2cc1ab11172b3e089292e723ccd791cbf982674954b66a861e3836330d098e0a

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_139516e48942b3da578c9cc05f8f4780_elex_glassworm_icedid_njrat_vidar.exe
Size 27.4MB
Sample260810-dh81cstygt
SHA256 2cc1ab11172b3e089292e723ccd791cbf982674954b66a861e3836330d098e0a
MD5 139516e48942b3da578c9cc05f8f4780
SHA1 5fc30817ba078ca926db646f3fb69969a50b8494
SHA512 a5311d9ebe5ef988074120d37917d7181124307b5301d9e8d63a30432c3aa451ddc4ee41f3bbfe7dfd49a2a1bb225c8441b5dec39214b9dbbfd55568b0a7da11
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLcR+Y:51MbQ9yDAD7KjjqkusjmqMh6
TLSH
T16A576D19F94680F1E96B50704DDBD2BFCA707A2186224BE7EA8DC71F7E337915C28621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5868	svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe
4700	svchost_CABBCBCCCCACBBCCBBAACBBCABCAAABBBCCBCCBBACCAABBBAAAABCC.exe
828	svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBCBCACBAABCBBCABCCCABACBAACCCCAACBACBAAACBBACCCBCCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBCBCCCCACBBCCBBAACBBCABCAAABBBCCBCCBBACCAABBBAAAABCC.exe"	svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABBBCCCCABCBBABCBBCCBBCACCACBCBBBBBABBBCABCBBABABCBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe"	2026-08-10_139516e48942b3da578c9cc05f8f4780_elex_glassworm_icedid_njrat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1208	sc.exe
4776	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5664	cmd.exe
4896	cmd.exe
3176	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBCBCCCCACBBCCBBAACBBCABCAAABBBCCBCCBBACCAABBBAAAABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_139516e48942b3da578c9cc05f8f4780_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2804	2026-08-10_139516e48942b3da578c9cc05f8f4780_elex_glassworm_icedid_njrat_vidar.exe
2804	2026-08-10_139516e48942b3da578c9cc05f8f4780_elex_glassworm_icedid_njrat_vidar.exe
2804	2026-08-10_139516e48942b3da578c9cc05f8f4780_elex_glassworm_icedid_njrat_vidar.exe
2804	2026-08-10_139516e48942b3da578c9cc05f8f4780_elex_glassworm_icedid_njrat_vidar.exe
5868	svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe
5868	svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe
5868	svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe
5868	svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe
4700	svchost_CABBCBCCCCACBBCCBBAACBBCABCAAABBBCCBCCBBACCAABBBAAAABCC.exe
4700	svchost_CABBCBCCCCACBBCCBBAACBBCABCAAABBBCCBCCBBACCAABBBAAAABCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	2026-08-10_139516e48942b3da578c9cc05f8f4780_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5868	svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe
Token: SeDebugPrivilege	4700	svchost_CABBCBCCCCACBBCCBBAACBBCABCAAABBBCCBCCBBACCAABBBAAAABCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 4896	2804	2026-08-10_139516e48942b3da578c9cc05f8f4780_elex_glassworm_icedid_njrat_vidar.exe	93
PID 4896 wrote to memory of 5616	4896	cmd.exe	95
PID 5868 wrote to memory of 6088	5868	svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe	96
PID 2804 wrote to memory of 3176	2804	2026-08-10_139516e48942b3da578c9cc05f8f4780_elex_glassworm_icedid_njrat_vidar.exe	99
PID 3176 wrote to memory of 1208	3176	cmd.exe	101
PID 2804 wrote to memory of 5664	2804	2026-08-10_139516e48942b3da578c9cc05f8f4780_elex_glassworm_icedid_njrat_vidar.exe	102
PID 5664 wrote to memory of 4776	5664	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-10_139516e48942b3da578c9cc05f8f4780_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_139516e48942b3da578c9cc05f8f4780_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABAACCACACBAAACABBAABCCBCBACACAABCCBCCBABBCCCACBBCABBABCBCBCCCBAACBACCCACAACBBCAAABAACBABCABCCACABBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABAACCACACBAAACABBAABCCBCBACACAABCCBCCBABBCCCACBBCABBABCBCBCCCBAACBACCCACAACBBCAAABAACBABCABCCACABBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACBACBBBACBACCBACCAABAACBCCCACBCABBBBBBAAAACBABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe" start= auto displayName= "UserDataSvc_BAACBACBBBACBACCBACCAABAACBCCCACBCABBBBBBAAAACBABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACBACBBBACBACCBACCAABAACBCCCACBCABBBBBBAAAACBABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe" start= auto displayName= "UserDataSvc_BAACBACBBBACBACCBACCAABAACBCCCACBCABBBBBBAAAACBABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACBACBBBACBACCBACCAABAACBCCCACBCABBBBBBAAAACBABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACBACBBBACBACCBACCAABAACBCCCACBCABBBBBBAAAACBABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCBCCCCACBBCCBBAACBBCABCAAABBBCCBCCBBACCAABBBAAAABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCBCCCCACBBCCBBAACBBCABCAAABBBCCBCCBBACCAABBBAAAABCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe
1⤵
- Executes dropped EXE
PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5f0cecfca7f3884e57c725a7d19bbecb1abdf8c862dc7369ad83e60218ecaad8
MD5 a258023298325c413da283452d28cce8
SHA1 7df01acee31a6c99de793b1c28d09db6da63995b
SHA512 bcce48165a856c004d8b05d94a54f54375b473f9edf6fc2a20e71d08f5fe6d4960910bc2a5fc2499b328a30daa37376716de278653d90c17bb4f51b277218e07
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7479d587b3eed0f4074b7c0d517c250f0780ac14643d67bf42f43e4b8164ba3a
MD5 2f23bd3296fe08f7071d58a4c1081567
SHA1 1a456c1cfa2a684bc4d4bed9a50ef00261f73259
SHA512 cd5c6eff3fb1f628f5d0e1bf691efe1f4204f01d597818c799817aaeaa349f8aeb5f0953647fef799fa5378e9d5bf909e055425c9b0a67405bb961fe474de21a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0adf3ad2bb6a0d4929b94578a010c32e178167658811affff33bb2a3ec5c348f
MD5 f229639108eba9e8113873196c37f536
SHA1 75142129cfae3a97d2b5b9a44a695bbf6e483ded
SHA512 d40cf91d1d7aedaa8eb5578c5fff6b7856e10f359b7f8410ce299adeb227fa393c5cf24474892318379e7c870a07e6bb840367d85cb21b326609bc30ce46966d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2a4d578afecd1cc060d533bb3b446f25cbc9e6fe74026da848abca5df2ef024e
MD5 60a4c0f6ac196a2b268670af248dd621
SHA1 8d57f01e420ab35bbe8537fbdc66fe8f35409e97
SHA512 5325fc5bb35e41287db91fed0ad2da0ffb482c1aec9d6c0906ea68dc310e223b5ed7feb88ee26cca72c61114ffb3375a50531514f23c8317966d6b35ac8e767f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4d51d043e1999446002d27b106d952dbb30356778b6285b5cec07b2c457cc651
MD5 14ecf4fc55971b62f8ceab516d5843b5
SHA1 3f726d4184b4090758a2767de8fc435acf3d7744
SHA512 1af75e0e14b37b8aad292c76831312308530951cfea709c5bbd3a1ea475b690335e8f7e60042d40ed6434dc8fceca80ceb4e3b434e6062accbae3a254688205b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1a086cec27784bd1c6a9a1de3312a41d6189b4d3dac539d2a9c516d1e698eb7e
MD5 2fc60d3941d9d93710e96063b15e0ded
SHA1 302c0b17402626ad6cf55f7ba25237aa7abbddac
SHA512 3dbf7ed4ec6b00aba4c08d21f12b4f8029935e0c12dc2b6e5ba57aaa3af8fe662b102634722672ebf06175244a310ae2747a1f573287d7617abedd8ccb8951c4
MD5 SHA1 SHA512

Submit Download

svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABCCBBACCAACAAACBBBCBACBCAABCABCABBAAACAAABCBCCABAAA.exe
Size 27.4MB
SHA256 2cc1ab11172b3e089292e723ccd791cbf982674954b66a861e3836330d098e0a
MD5 139516e48942b3da578c9cc05f8f4780
SHA1 5fc30817ba078ca926db646f3fb69969a50b8494
SHA512 a5311d9ebe5ef988074120d37917d7181124307b5301d9e8d63a30432c3aa451ddc4ee41f3bbfe7dfd49a2a1bb225c8441b5dec39214b9dbbfd55568b0a7da11
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLcR+Y:51MbQ9yDAD7KjjqkusjmqMh6
TLSH
T16A576D19F94680F1E96B50704DDBD2BFCA707A2186224BE7EA8DC71F7E337915C28621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1adeea1a5d27455ad377bc9ebb66c0dd56131f4abaf66878c37ba2ef1b953b05
MD5 c65638b3da8ae903f3af5551d41609fa
SHA1 7f5c5a814bed26c6a5bac488dfc19dae2d5ad868
SHA512 6308105f5592c88c74e8f28e104b231108e24d0b70e0a213374cc80e5ea201e8b00ab215c8d98556ac7f1cc7ba2ef1c6442ce13500e5e61374f1bd047858c4dc
TLSH
T1F411B691D4A9DC53E833688B572ADB931CA8779FA814AE241288451DEBC9C33CD554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/828-80-0x0000000000A10000-0x0000000000A31000-memory.dmp

Download

memory/2804-7-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/2804-0-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/4700-70-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/5868-34-0x0000000000A10000-0x0000000000A31000-memory.dmp

Download

memory/5868-24-0x0000000000A10000-0x0000000000A31000-memory.dmp

Download