3f1262df02ec8655d108468c6292f4d6696e3ee21b30961ba469e47bf679a736

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_d75f7c2cb0405b0d4aef786e703ec962_elex_glassworm_icedid_vidar.exe
Size 10.1MB
Sample260813-ynph5awzbw
SHA256 3f1262df02ec8655d108468c6292f4d6696e3ee21b30961ba469e47bf679a736
MD5 d75f7c2cb0405b0d4aef786e703ec962
SHA1 bbe3327a67d9a1bbfd539672260ab82a80218d3c
SHA512 3a8056006799461b36385b695a4f9c8620b2001f01a5aa8b90abbf3b44d997fab5f303af21643bc318f957864c83bd6c65de86df5e079b39690906b3e5cc7bbb
SSDEEP 49152:U+ES+ETqatglu+ES+ES+Ek+ES+ES+E2+ES+ES+Eks+E2+ES+ES+EkN+ES+ES+Ekc:JO2Wt6O2Wt6O2Wtu
TLSH
T116B62B09F98640B1D4274170499BD27F8670B925C7138EEBE649CEEEFBE3AD05938631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3724	svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe
4400	svchost_BCCBABAAABAABACAACBBBBCCBACACCAAAABABBCCABBAABCCBAABACB.exe
4252	svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABCCCCCAABCAABCAAABCACCCACAAAACCCCCABACBBCBBAACABCAAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe"	2026-08-13_d75f7c2cb0405b0d4aef786e703ec962_elex_glassworm_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABCBCACACBAACCBCCACCAACABACAABACCCAACCACABABCBBACCAACCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBABAAABAABACAACBBBBCCBACACCAAAABABBCCABBAABCCBAABACB.exe"	svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1348	sc.exe
3356	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4840	cmd.exe
3712	cmd.exe
1504	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBABAAABAABACAACBBBBCCBACACCAAAABABBCCABBAABCCBAABACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_d75f7c2cb0405b0d4aef786e703ec962_elex_glassworm_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
396	2026-08-13_d75f7c2cb0405b0d4aef786e703ec962_elex_glassworm_icedid_vidar.exe
396	2026-08-13_d75f7c2cb0405b0d4aef786e703ec962_elex_glassworm_icedid_vidar.exe
396	2026-08-13_d75f7c2cb0405b0d4aef786e703ec962_elex_glassworm_icedid_vidar.exe
396	2026-08-13_d75f7c2cb0405b0d4aef786e703ec962_elex_glassworm_icedid_vidar.exe
3724	svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe
3724	svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe
3724	svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe
3724	svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe
4400	svchost_BCCBABAAABAABACAACBBBBCCBACACCAAAABABBCCABBAABCCBAABACB.exe
4400	svchost_BCCBABAAABAABACAACBBBBCCBACACCAAAABABBCCABBAABCCBAABACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	396	2026-08-13_d75f7c2cb0405b0d4aef786e703ec962_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	3724	svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe
Token: SeDebugPrivilege	4400	svchost_BCCBABAAABAABACAACBBBBCCBACACCAAAABABBCCABBAABCCBAABACB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
432	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 4840	396	2026-08-13_d75f7c2cb0405b0d4aef786e703ec962_elex_glassworm_icedid_vidar.exe	95
PID 4840 wrote to memory of 4032	4840	cmd.exe	97
PID 3724 wrote to memory of 3996	3724	svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe	98
PID 3996 wrote to memory of 4544	3996	notepad.exe	99
PID 396 wrote to memory of 3712	396	2026-08-13_d75f7c2cb0405b0d4aef786e703ec962_elex_glassworm_icedid_vidar.exe	103
PID 3712 wrote to memory of 1348	3712	cmd.exe	105
PID 396 wrote to memory of 1504	396	2026-08-13_d75f7c2cb0405b0d4aef786e703ec962_elex_glassworm_icedid_vidar.exe	106
PID 1504 wrote to memory of 3356	1504	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-13_d75f7c2cb0405b0d4aef786e703ec962_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_d75f7c2cb0405b0d4aef786e703ec962_elex_glassworm_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBBBBACAAABCCBAACAAAABCAACCAABBBACBBCBBCBBBCBBABBABCCCAABACACBCCCABBACABBBBABBAABABAABBBACAACCAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBBBBACAAABCCBAACAAAABCAACCAABBBACBBCBBCBBBCBBABBABCCCAABACACBCCCABBACABBBBABBAABABAABBBACAACCAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAABAABAAAAAAACBCBAABBABCCCBBBABABAACBACCBBCBABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe" start= auto displayName= "UserDataSvc_CCAABAABAAAAAAACBCBAABBABCCCBBBABABAACBACCBBCBABBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAABAABAAAAAAACBCBAABBABCCCBBBABABAACBACCBBCBABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe" start= auto displayName= "UserDataSvc_CCAABAABAAAAAAACBCBAABBABCCCBBBABABAACBACCBBCBABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAABAABAAAAAAACBCBAABBABCCCBBBABABAACBACCBBCBABBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAABAABAAAAAAACBCBAABBABCCCBBBABABAACBACCBBCBABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4544

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAAABAABACAACBBBBCCBACACCAAAABABBCCABBAABCCBAABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAAABAABACAACBBBBCCBACACCAAAABABBCCABBAABCCBAABACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe
1⤵
- Executes dropped EXE
PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 740c4558d61be475713dc417109659213b4d900a376731d121398d6c979e4d03
MD5 ac7cfb2c6437c6efcbdd31c2f6ce9d44
SHA1 e9eb833e436454a68e7a6231238e64a3976f7874
SHA512 41b8bd5a02cd4c872717d6d6ef0489e7119d77e68f1a95f4d506c79a78e4af2108362d08930f2b2a506c1c4bfbff6d46e362be568c28029171be492ff4f9ab4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 51f28aea4643cbc31e5e19d70bde6c977d2550456492abaaffc85e9b6ce3d80a
MD5 b686817c793e066081e91a91cc940f5a
SHA1 944ee1a4f609a8fd0eab5306688dd97aea489eab
SHA512 6788ab9730cd0def089bd3469f272be4bf32332fb7f03555b023932c538f89bb8bf2de5c3887f2742e4dd67f8f39527fc99197b0e5533068079f2225168b4a71
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2b4ae1099204bca68a8953f49c70f937ddae533ed6813bf9e5ca0fc89e1c3934
MD5 f3e41c59ece197186fb5c12db6054cc0
SHA1 352a6237e0afbcad31282c768082e7b1bab6d683
SHA512 77b0121c69a9b4137d3bb3fa2c9b12f50616c6889a3b709e00f45a2439e7f81d55452b85c7fbc2f1fc656ff74dc7f28e55bab4bd6436c4840ace7afbd842fbcf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a84c57796caa7d688f38df19c47518260f1ee350b2a4085e49dfa1207fbc37d
MD5 b3a554993d25a1e305bba277513e92d6
SHA1 5a10d42c21e9174cd2d54fb090bae72be088a147
SHA512 00c0093b0c0eae7b0c9a4d2555684893bdc0f9ce2c63d6e90df9e93c44afd26d76fc556ae8184525a59f1ced0dbda275e2173edf358b4d295e82b37d9230fcbd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3d92b4eedf1b1032932dfc205be160eb16bdccbf2cd3df2846eb00616b497e46
MD5 a5f298e1303cfd8207d67b7a875b2b74
SHA1 49b79d0e85a1707ae6b589722cf5f0df6d712c94
SHA512 1ca0d2a663af40bd85ca1c111662fc380b69599bdb437fe433479808e1ef5ce3e2ec7eec582ffabef1242bc06c3078207a2a697650b2827ee2d0abf9dc934041
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f32a47fac08db5c1655a65f77b56707eb8495b8c902eba6b4f0c9122a6e57f3f
MD5 4dcc8dfc88268af44b54e48ed2d842ab
SHA1 60d36846528de1fa40647d5db47c59dab7927acd
SHA512 a33e8d5f70dd3131fb970e9874e4dbf72aab2bb2a4f5ba604973e8d677248821b297eaebfa9e992d7887368c8e27765c623be2deefd997b35103678e48a885cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b74f05554fd968616c9975efb2f97a0a97974bd49bd12c6099b0b2933292e040
MD5 45de6deacea242d771d2917f3ab3040e
SHA1 4838ac8ffff9d21c807be9b9dc7b1b2acfa9e6a7
SHA512 64fe122ee414b5129b4bc1983010b59a46436d9aeb082e82380daa6acf8bb2439f53c9c489c0b6e86c58c112cb772c86003386d40c01f122e8bedab5325c207c
MD5 SHA1 SHA512

Submit Download

svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCACCAAAACBBBBACAACBBBACAAABCACACABCBAABBCACAABCCA.exe
Size 10.1MB
SHA256 3f1262df02ec8655d108468c6292f4d6696e3ee21b30961ba469e47bf679a736
MD5 d75f7c2cb0405b0d4aef786e703ec962
SHA1 bbe3327a67d9a1bbfd539672260ab82a80218d3c
SHA512 3a8056006799461b36385b695a4f9c8620b2001f01a5aa8b90abbf3b44d997fab5f303af21643bc318f957864c83bd6c65de86df5e079b39690906b3e5cc7bbb
SSDEEP 49152:U+ES+ETqatglu+ES+ES+Ek+ES+ES+E2+ES+ES+Eks+E2+ES+ES+EkN+ES+ES+Ekc:JO2Wt6O2Wt6O2Wtu
TLSH
T116B62B09F98640B1D4274170499BD27F8670B925C7138EEBE649CEEEFBE3AD05938631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 99fb49527823c87217e5c191101e1ff51235ba5cf58255369d674309c0a00ba4
MD5 16dd9c6617bbd2f52feb4cdff0ac32ca
SHA1 73da3e26e50d422515be02225d3bbf7c69c58cba
SHA512 5ae3bdf54fcefd3958fc97687b7a7ecae2899a31cb6e60daa8320008393d98a20cbf9e4a299eda53aa4011cab0f8b4d8daf332216940389b129d08c13e99e119
TLSH
T17D110461A4A5DC83F93328D7E61A9B424CF436ABAC5C7A082308C30DABC5C72CD558F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/396-0-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/396-8-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/3724-37-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/3996-60-0x0000000005820000-0x0000000005821000-memory.dmp

Download

memory/4400-82-0x0000000000670000-0x0000000000691000-memory.dmp

Download