5e5003dd1672feb9351025d443a232628200c514e3d672924aae0bae4ef5e497

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_1c273a6ab5d46f9f99d4d005b34c5cfe_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Size 60.0MB
Sample260825-wfkh4aac47
SHA256 5e5003dd1672feb9351025d443a232628200c514e3d672924aae0bae4ef5e497
MD5 1c273a6ab5d46f9f99d4d005b34c5cfe
SHA1 647c795a51357706e7c3b673a7521ea1d2fd7393
SHA512 32dc1e10ff52fcaa14a0e77d391f1ce6c6d392e5088d0f6bc75923a1a0edaa2bcfac4d4814c81033209a59b7ef97382fe5a85ae135eaa23d76abd3e11bb0266f
SSDEEP 196608:m1tIDewjqkjiqME1tIDewjqkjiqME1tIDewjqkjiqMLnSH:m8KwekyE8KwekyE8KwekyLq
TLSH
T105D75D19F99640F1E96B50B04CDBD37FCA707B2186234FABEA89C71B6D33B515C28621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4120	svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe
920	svchost_ACACACCBABCABACBACCBACBBCABBCACBCBCBBCACBCBBBBBBBAABBAC.exe
968	svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCABACCAACABABABABCBCBACCAACCCCCACCBCCACCACBAACCBACACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe"	2026-08-24_1c273a6ab5d46f9f99d4d005b34c5cfe_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACBABBCCBACABCAABABBBAABACBBAACABCCBCACACBCBCCCCBBCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACACCBABCABACBACCBACBBCABBCACBCBCBBCACBCBBBBBBBAABBAC.exe"	svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3200	sc.exe
3264	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3300	cmd.exe
5144	cmd.exe
2340	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_1c273a6ab5d46f9f99d4d005b34c5cfe_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACACCBABCABACBACCBACBBCABBCACBCBCBBCACBCBBBBBBBAABBAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4132	2026-08-24_1c273a6ab5d46f9f99d4d005b34c5cfe_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
4132	2026-08-24_1c273a6ab5d46f9f99d4d005b34c5cfe_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
4132	2026-08-24_1c273a6ab5d46f9f99d4d005b34c5cfe_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
4132	2026-08-24_1c273a6ab5d46f9f99d4d005b34c5cfe_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
4120	svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe
4120	svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe
4120	svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe
4120	svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	2026-08-24_1c273a6ab5d46f9f99d4d005b34c5cfe_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4120	svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 3300	4132	2026-08-24_1c273a6ab5d46f9f99d4d005b34c5cfe_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	92
PID 3300 wrote to memory of 2304	3300	cmd.exe	94
PID 4120 wrote to memory of 2224	4120	svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe	95
PID 4132 wrote to memory of 5144	4132	2026-08-24_1c273a6ab5d46f9f99d4d005b34c5cfe_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	98
PID 5144 wrote to memory of 3200	5144	cmd.exe	100
PID 4132 wrote to memory of 2340	4132	2026-08-24_1c273a6ab5d46f9f99d4d005b34c5cfe_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	101
PID 2340 wrote to memory of 3264	2340	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-24_1c273a6ab5d46f9f99d4d005b34c5cfe_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_1c273a6ab5d46f9f99d4d005b34c5cfe_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBABBACACBBBBCACAAABABCBACCBAACAAACABCCACBBCAACACACBACBAACCBCBACBACCCCACBACBBBCABBAABBAAAAACABCCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBABBACACBBBBCACAAABABCBACCBAACAAACABCCACBBCAACACACBACBAACCBCBACBACCCCACBACBBBCABBAABBAAAAACABCCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBCAACACAABACABAABBCBBCACBBBBABABCABBCCABACBABBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe" start= auto displayName= "UserDataSvc_CACBCAACACAABACABAABBCBBCACBBBBABABCABBCCABACBABBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5144
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBCAACACAABACABAABBCBBCACBBBBABABCABBCCABACBABBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe" start= auto displayName= "UserDataSvc_CACBCAACACAABACABAABBCBBCACBBBBABABCABBCCABACBABBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBCAACACAABACABAABBCBBCACBBBBABABCABBCCABACBABBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBCAACACAABACABAABBCBBCACBBBBABABCABBCCABACBABBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2224

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACCBABCABACBACCBACBBCABBCACBCBCBBCACBCBBBBBBBAABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACCBABCABACBACCBACBBCABBCACBCBCBBCACBCBBBBBBBAABBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBCCACCBCBBACCBAACBAAACBBCCBBCCAAABBCABCCABBACACCBA.exe
1⤵
- Executes dropped EXE
PID:968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8388e7a43041402c108e2e781ef480db52259194a442f673a2f8852da6857eaa
MD5 b0bfabfb2690140d0f0e5a0b0dc1cbca
SHA1 08ca870afa2e387c425aea6a1913c602c96d40a4
SHA512 d1ac8c6de1352ba874f9367859777898429c9ae41a39ba0552aed4e7dff599cfa76fc3a689c4a12d2f2cb1dcb50fd4c173adbdab59f857a7a3baed0edb62cfb6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 14257048c667aae5516b48b1f2f3568ba4d7b040d6ae9803ac6b813e90c1abdb
MD5 a53b47f92c39df547f00a8df22bc3816
SHA1 4cb2061731bdd6d86b631b45e514f171b2861cd9
SHA512 810752d9b181caa4a5ebc6dabd416ca86e50c83101e43e5fc6029ae17a3e15f6bb340cb2e4aebeab892376139d5e8dcabbc86aa44ed1d76772562a9edbdfa4e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 277e84761b08995c35685193659d5f5385842dcfe8e713ea7c3463a806e1977d
MD5 61c98ceb53999d087007cf7b15466d80
SHA1 d11fdd9d1d7f393f6ec626fedd367ccd8df16457
SHA512 6c6b9bf3f8c3bfcba6fd637ef1b31a5055dea067531ee15f5ba0251c88b73a2235ed21c3a90e4972d46491e17f7fde616c8694832f7bb34f2917d88f1fdce54e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8340fe49f8c59564dac352075ba831095838547324ac3f6f9c20b75a646789ef
MD5 9aab81e81929447564fe218586c4dcb5
SHA1 4ef3aa55c28e38cd2d9c5d06389501597a2c36a6
SHA512 500801ccb977ed2fc1090ba4889b26e27f046151385f03b2ec75e69a6a152f9bd8cd36f64e76aff268acefb9d8c43c02ecd3abc82172cca84e60604d70ac32f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 58c6a96419bd0acb3ec6e1a3623c8930f91c6db1d6badd3169a872634eda2d65
MD5 85e8b643f17e0a004bd2f5ff8929f867
SHA1 0bc84d4f047bc6877c8be5bfa0459724d16f1a8c
SHA512 3272e875117f8e57b71a685e794cdf0252f2880ccd7ae909ba97d9b9d91f8816e0ea017b68a1a6ceed229fa25854baf3a28678512b0b26b717cfbd68c228722d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 865f862509188e560eba331a56f2f7b1053ebeea45c9100bdab8de1e47717e38
MD5 09ede98fa4b0708ea4f18cbda1bde551
SHA1 ec2cf3840149b6568dfa42efb4583f71b5d1bd27
SHA512 02eb2495375a43d3a784a5b940a0b931cf31a71be011a41ef067c3a27bd87ad6b1c37e321c5b08a057ddece8a8edb37a3e904f672a0dcb0910bcfd4f0578965b
MD5 SHA1 SHA512

Submit Download

memory/920-69-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/4120-35-0x0000000000590000-0x00000000005B1000-memory.dmp

Download

memory/4132-0-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/4132-8-0x0000000000230000-0x0000000000251000-memory.dmp

Download