_63e269fe21fc84109b69ad51a98a3ea1_elex_glassworm_icedid_vidar.exe	93
PID 1920 wrote to memory of 1204	1920	cmd.exe	95
PID 6076 wrote to memory of 3844	6076	2026-08-09_63e269fe21fc84109b69ad51a98a3ea1_elex_glassworm_icedid_vidar.exe	96
PID 3844 wrote to memory of 5240	3844	cmd.exe	98
PID 6076 wrote to memory of 3092	6076	2026-08-09_63e269fe21fc84109b69ad51a98a3ea1_elex_glassworm_icedid_vidar.exe	99
PID 3092 wrote to memory of 4528	3092	cmd.exe	101
PID 5404 wrote to memory of 3504	5404	svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-09_63e269fe21fc84109b69ad51a98a3ea1_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_63e269fe21fc84109b69ad51a98a3ea1_elex_glassworm_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACCBCAACCBACCACBAACCBCAABACBAABCCAABAABBACCABCCCCBAAABBCBABBCACCACAABACCCCBBCBCBBABABBACCABCBABACABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACCBCAACCBACCACBAACCBCAABACBAABCCAABAABBACCABCCCCBAAABBCBABBCACCACAABACCCCBBCBCBBABABBACCABCBABACABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBABCCBACBBBCBCACBABCCAABBBBACBABABACBBBBAACBBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe" start= auto displayName= "UserDataSvc_ACBABCCBACBBBCBCACBABCCAABBBBACBABABACBBBBAACBBACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBABCCBACBBBCBCACBABCCAABBBBACBABABACBBBBAACBBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe" start= auto displayName= "UserDataSvc_ACBABCCBACBBBCBCACBABCCAABBBBACBABABACBBBBAACBBACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBABCCBACBBBCBCACBABCCAABBBBACBABABACBBBBAACBBACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBABCCBACBBBCBCACBABCCAABBBBACBABABACBBBBAACBBACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe
1⤵
- Executes dropped EXE
PID:4328

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCCAAABBBBCBCBBBACCCBACBACCAAABCACBAAACBCABAAABBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCCAAABBBBCBCBBBACCCBACBACCAAABCACBAAACBCABAAABBCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ffa6657d2622167c6862be46b5da5c72e6f596bdd1ba73a9bd3ab1f11cf7e888
MD5 86300850dfe88f00978ab3cbd964cf1e
SHA1 1127c0cd67d186a8ad414c75b1279621adb75327
SHA512 aefa0296aee053b13e5c45aa72f1ade515475ba04714d295aa6662ff943083fb3cddb1feeac90248379337c8ae27ac91a24ceddea94ded81c5c8dce19bc0c76e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2442c8023ea0a1099565f3c72be95ae31cad43ad25d647ea8555233588bef685
MD5 227d1256693e962545e43ec63c3e7aae
SHA1 d36841a2991154617a54fc9a14c549f2e634323d
SHA512 5beb31530a8687a5a2a0d0f83e1d4899830270765117ad5af228fa564dcbc902710479d84468d5e06f0f7442f074ab17fc89c8c5023d8c89260d92bd6a089488
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 55a010913322531b54748f765218698d47ec9072b91dea1fca0c2be2b62d54d7
MD5 e15dcdfb9f96eec3bb762214a4f563bd
SHA1 24ead8c1849f9f0b477ccc19c75e6ffe25f0aa69
SHA512 2ab9a4e99dd51cefbeebdb25fd7208411669c12c226ff73a1d4079563625b416c0ae41ffd47b433f090fdd25d103d42466eb879517f50e46388bf03e171929d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8945eeb86fa0ddcf64f868de390478c7f6db107894ed980de517be4a1ab0c6fe
MD5 023159fe00d43a2a031bc141a6ee8489
SHA1 413dac8d8af17e77fbbfb1b200dc8d0658ab4ad6
SHA512 719a3d98674802f911862b8133d5d765bdf85f78bb0de7f23d66eeb9c16d9ee63e8db3b51849f70c68449c40b4393bd60cdf930f363d93f5ace21a16025c3ef1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2d1c733e73818de3daace12627e7f27a23834316b32845adcb970fbaf9bd102a
MD5 5d976eced35cf0deb8eb79c97f9734c2
SHA1 c461f7b86b48e6ea9cb9b6e966d71a187e228cbc
SHA512 54e00e2dd8de821c56c8b937cfc167f7595630b8e46b2eb1164eb6fcc3a28caf65e35a5656383c9a7130fc0aa2f67f19afef605432f1aec9f0980e1c9d365ceb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6921a5f2174bb80aa003d0b7916b4d4523cc7398de303701bed22554e90c3b90
MD5 675482cca7d3cea16800443d66b3a224
SHA1 6926d1a65a1eef1087f6a246537ff411cbce48a2
SHA512 efc57dda35b4e1dc60dad9b1a88ee396637f4d7bc017379b104ebab7519e40062384aac653b8baf5ae90f977e22d47ced6cab59a9b9e29ce88ca6b9e60bb7857
MD5 SHA1 SHA512

Submit Download

svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABBCCBAACABCCBBAAABABCBBABCBBABCACACAAABCAAAACAACAA.exe
Size 938KB
SHA256 ba4c01ffddecbfa021e1eb2cc3a53e6b389ac97dea7047808c84a501ae47f53f
MD5 63e269fe21fc84109b69ad51a98a3ea1
SHA1 98d3e5fac49535ca7e064835863248615351665e
SHA512 484aa07c06d06730d9d5d76f06fc3308c659c8f550a5ba5758fa485918a420dfaa51d7587b8ea7c52fa04705717ebf499cc65603c9e16a87a040881fa7eea5fe
SSDEEP 24576:m9+EM0Hb9+EM0q9+EM0HdExqatgl8bRAhY9:U+E9B+ES+E9oqatgl4T
TLSH
T11015E746BA8580B1E467063049A792BE5730B915CB139E9BB2449FDEFFF27C09E31631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 44edfba4a41d2aeaecaaff238e5764090f0a6384f1ef1b056aa32690d1a90e41
MD5 7f59a0e3cd4d1ea13143c32bb9d7c040
SHA1 a3755c49fb6787fa9ba0965833fbbf95cbf52cf4
SHA512 36dcc9a561eb165fc9bac88135ae61e7c56e3d980dba8b032d7f3632e0d81903a9d52462b38d5ecf134df0e14dbf0d3ad7a50a4cc032a6e3002aab6cd500d89e
TLSH
T10B110D8590E9DCD7F533A8878629E9C68CEC36EB58546A1463049218B7D5E31CF11CF2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3560-72-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/4328-66-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/5404-35-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/5404-22-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/6076-6-0x0000000000290000-0x00000000002B1000-memory.dmp

Download