046a9a3d8c846aa47252e1d34d2d5a077b1a3056f1f1c2bc6d34681ebca73848

Analysis

max time kernel
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e9074c2dd4ab846008d2f7e3f3d78475_elex_glassworm_icedid_njrat_stop_vidar.exe
Size 11.5MB
Sample260810-1dvy9syfpg
SHA256 046a9a3d8c846aa47252e1d34d2d5a077b1a3056f1f1c2bc6d34681ebca73848
MD5 e9074c2dd4ab846008d2f7e3f3d78475
SHA1 262ad4aae4a472ed433e5c7769710aaf71e7acbb
SHA512 5b8767e697ac2c7416e41a1e4e94d72921c087446f7dca0b74e59c084f1770a24074d609a9eebd3d92976298f3abc3158c9051f548b6d0b64baa3d282dc7c18c
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Xp7Dp7Dp7Dp7Dp741MbQ9yDAD7KjjqkusjmqMhj:vBBBB1BBBB41tIDewjqkjiqMd
TLSH
T119C67C25BBA081F5F9A79839897BC731E97179210E32438F86D4C61E6F336919D38732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
3796	svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABBABCACCBAACCAABCBAABBAABAAACBAACCBABCBBACBCACCCCCBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe"	2026-08-10_e9074c2dd4ab846008d2f7e3f3d78475_elex_glassworm_icedid_njrat_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3368	sc.exe
3168	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1636	cmd.exe
5924	cmd.exe
3736	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e9074c2dd4ab846008d2f7e3f3d78475_elex_glassworm_icedid_njrat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5960	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
792	2026-08-10_e9074c2dd4ab846008d2f7e3f3d78475_elex_glassworm_icedid_njrat_stop_vidar.exe
792	2026-08-10_e9074c2dd4ab846008d2f7e3f3d78475_elex_glassworm_icedid_njrat_stop_vidar.exe
792	2026-08-10_e9074c2dd4ab846008d2f7e3f3d78475_elex_glassworm_icedid_njrat_stop_vidar.exe
792	2026-08-10_e9074c2dd4ab846008d2f7e3f3d78475_elex_glassworm_icedid_njrat_stop_vidar.exe
3796	svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe
3796	svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	792	2026-08-10_e9074c2dd4ab846008d2f7e3f3d78475_elex_glassworm_icedid_njrat_stop_vidar.exe
Token: SeDebugPrivilege	3796	svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 3736	792	2026-08-10_e9074c2dd4ab846008d2f7e3f3d78475_elex_glassworm_icedid_njrat_stop_vidar.exe	91
PID 3736 wrote to memory of 5960	3736	cmd.exe	93
PID 792 wrote to memory of 1636	792	2026-08-10_e9074c2dd4ab846008d2f7e3f3d78475_elex_glassworm_icedid_njrat_stop_vidar.exe	94
PID 1636 wrote to memory of 3368	1636	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e9074c2dd4ab846008d2f7e3f3d78475_elex_glassworm_icedid_njrat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e9074c2dd4ab846008d2f7e3f3d78475_elex_glassworm_icedid_njrat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCCBBCCBBCACCBAABAAABCBCBBCCACBABBBCABCAACCBACBABCBABBABBCBAABCAACCABBCCAACBCAACCBBCBABCCBBACCACAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCCBBCCBBCACCBAABAAABCBCBBCCACBABBBCABCAACCBACBABCBABBABBCBAABCAACCABBCCAACBCAACCBBCBABCCBBACCACAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBABCACCCBCCAACBABBBCAACCBCCAAACBCABBCACBCCCBBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe" start= auto displayName= "UserDataSvc_CBBBABCACCCBCCAACBABBBCAACCBCCAAACBCABBCACBCCCBBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBABCACCCBCCAACBABBBCAACCBCCAAACBCABBCACBCCCBBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe" start= auto displayName= "UserDataSvc_CBBBABCACCCBCCAACBABBBCAACCBCCAAACBCABBCACBCCCBBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBABCACCCBCCAACBABBBCAACCBCCAAACBCABBCACBCCCBBACA"
  2⤵
  - Executes a command shell one-liner
  PID:5924
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBABCACCCBCCAACBABBBCAACCBCCAAACBCABBCACBCCCBBACA"
    3⤵
    - Launches sc.exe
    PID:3168

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe
1⤵
PID:4224

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBCAACCACBBAACCCBAAABCCCBCCCBACCACCAACACBCBCBBBBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBCAACCACBBAACCCBAAABCCCBCCCBACCACCAACACBCBCBBBBABA.exe
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 af5642a6ea1f0b7a22297989b0cbc3f69783ecf0f2a4c8cd897fb5a150ba5ba7
MD5 889b6907aa8b2d500db65b2f02dd54cb
SHA1 c63a5ef6695c53a10ef4ad8b4e910dbbcaf4b3c7
SHA512 3c918002bf2603b2ddce46063266007876d4808c34b0a07b1578f38dce09b7b0b1b22db49916a38a7b5d3a37fd1f0112a84dc3a2d085e0b8323e5ca1007d4d57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d68701f9b0c9dbe445d4b1afc9ca59d87a968213cc4d0f9a4e8caaceea2bbe64
MD5 b91b4b39cf1df4b1c2fe249e2b349ee8
SHA1 1bd8794f433d27da158f0836f8eda7582fb2c9fd
SHA512 16c709a3bca0974f89daa2f083aca6d1854ad5c2cc48c86914f9ae5fbfd574614c5a8b0ec0cade3492e70318e05eb427c77ffebbcfcad563493dd505d086140b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d5e0df37b5bba08cd53093fbf14310d5016b1b922c3b791f461f682331268c0b
MD5 fba0db5b9cb8d9a75f315365733686e9
SHA1 e6273e9cdc41e0ead30937016edb0f5b9791bbd9
SHA512 f742175c6f11c410d26f8164ab2d724983ba7ea65610e7fca2dcb2888a769342c9ed0038ff13b904e6a949eb76aedbce33dda2607f190c4ef8746987d59a0a5a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cb2dbb3ac50d1529e1edcd76084017762d9c65dbe8b15fcd828e3748da542162
MD5 c4badc1c76f129f99777513cc9c1f7e4
SHA1 b5950582d1b7092fff1999a76499991420c7aaeb
SHA512 1aa667c4dc3f7e6f691f2d406cfc1c4323959b35ae7442b4c6c793ba408efe749780661e24a0f586bcd7863c365670fe8dd53556e63cc204591daf27ca0f5de3
MD5 SHA1 SHA512

Submit Download

svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe
Size 11.5MB
SHA256 046a9a3d8c846aa47252e1d34d2d5a077b1a3056f1f1c2bc6d34681ebca73848
MD5 e9074c2dd4ab846008d2f7e3f3d78475
SHA1 262ad4aae4a472ed433e5c7769710aaf71e7acbb
SHA512 5b8767e697ac2c7416e41a1e4e94d72921c087446f7dca0b74e59c084f1770a24074d609a9eebd3d92976298f3abc3158c9051f548b6d0b64baa3d282dc7c18c
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Xp7Dp7Dp7Dp7Dp741MbQ9yDAD7KjjqkusjmqMhj:vBBBB1BBBB41tIDewjqkjiqMd
TLSH
T119C67C25BBA081F5F9A79839897BC731E97179210E32438F86D4C61E6F336919D38732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABCBBCBACABCCBCABCCBCBABACCBBBAACBCCCABCCCCCCBABCBC.exe
Size 5.2MB
SHA256 6d795bf18345924d7c0269e4ba79f2db096db5f4729e334e045605e2a8768105
MD5 c8c84c9990bde4b71bdfea3414d11a34
SHA1 89138359cdde2f5e2bddf00700ffa7aa7d910a8d
SHA512 8606f85d355938caad6e64578bb59d4a3418fe10510431b45937bc7ebaf2fcae6acaf315e64e2d68928d1398d24b3eec487a82bd2f4488e0f2eab8fb2d1fcc53
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Xp7Dp7Dp7Dp7Dp741MJ:vBBBB1BBBB41Q
TLSH
T1E6468D10B7918035F5B328728ABFD739957CB9214F6886CFE388472E5E71AE0A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BCCCCBCAACCACBBAACCCBAAABCCCBCCCBACCACCAACACBCBCBBBBABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCBCAACCACBBAACCCBAAABCCCBCCCBACCACCAACACBCBCBBBBABA.exe
Size 3.3MB
SHA256 b09afff2aadd505e45bf93ef44a93d7968ac3e2ee8fa34cde6165b14bc31a1d2
MD5 96058dcbc8ca98b81e8bbf282463c4f6
SHA1 04b5953d70ff3b0d41e5a16591511faa4f982afd
SHA512 b3f83ec39cc8b3b844a6475232e9fa92fa09bd06955be9579e3631542d287854161b12f5f0fd9a82f39d98168b99ac87c18f79d43451c99b9315e3c871901b2f
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCA+E6Dd79WCY+EU:Jp7Dp7Dp7Dp7Dp7Xp7Dp7P
TLSH
T119F57B10B7818035F5B329728ABFD339552CB9714F6986CFE388072E5E71AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/792-0-0x0000000000860000-0x0000000000881000-memory.dmp

Download

memory/792-7-0x0000000000860000-0x0000000000881000-memory.dmp

Download

memory/3796-24-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/3796-37-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download