176f7916a2501e8edef79813399a2ada518774d92d025a7bc27b8358ae5471cc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_10f10e282b53aa5ad48fcf3996fc0ecd_elex_glassworm_icedid_vidar.exe
Size 2.3MB
Sample260827-2qlrssz1hx
SHA256 176f7916a2501e8edef79813399a2ada518774d92d025a7bc27b8358ae5471cc
MD5 10f10e282b53aa5ad48fcf3996fc0ecd
SHA1 1007ff83cac0a24595ecfbefcc8fbd7edfacd10c
SHA512 35b719427f57dc80bdcee139a031c7ec15400d4ceaaafbed4de963a9ba6c6227cd4023e45e282b45c28b107d0a6d54bac87beb1f753354a742cf65a5ff0c9c3d
SSDEEP 49152:U+E/z+E3+ES+E7+EXqatglk+E/z+E3+ES+E7+EXqatglqwMW:mMfMw
TLSH
T1DCB51805FA4640B2D8260170488792BE9B70B915CB138EDBA2989FEEFFF37D05935674
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1208	svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe
5908	svchost_AACBBCCBACBBCBCBACBBBCCBABCACBBACBAABCACACACCCAACBBBCCC.exe
2256	svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABAACBCBBACBAACBACCCAABABCAAABBBCAACACBCBBCBCBCAAAAAABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe"	2026-08-27_10f10e282b53aa5ad48fcf3996fc0ecd_elex_glassworm_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCABACBCAACCABACABCCACCBACBBBACCBCBCBAACABCACCBCBCBABCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBBCCBACBBCBCBACBBBCCBABCACBBACBAABCACACACCCAACBBBCCC.exe"	svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4344	sc.exe
6036	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
216	cmd.exe
5316	cmd.exe
2212	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_10f10e282b53aa5ad48fcf3996fc0ecd_elex_glassworm_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBBCCBACBBCBCBACBBBCCBABCACBBACBAABCACACACCCAACBBBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6000	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
628	2026-08-27_10f10e282b53aa5ad48fcf3996fc0ecd_elex_glassworm_icedid_vidar.exe
628	2026-08-27_10f10e282b53aa5ad48fcf3996fc0ecd_elex_glassworm_icedid_vidar.exe
628	2026-08-27_10f10e282b53aa5ad48fcf3996fc0ecd_elex_glassworm_icedid_vidar.exe
628	2026-08-27_10f10e282b53aa5ad48fcf3996fc0ecd_elex_glassworm_icedid_vidar.exe
1208	svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe
1208	svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe
1208	svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe
1208	svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe
5908	svchost_AACBBCCBACBBCBCBACBBBCCBABCACBBACBAABCACACACCCAACBBBCCC.exe
5908	svchost_AACBBCCBACBBCBCBACBBBCCBABCACBBACBAABCACACACCCAACBBBCCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	628	2026-08-27_10f10e282b53aa5ad48fcf3996fc0ecd_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	1208	svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe
Token: SeDebugPrivilege	5908	svchost_AACBBCCBACBBCBCBACBBBCCBABCACBBACBAABCACACACCCAACBBBCCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5856	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 216	628	2026-08-27_10f10e282b53aa5ad48fcf3996fc0ecd_elex_glassworm_icedid_vidar.exe	98
PID 216 wrote to memory of 6000	216	cmd.exe	100
PID 1208 wrote to memory of 4992	1208	svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe	101
PID 4992 wrote to memory of 5400	4992	notepad.exe	102
PID 628 wrote to memory of 5316	628	2026-08-27_10f10e282b53aa5ad48fcf3996fc0ecd_elex_glassworm_icedid_vidar.exe	106
PID 5316 wrote to memory of 4344	5316	cmd.exe	108
PID 628 wrote to memory of 2212	628	2026-08-27_10f10e282b53aa5ad48fcf3996fc0ecd_elex_glassworm_icedid_vidar.exe	109
PID 2212 wrote to memory of 6036	2212	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-27_10f10e282b53aa5ad48fcf3996fc0ecd_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_10f10e282b53aa5ad48fcf3996fc0ecd_elex_glassworm_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBCCACBBBBBAACBCCBBABBCACBACBABBABACACBCAAACAACAABAABCCBCCAAACABBBABBBCAACCAAACBCCABBCBBCAAABCBCBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBCCACBBBBBAACBCCBBABBCACBACBABBABACACBCAAACAACAABAABCCBCCAAACABBBABBBCAACCAAACBCCABBCBBCAAABCBCBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACAAABAABABAABABAACCCAACAACBCABAAACCCCCBCCABBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe" start= auto displayName= "UserDataSvc_BCACAAABAABABAABABAACCCAACAACBCABAAACCCCCBCCABBCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACAAABAABABAABABAACCCAACAACBCABAAACCCCCBCCABBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe" start= auto displayName= "UserDataSvc_BCACAAABAABABAABABAACCCAACAACBCABAAACCCCCBCCABBCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACAAABAABABAABABAACCCAACAACBCABAAACCCCCBCCABBCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACAAABAABABAABABAACCCAACAACBCABAAACCCCCBCCABBCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5400

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCCBACBBCBCBACBBBCCBABCACBBACBAABCACACACCCAACBBBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBCCBACBBCBCBACBBBCCBABCACBBACBAABCACACACCCAACBBBCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe
1⤵
- Executes dropped EXE
PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b8bb7c7ed3968b450ae91d79bb303f8be851b0177a1dc598de469bf9d236672
MD5 67aa67819193cd6b4847d2a31667995b
SHA1 55234908b61b7a6401802291e5f58a7fb6e1484d
SHA512 c0e54b17e877638b7e0c6dac7dcaa9dae1b9ea71ae960ea14814b73d17cacf7f5b049a7ae809466d1d1e1c3b33c9922a102f8fb879bd8f59b8d43199a713bd16
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5449028174f96aad730d71089e3c36468581b4fbf801bb2793e0dc0f199179bd
MD5 dd981d8d6b68899db5f06f927448d00c
SHA1 8f247d58e58c4b64ccd17088eec3f1d266d8e75f
SHA512 039896885dbbefc72af6ead855bf64b7688e546796244b03817ce638c375cf123a6c5e3ae633c38a284ba98563e1214d27bcfc00d4b358c142693ba9d202fdcd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 036b095bbf25596c4aff6a10ba4f3d3fd4413265002f8ea102c19fafde76c919
MD5 4f6ef723677823b66f7fbab858caddf0
SHA1 2ac78020ceceab09a8dc40e888a6da36b48d91a1
SHA512 b8cc6188e40901026fcc2becf473a5ac075d7d912563648f035738db022b5515325641af826073381332ab4504d617e14e59dab64029184843c62b9268cbf511
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9052acdab23bdadbd1d33601b17d30510d38248dcdd417fb0dce17ed84350cdb
MD5 d5bbb5f687cfcd4e3f0e54a305293d1b
SHA1 8a7e6c66c3879ab388635bdf2f67d43e481ef5ea
SHA512 e058829e9f465f363a84f750747c906ad7569307351255c8fb1b2f6dfb806d4b1266ba4a59fdbd607c3238e841e6f8f89939ad036bb8a224f4d0367770428bf4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bd2ddd138780a28f40663ffab181fe85b8e18cfe2a544848eb3dd85f3ca76dd7
MD5 e29eae5e9ca9287d73b1a9efd3db12a0
SHA1 7248bd0b0040a08a294d0a748309bb134ce7c6d3
SHA512 4db56515c7372755f91457cc15d74f3441bf2c76dc862f6feafd71e62439ef8edae04817c98a028eae4aa378f0a9bf1e669839cc59f690a3763247c786480ab9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 00b8881c0c2d3d4e7f5ebb4dfb74d99b9d8391e51fda06c6f200406860f44c8d
MD5 3b91eae335d86270b9774fdc19ad64b9
SHA1 0a745844d23a7606b8ef2c74bffebd1e8ba86b5c
SHA512 d1b0a72991cbb7953fb3fa48f34ad4deda8de6c99e1cc438b865d92c32c8f6babb9abc97f831d598f3637ca4ac9f5c7abe8ff6614b96e1a0280e002518ac12ff
MD5 SHA1 SHA512

Submit Download

svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABABCCBABBACBABCCCAAACBCABBBCCCBCCBAAACBBBACACABBAB.exe
Size 2.3MB
SHA256 176f7916a2501e8edef79813399a2ada518774d92d025a7bc27b8358ae5471cc
MD5 10f10e282b53aa5ad48fcf3996fc0ecd
SHA1 1007ff83cac0a24595ecfbefcc8fbd7edfacd10c
SHA512 35b719427f57dc80bdcee139a031c7ec15400d4ceaaafbed4de963a9ba6c6227cd4023e45e282b45c28b107d0a6d54bac87beb1f753354a742cf65a5ff0c9c3d
SSDEEP 49152:U+E/z+E3+ES+E7+EXqatglk+E/z+E3+ES+E7+EXqatglqwMW:mMfMw
TLSH
T1DCB51805FA4640B2D8260170488792BE9B70B915CB138EDBA2989FEEFFF37D05935674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 f11c6a1c65afe6ea4e013f5ac7ab22337fdb4c69a4c4d4f0c25220c115579d2a
MD5 1abda8a7277a3ce5fd1761cc508577ba
SHA1 d2bed5af5e1beb6475a71eca2ca1547e03091589
SHA512 7a125862cdc434a3830cad2a78132356e18302013fb08ed65cf7112bab7db079760777fb07312a7012251654ec8fa0f017308a3d3398060baff034bd7ddde720
TLSH
T1F5110654F0F69C57F83278DA5615ABE32DE1778F2C6C6A98231D831CB345C368E514D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/628-7-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/628-0-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/1208-36-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/1208-26-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/2256-89-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/4992-60-0x0000000003070000-0x0000000003071000-memory.dmp

Download

memory/5908-87-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download