eba62cf77bc1beeaf7b540fac988231ad3737c74e50059ae0e4e43da75f43161

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_078b0fa99152508b9c41c3229e05fdf3_elex_glassworm_icedid_njrat_vidar.exe
Size 8.5MB
Sample260830-15djasap2v
SHA256 eba62cf77bc1beeaf7b540fac988231ad3737c74e50059ae0e4e43da75f43161
MD5 078b0fa99152508b9c41c3229e05fdf3
SHA1 961daee0174885aa4558eee59abe6698c6c95790
SHA512 a11162a606fcf667fcee04f8dd761af83de931e6e9a4f6ce126e6512885c890374b5a845f93cb0912cf92ec099568a2c089f56d56236ebbd01fc9f005d114ef9
SSDEEP 49152:U+ES+ES+E2+ES+ES+EDqsC5t+ES+ES+E2+ES+ES+EDqsC5PozMlTzQ/7YGsTj1VC:05n5P1MbQ9yDAD7KjjqkusjmqMh4
TLSH
T167966B29ABF481E5F9BBD938987BC272FA7279100933535F8991C21E6F336914D28731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5056	svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe
3456	svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe
896	svchost_BAACCACCCAAABABABACCABBCAABBAAAABCACCBBCBBCACABCBCCBAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACACCBCBCAAAAAACBCABABBCCCAACCABAACCACBCBCCBBBCBBCACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe"	2026-08-30_078b0fa99152508b9c41c3229e05fdf3_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABCCACBACCBAACBABACABCCACCAACBBBBABACCCBBBBABCABCAAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACCACCCAAABABABACCABBCAABBAAAABCACCBBCBBCACABCBCCBAAB.exe"	svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3176	sc.exe
4760	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4300	cmd.exe
356	cmd.exe
5756	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACCACCCAAABABABACCABBCAABBAAAABCACCBBCBBCACABCBCCBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_078b0fa99152508b9c41c3229e05fdf3_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3480	2026-08-30_078b0fa99152508b9c41c3229e05fdf3_elex_glassworm_icedid_njrat_vidar.exe
3480	2026-08-30_078b0fa99152508b9c41c3229e05fdf3_elex_glassworm_icedid_njrat_vidar.exe
3480	2026-08-30_078b0fa99152508b9c41c3229e05fdf3_elex_glassworm_icedid_njrat_vidar.exe
3480	2026-08-30_078b0fa99152508b9c41c3229e05fdf3_elex_glassworm_icedid_njrat_vidar.exe
5056	svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe
5056	svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe
5056	svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe
5056	svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe
896	svchost_BAACCACCCAAABABABACCABBCAABBAAAABCACCBBCBBCACABCBCCBAAB.exe
896	svchost_BAACCACCCAAABABABACCABBCAABBAAAABCACCBBCBBCACABCBCCBAAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	2026-08-30_078b0fa99152508b9c41c3229e05fdf3_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5056	svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe
Token: SeDebugPrivilege	896	svchost_BAACCACCCAAABABABACCABBCAABBAAAABCACCBBCBBCACABCBCCBAAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4300	3480	2026-08-30_078b0fa99152508b9c41c3229e05fdf3_elex_glassworm_icedid_njrat_vidar.exe	91
PID 4300 wrote to memory of 5916	4300	cmd.exe	93
PID 3480 wrote to memory of 356	3480	2026-08-30_078b0fa99152508b9c41c3229e05fdf3_elex_glassworm_icedid_njrat_vidar.exe	94
PID 356 wrote to memory of 3176	356	cmd.exe	96
PID 3480 wrote to memory of 5756	3480	2026-08-30_078b0fa99152508b9c41c3229e05fdf3_elex_glassworm_icedid_njrat_vidar.exe	97
PID 5756 wrote to memory of 4760	5756	cmd.exe	99
PID 5056 wrote to memory of 2864	5056	svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-30_078b0fa99152508b9c41c3229e05fdf3_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_078b0fa99152508b9c41c3229e05fdf3_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBCCCAABAAACBBCCCABBCBCBCCAACCCAACCABBCBBACACABAABCCCBCBBBCCCCCBCCABACAAABBACCABBAACCBABACCABCBCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBCCCAABAAACBBCCCABBCBCBCCAACCCAACCABBCBBACACABAABCCCBCBBBCCCCCBCCABACAAABBACCABBAACCBABACCABCBCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACAAACBCAAAACCBCABBCACBCABBACCCAABACBBACABACABAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe" start= auto displayName= "UserDataSvc_CACAAACBCAAAACCBCABBCACBCABBACCCAABACBBACABACABAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:356
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACAAACBCAAAACCBCABBCACBCABBACCCAABACBBACABACABAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe" start= auto displayName= "UserDataSvc_CACAAACBCAAAACCBCABBCACBCABBACCCAABACBBACABACABAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACAAACBCAAAACCBCABBCACBCABBACCCAABACBBACABACABAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACAAACBCAAAACCBCABBCACBCABBACCCAABACBBACABACABAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe
1⤵
- Executes dropped EXE
PID:3456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCCAAABABABACCABBCAABBAAAABCACCBBCBBCACABCBCCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACCCAAABABABACCABBCAABBAAAABCACCBBCBBCACABCBCCBAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9413930b43e5c4f504295b3dd0afbc588f907260435caaba9081bac0fe6f883a
MD5 b54a31b63c4fe4f0ac4d1136e34dd726
SHA1 88e699a25c376785aabb5804e2cb86829de2dc33
SHA512 2bcbc221cabc2cca1e6ddbf3e439b21eacc714507e32a71424e802e092f35284bfa3d4f72c8e8702261c3f45d6d092b9992ad89c712962bf2132e2dfe73b551a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f41ef6d7f68eb704f3c4f21c3849227d0e113564eee4bd98089109b2f3ce8daf
MD5 f4df6066da224ef7de5fc0bb30f5c414
SHA1 fad429230fb2cc63d53b271c24bb85f6d508602b
SHA512 fdef866d3f8eb1aeacf1261a4b7454d12c9bad0df9ff907247192c3adb054653eda2d41b95c5ad1bf23f479d4a21f66d314db333685fcdc3a3abe303631e8e55
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7fc7b9fd659438ed544c4a4ea17a2164c573c2e69c45462d32a295c5f00786d9
MD5 829cc64dd03685f065708e53e016690c
SHA1 f9af3ada7db8878bcf7177e3de0eca58eac03d75
SHA512 0658a97a9aa8a5f0bcf8899cdf0c426b8358b1821b7d98ce563635007505fd33da9bd4360b8e2cad19940ae979290f87814b358e1176438066406d71b93b5f72
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f27466c8bc4b1fbbc022ce86f98f909ff2742823bf44dda12371231d42000a0e
MD5 523edb480e27c93f73f1dd0c75911fcd
SHA1 9e69a8544b187c1b8846427c23810d9d7a523f25
SHA512 ae336f77c1a8f997106c06be562774139c11ae58624718f2260fb7ed734b3444bd81508e016f602ce7bc85109208d8f34d8ad2a0f378f5c2930e851ed3c709fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b41f4d9ddec59303e2fd6ea94b71d846786ea6fb64b067ae9803e0f6dc219f71
MD5 bf56b705ca08bbe311bb7ba2de858cce
SHA1 51f9548e22998f160299199a07c34b8e7c977ff6
SHA512 1fe7797a6ca2362a46aa6005e96933533dbcc4a73400cfa03a318b5e8da5b03c9cf7929b2dec9b1c18646521989b03f517d598e36e17fae5cdcebad3d06397b3
MD5 SHA1 SHA512

Submit Download

RequestConvertTo.exe

Path C:\Users\Admin\Downloads\RequestConvertTo.exe
Size 26.2MB
SHA256 c9288276a19fe7964a7053b407727481af607ea400174eb2cb072acc91aa1493
MD5 b3284dba891aebd887640a083447b36d
SHA1 28ee338197f70ab9fe3fd25a2a71533d9449f112
SHA512 8cfa72bd5c437c6b8be23e59bac0a08a2afeb44a7f282bb4e4a8f48b40b9b8d3fe1e5e37a8330d6c350cd8b95983acf595c6368e5a4c62765ec9f8926d038f9b
SSDEEP 393216:05n5P8KwekyD5n5P8KwekyD5n5P8KwekypHfJ:05n5Nt5n5Nt5n5N3fJ
TLSH
T11C576C29ABF481E5F9BBD938987BC272FA7279100933535F8991C21E6F336914D28731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RequestConvertTo.exe

Path C:\Users\Admin\Downloads\RequestConvertTo.exe
Size 1.2MB
SHA256 d12ad60301367afcbdf729c9414d97c783ee4f77609c6b44dffc521c64842159
MD5 f0fd6cd7940494f85bdd162f025aa939
SHA1 1416c48c54ef6c665ec38f405c9236b9d2752bbb
SHA512 073cd082f01dc0675c6eafa0ca2d7cdb510d791a3dcfe2939095e3fda37c7c3b40c4bc613f1b4f775aa16dad36ef0707e93d6ed324ae364bb77865988248e713
SSDEEP 24576:m9+EM0q9+EM0q9+EM0O9+EM0q9+EM0q9+EMuqURrCn5X9+EM0q9+EM0q9+EM0O9u:U+ES+ES+E2+ES+ES+EDqsC5t+ES+ES+r
TLSH
T1A3553C09FBD71061E97755B04CEBD2BB8D307A2087218AFFE609D71E6932BD09839716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 260dd2e96d915fac124c804d65f9c8659ca4225e8bcccedabe9a62946e8a1deb
MD5 36f3108b4c1831e9f97c89e7b294db4a
SHA1 d0cf9a6f7fae50d5b85e6778177f0f7d7c6e5e2d
SHA512 ce91be270a0745359aacd60c6e74fd058f26382378db0767fd9ffc42f290ac3cc4ad2db8ff97a3038a6b04d0df7c304fc5f0108f81f0e4c34d49ee1f732eeeef
MD5 SHA1 SHA512

Submit Download

svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBAAAABCBCBCCBACACBCABABBCCABCBCCAABCABCCAACCCACB.exe
Size 8.5MB
SHA256 eba62cf77bc1beeaf7b540fac988231ad3737c74e50059ae0e4e43da75f43161
MD5 078b0fa99152508b9c41c3229e05fdf3
SHA1 961daee0174885aa4558eee59abe6698c6c95790
SHA512 a11162a606fcf667fcee04f8dd761af83de931e6e9a4f6ce126e6512885c890374b5a845f93cb0912cf92ec099568a2c089f56d56236ebbd01fc9f005d114ef9
SSDEEP 49152:U+ES+ES+E2+ES+ES+EDqsC5t+ES+ES+E2+ES+ES+EDqsC5PozMlTzQ/7YGsTj1VC:05n5P1MbQ9yDAD7KjjqkusjmqMh4
TLSH
T167966B29ABF481E5F9BBD938987BC272FA7279100933535F8991C21E6F336914D28731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 12fbd576947a920be76a5082ce960dcad29777070fc56fbdc14e46d660315ec8
MD5 a9021071dcd2f0b2c642845bc1e68776
SHA1 17f7478234c3ea85c4903061cccfacbfac434989
SHA512 89f7a6a5143ef546dc1a5ac988805d4d221e44794a848e6f171435588f4740f1b5343890a8d9741c9d93bdb395e3acdfb741a2c56ad5690c150da7dec3244b84
TLSH
T1B7113D10B0F9C493F93268CA9519CEE71CE833DB5C5CAA04230982286BC5872CE594F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/896-109-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/3456-87-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/3480-33-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/3480-83-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/3480-59-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/3480-10-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/3480-21-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/5056-71-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/5056-50-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/5056-32-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/5056-110-0x0000000000650000-0x0000000000671000-memory.dmp

Download