ba0b580dd015d1d58a1e9d6d664ce676e91dfc1553462b55657d865b0d946bef

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_2f0f374a136edb259bc5d5a0f7046914_elex_glassworm_icedid_njrat_vidar.exe
Size 1.5MB
Sample260825-tr19wack3s
SHA256 ba0b580dd015d1d58a1e9d6d664ce676e91dfc1553462b55657d865b0d946bef
MD5 2f0f374a136edb259bc5d5a0f7046914
SHA1 88a11fdd9a136df39150a94df352b03388ac4a06
SHA512 6ffb75e2bc2e03b1a666d4ad7a5abb7de4ddf8a14629a106efbcb0e48e82bdabaec88601c3161014f25499b73c0641dafe057c10f680acbf0f2b85325a2d3767
SSDEEP 24576:m9+EM0JExqatgl8bl9+EM0v9+EM01Exqatgl8bA9+EM0/UpslZOZPTiw2q:U+EWqatglu+E7+EqqatglL+EF3giw2q
TLSH
T189755B4ABB9984B2E4670231489782B79BB1BC110F22D7DF6384933E5F337D0AA35B55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2880	svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe
3720	svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe
812	svchost_BBABCBBAABCCABBBABCBBABACCACCCBABAAABABCCABCBCAAACBCCAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAACCCAABBABCACBBCBBABACCBBBCAAABCBAABBCCABBCBCBCBBCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe"	2026-08-24_2f0f374a136edb259bc5d5a0f7046914_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCACCABCBCCCCCCCAABCCBAACCCCABBACACBACCBAABCCCBACABCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABCBBAABCCABBBABCBBABACCACCCBABAAABABCCABCBCAAACBCCAA.exe"	svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1216	sc.exe
6100	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6068	cmd.exe
4916	cmd.exe
5452	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_2f0f374a136edb259bc5d5a0f7046914_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABCBBAABCCABBBABCBBABACCACCCBABAAABABCCABCBCAAACBCCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5412	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4364	2026-08-24_2f0f374a136edb259bc5d5a0f7046914_elex_glassworm_icedid_njrat_vidar.exe
4364	2026-08-24_2f0f374a136edb259bc5d5a0f7046914_elex_glassworm_icedid_njrat_vidar.exe
4364	2026-08-24_2f0f374a136edb259bc5d5a0f7046914_elex_glassworm_icedid_njrat_vidar.exe
4364	2026-08-24_2f0f374a136edb259bc5d5a0f7046914_elex_glassworm_icedid_njrat_vidar.exe
2880	svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe
2880	svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe
2880	svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe
2880	svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe
812	svchost_BBABCBBAABCCABBBABCBBABACCACCCBABAAABABCCABCBCAAACBCCAA.exe
812	svchost_BBABCBBAABCCABBBABCBBABACCACCCBABAAABABCCABCBCAAACBCCAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4364	2026-08-24_2f0f374a136edb259bc5d5a0f7046914_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2880	svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe
Token: SeDebugPrivilege	812	svchost_BBABCBBAABCCABBBABCBBABACCACCCBABAAABABCCABCBCAAACBCCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 5452	4364	2026-08-24_2f0f374a136edb259bc5d5a0f7046914_elex_glassworm_icedid_njrat_vidar.exe	92
PID 5452 wrote to memory of 5412	5452	cmd.exe	94
PID 2880 wrote to memory of 5416	2880	svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe	95
PID 4364 wrote to memory of 6068	4364	2026-08-24_2f0f374a136edb259bc5d5a0f7046914_elex_glassworm_icedid_njrat_vidar.exe	96
PID 6068 wrote to memory of 1216	6068	cmd.exe	98
PID 4364 wrote to memory of 4916	4364	2026-08-24_2f0f374a136edb259bc5d5a0f7046914_elex_glassworm_icedid_njrat_vidar.exe	99
PID 4916 wrote to memory of 6100	4916	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-24_2f0f374a136edb259bc5d5a0f7046914_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_2f0f374a136edb259bc5d5a0f7046914_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBCACBABCCBCCCAABBACAAAABABCCACABCCCCCAABCCAABBCCCACABBCBABACBABAAACCBAAAABBABCBAAAAACBACCBACCBACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBCACBABCCBCCCAABBACAAAABABCCACABCCCCCAABCCAABBCCCACABBCBABACBABAAACCBAAAABBABCBAAAAACBACCBACCBACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBCCCCCAABABCCCAAACCBCABBBCCABBCACBBBBACACBABBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe" start= auto displayName= "UserDataSvc_CCCBCCCCCAABABCCCAAACCBCABBBCCABBCACBBBBACACBABBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBCCCCCAABABCCCAAACCBCABBBCCABBCACBBBBACACBABBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe" start= auto displayName= "UserDataSvc_CCCBCCCCCAABABCCCAAACCBCABBBCCABBCACBBBBACACBABBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBCCCCCAABABCCCAAACCBCABBBCCABBCACBBBBACACBABBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBCCCCCAABABCCCAAACCBCABBBCCABBCACBBBBACACBABBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe
1⤵
- Executes dropped EXE
PID:3720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBBAABCCABBBABCBBABACCACCCBABAAABABCCABCBCAAACBCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBBAABCCABBBABCBBABACCACCCBABAAABABCCABCBCAAACBCCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cb0ca6e20dfc2a77e953b3bcbcd186768bf1cf0a82de8ccabbf9c7c5a10ce8a8
MD5 3424c77b1b85ba22d2db85991f55e8ae
SHA1 2ca67b88fbfe12635ba012d88d80f0b0f7805bd0
SHA512 57848cf7547e16ea20151a4d6bf7c38f459ea66c05cd38dd1ab3d0f541b1ff686671097860197a7e849b4f862994d2af72e433341070fea93d38f03dcb1cebdc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2aef40756e60707b26c5f768461de8a7dd11fc0ac1f6309284caa079363126df
MD5 03e8d29b02ff0206ec439efe94274080
SHA1 ec21ffc66859cc87b0dfeaadef4962ffc6448577
SHA512 717017383bed090ecb38f6fb08acc60057ec4c6b09fc4780717a84267487726ff769aa9974524e1527798f020ef028b2a466c098edee3b21530627f592fd23d7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ecf2cb53cb82d0f3a0a7b1ca6a096ca96c2acbd5316f4871bf34c2ebd592a26d
MD5 5a95da6f8b252ddd8d626640970c09ec
SHA1 f3ce9750a5108c853d6cc43261bed4fafe0550c9
SHA512 6c29a860cc4f2ab64bbde3c338552869ba1d04f19bf9e8fe3493c2faca19719834641456ddff032cb855a28a2ac8c84bda280b020b6c41b2d62249f5e3d08b8e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b0dff9e0a25a502c5e8770bd95b1a9dbc3e7614866316bab42b9ce219a10e689
MD5 0814114731e3b5ee573736c9271fe1d6
SHA1 09615cda21538f57b9243f75286c63acb3dce0a8
SHA512 4e6efb6585b75f5e8efa13365ba78be1f5e5bd219b4660f88189e4226a5bfe51fb1fff6a6f565d2ef43ba61bfce3ae0cda744dcd87d2d4d70d435be3edeba222
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 48869bdb62b4c6996c250bdb7977eb426b963e2c854537f2f1579d35b33e68fc
MD5 8f6828a2e0f4159697356238dae15374
SHA1 9ffaa63cdaadace5405485e438c79592c70b4447
SHA512 9101e7b8340358a3b3a947674cfd0beedba81a5e7a27b7c9abad5dedbc6f78313d2cc3f3e4bd087273a0982a48e79c4e5d2f4c5c975c777a0085643ea162d1c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6dec7526af496d02879d292e2c306d8a2b5afebc65f45ee1434c83426a714891
MD5 3bb114511642c3b8d2a4d0bbc90b7dbc
SHA1 42b8aac9a2d2f763e00d3df7efb7b01ce2626f56
SHA512 e9ea1f4005627a4d8fb192733958174d05cef093aaa32edaedb68b0cea14f3c8fb4b94a3a9b17e1bfe4168ac3aa2cf4057ef979dd2a5dd9a0f83744ddb056b12
MD5 SHA1 SHA512

Submit Download

svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBCACBBAABCACAAABAAAACBCAABBBBACAABCCAACBACCBBAABA.exe
Size 1.5MB
SHA256 ba0b580dd015d1d58a1e9d6d664ce676e91dfc1553462b55657d865b0d946bef
MD5 2f0f374a136edb259bc5d5a0f7046914
SHA1 88a11fdd9a136df39150a94df352b03388ac4a06
SHA512 6ffb75e2bc2e03b1a666d4ad7a5abb7de4ddf8a14629a106efbcb0e48e82bdabaec88601c3161014f25499b73c0641dafe057c10f680acbf0f2b85325a2d3767
SSDEEP 24576:m9+EM0JExqatgl8bl9+EM0v9+EM01Exqatgl8bA9+EM0/UpslZOZPTiw2q:U+EWqatglu+E7+EqqatglL+EF3giw2q
TLSH
T189755B4ABB9984B2E4670231489782B79BB1BC110F22D7DF6384933E5F337D0AA35B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a94574aad137551c4bf80799c7083b0d96899581bbfb066dca4fc6411c2bd6d1
MD5 b27c9686d3d0f3b9ffdecf5664253585
SHA1 3d358a32532e1f5d4c7056a55b4cce7266822b5f
SHA512 467d951070f4a22c1e3cd355b0b5046fca3d0b2c3eb3d4bcb601e3792982bef5b513c351ac8235b4bc02b4a8ff9e356334885fd730b034ad4f4f3d01aad163d4
TLSH
T130112B63E0F6C023E4732C8B942ACCC61DA436EB58EC6EA413065118ABE9C349E565F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/812-81-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/2880-36-0x0000000000490000-0x00000000004B1000-memory.dmp

Download

memory/2880-23-0x0000000000490000-0x00000000004B1000-memory.dmp

Download

memory/3720-76-0x0000000000490000-0x00000000004B1000-memory.dmp

Download

memory/4364-0-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/4364-7-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download