cd5695cb2eaa2f637d1b3bfe007a4ff91f0774e956daca474f498d7338107acf

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_0563989962ad5916d723e1e08649cc62_elex_glassworm_icedid_njrat_vidar.exe
Size 8.1MB
Sample260828-24v8dsed29
SHA256 cd5695cb2eaa2f637d1b3bfe007a4ff91f0774e956daca474f498d7338107acf
MD5 0563989962ad5916d723e1e08649cc62
SHA1 5f44705c283f5407a5f998b6b06e94621ed3d9c5
SHA512 4dbd197a6f9e03705ea26f1f5072aa1af3763e352e4200d8bb273523c6272abf5cd19be613f3b4ce40ddc0b282b17aa460ee7ce36dd208913ae3847d55ee29e2
SSDEEP 49152:U+ES+Ej+ES+ES+Ej+ES+ES+Eb+ES+Ej+ES+ES+Ej+ES+ES+EJozMlTzQ/7YGsTja:g1MbQ9yDAD7KjjqkusjmqMh0
TLSH
T162867C2DEBA481E5F9ABD47898ABC276FA717A110833574BCAD1C61F6F336524C18331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2956	svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe
3508	svchost_CCCABACAACCCCCACABACBACBACABBABBACABBBACBCCBCBCBBAABCCB.exe
3712	svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBCACCCAABCCACCAACAAAABCACBABCBCCACCCCAABCCCABCCBAABACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe"	2026-08-28_0563989962ad5916d723e1e08649cc62_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBACCAAABACABBBAAACCCCABCBCCAAACACBAACAACCCAACCCCCBBACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCABACAACCCCCACABACBACBACABBABBACABBBACBCCBCBCBBAABCCB.exe"	svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4896	sc.exe
1880	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3984	cmd.exe
4028	cmd.exe
1968	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_0563989962ad5916d723e1e08649cc62_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABACAACCCCCACABACBACBACABBABBACABBBACBCCBCBCBBAABCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2852	2026-08-28_0563989962ad5916d723e1e08649cc62_elex_glassworm_icedid_njrat_vidar.exe
2852	2026-08-28_0563989962ad5916d723e1e08649cc62_elex_glassworm_icedid_njrat_vidar.exe
2852	2026-08-28_0563989962ad5916d723e1e08649cc62_elex_glassworm_icedid_njrat_vidar.exe
2852	2026-08-28_0563989962ad5916d723e1e08649cc62_elex_glassworm_icedid_njrat_vidar.exe
2956	svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe
2956	svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe
2956	svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe
2956	svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe
3508	svchost_CCCABACAACCCCCACABACBACBACABBABBACABBBACBCCBCBCBBAABCCB.exe
3508	svchost_CCCABACAACCCCCACABACBACBACABBABBACABBBACBCCBCBCBBAABCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	2026-08-28_0563989962ad5916d723e1e08649cc62_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2956	svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe
Token: SeDebugPrivilege	3508	svchost_CCCABACAACCCCCACABACBACBACABBABBACABBBACBCCBCBCBBAABCCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2844	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 3984	2852	2026-08-28_0563989962ad5916d723e1e08649cc62_elex_glassworm_icedid_njrat_vidar.exe	100
PID 3984 wrote to memory of 2984	3984	cmd.exe	102
PID 2956 wrote to memory of 2764	2956	svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe	104
PID 2764 wrote to memory of 3744	2764	notepad.exe	105
PID 2852 wrote to memory of 4028	2852	2026-08-28_0563989962ad5916d723e1e08649cc62_elex_glassworm_icedid_njrat_vidar.exe	109
PID 4028 wrote to memory of 4896	4028	cmd.exe	111
PID 2852 wrote to memory of 1968	2852	2026-08-28_0563989962ad5916d723e1e08649cc62_elex_glassworm_icedid_njrat_vidar.exe	112
PID 1968 wrote to memory of 1880	1968	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-28_0563989962ad5916d723e1e08649cc62_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_0563989962ad5916d723e1e08649cc62_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABABABBCAACACBABBBBBBAABCBBBACCAABCAACACBBCCBCCBBACCABAACACCBBCACAAAACCBBCCCACBAACCBAABAACBCBBBACABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABABABBCAACACBABBBBBBAABCBBBACCAABCAACACBBCCBCCBBACCABAACACCBBCACAAAACCBBCCCACBAACCBAABAACBCBBBACABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCBABCCBCCCBBBBABAABCACBAAACBAACCCBBCACBCAAAACCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe" start= auto displayName= "UserDataSvc_ACBCBABCCBCCCBBBBABAABCACBAAACBAACCCBBCACBCAAAACCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCBABCCBCCCBBBBABAABCACBAAACBAACCCBBCACBCAAAACCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe" start= auto displayName= "UserDataSvc_ACBCBABCCBCCCBBBBABAABCACBAAACBAACCCBBCACBCAAAACCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCBABCCBCCCBBBBABAABCACBAAACBAACCCBBCACBCAAAACCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCBABCCBCCCBBBBABAABCACBAAACBAACCCBBCACBCAAAACCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3744

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2844

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABACAACCCCCACABACBACBACABBABBACABBBACBCCBCBCBBAABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABACAACCCCCACABACBACBACABBABBACABBBACBCCBCBCBBAABCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe
1⤵
- Executes dropped EXE
PID:3712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 657a63988d2426762e09d02efd430baa53060099090c8202b15cd40705fa51d6
MD5 180ddab3ef7b2188a8058523b5c72c20
SHA1 1d301af65dcf961b351c0a604dd354703ade22c0
SHA512 61361dfa586ea36b73f3633aa0d5edb1cdd0d9be1b6a7efa3206dfd1760c026def0349610befbd52da8a67d80d5ab984768bb4459419b2a8594e2ead273bb939
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3381a3d54bf33002c20bcf7bf6d17829f932991aad2d52169bd3f3f6e3682cc9
MD5 dd144e4c417161bbfb83fe031b2fd573
SHA1 c9ec89e78070bd589da63e3f929650a9c58cbe11
SHA512 ea2020c7ac37ef4d146195310deb6610aff927aa6fb174c4a2a2f3d2df8179968300be7f544410b5364ed4e3568208c0d5471ea22319dd9ec3ab648384b0a4cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1fcebd91c51d402ce96d5f4683a3688b6b0f2a900f55c502a7ad89b077915bf2
MD5 8bf9a6b235a76a092ee3591df74f5056
SHA1 cb4fdbe65c617248adac96bb528f5fd42eacbd5d
SHA512 5e97f2ada6d3477902751943913b56861034861346d61b149c11c3738a6060b25ef42a6698874f279d40fddcc10e40e7a8e43292037345ab5cdecdccda181800
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3f8cb25ffc02210d75284bc0950a11d73e3be476ae835328fb35d34946a78912
MD5 214c76c6603f9559c5d14c92b239d084
SHA1 b576c70bc212c53bb4135e9f22d532a75e1b3e67
SHA512 0fe9afd7ad38991df1ede665b1f2ffe04d4d2af74313714e9988f0ff72569fd6a74cc560868d4994eb45f76874de60e55847f51b88afaea81327ae3ead18f3fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 eb653ff85e736f8832960313745defd80a757ad7d98ed413535d259a9659aafb
MD5 9fbaca5743c0651982e8470d82648543
SHA1 b2e04604d675f2799bb908d6ec6e7914a73587cb
SHA512 f26622e0cfda0d2335bbe5ebdbecc6af8720679643d34d25608224496c4b8a858f0ea2f55fa06dc96f34cd1a2f1d24c325366ecdf5ec79e65ffe525ee8827b6e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 33e45d69b98381f84ba52281efe8e40c3518d577ad0bd6cd857be0fb26408782
MD5 e4cbe43b745efd7032173d2600b55be5
SHA1 2807db58f8fca987ea81a65165661577a1dd219e
SHA512 74d50649ed0261758959e10452b730fa55228a844f87ff2df8f2c317a02ae88c640ddeeedb913f21a34b010565e2bc677c594a753ff2aee89ff3528f578fc5ff
MD5 SHA1 SHA512

Submit Download

svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCBCBAABCAACABBBACACCBABACCCBBACCBBBCBAACBACCABBBBA.exe
Size 8.1MB
SHA256 cd5695cb2eaa2f637d1b3bfe007a4ff91f0774e956daca474f498d7338107acf
MD5 0563989962ad5916d723e1e08649cc62
SHA1 5f44705c283f5407a5f998b6b06e94621ed3d9c5
SHA512 4dbd197a6f9e03705ea26f1f5072aa1af3763e352e4200d8bb273523c6272abf5cd19be613f3b4ce40ddc0b282b17aa460ee7ce36dd208913ae3847d55ee29e2
SSDEEP 49152:U+ES+Ej+ES+ES+Ej+ES+ES+Eb+ES+Ej+ES+ES+Ej+ES+ES+EJozMlTzQ/7YGsTja:g1MbQ9yDAD7KjjqkusjmqMh0
TLSH
T162867C2DEBA481E5F9ABD47898ABC276FA717A110833574BCAD1C61F6F336524C18331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 a9fee0f6c65e3e7e68d7043f749de3d8b6b5feaa563d1822227eca4d3e9b8ff5
MD5 8046dd4a7e1449fe57dd89c2254b16e3
SHA1 012626013ccf7ddf79153717363782adaadb7191
SHA512 0b36624d0a8ce5c3550e2a0f3e6d288e059111724b524acd303ab39313ffb58a495135a87e00ccba216022de33c563fa66237b94c5459134c8015388995b8629
TLSH
T1D011EE41E0F5DC13E53228DB9719DEC3ECD5779FACAC6A1423089118AB54C71CF591D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2764-60-0x0000000005050000-0x0000000005051000-memory.dmp

Download

memory/2852-0-0x0000000000820000-0x0000000000841000-memory.dmp

Download

memory/2852-7-0x0000000000820000-0x0000000000841000-memory.dmp

Download

memory/2956-36-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/2956-26-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/3508-87-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/3712-89-0x0000000000730000-0x0000000000751000-memory.dmp

Download