f93effc4d28197fd9217fe1cbf3012ef4a5185911ff91ad9d055e82876590a15

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_a4bb80b2d3ee31e62d351d6de649ef01_elex_glassworm_icedid_vidar.exe
Size 19.4MB
Sample260827-nerl1sswft
SHA256 f93effc4d28197fd9217fe1cbf3012ef4a5185911ff91ad9d055e82876590a15
MD5 a4bb80b2d3ee31e62d351d6de649ef01
SHA1 2609bbda04d995218dd664c1cd35baa0dd20ca7f
SHA512 e4e36a749c87e8c77798b99da9ff9844f6e3209f78cf9c22e16a0e7a22edf28627b615a5300280a35489fb351752c5592087d159c2ad500eb372365504f62637
SSDEEP 49152:U+Ecj+E3+ES+E7+EBqatglK+Ecj+E3+ES+E7+EBqatglK+EcNR+Ecj+E3+ES+E7o:Evk1vk1vk1vk1vk1vk1vk1vk1vkA4Tu
TLSH
T186272C05FA8640B1E4270170489BD2BF4A70B915CB138EABE2489FDFFBB3BD05925675
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c583-18.dat	INDICATOR_EXE_Packed_Fody

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1556	svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe
4884	svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe
3724	svchost_CABCCACBCAACCBACAACBBBAACCCBCCBBBACABCBCCBABABCABCCAABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAAABBCBACBACBAABACABCACBBABBBCCAACABBBBCACCACABACBAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe"	2026-08-27_a4bb80b2d3ee31e62d351d6de649ef01_elex_glassworm_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACABCBCACCACCCCBABAACACACBAACCBABBCCACAACCCCACBCBCBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCCACBCAACCBACAACBBBAACCCBCCBBBACABCBCCBABABCABCCAABA.exe"	svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2692	sc.exe
4708	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5812	cmd.exe
5984	cmd.exe
5692	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCCACBCAACCBACAACBBBAACCCBCCBBBACABCBCCBABABCABCCAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_a4bb80b2d3ee31e62d351d6de649ef01_elex_glassworm_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3372	2026-08-27_a4bb80b2d3ee31e62d351d6de649ef01_elex_glassworm_icedid_vidar.exe
3372	2026-08-27_a4bb80b2d3ee31e62d351d6de649ef01_elex_glassworm_icedid_vidar.exe
3372	2026-08-27_a4bb80b2d3ee31e62d351d6de649ef01_elex_glassworm_icedid_vidar.exe
3372	2026-08-27_a4bb80b2d3ee31e62d351d6de649ef01_elex_glassworm_icedid_vidar.exe
1556	svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe
1556	svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe
1556	svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe
1556	svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3372	2026-08-27_a4bb80b2d3ee31e62d351d6de649ef01_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	1556	svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 5812	3372	2026-08-27_a4bb80b2d3ee31e62d351d6de649ef01_elex_glassworm_icedid_vidar.exe	92
PID 5812 wrote to memory of 6084	5812	cmd.exe	94
PID 3372 wrote to memory of 5984	3372	2026-08-27_a4bb80b2d3ee31e62d351d6de649ef01_elex_glassworm_icedid_vidar.exe	95
PID 5984 wrote to memory of 2692	5984	cmd.exe	97
PID 3372 wrote to memory of 5692	3372	2026-08-27_a4bb80b2d3ee31e62d351d6de649ef01_elex_glassworm_icedid_vidar.exe	98
PID 5692 wrote to memory of 4708	5692	cmd.exe	100
PID 1556 wrote to memory of 2364	1556	svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-27_a4bb80b2d3ee31e62d351d6de649ef01_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_a4bb80b2d3ee31e62d351d6de649ef01_elex_glassworm_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACACACAAABABACACCBCCABBAABAABBCABBBCCCACCABCABAACBABAAACCCCABAABBBBCBBACACCACACCAACABACCCCABCBCCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACACACAAABABACACCBCCABBAABAABBCABBBCCCACCABCABAACBABAAACCCCABAABBBBCBBACACCACACCAACABACCCCABCBCCCCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACBABBABAAACBBABACACAACAACBAABCCACCCAACACACAAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe" start= auto displayName= "UserDataSvc_CAACBABBABAAACBBABACACAACAACBAABCCACCCAACACACAAABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACBABBABAAACBBABACACAACAACBAABCCACCCAACACACAAABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe" start= auto displayName= "UserDataSvc_CAACBABBABAAACBBABACACAACAACBAABCCACCCAACACACAAABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACBABBABAAACBBABACACAACAACBAABCCACCCAACACACAAABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5692
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAACBABBABAAACBBABACACAACAACBAABCCACCCAACACACAAABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe
1⤵
- Executes dropped EXE
PID:4884

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCACBCAACCBACAACBBBAACCCBCCBBBACABCBCCBABABCABCCAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCACBCAACCBACAACBBBAACCCBCCBBBACABCBCCBABABCABCCAABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1022af90a194f317b9b00c1e52729afeefcebd3aa1b2e641d9b62e2ea75c581c
MD5 24c52f6899d2e08a1050bcd67ec89c75
SHA1 8445cf5dfcf142f61fab5888c4d97978672193b0
SHA512 059d0b97454de57c2af157b86dba6d4c3b918360b8559fefd5b5f8442902357bf07f287b52e8328d91e58735cccb0d47c4aa5e11935d1b3f67bfcaf349708fb6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 47bc0a7ed65dffb9a9c2599c3014c298cfc81f2ed148acede928d8469baff36d
MD5 979e8f5a4d014600098561f800fd0bff
SHA1 e536b5da0bdbf7f1684d3496b09bd9129062113a
SHA512 886e04bb922d2000c9b8592652990abf33584e8cc21f9ebc08d2c5a2aaa1e353546a61b97c3428a1b5bb5b56cb98fc7cc68662d739ab9937709a55524703841a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 96f4419efa4beac7006a95d489f03c649c3040566be43b80ed10cc86d40d1641
MD5 35b52611e859e813f427bf4765d32d2c
SHA1 b49fde964b4de16f12ad5199a4038aa736620de2
SHA512 2bc4ad3136a4407924f474ad0af3b3b1100f9aa4c9105a6cebc8b47508b19b8b595e9445c5a0b66283abdd5cde6f9a48957c5f6762569fe3f07c869c88e82bcb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 96499ec381768355cc07c2d0e6cdfe668bbf1f5ac9155782ef30fd6c9052b7ae
MD5 2e8a8d3b7678b99a4d7de13cd3c398eb
SHA1 4f9db710b1afb2dbca17a90294bde51a7a121465
SHA512 c87a6c35e790a088294721719f5ef8ea242fdd08078a4993d988cc3ac8ec55707d260df83369f13d9377c5698cc1e10d6e98ae7fbdd05d149af887a14a742e40
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6d020d383b01dc18c7f4f7fc59c6e7495db1ffaea195de9f85ef0d9e4c7af904
MD5 5f6d10b5b3feb29ae081a0443c76718d
SHA1 f937e4ae04d057cea68583e2942ef2c90ab3ec7e
SHA512 421bcd7549573de0e24ff1bd1543579e809dac8b0aed54f4a26fffb1fff8286ca4dae7f33bf0093d4f5d24ee960c0885f21960b0217fb36c3e7373f058576842
MD5 SHA1 SHA512

Submit Download

svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCCCAAABACCBCCBAACBBAABCBBACAACBBACABCBABABBCCCCAC.exe
Size 19.4MB
SHA256 f93effc4d28197fd9217fe1cbf3012ef4a5185911ff91ad9d055e82876590a15
MD5 a4bb80b2d3ee31e62d351d6de649ef01
SHA1 2609bbda04d995218dd664c1cd35baa0dd20ca7f
SHA512 e4e36a749c87e8c77798b99da9ff9844f6e3209f78cf9c22e16a0e7a22edf28627b615a5300280a35489fb351752c5592087d159c2ad500eb372365504f62637
SSDEEP 49152:U+Ecj+E3+ES+E7+EBqatglK+Ecj+E3+ES+E7+EBqatglK+EcNR+Ecj+E3+ES+E7o:Evk1vk1vk1vk1vk1vk1vk1vk1vkA4Tu
TLSH
T186272C05FA8640B1E4270170489BD2BF4A70B915CB138EABE2489FDFFBB3BD05925675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1556-22-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/1556-35-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/3372-6-0x0000000000D40000-0x0000000000D61000-memory.dmp

Download

memory/3724-72-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/4884-66-0x0000000000140000-0x0000000000161000-memory.dmp

Download