f3c8ceb5912b2cdb58d0a372dadf5bda7f514c544e9221f5f7c515f0290c654e

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_827e1c764cfde2bb7380c61957878239_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Size 27.9MB
Sample260907-sc54vaygrc
SHA256 f3c8ceb5912b2cdb58d0a372dadf5bda7f514c544e9221f5f7c515f0290c654e
MD5 827e1c764cfde2bb7380c61957878239
SHA1 f4a6f303d6daca94ab2f1c6a0c04aa03fc21919e
SHA512 889f57519db90fd76a1ca1b90685351c4b53c2687a29e399a99a65f423ee558b636a119886bc104eeb93d24af29eda28914dde3c59633e2a4918e8771186dc4d
SSDEEP 98304:Spupupupupupups1MbQ9yDAD7KjjqkusjmqMhq:91tIDewjqkjiqMU
TLSH
T17D575D09F94380F2D92B51B04CDBD3BFDA70BA1146128BABE78DC71F6D33B916925225
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1960	svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe
2172	svchost_CCABABCBCBABBACBBBAAABCCBAABCBACBBBCBBCACABACBCCBACACBB.exe
4576	svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CAACACCACBAAAABACCBBCBBBBBCCAACCCCABBBABBCBAABBBAAAAACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe"	2026-09-05_827e1c764cfde2bb7380c61957878239_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCCCBBABCCCBABBBBAACCABAABCCBCACACABAAACBAAACAABCBBCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABABCBCBABBACBBBAAABCCBAABCBACBBBCBBCACABACBCCBACACBB.exe"	svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4284	sc.exe
3728	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
544	cmd.exe
4472	cmd.exe
3240	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_827e1c764cfde2bb7380c61957878239_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABABCBCBABBACBBBAAABCCBAABCBACBBBCBBCACABACBCCBACACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1556	2026-09-05_827e1c764cfde2bb7380c61957878239_elex_glassworm_icedid_njrat_vidar_wannacry.exe
1556	2026-09-05_827e1c764cfde2bb7380c61957878239_elex_glassworm_icedid_njrat_vidar_wannacry.exe
1556	2026-09-05_827e1c764cfde2bb7380c61957878239_elex_glassworm_icedid_njrat_vidar_wannacry.exe
1556	2026-09-05_827e1c764cfde2bb7380c61957878239_elex_glassworm_icedid_njrat_vidar_wannacry.exe
1960	svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe
1960	svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe
1960	svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe
1960	svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe
2172	svchost_CCABABCBCBABBACBBBAAABCCBAABCBACBBBCBBCACABACBCCBACACBB.exe
2172	svchost_CCABABCBCBABBACBBBAAABCCBAABCBACBBBCBBCACABACBCCBACACBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	2026-09-05_827e1c764cfde2bb7380c61957878239_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Token: SeDebugPrivilege	1960	svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe
Token: SeDebugPrivilege	2172	svchost_CCABABCBCBABBACBBBAAABCCBAABCBACBBBCBBCACABACBCCBACACBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2996	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 544	1556	2026-09-05_827e1c764cfde2bb7380c61957878239_elex_glassworm_icedid_njrat_vidar_wannacry.exe	101
PID 544 wrote to memory of 4140	544	cmd.exe	103
PID 1960 wrote to memory of 4616	1960	svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe	104
PID 4616 wrote to memory of 2248	4616	notepad.exe	105
PID 1556 wrote to memory of 4472	1556	2026-09-05_827e1c764cfde2bb7380c61957878239_elex_glassworm_icedid_njrat_vidar_wannacry.exe	109
PID 4472 wrote to memory of 4284	4472	cmd.exe	111
PID 1556 wrote to memory of 3240	1556	2026-09-05_827e1c764cfde2bb7380c61957878239_elex_glassworm_icedid_njrat_vidar_wannacry.exe	112
PID 3240 wrote to memory of 3728	3240	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-05_827e1c764cfde2bb7380c61957878239_elex_glassworm_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_827e1c764cfde2bb7380c61957878239_elex_glassworm_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCBBCCCACAABABBCCCCBABCCACCABCCBBCBBCABABBABCABBBBBABCABACCCBABCACBCACBBCCAAACCABACACBACAACBBAACAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBCBBCCCACAABABBCCCCBABCCACCABCCBBCBBCABABBABCABBBBBABCABACCCBABCACBCACBBCCAAACCABACACBACAACBBAACAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAAABABBACBBCCCBCAAAACCACCCCCCBBABCBBAAACBBCAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe" start= auto displayName= "UserDataSvc_AAAAABABBACBBCCCBCAAAACCACCCCCCBBABCBBAAACBBCAAABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAAABABBACBBCCCBCAAAACCACCCCCCBBABCBBAAACBBCAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe" start= auto displayName= "UserDataSvc_AAAAABABBACBBCCCBCAAAACCACCCCCCBBABCBBAAACBBCAAABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAAABABBACBBCCCBCAAAACCACCCCCCBBABCBBAAACBBCAAABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAAABABBACBBCCCBCAAAACCACCCCCCBBABCBBAAACBBCAAABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3728

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2248

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABABCBCBABBACBBBAAABCCBAABCBACBBBCBBCACABACBCCBACACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABABCBCBABBACBBBAAABCCBAABCBACBBBCBBCACABACBCCBACACBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe
1⤵
- Executes dropped EXE
PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1461667bb8b5267d3683d3831d8804c01b6cdbc315adb9ce7350899bd0c73ded
MD5 9fcbd5ad3a883d5cc747713930960b76
SHA1 8bef470a038455efba0b6f9549e5632acb7cd019
SHA512 2a3a19fbe897de33c28d6d4ebcfd90b87b604a5eb157d377cd7952dbe71e95ac2d077050a90c1275be3fc7af65b320eb45c6454d9460d91dceaa1403d94de54b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2841ef99dee3f1a9af30b748ee78767c6c773bbb1dcf9768c2ae197b713ce5e7
MD5 d6c1d7d1f223b54cec7797ddd1036a7c
SHA1 ed7702a4ff3a087e75dec64b86c725409c1f6e8b
SHA512 6031fee7f3267ff24bbc8fb72ee9ded969c0c4e588a7c1583d96dc413834805e2848b4163649544e4ff5b31ec2659f811cc7583827e98b25ca8fc58f92e4569e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c97423dd50dfeea7aa990a7bc5d849df55de0db7cf747d87ebe02476fef4ffad
MD5 590f482722cea948f18f57404ef57c6d
SHA1 1d11d9488cf9d0fb7451ac609f459387a9c287bf
SHA512 8631740e1287b5b355dde1c9f608832565f65aa1732f1098c3d39b5a579475a325af29df1f1b5f8df643eb659e860ee8b362bd85353a6de1ef861f38d6231c7e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 528b9caac411fe7b67406ba62b62797b1ab287f07f10c5adbe37432173f0a302
MD5 bab8ae8976f6755e89313a1055e2837b
SHA1 b650c19c1897306f7d7b23999c343b52f80026b7
SHA512 600418e929df4f4a8f60d7d1eb8f16753103415838e88b1ca293a042a372e182bcf3f885cff7de00cda7b0919057d67dd40741fa18492cb791b982cd1bb932b8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fafde8effd26d90ab419ea36047d4f1e407dc2277a478e7e2282f615a803fe4c
MD5 576dc6282f7086dbcfd346bffa67e564
SHA1 43e336e113ce9a587365a39243f2e3aeca7b8077
SHA512 0cb090970eb56c932e14f6300fc1a8753c6e3a51b9bde79ccf8471a038e7a27c18f316a8525653cc19201a0b10af08e0df14511a6cf0b879be22422b97387f15
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f65769508ea4af8cf6d840874f4501437949aebe57f498be92a52ee737088db1
MD5 e0d21ffaa047102059c00c2aaa1f001f
SHA1 81cde09cf30a405c246d54e781941302e9f7c99a
SHA512 4de36e6b5feb9ae6308f6395b9afc54867bef91f0d3edadb3d330d071e58a7f46f9564351652cf5a7d12ed115822fda4674514c9655afd93e2da80ad5bd9f2af
MD5 SHA1 SHA512

Submit Download

svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACBAABABAACBBBCCBBBBABABCAABCBCCBABCCACACAAAACCACB.exe
Size 27.9MB
SHA256 f3c8ceb5912b2cdb58d0a372dadf5bda7f514c544e9221f5f7c515f0290c654e
MD5 827e1c764cfde2bb7380c61957878239
SHA1 f4a6f303d6daca94ab2f1c6a0c04aa03fc21919e
SHA512 889f57519db90fd76a1ca1b90685351c4b53c2687a29e399a99a65f423ee558b636a119886bc104eeb93d24af29eda28914dde3c59633e2a4918e8771186dc4d
SSDEEP 98304:Spupupupupupups1MbQ9yDAD7KjjqkusjmqMhq:91tIDewjqkjiqMU
TLSH
T17D575D09F94380F2D92B51B04CDBD3BFDA70BA1146128BABE78DC71F6D33B916925225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 39a93e05833799a29f2e1cef69f6b5b7621069e5cb970637d375780ac0f6cd27
MD5 0c3f928520bd85afebac03855e766787
SHA1 dd2fdf161d00b6678d8c0cdc2e4eea5706365f9c
SHA512 dc0e1bed32d16a745153aa33c76ba21f014ad3e8e767244092108f2b588328a22ccb728138fd3dd64b54ab92ceb68a6f237e754ebe246c10e56e69ce9b4fb371
TLSH
T17311C850B05ADC87E1322DC35B19DBC748943B9E695C9B18230D4119E75EC37CD564A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1556-0-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/1556-8-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/1960-37-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/2172-73-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/4616-61-0x0000000005A70000-0x0000000005A71000-memory.dmp

Download