57d721b11454b08d583d2de91e90603e1848519abe76d8915c1188b3204b8ea8

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_8dd81e7450e12d55ca81e7a36ca72d5c_elex_glassworm_icedid_njrat_vidar.exe
Size 3.2MB
Sample260819-nb9y7asfla
SHA256 57d721b11454b08d583d2de91e90603e1848519abe76d8915c1188b3204b8ea8
MD5 8dd81e7450e12d55ca81e7a36ca72d5c
SHA1 e2b020aa59729004d048b8c81f6b7e380f064eac
SHA512 fb1c107bde08d1993e36dc184dea9dfe4705ed06c935ce62e0a4ba242c84aa82e216047c3c6db4d20f29e5d73af7da9d3444c79f11efde6c9c86be35af64b52d
SSDEEP 49152:U+E7+EBqatglK+E/RB+E7+EBqatglK+E/RB+E7+EBqatglK+E/R+qatglF:8NRbNRbNRMe
TLSH
T18BF51746FA4184F2D4160131494792BE9B70B811CA139F5BA3989EEEFFF37D0AE25670
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3904	svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe
3388	svchost_CABBABACBBBAAAACAAAAAABCCBACCACABABCCACAABCBCACCBABBCCA.exe
4792	svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBABAAABCACACBBCCAAABCCBBCCBBCCCCABACBBBAAABBCAABBBBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe"	2026-08-19_8dd81e7450e12d55ca81e7a36ca72d5c_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCACBABAACACCBBBABABBAABBCBABABABCABCAAAACAAAABCBABCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBABACBBBAAAACAAAAAABCCBACCACABABCCACAABCBCACCBABBCCA.exe"	svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5832	sc.exe
2716	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1848	cmd.exe
2288	cmd.exe
904	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBABACBBBAAAACAAAAAABCCBACCACABABCCACAABCBCACCBABBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_8dd81e7450e12d55ca81e7a36ca72d5c_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3304	2026-08-19_8dd81e7450e12d55ca81e7a36ca72d5c_elex_glassworm_icedid_njrat_vidar.exe
3304	2026-08-19_8dd81e7450e12d55ca81e7a36ca72d5c_elex_glassworm_icedid_njrat_vidar.exe
3304	2026-08-19_8dd81e7450e12d55ca81e7a36ca72d5c_elex_glassworm_icedid_njrat_vidar.exe
3304	2026-08-19_8dd81e7450e12d55ca81e7a36ca72d5c_elex_glassworm_icedid_njrat_vidar.exe
3904	svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe
3904	svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe
3904	svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe
3904	svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe
3388	svchost_CABBABACBBBAAAACAAAAAABCCBACCACABABCCACAABCBCACCBABBCCA.exe
3388	svchost_CABBABACBBBAAAACAAAAAABCCBACCACABABCCACAABCBCACCBABBCCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3304	2026-08-19_8dd81e7450e12d55ca81e7a36ca72d5c_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3904	svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe
Token: SeDebugPrivilege	3388	svchost_CABBABACBBBAAAACAAAAAABCCBACCACABABCCACAABCBCACCBABBCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 904	3304	2026-08-19_8dd81e7450e12d55ca81e7a36ca72d5c_elex_glassworm_icedid_njrat_vidar.exe	92
PID 904 wrote to memory of 3516	904	cmd.exe	94
PID 3904 wrote to memory of 2444	3904	svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe	95
PID 3304 wrote to memory of 1848	3304	2026-08-19_8dd81e7450e12d55ca81e7a36ca72d5c_elex_glassworm_icedid_njrat_vidar.exe	98
PID 1848 wrote to memory of 5832	1848	cmd.exe	100
PID 3304 wrote to memory of 2288	3304	2026-08-19_8dd81e7450e12d55ca81e7a36ca72d5c_elex_glassworm_icedid_njrat_vidar.exe	101
PID 2288 wrote to memory of 2716	2288	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-19_8dd81e7450e12d55ca81e7a36ca72d5c_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_8dd81e7450e12d55ca81e7a36ca72d5c_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACBBABBCBBCCBAABABCBBACCCCBBBCBAAABBBABABAABBCABABABACAACCCCCABBABAABBCAACBCCACACACCBCCBACCABCACCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACBBABBCBBCCBAABABCBBACCCCBBBCBAAABBBABABAABBCABABABACAACCCCCABBABAABBCAACBCCACACACCBCCBACCABCACCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBABABBCACBBCBBCCCCBBACACABACCAAACABCBCBCCBAACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe" start= auto displayName= "UserDataSvc_AABBABABBCACBBCBBCCCCBBACACABACCAAACABCBCBCCBAACBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBABABBCACBBCBBCCCCBBACACABACCAAACABCBCBCCBAACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe" start= auto displayName= "UserDataSvc_AABBABABBCACBBCBBCCCCBBACACABACCAAACABCBCBCCBAACBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBABABBCACBBCBBCCCCBBACACABACCAAACABCBCBCCBAACBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBABABBCACBBCBBCCCCBBACACABACCAAACABCBCBCCBAACBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABACBBBAAAACAAAAAABCCBACCACABABCCACAABCBCACCBABBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABACBBBAAAACAAAAAABCCBACCACABABCCACAABCBCACCBABBCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe
1⤵
- Executes dropped EXE
PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4ab9a192f0f786fd70da0cd4d6a3855e9e14539c0c89d75c795e89b1cda4c462
MD5 0c6ccb62f7594f70f25b1078f4d363a0
SHA1 af3292dfe9d4380bd5ab13b3cb63de6332120872
SHA512 b29775b91bec3e84d33522c41768dc852933fb1db1ba2b5b2f000882b244bfbe1909d6b071c38e6380e0a69c5fa322fc539acf927a20a782dc17366dcd9e7b1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 041651f0f7f78b55bf43da15f161c9a0f3b161f6c559b9013e3e9bdf59cd4ab3
MD5 0876743e0ecb1e2083923a650fa50db1
SHA1 3ccf473bdf733c08a3e2e89d5db8b56315970a6c
SHA512 4263de8839a0d4b63ae7848c63abad4f4ef1e4b922b76b18aff8a6ebab6aeab63c49310c3ee91f9564278847c1c01497cee9d43be188cb38159f7a906e2fdd3e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 39134d614f4a5643d2f89827468805736ea2cb1f1db3cec23dbfe8e219434419
MD5 220681b2e0f09fd4f15e5971f1a0f17c
SHA1 45aeec75577b8e9066aea52a6793ca8b0a3bc343
SHA512 d21885f7f9d9f2e7d9eafb1578eee211996ff8b65e074656f23009b8c506762aa4e3b3711b4deb9aea832333e80d50f7c93c670afaf164981c6d3d0de101997e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 51a08ec1bb796755a9f47b62503564a7aeabedb28d578358c3eeb1f0943700be
MD5 632f92b81dafe575136c1c78001bebf9
SHA1 908203e90e88102d13045be6fbb9135702b6b303
SHA512 e23368e3cf459a4ff2f5766c95c84794368621bd1dfe2fa40a5d7375f8af773a015b8addf7d0e271a0f95c9df5dffeaddb7602c58303d5e569684d1d3e0d2a65
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f93105c4f24d4d0cfe74971cae187c9aba2ac2ad6df6e6ac9d4c5b285447d572
MD5 c008b05b574d6b9359f6a26823770561
SHA1 57b2d6af372faf63e8c782903a62f59fb9685c8e
SHA512 f49245085ab7ef547af21f6fddcf912de73abd5f413d96312b4104df81bf1ee9dee19b3b87a9c0cdd3c66262ef069925861de10107d0401947924c8190168dcf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 47af5f82a6cb613c6ad88ae54fe9a470bc498aece797ac02968814476c4bcafe
MD5 d9d5ffdcd046a027758370e79a4899f8
SHA1 c28415f01cf509c1b0e9f8c8080de753ca5929a2
SHA512 21f9fcf1093143b81e16c17c13aff9fd268f4029d03069b3d2a51f8f040b0199f8a13b72e4040bd01f34b52cadef1463e2524ddd1c34a1ee0ffe4fe833587c5d
MD5 SHA1 SHA512

Submit Download

svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCCBAAABAAABACCBACBCCBABACCBABCBCBCBBABAACCAAABABAAC.exe
Size 3.2MB
SHA256 57d721b11454b08d583d2de91e90603e1848519abe76d8915c1188b3204b8ea8
MD5 8dd81e7450e12d55ca81e7a36ca72d5c
SHA1 e2b020aa59729004d048b8c81f6b7e380f064eac
SHA512 fb1c107bde08d1993e36dc184dea9dfe4705ed06c935ce62e0a4ba242c84aa82e216047c3c6db4d20f29e5d73af7da9d3444c79f11efde6c9c86be35af64b52d
SSDEEP 49152:U+E7+EBqatglK+E/RB+E7+EBqatglK+E/RB+E7+EBqatglK+E/R+qatglF:8NRbNRbNRMe
TLSH
T18BF51746FA4184F2D4160131494792BE9B70B811CA139F5BA3989EEEFFF37D0AE25670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 ad2b53342307c3e7ac3132b54179892df1e0a44c553eb86faf5ff858775173d6
MD5 5debdaa431e8a48f243fa0963c31c048
SHA1 dbac14204473f783b2a822e2370e2f7202a462fc
SHA512 68e9d9e48b1a67b137b407d8dde1b34786fa5c9967b144178e6c1a819eab98b6e78b1b286a753949f88078fb2966600c785cbc877171667c9ebbbc87a2a9422c
TLSH
T11011E6B6D4B58C5BFA7228C7913DDA82CCA033FF589C6A05120942186795832DE190E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3304-0-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/3304-8-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/3388-79-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/3904-32-0x0000000000130000-0x0000000000151000-memory.dmp

Download