4ebb16b55bedc1b73ed996c175a10381e6c403bccc89a75e9824bdcf4f1aba40

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
Size 12.5MB
Sample260903-mefdbage95
SHA256 4ebb16b55bedc1b73ed996c175a10381e6c403bccc89a75e9824bdcf4f1aba40
MD5 6b30e9ae3218a7e40ab30b0381bed949
SHA1 f4e14971d5277076f6090d9309ec69c93c1c8340
SHA512 3e4d3f5686f8167e066a88e5e273edf0794e6fcb311e8ed002960ec8fa2c31921aaafc3e699c5aaf3464406d1a3ee58f5a0e70c4543895edd11bd4346bb9f499
SSDEEP 49152:U+En+En+En+En+En+Ez+En+En+En+En+En+En+En+En+En+En+Ez+En+En+En+Ew:y1MbQ9yDAD7KjjqkusjmqMhO
TLSH
T17ED68D28FAE584F1F97B90744CABC27ADA717A214533479BDA99C60F6E337914C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3136	svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe
2840	svchost_BBCBACACBBBBAABCCBBABBAAAABBCCACBABBAACBCCBCACBABBACBAA.exe
2732	svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBABCACBCAACACAACAABBACCBCBCABAABBCCACABABCACBAACCACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe"	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCCBACAACBACCAACBCAABCCAABCBAACACCBBBCCBACBAABACBBBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBACACBBBBAABCCBBABBAAAABBCCACBABBAACBCCBCACBABBACBAA.exe"	svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
428	sc.exe
2652	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6056	cmd.exe
1408	cmd.exe
1068	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBACACBBBBAABCCBBABBAAAABBCCACBABBAACBCCBCACBABBACBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4184	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
4184	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
4184	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
4184	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
3136	svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe
3136	svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe
3136	svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe
3136	svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe
2840	svchost_BBCBACACBBBBAABCCBBABBAAAABBCCACBABBAACBCCBCACBABBACBAA.exe
2840	svchost_BBCBACACBBBBAABCCBBABBAAAABBCCACBABBAACBCCBCACBABBACBAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4184	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3136	svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe
Token: SeDebugPrivilege	2840	svchost_BBCBACACBBBBAABCCBBABBAAAABBCCACBABBAACBCCBCACBABBACBAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 6056	4184	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe	92
PID 6056 wrote to memory of 1776	6056	cmd.exe	94
PID 3136 wrote to memory of 2452	3136	svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe	95
PID 4184 wrote to memory of 1408	4184	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe	98
PID 1408 wrote to memory of 428	1408	cmd.exe	100
PID 4184 wrote to memory of 1068	4184	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe	101
PID 1068 wrote to memory of 2652	1068	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAAACBCBBBAABBABCBBCCCABBACCACABAABCCCABBABBABCCBABACBBBABACCBAABBAAABBCAAACCBCAACBCBBAABAAABBACBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAAACBCBBBAABBABCBBCCCABBACCACABAABCCCABBABBABCCBABACBBBABACCBAABBAAABBCAAACCBCAACBCBBAABAAABBACBBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBAAACAACBAACBABBABCBACABCCCACBABBAACABCCCAAABBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe" start= auto displayName= "UserDataSvc_ACBAAACAACBAACBABBABCBACABCCCACBABBAACABCCCAAABBBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBAAACAACBAACBABBABCBACABCCCACBABBAACABCCCAAABBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe" start= auto displayName= "UserDataSvc_ACBAAACAACBAACBABBABCBACABCCCACBABBAACABCCCAAABBBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBAAACAACBAACBABBABCBACABCCCACBABBAACABCCCAAABBBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBAAACAACBAACBABBABCBACABCCCACBABBAACABCCCAAABBBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2652

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACACBBBBAABCCBBABBAAAABBCCACBABBAACBCCBCACBABBACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACACBBBBAABCCBBABBAAAABBCCACBABBAACBCCBCACBABBACBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe
1⤵
- Executes dropped EXE
PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 178e12f10e93b61d152f6f12ede3c0a2cc4bfd04d8b0a96106ff14ab225d9401
MD5 99fa0f235f6fe46464b62f1379778b26
SHA1 16da6a3fa5be21466ff4abe95361f5c374ec47d6
SHA512 9b8392e7aae493b8fcf25a5c7816025b4bf04cd346c07225dd0e8b33355a3155f97a7e08d5aca50733adbb8cdd87c77f37a7af749394c89a00f29914edc184ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3d65220ba2e34f72475567f8e504f6e8265abc6b1acc37548e5d100768abdffc
MD5 0b7eeea588def5a91f6859933d5a4235
SHA1 10b2e31f11129b04d0ca3bee5d06de06b1babe9e
SHA512 83798757582bc262a92ff04b709156271c04bd4f37f75011a8ddca5948a75c6d8841f370c0e1894233c02adbf3664f0124928acccbb08e219bdde7f6ac728720
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1972f951ad4273a01398793ae1823f439a0303535787831efa30d6c70b1a855c
MD5 350cf1a46652961369894bb8e57e57ac
SHA1 609109c109b9da77e8fdd26c52443c126494714f
SHA512 f1b41c317297771f93412736c47ad68609033b7ed5750d7e9b56ece76139088b0cb1f515acc2cd0f4d5f3fe3cf6a993b1d71a5dc08eb868dd77c40e1e62b615c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8595caf7c3b9075bb3dc81e35c86cb4e998ec779dd2d17002575e0c41bb0f2d7
MD5 10efaf46a67676aa42a15bd4c96436f8
SHA1 993432e92d814827528a62ac0c99487e051819a0
SHA512 afe89283adfce383caa3eeb3ec3cd64e677ff2465332d469701c48eb93cc0d1882af99e3354854b8e1d1209c81e0d64515de9a65d698fbb0e25e0d55d1eae2e4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 66d9f61486aed8ac307f4308d43640459a0a3426497883a80a91814da990d67b
MD5 774592f80b0f85d80af114d85a1ff5fc
SHA1 56993889c64f558fe91d09248d47f16e79e4ce05
SHA512 8d0ab4baac0202b3cfc23bb2b28a24a8f4ace2d5e568171088d864b492b9fed9bdcd2f363b03052796477f26486e208a7322b01bd8f5e0a46a2c83b0365f61cd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 016bf644db7fe155402bb855900f915e2f4af5b534b894877e3a51734ce5b9da
MD5 516b15d418a2004f5c14032848d8c7a3
SHA1 80b803cb505b2bf8470797de209a67e293707253
SHA512 b975c750b3a0a76babb8f64c2ff3afd575d92afcf3cb0ca4b5b695052859118a9ec41c39180a4096e9ba9ada8fb3ca6199066ace376e9451c52c3a7ff16ef539
MD5 SHA1 SHA512

Submit Download

svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCACCBCBCCAACBCCABAACCBCBAAACBACCBCCCCBCACBCCBB.exe
Size 12.5MB
SHA256 4ebb16b55bedc1b73ed996c175a10381e6c403bccc89a75e9824bdcf4f1aba40
MD5 6b30e9ae3218a7e40ab30b0381bed949
SHA1 f4e14971d5277076f6090d9309ec69c93c1c8340
SHA512 3e4d3f5686f8167e066a88e5e273edf0794e6fcb311e8ed002960ec8fa2c31921aaafc3e699c5aaf3464406d1a3ee58f5a0e70c4543895edd11bd4346bb9f499
SSDEEP 49152:U+En+En+En+En+En+Ez+En+En+En+En+En+En+En+En+En+En+Ez+En+En+En+Ew:y1MbQ9yDAD7KjjqkusjmqMhO
TLSH
T17ED68D28FAE584F1F97B90744CABC27ADA717A214533479BDA99C60F6E337914C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3dc697424a800bf40e17da8beb828dc08eac8122928b60211b745faa98b1b259
MD5 c538032990f8835ff54ac988a4d29375
SHA1 3a99a105a73e5601c288f8ed01db7b248ec5f1a4
SHA512 79604b47a09cb33a83f5c76d49116a6696d7cc9625004952c959d5074e08d9e7571cd7390332aad63b2bd6bd4cf2dd6bb3bbdf2a499161b2737190803b9d4bc5
TLSH
T14A110491F0B5CC93E03268C37A27CA872CD83BD6A87CABA4231D8118F7489354E194F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2732-82-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/2840-69-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/2840-81-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/3136-31-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/4184-7-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/4184-0-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download