0b34bb8fd34ca56f956ec8c397b83ebca871e06c2245dc287c2e4fc683765ef6

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_00b351ab4c7c1c0107db83936f20042b_elex_glassworm_icedid_njrat_vidar.exe
Size 7.9MB
Sample260830-2h8atsdf86
SHA256 0b34bb8fd34ca56f956ec8c397b83ebca871e06c2245dc287c2e4fc683765ef6
MD5 00b351ab4c7c1c0107db83936f20042b
SHA1 0a8d3dc449d11d4a2fee73bece7c807d1c660e70
SHA512 804f7a7fd62f838c6c4ecabd98c6832c8a9462ef0ca0d2107f4376a1c4216270afd9d13debba84ada9bcdd9d00a64e92fee5fd77b90c3aaccd7a6a9e3166773b
SSDEEP 49152:U+Ej+ES+ES+EYC5E+Ej+ES+ES+EYC5iozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJr+:q5a5i1MbQ9yDAD7KjjqkusjmqMhP
TLSH
T1F0865C2DABF481E5F9ABD978987BC272FA727A100933530F8991C21E6F335914D29731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2652	svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe
2072	svchost_ABABCBBAABACABAAACABBACCCBBCBBCCBAAABBCCBCCBBCABACBCABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACAACABCABBCACAABBBAAACCBBBAACBBBBAAACCCCCBAAACAAACABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe"	2026-08-30_00b351ab4c7c1c0107db83936f20042b_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCABCBCACBBABACBCCCCCBBACBCAABCCBACCBBACAAACBCBCAACBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABCBBAABACABAAACABBACCCBBCBBCCBAAABBCCBCCBBCABACBCABB.exe"	svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5360	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABCBBAABACABAAACABBACCCBBCBBCCBAAABBCCBCCBBCABACBCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_00b351ab4c7c1c0107db83936f20042b_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5924	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4524	2026-08-30_00b351ab4c7c1c0107db83936f20042b_elex_glassworm_icedid_njrat_vidar.exe
4524	2026-08-30_00b351ab4c7c1c0107db83936f20042b_elex_glassworm_icedid_njrat_vidar.exe
4524	2026-08-30_00b351ab4c7c1c0107db83936f20042b_elex_glassworm_icedid_njrat_vidar.exe
4524	2026-08-30_00b351ab4c7c1c0107db83936f20042b_elex_glassworm_icedid_njrat_vidar.exe
2652	svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe
2652	svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe
2652	svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe
2652	svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	2026-08-30_00b351ab4c7c1c0107db83936f20042b_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2652	svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 5360	4524	2026-08-30_00b351ab4c7c1c0107db83936f20042b_elex_glassworm_icedid_njrat_vidar.exe	91
PID 5360 wrote to memory of 5924	5360	cmd.exe	93
PID 2652 wrote to memory of 3952	2652	svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-30_00b351ab4c7c1c0107db83936f20042b_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_00b351ab4c7c1c0107db83936f20042b_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACACBCCBABBABBBCCACBCBBCACBCACBCBAAAACBCABCCCCABAACCBCABCAABAACCACBBACBCBBACAACACBBBBBCCCBBCBABCAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACACBCCBABBABBBCCACBCBBCACBCACBCBAAAACBCABCCCCABAACCBCABCAABAACCACBBACBCBBACAACACBBBBBCCCBBCBABCAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBAABACABAAACABBACCCBBCBBCCBAAABBCCBCCBBCABACBCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCBBAABACABAAACABBACCCBBCBBCCBAAABBCCBCCBBCABACBCABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cf233f98b33829b2eb496b8330239c94150a2faa2d9481962d6bd497f5d4e998
MD5 23a1725686c8cc87e349ebd656187be8
SHA1 83bf025fa6bbb750bd4876dd1e01f237d9c56a4c
SHA512 1dfc2e00ced5a2de2bef551e4b665b223e9034f1cea9a0b419020af71e5d43f93fcbee1ccfc9ad631fdfcf8745205ed9cf96c1462c7b86755afcd5b66462d35c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eb82797b861f2888e71340025fe6cf67967b89c2727057d1196366134049490b
MD5 086bd4ab1e5a8e2a25cbf5b7a2511666
SHA1 c20cec8d2d3f59b7e47e94bc9e3f75e5c48d518c
SHA512 7e6e18d8c163479f54f3315591ea2bdf38640cbed221139ae77d77c0c7506b679ad9cb8ad89d89563ad8c0398de75e529bb976901bcc2251a34c1bb592916ac5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eb4e5f2882b5b3956d1058a9eff2d8d4232c51dc63cf57168ead392e8caa9a68
MD5 9d081661e3fdf62afbf9e12be9b0846e
SHA1 06baba5da927cc4fe0df6a0b697aa7138484049e
SHA512 bc6682246421697b2dd67448cd5f31c0608a78c6770a9826b3160f4dbd1ec58f74c98f3c8252eaac151e18a6864fe8acd0c11f38a8febc026301c635c4ff680e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 48a9226c4005f596057c49400afea6f2cc7567070178a27113adfd73d96bb7e1
MD5 c12a7452ed914609b6a71c79c089f01a
SHA1 58acfe6c7bc37fcc83aa5f081b33fe1d8bae186c
SHA512 9fcceea287386c03720d8b2eb4d50e2587e0d9ec705debc4db43704be59b7480a7cf9d1774e987e6499d6fe7fa6e457f0d7065945c81cb0f6dd3878ac227c24e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f5fc29671a1d4166416a7400555c535e921b296fc2b281843a3e7818062031b7
MD5 ba15122b2a7d8a2540af570def271359
SHA1 34db9c385ac1a843ff7bf1cec308719012d854cf
SHA512 fb61f9697e264ceec1bba87ab8e7876b1c5e5824f649720cff38dabef79c2e1bf2850d39856b641441d1bc0d2ff178ea540533f10300458995759eb5a9e2f868
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 06f32efe865d48484422fa4c499e7c5c9d318910631c230d1a03bd7c9df907a1
MD5 f5c7625de8df1ed433ed5f34a902669a
SHA1 4ed4bb36b07866c05c47f7969870f444dcc50f08
SHA512 4301c8c3d9fedb1766d5dead915c5fc8f6d4249f5bf751d60696bae4e5c8b32a463fe647462064e2ca0e959e9fccc4e19551c1cbae2d27f869dbc2052e6c9c73
MD5 SHA1 SHA512

Submit Download

svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBBCBCBACCCACCACCCCBBAACAABCBBCBBACBCCCBBBCCABBAAAC.exe
Size 7.9MB
SHA256 0b34bb8fd34ca56f956ec8c397b83ebca871e06c2245dc287c2e4fc683765ef6
MD5 00b351ab4c7c1c0107db83936f20042b
SHA1 0a8d3dc449d11d4a2fee73bece7c807d1c660e70
SHA512 804f7a7fd62f838c6c4ecabd98c6832c8a9462ef0ca0d2107f4376a1c4216270afd9d13debba84ada9bcdd9d00a64e92fee5fd77b90c3aaccd7a6a9e3166773b
SSDEEP 49152:U+Ej+ES+ES+EYC5E+Ej+ES+ES+EYC5iozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJr+:q5a5i1MbQ9yDAD7KjjqkusjmqMhP
TLSH
T1F0865C2DABF481E5F9ABD978987BC272FA727A100933530F8991C21E6F335914D29731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2652-35-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Download

memory/4524-0-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/4524-8-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download