f1741e33627676e9169f50430c3a2857d43b8688da4643d68206c79ce06f6d3b

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_55d3d8400adf0f44e3184f6475b90709_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Size 61.5MB
Sample260907-dmancsvzgy
SHA256 f1741e33627676e9169f50430c3a2857d43b8688da4643d68206c79ce06f6d3b
MD5 55d3d8400adf0f44e3184f6475b90709
SHA1 f0b6ea1c7e20f74eb8f26d7c3727e286dd0f455c
SHA512 98a4cd4aaa25be478d643251afbca4218d060ac1acba478046ca1a7908a9630c2c81b43b341199e0ab799298c8fccd39dac4a37c0f66c11fb60ddb8e05bf6564
SSDEEP 393216:K8KwekyV8KwekyV8KwekyV8KwekyV8KwekyV8KwekyV8KwekyN:ohhhhhhr
TLSH
T153E77D29EBB485E5F9ABD43899BBC672EA727A110833570BC9E1C21F6F336514D18331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2736	svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe
5768	svchost_AABACBCCBBCACABBBCBAACBBBBCCCCCCCABAACAAACACACCBCBABCAB.exe
1072	svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBABBACACCBABACABBABBCABCBCCCACBCCCACCAAAABBABACCBACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe"	2026-09-06_55d3d8400adf0f44e3184f6475b90709_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCAAAAABCAAABBBCBBBAAAABCAAABCACBCBCAABBBCCCABAABCABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABACBCCBBCACABBBCBAACBBBBCCCCCCCABAACAAACACACCBCBABCAB.exe"	svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2184	sc.exe
2780	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4240	cmd.exe
3800	cmd.exe
2104	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_55d3d8400adf0f44e3184f6475b90709_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABACBCCBBCACABBBCBAACBBBBCCCCCCCABAACAAACACACCBCBABCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3400	2026-09-06_55d3d8400adf0f44e3184f6475b90709_elex_glassworm_icedid_njrat_vidar_wannacry.exe
3400	2026-09-06_55d3d8400adf0f44e3184f6475b90709_elex_glassworm_icedid_njrat_vidar_wannacry.exe
3400	2026-09-06_55d3d8400adf0f44e3184f6475b90709_elex_glassworm_icedid_njrat_vidar_wannacry.exe
3400	2026-09-06_55d3d8400adf0f44e3184f6475b90709_elex_glassworm_icedid_njrat_vidar_wannacry.exe
2736	svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe
2736	svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe
2736	svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe
2736	svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3400	2026-09-06_55d3d8400adf0f44e3184f6475b90709_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Token: SeDebugPrivilege	2736	svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 4240	3400	2026-09-06_55d3d8400adf0f44e3184f6475b90709_elex_glassworm_icedid_njrat_vidar_wannacry.exe	92
PID 4240 wrote to memory of 1916	4240	cmd.exe	94
PID 2736 wrote to memory of 2440	2736	svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe	95
PID 3400 wrote to memory of 3800	3400	2026-09-06_55d3d8400adf0f44e3184f6475b90709_elex_glassworm_icedid_njrat_vidar_wannacry.exe	98
PID 3800 wrote to memory of 2184	3800	cmd.exe	100
PID 3400 wrote to memory of 2104	3400	2026-09-06_55d3d8400adf0f44e3184f6475b90709_elex_glassworm_icedid_njrat_vidar_wannacry.exe	101
PID 2104 wrote to memory of 2780	2104	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-06_55d3d8400adf0f44e3184f6475b90709_elex_glassworm_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_55d3d8400adf0f44e3184f6475b90709_elex_glassworm_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAAACCACCBAAAABAAABBAAACAABCBBABBBCCAAACCBBCCCCCCBCCCBBACBCCABCCBBCBCBBCBCACBBABBCBBABCCCBAACBCCCCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCAAACCACCBAAAABAAABBAAACAABCBBABBBCCAAACCBBCCCCCCBCCCBBACBCCABCCBBCBCBBCBCACBBABBCBBABCCCBAACBCCCCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBBAAACBCCCBCACBAAACBABAAABCBBABCABABBACCBBBCBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe" start= auto displayName= "UserDataSvc_CBCBBAAACBCCCBCACBAAACBABAAABCBBABCABABBACCBBBCBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBBAAACBCCCBCACBAAACBABAAABCBBABCABABBACCBBBCBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe" start= auto displayName= "UserDataSvc_CBCBBAAACBCCCBCACBAAACBABAAABCBBABCABABBACCBBBCBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBBAAACBCCCBCACBAAACBABAAABCBBABCABABBACCBBBCBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBBAAACBCCCBCACBAAACBABAAABCBBABCABABBACCBBBCBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCCBBCACABBBCBAACBBBBCCCCCCCABAACAAACACACCBCBABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACBCCBBCACABBBCBAACBBBBCCCCCCCABAACAAACACACCBCBABCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACAAAAACAAABAACCAABABCABAACCCBCCACBBACBBCBBACBCABCCBA.exe
1⤵
- Executes dropped EXE
PID:1072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 310732e39b45db6003b4c3ab27ecdcc0697d12d9f55d3a941ef0ee272ec3cfcf
MD5 dcc8f4d56fb29ee34d21d2e5a33462c4
SHA1 9ad41de9bf5479525b2fb4b6ed76bba69f43abb4
SHA512 bbb708cbfda351938d22a994c7609f586bff2afb906a345c59ee624be40ef9695cb4916eaddb3cebe8c787c01bfa00a7e859a3d3603ac4b57b51dc44a766b263
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8cd84f030ee4ebe3962c4021ad43dadd9c551b73c1d5c090f9b60244643ae625
MD5 2569406ec6bcc30187fb4484fda228d3
SHA1 d8eb144ad8157dce307ea69f54962cab4aebcd19
SHA512 52a9aca0782632449719acb4899eef42aaac65425b6743d4fca22d1f182e6c7c5124a7077e5d0e8af4f486d5b89c3bdde2dcc66529c813e4f93f9c1dbc47553f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cd857cffe2d138d63dd814084492bd80db3c0c2fe796dfe4acb5915b1cb538bd
MD5 d9e9546b838dcfdd8157e5c640f2f2d1
SHA1 28baeb3cbe472c82d4eb92de1481bc076730b72c
SHA512 a7d0f008ed4473711463462d37b641e79ca48e6ae34f6a2a7973d900ac1c984af3512556dc5b520cf4e73c9a7ac466ab7d7d79be86a45e69f0ddafd238e9d205
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 75cbb1ca7d2646a1ad268dfc530a68e30713260785c59672a55cc0684646723b
MD5 8b7a32efaadb2ecac5f9996ac88561f7
SHA1 3466c7cdfeb87a2f254e594840a99c874ca5e42f
SHA512 bcdad8cc9a20c7bb9e37d3ae54a6bab3dd5743c5ca03b42a91294559f6feabcd6b0607d64d05fb8f05ab7f59a0c0642db46cb442865798ec208b935fcf053983
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 282dbef3951ac36dba15a8f9d393b43454e4672223c410b7407f9a4986057b56
MD5 3e2cc4af188ab80e776febd1012a2c6e
SHA1 0604fc96ed484e77be42493614c5087e5a85d412
SHA512 44bd957542849f333acd85660a7138e58ec985c57a1a4994b92d336eb9336d007bdab055d1afd96dd5dba8ec67fbedb932dceb127750035316f8ae0e23497064
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 21d0c6776796f6d7ec5297ae5077fb8f33733039351b5ad6aa930766df4d042b
MD5 6c869738353a06070dcef6ae6697f6c0
SHA1 66743aae834073705454866925eb4c6b0a3dae08
SHA512 0ad84d88dd80775948df7a1256e7d540dcff39b83ff31e21b46c60dc1ecc52c0659e1fb3be9555a4c1b8f4832a4b158e876947f052d10f66771e93ea146cf3a2
MD5 SHA1 SHA512

Submit Download

memory/2736-34-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/3400-0-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/3400-8-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/5768-65-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download