d5103f5d21883f5324a73707a873c69ebc068a8eb6470fba2bf84aa4fb04a761

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_80ef808d4309b496f7c214756eb34c79_elex_glassworm_icedid_njrat_remcos_vidar.exe
Size 28.8MB
Sample260819-b2a7bsthpd
SHA256 d5103f5d21883f5324a73707a873c69ebc068a8eb6470fba2bf84aa4fb04a761
MD5 80ef808d4309b496f7c214756eb34c79
SHA1 6e4cb43d7bbab56c3c5cea449deaf92f2365197c
SHA512 e999c2145fad7283ae031f59197fbe7c8b793c6b66d4cb19a976261276a9de12d12880564294d65a1b59760020a3f53881020f2f4cb8a8940ffa6b8d6d748129
SSDEEP 49152:U+Ee+Eo+Ee+Ee+Ee+Ee+Eow8obnyMWmddjZ7xlo5s+Ee+Eo+Ee+Ee+Ee+Ee+Eowk:irU5arU561MbQ9yDAD7KjjqkusjmqMhS
TLSH
T1EC671929A6A4C0E1E96A973898678171E9717D100A3253BFDDB0F61EEE3B5B14D3C730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4716	svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe
2092	svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe
1800	svchost_BCABACCBBCBBBBACABCBCAAACCCBBBCCBACCACBABCABABBABCACBBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABABAAAAACACAABAAACBBACCAABBCAAACCCABAACCBCAAAABBBABAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe"	2026-08-19_80ef808d4309b496f7c214756eb34c79_elex_glassworm_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCCBBABBBCBCCBBABCCBCBACCBBCCBACABCCABBCCBAAAABCCACABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABACCBBCBBBBACABCBCAAACCCBBBCCBACCACBABCABABBABCACBBA.exe"	svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1836	sc.exe
612	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4948	cmd.exe
3168	cmd.exe
4532	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABACCBBCBBBBACABCBCAAACCCBBBCCBACCACBABCABABBABCACBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_80ef808d4309b496f7c214756eb34c79_elex_glassworm_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3248	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
616	2026-08-19_80ef808d4309b496f7c214756eb34c79_elex_glassworm_icedid_njrat_remcos_vidar.exe
616	2026-08-19_80ef808d4309b496f7c214756eb34c79_elex_glassworm_icedid_njrat_remcos_vidar.exe
616	2026-08-19_80ef808d4309b496f7c214756eb34c79_elex_glassworm_icedid_njrat_remcos_vidar.exe
616	2026-08-19_80ef808d4309b496f7c214756eb34c79_elex_glassworm_icedid_njrat_remcos_vidar.exe
4716	svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe
4716	svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe
4716	svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe
4716	svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe
1800	svchost_BCABACCBBCBBBBACABCBCAAACCCBBBCCBACCACBABCABABBABCACBBA.exe
1800	svchost_BCABACCBBCBBBBACABCBCAAACCCBBBCCBACCACBABCABABBABCACBBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	616	2026-08-19_80ef808d4309b496f7c214756eb34c79_elex_glassworm_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	4716	svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe
Token: SeDebugPrivilege	1800	svchost_BCABACCBBCBBBBACABCBCAAACCCBBBCCBACCACBABCABABBABCACBBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 4948	616	2026-08-19_80ef808d4309b496f7c214756eb34c79_elex_glassworm_icedid_njrat_remcos_vidar.exe	92
PID 4948 wrote to memory of 3248	4948	cmd.exe	94
PID 616 wrote to memory of 3168	616	2026-08-19_80ef808d4309b496f7c214756eb34c79_elex_glassworm_icedid_njrat_remcos_vidar.exe	95
PID 3168 wrote to memory of 1836	3168	cmd.exe	97
PID 4716 wrote to memory of 1804	4716	svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe	98
PID 616 wrote to memory of 4532	616	2026-08-19_80ef808d4309b496f7c214756eb34c79_elex_glassworm_icedid_njrat_remcos_vidar.exe	99
PID 4532 wrote to memory of 612	4532	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-19_80ef808d4309b496f7c214756eb34c79_elex_glassworm_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_80ef808d4309b496f7c214756eb34c79_elex_glassworm_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACABBBBCBAACBCCBACBACBCACCBBAAABAABBABCACAAABCCCCAACABBAABABCCCBCBBACCACCBAACACCCBAABBAAAAACABBBBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACABBBBCBAACBCCBACBACBCACCBBAAABAABBABCACAAABCCCCAACABBAABABCCCBCBBACCACCBAACACCCBAABBAAAAACABBBBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBBCCABCCABCAACCCCCBCAACBAACCBBBACBBCACBBACBBCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe" start= auto displayName= "UserDataSvc_BBBBBCCABCCABCAACCCCCBCAACBAACCBBBACBBCACBBACBBCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBBBCCABCCABCAACCCCCBCAACBAACCBBBACBBCACBBACBBCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe" start= auto displayName= "UserDataSvc_BBBBBCCABCCABCAACCCCCBCAACBAACCBBBACBBCACBBACBBCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBBCCABCCABCAACCCCCBCAACBAACCBBBACBBCACBBACBBCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBBBCCABCCABCAACCCCCBCAACBAACCBBBACBBCACBBACBBCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe
1⤵
- Executes dropped EXE
PID:2092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACCBBCBBBBACABCBCAAACCCBBBCCBACCACBABCABABBABCACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACCBBCBBBBACABCBCAAACCCBBBCCBACCACBABCABABBABCACBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ca305018ef72791fb6e09cb3988ba0f73549e4ed0d0fe323f4494010dabf6e11
MD5 f600b82aa5ca3caf3d8020c25ea02fb7
SHA1 4751f5bf5cba7d2466d10ba75ed7e4e25f0297e3
SHA512 ff4a24fde24cdca62ea9b395663707724818163ee3318d9db2191ee2355d519545cdd5ee20b79200419ee72bea815b60c3f6ff022ff0e33735b77d2f841aeac3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8b2abf00625c76c86d95c65e5dbd95993bc4efebde9c738efe6ce1e3979be071
MD5 2cd328a7d0f116aa8e636d4e21f3c252
SHA1 c20564f5467108870521484b1be63f4ab69a5a1d
SHA512 984f7bb8b68e735e76ff076ce81e5bc48b377c7bb8e172f12a668f4af424029b4696c30f39b8c6d7e595866d61a767d170587f0bd55cef160d27559f9622a16b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bb301a4ec838d2a56dbdbe611b6ed1efea1496eed78b8e7563e296761c0b7266
MD5 1dc4b86e88f5dfc7b8c4824219e53ec0
SHA1 bd146d89c26790daab23cdec2050b4e528a35f65
SHA512 d31ee753390d3b35e80496c5d7176f8c0749b99093fbfca4d85e6ae0d259cccca863292043b8d877580a1b33b3dee771178c53c1ba1a5449c0e713f026016c75
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3b3981407c15acdbdd0a11e0ed5be468a44e72f292cbee456bb91ad59b448218
MD5 e90686453b2bca06a8f3b7c194248298
SHA1 024bdc94d5e016e0afc1060267e56a12261244c7
SHA512 c83ecc2f16a7900c1371ae1ed342db90b1f5a2e4dff1ea1a4c5949df4f7fa316b733cece7dc321e2d050ca671ce231c32afc9b798e3319fd9de584ede7bf6839
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aff7914e9c2c65a2e71db6662457905298b33dff5c08610346785565cc21647e
MD5 adcad78a1b927ba7935c88fa37bb0df6
SHA1 fdca862a950c7e3c4c576ef88c2b59a1ca6fb258
SHA512 e79d3dfc657f8da9f42bd162f1258b57363179c9cee48928c9bf95e51fee18461f577dfa5984532b91d60fe784543eadbb14a271aa0d42f5d6b8ac8eef72e4d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e28fce7ef1c8d4587a188ce57e93fd4b0ede0b923da0d553570dccff498a0b6d
MD5 b209a8c3e9ab1778757dc221770d7756
SHA1 c82f8815a2ade1b6dba78ce26bfae0eef8a5ab76
SHA512 d09a0cf1fe1889f3a46578102e93ce8a5ccd7ec228ebd4a068e34c2bdf06c585b075eb4579bc5880a49632095d9f1f7a9ca6216826ae74dd424cfe12785c5e99
MD5 SHA1 SHA512

Submit Download

svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACBCCAAACBCBCACAAACBAACCACABAABACAABAABBBACBAAACACCC.exe
Size 28.8MB
SHA256 d5103f5d21883f5324a73707a873c69ebc068a8eb6470fba2bf84aa4fb04a761
MD5 80ef808d4309b496f7c214756eb34c79
SHA1 6e4cb43d7bbab56c3c5cea449deaf92f2365197c
SHA512 e999c2145fad7283ae031f59197fbe7c8b793c6b66d4cb19a976261276a9de12d12880564294d65a1b59760020a3f53881020f2f4cb8a8940ffa6b8d6d748129
SSDEEP 49152:U+Ee+Eo+Ee+Ee+Ee+Ee+Eow8obnyMWmddjZ7xlo5s+Ee+Eo+Ee+Ee+Ee+Ee+Eowk:irU5arU561MbQ9yDAD7KjjqkusjmqMhS
TLSH
T1EC671929A6A4C0E1E96A973898678171E9717D100A3253BFDDB0F61EEE3B5B14D3C730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 135263ebb702625be542fe8b5a191e013a103ceb34d60a1362e546ee6bf0b431
MD5 0568a776deb0ee80f891de513773d55f
SHA1 7163385d3aae813c6635fafb59804b146b09b4e3
SHA512 7448a82c37547db782444f1dc049c417c0e35138c6c0da10047fffe7d0468ced226d3c161aafaa92c58ad29364ce0467ca86d83bd2a59be278696bf63ae0f494
TLSH
T105110405F4E98867E93328CBA62DCE920DB9368B58AC6E6162099218F665C37CD154F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/616-7-0x0000000000E60000-0x0000000000E81000-memory.dmp

Download

memory/616-0-0x0000000000E60000-0x0000000000E81000-memory.dmp

Download

memory/1800-81-0x0000000000640000-0x0000000000661000-memory.dmp

Download

memory/2092-66-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/4716-36-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/4716-23-0x0000000000620000-0x0000000000641000-memory.dmp

Download