b23fcc808ba19e456cab5d6a120c177917e848f92e6b6fd8e8a00fa371fe3799

Analysis

max time kernel
151s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_1b26d1286c8450524887bc2a26522912_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Size 96.3MB
Sample260825-wktybsac65
SHA256 b23fcc808ba19e456cab5d6a120c177917e848f92e6b6fd8e8a00fa371fe3799
MD5 1b26d1286c8450524887bc2a26522912
SHA1 d9e96ea383c5a7379a774d46d2a8306a332cf7bf
SHA512 f86c04cb393636197135850cfa8d951632b479398da615ac5f198af58e3c0d4c85a28284916789e968d86a2c59cd79a6b27ebdc5a6c737862ea73d7aa3b2e62a
SSDEEP 393216:68Kwekyh8Kwee8Kwekyh8Kwee8Kwekyh8Kwee8Kwekyh8Kwee8Kwekyh8KweP:4lElElElElX
TLSH
T117288D19FA9580F1E86B9074889BC2BBEB7079110A325B9BDB95C71F6F337905D28331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4216	svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe
3776	svchost_CBCCCCACACCCCAAACBBAABCCACBCACABCABCCACABBBABBABCCAACAB.exe
1832	svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCACAACBACABBCABBCBCBCCCCCBCACBABBAAACAABCBBBACBCBBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe"	2026-08-24_1b26d1286c8450524887bc2a26522912_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCBAACCACABBABACCBCAACBCABABABBBACBCBCABACCAACBCCABCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCCCACACCCCAAACBBAABCCACBCACABCABCCACABBBABBABCCAACAB.exe"	svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5960	sc.exe
1720	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5012	cmd.exe
2792	cmd.exe
5812	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCCCACACCCCAAACBBAABCCACBCACABCABCCACABBBABBABCCAACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_1b26d1286c8450524887bc2a26522912_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2588	2026-08-24_1b26d1286c8450524887bc2a26522912_elex_glassworm_icedid_njrat_vidar_wannacry.exe
2588	2026-08-24_1b26d1286c8450524887bc2a26522912_elex_glassworm_icedid_njrat_vidar_wannacry.exe
2588	2026-08-24_1b26d1286c8450524887bc2a26522912_elex_glassworm_icedid_njrat_vidar_wannacry.exe
2588	2026-08-24_1b26d1286c8450524887bc2a26522912_elex_glassworm_icedid_njrat_vidar_wannacry.exe
4216	svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe
4216	svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe
4216	svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe
4216	svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe
3776	svchost_CBCCCCACACCCCAAACBBAABCCACBCACABCABCCACABBBABBABCCAACAB.exe
3776	svchost_CBCCCCACACCCCAAACBBAABCCACBCACABCABCCACABBBABBABCCAACAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2588	2026-08-24_1b26d1286c8450524887bc2a26522912_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Token: SeDebugPrivilege	4216	svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe
Token: SeDebugPrivilege	3776	svchost_CBCCCCACACCCCAAACBBAABCCACBCACABCABCCACABBBABBABCCAACAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 5812	2588	2026-08-24_1b26d1286c8450524887bc2a26522912_elex_glassworm_icedid_njrat_vidar_wannacry.exe	91
PID 5812 wrote to memory of 3588	5812	cmd.exe	93
PID 4216 wrote to memory of 4476	4216	svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe	94
PID 2588 wrote to memory of 5012	2588	2026-08-24_1b26d1286c8450524887bc2a26522912_elex_glassworm_icedid_njrat_vidar_wannacry.exe	97
PID 5012 wrote to memory of 5960	5012	cmd.exe	99
PID 2588 wrote to memory of 2792	2588	2026-08-24_1b26d1286c8450524887bc2a26522912_elex_glassworm_icedid_njrat_vidar_wannacry.exe	100
PID 2792 wrote to memory of 1720	2792	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-24_1b26d1286c8450524887bc2a26522912_elex_glassworm_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_1b26d1286c8450524887bc2a26522912_elex_glassworm_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBABCBACCBCACBBABABCABCCAACAACAABBBBAAABABBBBAACCBAABACBCABBAABBAAABAACCAACCBABCCAABCACAAAAACBACAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBABCBACCBCACBBABABCABCCAACAACAABBBBAAABABBBBAACCBAABACBCABBAABBAAABAACCAACCBABCCAABCACAAAAACBACAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBACABCBCABCBBACCAAACBACBACCBCCBBCCAACBAACAAACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe" start= auto displayName= "UserDataSvc_CACBACABCBCABCBBACCAAACBACBACCBCCBBCCAACBAACAAACBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBACABCBCABCBBACCAAACBACBACCBCCBBCCAACBAACAAACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe" start= auto displayName= "UserDataSvc_CACBACABCBCABCBBACCAAACBACBACCBCCBBCCAACBAACAAACBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBACABCBCABCBBACCAAACBACBACCBCCBBCCAACBAACAAACBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBACABCBCABCBBACCAAACBACBACCBCCBBCCAACBAACAAACBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCCACACCCCAAACBBAABCCACBCACABCABCCACABBBABBABCCAACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCCACACCCCAAACBBAABCCACBCACABCABCCACABBBABBABCCAACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBAABACCCCAAABABBBBABCBCAAABAACABBCABBBCCABAAACBBACB.exe
1⤵
- Executes dropped EXE
PID:1832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 893d7e5bd79858f75c5e481ba51ec54c8b65625014c67952816443f40ef4358c
MD5 c31e136122024355af843a2eeb608415
SHA1 494a9cec656225bb4ea3c43da0ba6c49c0480bdc
SHA512 ca410f60fcf0bdd5d576c1a67f8f01943b11077d4aea59c57c6900df1877289e65d009041ad0506e76f6cf26dd33d094be9c65885c925181b42d72f5779100f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 80eea20df529d52263d2c944fba9006f7d69f1878b5dd2c3af53f2f85735c779
MD5 211837cffc973a1537e96c1adec84e4c
SHA1 414c01ab7471e5e843f28e79f9a591ce1d9c139a
SHA512 ea5e06bca39adf4d0d365ed8b249bc98b259e40d6fb69590aaad21ce77373bde0f8d23a4b82d6efc12864142e624a223040064f69cce918a3d12e5e526ec61dd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 59368c0425cc15b84dad7386fd800a9cc7b43a90fec4d9c84eb9bf862edc6551
MD5 0a28ae6a540ee563b30d56eb4bfcb7ac
SHA1 f4d5a0b414f4ee78e41bd4569baca8a37fe68481
SHA512 0d76940cfec163444fee31318e9ffa35be965a5056acacbc8bd7eff3603d377d917b840c80ecb0474b72deb86460c9adb7fb73645138fb3df1a3c59fb4fd56e7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f055289d6ea8feb53761a1b67fd5ef48b82a859e4d29166235a60d0a3f6d0b3a
MD5 41a25394096c63d6cee8051555f470a1
SHA1 5abecf0ebcdee7687fd23fddb332f859dac1ebed
SHA512 083091b9376e8541ab690894ecae4b933252ae130c4b3df70bf058f66582265d01de504762d8bb53822eabee5a7b6f1e1babeec1b53d7c82a8dd773d4f4b9e7c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2acedaf6f7764ec48a12c6af097b228b7f6370ffb59e03397badf848a77f2259
MD5 c4c91ee4a359a30b66161f00d3775e07
SHA1 060bd5d41856947dda8856f695094cabe76e8b2b
SHA512 a3e0bb55542e347b9fc9d946ae2b194fc193e32787c205262e920cbe0d40014717e5a93b93ab46be386c13ca26aaba5e09b0e2a226fd42c2fac5c8712e427340
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 090321aac04df9678f3290af6dcc4ae40dc332895df97097710b160fa34ec5b4
MD5 bb921921b853e66fb82670455291709b
SHA1 ef7bbd769af877613820ba8d8e67c60f77569670
SHA512 d045daffbd38ef5b85bc89e3569c08b79491a2b22d508c5406731cdfaa7525791018fb5a354bb04cafa6d5a0b505029e633e067959661c3b3cbbe45cceebc8b3
TLSH
T126112702D0F5D857F572288A26F9EA931AA4739FDC9CEE04234D5218BB85C31CD555E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1832-79-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/2588-6-0x00000000004B0000-0x00000000004D1000-memory.dmp

Download

memory/3776-78-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/4216-31-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download