96acb1f95bb4ceb9c119157d81c5666afcf7599b08528f093a0398403e5b79ad

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_070f24904c79aff4625896fd1e61b20d_elex_glassworm_icedid_njrat_vidar.exe
Size 10.6MB
Sample260811-ejg4psvhlc
SHA256 96acb1f95bb4ceb9c119157d81c5666afcf7599b08528f093a0398403e5b79ad
MD5 070f24904c79aff4625896fd1e61b20d
SHA1 54a09fd5e5d06a98776f84220a3665490b9c5d2b
SHA512 bd353bd159071cbb45a5a52affa56256680c29f308c69b7f9d5a7703190926c6f4970451f479424c8896afa2fdfb7df40f6cda5c83f071f5ea65d187ac230b7b
SSDEEP 49152:U+ES+ES+ES+EK+ES+ES+ES+ES+ES+EK+ES+ES+ES+ES+ES+Ew+ES+ES+ES+EK+Ez:X1MbQ9yDAD7KjjqkusjmqMhW
TLSH
T1CEB69D2DFEA180F1F96B94788CABC37AEA717A1045334B5BDA95C60F6E336515C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4160	svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe
4420	svchost_ACACCCCAACCBACBAAABBBCCBABABCACCACACABBBABCAABBBBABBCAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCABCBACBABBCCCABBBBACACCACCAAABBBABBABCAACACACCABCCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe"	2026-08-11_070f24904c79aff4625896fd1e61b20d_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABCCBCBACBBCABAACCBABCCABCACABCCABCABBBBAACBBCBBABABCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACCCCAACCBACBAAABBBCCBABABCACCACACABBBABCAABBBBABBCAA.exe"	svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1584	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_070f24904c79aff4625896fd1e61b20d_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACCCCAACCBACBAAABBBCCBABABCACCACACABBBABCAABBBBABBCAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1500	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2572	2026-08-11_070f24904c79aff4625896fd1e61b20d_elex_glassworm_icedid_njrat_vidar.exe
2572	2026-08-11_070f24904c79aff4625896fd1e61b20d_elex_glassworm_icedid_njrat_vidar.exe
2572	2026-08-11_070f24904c79aff4625896fd1e61b20d_elex_glassworm_icedid_njrat_vidar.exe
2572	2026-08-11_070f24904c79aff4625896fd1e61b20d_elex_glassworm_icedid_njrat_vidar.exe
4160	svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe
4160	svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe
4160	svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe
4160	svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	2026-08-11_070f24904c79aff4625896fd1e61b20d_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4160	svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1584	2572	2026-08-11_070f24904c79aff4625896fd1e61b20d_elex_glassworm_icedid_njrat_vidar.exe	92
PID 1584 wrote to memory of 1500	1584	cmd.exe	94
PID 4160 wrote to memory of 1068	4160	svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-11_070f24904c79aff4625896fd1e61b20d_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_070f24904c79aff4625896fd1e61b20d_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBCBABCCBAAACBCBCAAAABCCCABBBAABBCBCCABBCBCBCAACBCBABABABBAAAACCBCAABCABBACCABACCBCCBABABCAABACCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBCBABCCBAAACBCBCAAAABCCCABBBAABBCBCCABBCBCBCAACBCBABABABBAAAACCBCAABCABBACCABACCBCCBABABCAABACCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1068

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCCAACCBACBAAABBBCCBABABCACCACACABBBABCAABBBBABBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCCCAACCBACBAAABBBCCBABABCACCACACABBBABCAABBBBABBCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4bfc59399c6be920f39a0f4e637104149325eab7c0e0482833013b5a6e9f2094
MD5 9ff406386a05b5dc6a1df70c4d38cfee
SHA1 c9b99d96eede393bc89bf26f8ec9f46e84ef545a
SHA512 d37b95e2e10d142bd8efa9b01454371be0dd9253a6ebe32bbf082dc86842c13400bd2f4c0bf142ce1c32ca2626f6b29a382d0114d407062317a5438ab15db0e4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f427f199f2217964eb93f90da732b1495ad70a04e2e6a964c2b5f055db86e54d
MD5 14d36754d363a45f0842e58ce34b1592
SHA1 27a82f2dd6f895d1cdea2d3d3988a7a6c599afeb
SHA512 358368bc1f5246424e2434916541db3178e6d9b57a65697b395247ee595399769468958dc7c1e7df1cb0ffa6b449dd0be0f5b9fb8e742be14e36ee76c3ab4fbd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 53ec0c6f7d427c99b21049659efd35598bb5f235e37b2e556ec80f438f783b6d
MD5 b8f52ffdd3abc90a72d8f67da79e7e5a
SHA1 d8a41fcfe460c0f6461368624308e9856c408ef5
SHA512 e9e495fed8973a4ac661fbe71fd363ee15f4e6fb382b70fab81f9efcd153774d67883257506c8bf2b6b301ed4aa7219803c88f2e6eaf574017d7d5dd1dbecaa5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 75da4c6198258f3a5a83a0140f9285257e786da24ab0a2b298689d2d7765760d
MD5 f0a74d4eda214dc16770208eb801921a
SHA1 b5d1f0b73d42fc2a17f69001925159f91b0906d4
SHA512 2c794f4b0209fc754a0c8f1c0492f43451b9c45f1ce60e51171232c7d02bd10372edd3dcf8dc24afa8fd23495ae2bdcee97b8d2df1c8d03c962b99ec1577fe29
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 54a6a46e442228a5a09400b84e1849056705901506658e651c251a430921222b
MD5 76c260e5464789105a3a206d392f66df
SHA1 e25c1301c92cdda870c1b5f1b6acce00d7f5d7ed
SHA512 9c7a64d009e3802930cca35ce7dfbc3cff2304e39a3ce854ef694675cdf898b1cad4d281db9b1fd53d252e816a2abd1b8af4b2fe44df32f8c9395ba9f2b60614
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f2023e1dcb9982e97f7fe265e2631e45c21a34fe0f9c96c77e353fe1e9cbf759
MD5 2c33664152fb6ee10a621f6a3a6043d8
SHA1 828f77172545439f2c08fc4b0d9389f1c7820ed5
SHA512 e1894ce9a042d6fc9ad9bda5f91dff3774cd59a7d3d6a575dae5fe37a3aedcc49dc542127b13ade05f01319b8c0427b61532c4060f1042c3a190f139204c8917
MD5 SHA1 SHA512

Submit Download

svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCCABBACACABCCCBBACABCBCBAACAACCBAABCCBBCBBACACCBA.exe
Size 10.6MB
SHA256 96acb1f95bb4ceb9c119157d81c5666afcf7599b08528f093a0398403e5b79ad
MD5 070f24904c79aff4625896fd1e61b20d
SHA1 54a09fd5e5d06a98776f84220a3665490b9c5d2b
SHA512 bd353bd159071cbb45a5a52affa56256680c29f308c69b7f9d5a7703190926c6f4970451f479424c8896afa2fdfb7df40f6cda5c83f071f5ea65d187ac230b7b
SSDEEP 49152:U+ES+ES+ES+EK+ES+ES+ES+ES+ES+EK+ES+ES+ES+ES+ES+Ew+ES+ES+ES+EK+Ez:X1MbQ9yDAD7KjjqkusjmqMhW
TLSH
T1CEB69D2DFEA180F1F96B94788CABC37AEA717A1045334B5BDA95C60F6E336515C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2572-0-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/2572-8-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/4160-35-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/4420-70-0x00000000001F0000-0x0000000000211000-memory.dmp

Download