47e4298d129d4d94c3ad9bbd108dd2c5923e52e4f497b33361cdae2f9df5e17c

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_297490623c2ae11917b1ea4c947cb062_elex_glassworm_icedid_vidar.exe
Size 1.5MB
Sample260821-ffm18axtas
SHA256 47e4298d129d4d94c3ad9bbd108dd2c5923e52e4f497b33361cdae2f9df5e17c
MD5 297490623c2ae11917b1ea4c947cb062
SHA1 25eea35e0c0de65e15983950b4a8529b10fde325
SHA512 81213760246214091b1e4545d03cd444c88101f98cc3f61b7bed2b2192f24ffea3af5641834f0b782a229a56a17eb8e300af472342ecfe327f2c164873cd9d18
SSDEEP 24576:m9+EM0qMbJExqatgl8br9+EM0qMbJExqatgl8br9+EM0qMbJExqatgl8bdAhY9:U+ETEqatgl2+ETEqatgl2+ETEqatglyT
TLSH
T1F8751846FA4581B2D41A0131484792AF5B70B815CF135E9B6398AFEEFFF37C06A22674
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2864	svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe
1356	svchost_BABAACCACBCBBABABCCCBBCCCCBACBBAACCCBBCCABAACCBCACCABBA.exe
5696	svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACBBBBCCBBAACBBCACABACCBBCCCCBABBAACCCCABCABCBAACACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe"	2026-08-21_297490623c2ae11917b1ea4c947cb062_elex_glassworm_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCAACCCCABBAABBCAABCCCBBBCACCCBABAAABBACCBABBACCAAACBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABAACCACBCBBABABCCCBBCCCCBACBBAACCCBBCCABAACCBCACCABBA.exe"	svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2632	sc.exe
2248	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1340	cmd.exe
1292	cmd.exe
4740	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_297490623c2ae11917b1ea4c947cb062_elex_glassworm_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABAACCACBCBBABABCCCBBCCCCBACBBAACCCBBCCABAACCBCACCABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2800	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2600	2026-08-21_297490623c2ae11917b1ea4c947cb062_elex_glassworm_icedid_vidar.exe
2600	2026-08-21_297490623c2ae11917b1ea4c947cb062_elex_glassworm_icedid_vidar.exe
2600	2026-08-21_297490623c2ae11917b1ea4c947cb062_elex_glassworm_icedid_vidar.exe
2600	2026-08-21_297490623c2ae11917b1ea4c947cb062_elex_glassworm_icedid_vidar.exe
2864	svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe
2864	svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe
2864	svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe
2864	svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe
1356	svchost_BABAACCACBCBBABABCCCBBCCCCBACBBAACCCBBCCABAACCBCACCABBA.exe
1356	svchost_BABAACCACBCBBABABCCCBBCCCCBACBBAACCCBBCCABAACCBCACCABBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	2026-08-21_297490623c2ae11917b1ea4c947cb062_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	2864	svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe
Token: SeDebugPrivilege	1356	svchost_BABAACCACBCBBABABCCCBBCCCCBACBBAACCCBBCCABAACCBCACCABBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 1292	2600	2026-08-21_297490623c2ae11917b1ea4c947cb062_elex_glassworm_icedid_vidar.exe	92
PID 1292 wrote to memory of 2800	1292	cmd.exe	94
PID 2864 wrote to memory of 4100	2864	svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe	95
PID 2600 wrote to memory of 4740	2600	2026-08-21_297490623c2ae11917b1ea4c947cb062_elex_glassworm_icedid_vidar.exe	98
PID 4740 wrote to memory of 2632	4740	cmd.exe	100
PID 2600 wrote to memory of 1340	2600	2026-08-21_297490623c2ae11917b1ea4c947cb062_elex_glassworm_icedid_vidar.exe	101
PID 1340 wrote to memory of 2248	1340	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-21_297490623c2ae11917b1ea4c947cb062_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_297490623c2ae11917b1ea4c947cb062_elex_glassworm_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABCAACAAABBACCBCCCACABCCCBCABCBBACBCABBBCCCBCBCCCCABCBBCABBCAABABACBABABAABBAACCAABBBBCBAACACABACBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABCAACAAABBACCBCCCACABCCCBCABCBBACBCABBBCCCBCBCCCCABCBBCABBCAABABACBABABAABBAACCAABBBBCBAACACABACBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABBAAAABBBAACCBBABCABABCCAACCABBBACCBBBCACCCBCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe" start= auto displayName= "UserDataSvc_ABABBAAAABBBAACCBBABCABABCCAACCABBBACCBBBCACCCBCCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABABBAAAABBBAACCBBABCABABCCAACCABBBACCBBBCACCCBCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe" start= auto displayName= "UserDataSvc_ABABBAAAABBBAACCBBABCABABCCAACCABBBACCBBBCACCCBCCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABBAAAABBBAACCBBABCABABCCAACCABBBACCBBBCACCCBCCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABABBAAAABBBAACCBBABCABABCCAACCABBBACCBBBCACCCBCCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAACCACBCBBABABCCCBBCCCCBACBBAACCCBBCCABAACCBCACCABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAACCACBCBBABABCCCBBCCCCBACBBAACCCBBCCABAACCBCACCABBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe
1⤵
- Executes dropped EXE
PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6101e3ec147a01c5e859897c5e924692920f66bd01d22bc96689508208be9907
MD5 55f9db937ea096433169bb83f2342140
SHA1 a8aecc7c1ad6d5b93db0e78b4a4e38c29d8a37b9
SHA512 0196e6fb19d6900c163ed50e940be74f885fc9adc7b218d65fe2505b1ac2eb415ace68eb20528dd949d5d11390c7de16953b5401e67d38ded6b855fde14bd1a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 234314a9d44454b3e655cb9871fde0264e933f44fd3e865a75578c556ea3f799
MD5 5e0e29ee1887e7dd8567210a2523a950
SHA1 a78dcc3daf6a900bca7e0d1a2fafbe69c9dcfbde
SHA512 b1a05e963b53eab83927f6579b89f584d5e04f963b3b1c2de7b78e063254b4513a0651bffb31829afc42d1d4215d417c1402cb234c6c7daed1a0cd6ca8d77f25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eb72a8fca91f9e47aa19018ad94444cb61b5448a43292b304a2a6c7f16bf38dd
MD5 745126dd1f131161f18d68d540b0440d
SHA1 8cc30034743ff72d85f9dd5955f04db13f9abefb
SHA512 6e7bf0845d6162768b27574321dfd21bd318bdcbe0cdeb2d3a57ea4bb6f1272be64fe22aaa1d34f0be71a871356fbd2bd7cde4ee7bae2c6a2c65e695574b6ed5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 abeafad26a4f2c81d95378142a236193014bb8a0fccb0988ace10325f611bda0
MD5 de446319a7accf55b63aad31444292a4
SHA1 ded267576b33069d22021f848e4b113427fadc02
SHA512 cdeb9b1b31416d121783d10217b99d1120e7b9dae4d4502e561fb0e27f0407807c5e8167c0c1eedca0138866be2e26b864537e10293af4ea097918f1b73aad04
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 45bba633b9a544d9bf79585db02acb90b5bb1b2280fede2e9749ec513e507844
MD5 d142bbf76e08bd5305634e86103989d0
SHA1 f551452cd7a908affe0a78712e0600bf1956e2e6
SHA512 daf861e2ace90e5ea4bef2f523f7db72f1953d3c253e4ec6afab2360ea8cc07f77fd466d1f732360e8968ddd0eba79c92d8ba3ac8df23feef82fca77db0c8c1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 018b042f337fd218482566d066369a9bb7f0a9bae0b0b08feb570244afde3833
MD5 4713437c8b20846a5beef0732f9fc95b
SHA1 2bbd89d9138bdb6b70c53896f9f921fe6c62fd16
SHA512 861d52014cbe3b49e6208bb54dd2f3777e277ebc72b27018a37ea38f7eeb43873b12f8f795181ecbda2a5dcced0b00191194bd9eb08618f668ab6b2fcab8f952
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dda1722b564c08e39540b1181232f2334ff35b5f5030fb514d411426f214715a
MD5 a9e69324665f2278371eaba1585fac38
SHA1 2d8d221d684eda55a343e1ffc30418471b4d68b7
SHA512 839410e4c2232d908451162c3fe232c39ab4be59ed6362cc63a26f7f25f876ff10bc071310d8ff2b4308208d672deaf3305fffb54aa30a24045a6bc79dfd2f7c
MD5 SHA1 SHA512

Submit Download

svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCAAACBACBABCBABABBACCCABCCCABCABABAAACBCBBABBBBCA.exe
Size 1.5MB
SHA256 47e4298d129d4d94c3ad9bbd108dd2c5923e52e4f497b33361cdae2f9df5e17c
MD5 297490623c2ae11917b1ea4c947cb062
SHA1 25eea35e0c0de65e15983950b4a8529b10fde325
SHA512 81213760246214091b1e4545d03cd444c88101f98cc3f61b7bed2b2192f24ffea3af5641834f0b782a229a56a17eb8e300af472342ecfe327f2c164873cd9d18
SSDEEP 24576:m9+EM0qMbJExqatgl8br9+EM0qMbJExqatgl8br9+EM0qMbJExqatgl8bdAhY9:U+ETEqatgl2+ETEqatgl2+ETEqatglyT
TLSH
T1F8751846FA4581B2D41A0131484792AF5B70B815CF135E9B6398AFEEFFF37C06A22674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 75add02d0def5d85e982e7513b7ce8b10081744d701bfe5ec0fbb82a5f235f78
MD5 a6099a1f950864596761550b1203114f
SHA1 fed01dd0964a0c3add9e2e2071ab2fc0f24a8e22
SHA512 2248f7a2db883f78dff427911680417540ca61afc1a778fa562a0add8497f1ed06d7ddf437e3db66dc0defcf8f88ae933d05fb89eb4100918dc63a420b878e0c
TLSH
T156112710E8F5C813F83229CBD739D89B2CE4338F68586A14228E511867A9C33CD990F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1356-65-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/2600-0-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/2600-8-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/2864-34-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download