a89e422bc3e2886107697a926f845c177c3d92aad88d3d6291ab1bd137232ade

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_395dbe185c2aa79608a30a3bcb72190e_elex_glassworm_icedid_njrat_stop_vidar.exe
Size 14.4MB
Sample260810-dakb2azdnc
SHA256 a89e422bc3e2886107697a926f845c177c3d92aad88d3d6291ab1bd137232ade
MD5 395dbe185c2aa79608a30a3bcb72190e
SHA1 f125447f0b3315b5f9c3816a0502ad542372f3a3
SHA512 3aeb6fbd41affb437564a4d7e0739f27d29e4269119b9c5d259539cdc73652756018b2a3a21ecef66233e93e3e0600b2b94e6b2a30c9810b5ef13b79915c741f
SSDEEP 196608:vBBBBAO4q7+zUhasYBBBBAO4q7+zUhasD1tIDewjqkjiqMz:YO4q78UhaspO4q78UhasD8Kwekyz
TLSH
T113E68D28AEE081F5F4B7993989BBD675E93179111E224B8F86D1C30E5E336D25C34B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5012	svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe
4108	svchost_AACACCAAABCBBCABAACBBBCCBCBACABCABBBBBABCCCABABBBCABCCA.exe
2728	svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CACBCCACABCABCCBACABACACCBAACBBABCBACBBABBCBAAACCABABACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe"	2026-08-10_395dbe185c2aa79608a30a3bcb72190e_elex_glassworm_icedid_njrat_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCBABBABCBCCACABACCACACBBBBBAABBACCACACBCCACABCBABCACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACACCAAABCBBCABAACBBBCCBCBACABCABBBBBABCCCABABBBCABCCA.exe"	svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1088	sc.exe
2892	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
984	cmd.exe
4860	cmd.exe
3528	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_395dbe185c2aa79608a30a3bcb72190e_elex_glassworm_icedid_njrat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACACCAAABCBBCABAACBBBCCBCBACABCABBBBBABCCCABABBBCABCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1156	2026-08-10_395dbe185c2aa79608a30a3bcb72190e_elex_glassworm_icedid_njrat_stop_vidar.exe
1156	2026-08-10_395dbe185c2aa79608a30a3bcb72190e_elex_glassworm_icedid_njrat_stop_vidar.exe
1156	2026-08-10_395dbe185c2aa79608a30a3bcb72190e_elex_glassworm_icedid_njrat_stop_vidar.exe
1156	2026-08-10_395dbe185c2aa79608a30a3bcb72190e_elex_glassworm_icedid_njrat_stop_vidar.exe
5012	svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe
5012	svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe
5012	svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe
5012	svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe
4108	svchost_AACACCAAABCBBCABAACBBBCCBCBACABCABBBBBABCCCABABBBCABCCA.exe
4108	svchost_AACACCAAABCBBCABAACBBBCCBCBACABCABBBBBABCCCABABBBCABCCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1156	2026-08-10_395dbe185c2aa79608a30a3bcb72190e_elex_glassworm_icedid_njrat_stop_vidar.exe
Token: SeDebugPrivilege	5012	svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe
Token: SeDebugPrivilege	4108	svchost_AACACCAAABCBBCABAACBBBCCBCBACABCABBBBBABCCCABABBBCABCCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2184	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 984	1156	2026-08-10_395dbe185c2aa79608a30a3bcb72190e_elex_glassworm_icedid_njrat_stop_vidar.exe	109
PID 984 wrote to memory of 2980	984	cmd.exe	111
PID 5012 wrote to memory of 4588	5012	svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe	112
PID 4588 wrote to memory of 2476	4588	notepad.exe	113
PID 1156 wrote to memory of 4860	1156	2026-08-10_395dbe185c2aa79608a30a3bcb72190e_elex_glassworm_icedid_njrat_stop_vidar.exe	117
PID 4860 wrote to memory of 1088	4860	cmd.exe	119
PID 1156 wrote to memory of 3528	1156	2026-08-10_395dbe185c2aa79608a30a3bcb72190e_elex_glassworm_icedid_njrat_stop_vidar.exe	120
PID 3528 wrote to memory of 2892	3528	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-08-10_395dbe185c2aa79608a30a3bcb72190e_elex_glassworm_icedid_njrat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_395dbe185c2aa79608a30a3bcb72190e_elex_glassworm_icedid_njrat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABCAAABBBABCBBACBABCCCCCAABCAABCCBBABCAABCACBCBCBBBABBABCCAABCBBACCACABBBBACBCBBBBCAABBBACCBAACCAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABCAAABBBABCBBACBABCCCCCAABCAABCCBBABCAABCACBCBCBBBABBABCCAABCBBACCACABBBBACBCBBBBCAABBBACCBAACCAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCACCBBCBCACAACACBAABCBBCBABBAABBBAACCCACAACCBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe" start= auto displayName= "UserDataSvc_BBBCACCBBCBCACAACACBAABCBBCBABBAABBBAACCCACAACCBBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCACCBBCBCACAACACBAABCBBCBABBAABBBAACCCACAACCBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe" start= auto displayName= "UserDataSvc_BBBCACCBBCBCACAACACBAABCBBCBABBAABBBAACCCACAACCBBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCACCBBCBCACAACACBAABCBBCBABBAABBBAACCCACAACCBBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCACCBBCBCACAACACBAABCBBCBABBAABBBAACCCACAACCBBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2476

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2184

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCAAABCBBCABAACBBBCCBCBACABCABBBBBABCCCABABBBCABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCAAABCBBCABAACBBBCCBCBACABCABBBBBABCCCABABBBCABCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe
1⤵
- Executes dropped EXE
PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 66436cef6ae3b23ebbac155815de40433c1271ee638ddd0e284995e7d8f9ee0f
MD5 a848bc3f7b37e7107d047cda64f8b44d
SHA1 4b448b55a70fc441c4cfb2312590e5767a236513
SHA512 294977875bd417086af865ade6d7ccaa055317c27f5744a6d17c5593898c750d9ff35c1d98bdcf1dd9f8283eef815363068a33a1ac7e9541e286007834f76f95
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 44513437e7050af7ea6f1a3e4461f6eebd5bda5c2d0cb7e8a268dd6509538f70
MD5 a1cbb913299d34c8bd8426b6e09f47a4
SHA1 ec544c8b19a95d326e3d423dbe5a84ae04c0798f
SHA512 5b3cb811734a30d36f6adf845a611c43dec403b42d085c157e7214e7c719f9fa7d2371cc913b522002ae9a595670fad3dcbb75b47a9cb283bf3b2392f4785c6a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bd1ea0ee05c6a733549603347d34e4d62ca49d75866117f7f8d5a476e7cc76d8
MD5 db4f073c455a68ac1475fefbb5d61efc
SHA1 86ac14dda9a2946b48282a995b09c23b55bff78c
SHA512 d7395d2799a05ce3d80499929f90b96528e425fc7d8b1bce7f59aae3f0e67c1857b021ef26110e8537eef709961dc82935ab9f6aabaf57e834f8aff708b8d5f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 75d5b8e5f3dee62986ed1adf781dbabf5af02457785b090f89d5b0fe560dedf9
MD5 bb68e5a60579b4b71c4e49ee8d79fd71
SHA1 f0a8668b4bd727cbf08576b2b95b9704e7d4b27b
SHA512 79d2a09d3839bc03819f4aacaf1c81007a80af5584fe51fdafc6e7ddc7e3c800d908ac7b0836d494bb535635e4afe0fd3bec4cb863f98eafff2395d59028aa3e
MD5 SHA1 SHA512

Submit Download

svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAACCBABAACBBACCBBBBCBABBACAACCBAAABABCABACBCCACBABCC.exe
Size 14.4MB
SHA256 a89e422bc3e2886107697a926f845c177c3d92aad88d3d6291ab1bd137232ade
MD5 395dbe185c2aa79608a30a3bcb72190e
SHA1 f125447f0b3315b5f9c3816a0502ad542372f3a3
SHA512 3aeb6fbd41affb437564a4d7e0739f27d29e4269119b9c5d259539cdc73652756018b2a3a21ecef66233e93e3e0600b2b94e6b2a30c9810b5ef13b79915c741f
SSDEEP 196608:vBBBBAO4q7+zUhasYBBBBAO4q7+zUhasD1tIDewjqkjiqMz:YO4q78UhaspO4q78UhasD8Kwekyz
TLSH
T113E68D28AEE081F5F4B7993989BBD675E93179111E224B8F86D1C30E5E336D25C34B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 fa45c2247f9ce937f0a8dbbc85056d2da6c09b93251cffc2a96e66023bd01aed
MD5 2cf4a68a968b728f6729797992991020
SHA1 be36f2a3edf9d1a1540675f29d02831cc7f8f2a3
SHA512 bc44be13fdca050ab6db8e7cf23eb111ff0b1e5c6e41e0e7383b3d08eb49d51327edfdc61813a998faf5520ba1c3a12ef163ee120b1fef91cff246bbf663fa4f
TLSH
T153112B1054BA9843FA32A9CB5319DFE30CE9764BBC585E04234D910CAFD5C35CE554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1156-0-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/1156-8-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/4108-88-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/4588-61-0x00000000052F0000-0x00000000052F1000-memory.dmp

Download

memory/5012-37-0x0000000000080000-0x00000000000A1000-memory.dmp

Download