2c4ebdc94ff93af99bb3b4c40499d2bdda578c030229485efb2a018611bbcc6e

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_93a228f68ef4668fbde128172888a7e8_elex_glassworm_icedid_vidar.exe
Size 7.1MB
Sample260827-prennavcqa
SHA256 2c4ebdc94ff93af99bb3b4c40499d2bdda578c030229485efb2a018611bbcc6e
MD5 93a228f68ef4668fbde128172888a7e8
SHA1 47149cfac6705bb5a67ea89dd5dc685a39568a6a
SHA512 218c75676d48fe2dac9d270154898856038aa903bf396be5058a739b253066c5cbfe75e9648a4e8f99dc7e6248d2a9aa8ae9dac39f4b40dba112a6a65fc1a97a
SSDEEP 49152:U+Ecj+E3+ES+E7+EBqatglK+Ecj+E3+ES+E7+EBqatglK+EcNR+Ecj+E3+ES+E79:Evk1vko1/tr37wY
TLSH
T1B5765B06FA5580B1D42B81704857D27FD6307C19CB229EEB96848AAFBFB37D05A39731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1648	svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe
2004	svchost_BABACBBAABBBBAACCBBCCCABABABCBBBCCCCBBBBACACBACAACCBBCA.exe
2036	svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBABBAACCACACABCBBACBACCBACBACBBACBCBAACCABCCBBBABBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe"	2026-08-27_93a228f68ef4668fbde128172888a7e8_elex_glassworm_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBCBBBBCAABCBCCCAAAAABCCBBACCCCBABBAABBBAAABCAABABCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABACBBAABBBBAACCBBCCCABABABCBBBCCCCBBBBACACBACAACCBBCA.exe"	svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1380	sc.exe
4880	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3648	cmd.exe
2508	cmd.exe
5332	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_93a228f68ef4668fbde128172888a7e8_elex_glassworm_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABACBBAABBBBAACCBBCCCABABABCBBBCCCCBBBBACACBACAACCBBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4956	2026-08-27_93a228f68ef4668fbde128172888a7e8_elex_glassworm_icedid_vidar.exe
4956	2026-08-27_93a228f68ef4668fbde128172888a7e8_elex_glassworm_icedid_vidar.exe
4956	2026-08-27_93a228f68ef4668fbde128172888a7e8_elex_glassworm_icedid_vidar.exe
4956	2026-08-27_93a228f68ef4668fbde128172888a7e8_elex_glassworm_icedid_vidar.exe
1648	svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe
1648	svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe
1648	svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe
1648	svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	2026-08-27_93a228f68ef4668fbde128172888a7e8_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	1648	svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 5332	4956	2026-08-27_93a228f68ef4668fbde128172888a7e8_elex_glassworm_icedid_vidar.exe	92
PID 5332 wrote to memory of 3520	5332	cmd.exe	94
PID 1648 wrote to memory of 5956	1648	svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe	95
PID 4956 wrote to memory of 3648	4956	2026-08-27_93a228f68ef4668fbde128172888a7e8_elex_glassworm_icedid_vidar.exe	98
PID 3648 wrote to memory of 1380	3648	cmd.exe	100
PID 4956 wrote to memory of 2508	4956	2026-08-27_93a228f68ef4668fbde128172888a7e8_elex_glassworm_icedid_vidar.exe	101
PID 2508 wrote to memory of 4880	2508	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-27_93a228f68ef4668fbde128172888a7e8_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_93a228f68ef4668fbde128172888a7e8_elex_glassworm_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAAACACBBBBBCCCACCBCCACBBCACACACBCBCCACABBCBBBBABABBAABCBABCCBACCAAABBAAABCAACABCCAACCCAABCBAABCCCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAAACACBBBBBCCCACCBCCACBBCACACACBCBCCACABBCBBBBABABBAABCBABCCBACCAAABBAAABCAACABCCAACCCAABCBAABCCCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAACBAABAABBCABAACCAACBCBBABBBABCCCAAABCCBCABCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe" start= auto displayName= "UserDataSvc_CAAACBAABAABBCABAACCAACBCBBABBBABCCCAAABCCBCABCAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAACBAABAABBCABAACCAACBCBBABBBABCCCAAABCCBCABCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe" start= auto displayName= "UserDataSvc_CAAACBAABAABBCABAACCAACBCBBABBBABCCCAAABCCBCABCAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAACBAABAABBCABAACCAACBCBBABBBABCCCAAABCCBCABCAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAACBAABAABBCABAACCAACBCBBABBBABCCCAAABCCBCABCAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAABBBBAACCBBCCCABABABCBBBCCCCBBBBACACBACAACCBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBBAABBBBAACCBBCCCABABABCBBBCCCCBBBBACACBACAACCBBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe
1⤵
- Executes dropped EXE
PID:2036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fc253ac1874b3f71f827428e1e3e1dccf4dbec6bb6e7c684937a0af32c5f437c
MD5 4f6fc08550b01412b47975c953398577
SHA1 f1ea1682e5a35532495f8121f6ed3aa6e50ec0aa
SHA512 a2d1fb2047b189085adbf5b3206aa1cae19ccbf187c2ab9136b260e348887e5df053453ce4af720b97bff58fb5d6664dcba14e52f5adc07931e59977a3eaa166
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 992c79fdf3d0db9c187748a17dd263cb1f33d04a51d13c579fa56a05d2b95060
MD5 c11fcf783b98c64755de94b058db9cc7
SHA1 1016d66c97ec371b69ea9f191a84ba3945c0079d
SHA512 c7affe6f362a8ef084338b633558f0f72a8a01219c2973d237a1bc3e7f5da289d204c5ef973ac52cc13d48ba1ca8cdaf150764edab9c4ddb41ef0a4b83797d84
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1b933dbef26dd2c9abee1c24e44e1757b21bd70af0c682e135d6f63ee6b07ce1
MD5 1bf8c3f9452cd846b35b6cafeaba114e
SHA1 a6304e92839340ec829fb249af42462831b04ee5
SHA512 2bcb2a2167a45c8f0f15acf4acf4c37e007249753a3e4f85019145e1cbdee29a79a19e9188eee40c5c77b1a93174629132389c6bdd893ee7c77bc8d24dd7a3ff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fc91864ec7a2c9111be09f7fb93e4ce3b343172285fa0ab3101fd0baf7884366
MD5 0472c2451bab468baeaafa37f7a441a2
SHA1 e958b8f99796cf9398ae676329e54bec8c1398d7
SHA512 364cf33aad5d909ced2206666e7bc0d6e35ed486fa183b37de743691a62c1329c3b9b3b6445640019cf88a369310f97092a12e4293b92e70b2699b65a04c08bb
MD5 SHA1 SHA512

Submit Download

ReceiveNew.exe

Path C:\Users\Admin\Downloads\ReceiveNew.exe
Size 768KB
SHA256 c745853f3aa0cac4a6df53b2a5abe32d2567b7c5f1284a27e2b73dcb42b9a224
MD5 6c0c09975fb979341c32164d63238c8a
SHA1 8eecee2bc50dfad0af7cdefb1512beeef0620a6e
SHA512 bb7cbb43217e413e610f497975cd6ce6c79b6fa70735a6caa7fa5a4f27e1b4a65c891a3fc44f9a0c63da665379741fe5735539d6b322c43591fa66a2f4eb3135
SSDEEP 12288:mgUFgEsnojA9gACGJgUFgEsnojA9gzgUFgEsnojA9gUFgEsnojAKgUFgEsnN+BeZ:m9+EM0qHJ9+EM0qq9+EM0q9+EM0v9+EI
TLSH
T1C7F43A45F98740B2E82B01B14C9BD3FF4A70BA218B128EEBF749835F6933BD09635655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReceiveNew.exe

Path C:\Users\Admin\Downloads\ReceiveNew.exe
Size 10.6MB
SHA256 ec1bcc026326a891ce89f6db58989ad1eabae7f7a40fc739d252e0458967a316
MD5 496bdbab237522d6bbcbbf230297a64e
SHA1 5dac9d3409cae6bd52d5174098ba25a56d367f12
SHA512 6f6655488579910b13f0d11d3343f644f3a47ad8edae76b020e5baee851b8a0422eedb54292de022fc9d53c403f8da5bc7e039f5263b0e1538c7fd778a17a4ec
SSDEEP 49152:U+Ecj+E3+ES+E7+EBqatglK+Ecj+E3+ES+E7+EBqatglK+EcNR+Ecj+E3+ES+E7J:Evk1vko1/tr37w7vk11
TLSH
T196B63A05FA8640B1D42B41704897D2BFD630BD19CB139EABE6488A9FBFB37D05A35631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReceiveNew.exe

Path C:\Users\Admin\Downloads\ReceiveNew.exe
Size 384KB
SHA256 51b8055100b201e843cd2c3f49fd891b34fb4e869b2808f175530b0194822412
MD5 9d1f990037e7530628cfa1834dae3e93
SHA1 73d921824457352741329900a11f5792a75e5c55
SHA512 6cf26a98f3ace9839169eb0d0637224cdeabc4ce70c3ce2ad2411a575322ed625b2f58c2cfd89cca98648c0f9eae26cb6ae83a7f793c4aba2547a4a1b2469aa2
SSDEEP 6144:m+dTTUFgEs3XojAdP+dTTYNV43WJ+dTTUFgEs3XojAdP+dTTz+dTTUFgEs3Xom:mgUFgEsnojA9gACGJgUFgEsnojA9gzgb
TLSH
T12E842A05F9C740B1E87B51B04DDBD2BF8930BB2586128DFBF64D874BA933F919824626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e6916d6e4a26be69ecd5d885cb9b017911052dab9aba0b6a5411cdc96acd639f
MD5 4a451d4bf07866e8215679517e8a71e8
SHA1 54e388f5a91bd082654aecc4fd833f6ada408af9
SHA512 ff116b08a22b2e66b41f872ad3e88dc434b99a47e30ed56800de6047e1162c2bae615b061914d141a0669b24498bd874f20c62a8c33e8c6f5a43c30e6c22fcb5
MD5 SHA1 SHA512

Submit Download

svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBBCAACAAABAABCBCBAABCBCCABAABABCCAAABABABCBBABCBA.exe
Size 7.1MB
SHA256 2c4ebdc94ff93af99bb3b4c40499d2bdda578c030229485efb2a018611bbcc6e
MD5 93a228f68ef4668fbde128172888a7e8
SHA1 47149cfac6705bb5a67ea89dd5dc685a39568a6a
SHA512 218c75676d48fe2dac9d270154898856038aa903bf396be5058a739b253066c5cbfe75e9648a4e8f99dc7e6248d2a9aa8ae9dac39f4b40dba112a6a65fc1a97a
SSDEEP 49152:U+Ecj+E3+ES+E7+EBqatglK+Ecj+E3+ES+E7+EBqatglK+EcNR+Ecj+E3+ES+E79:Evk1vko1/tr37wY
TLSH
T1B5765B06FA5580B1D42B81704857D27FD6307C19CB229EEB96848AAFBFB37D05A39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1648-49-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/1648-34-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/1648-71-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/2004-93-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/4956-48-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/4956-0-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/4956-70-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/4956-23-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/4956-12-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download