a2efa30797e2a5bcf2dfe81ed045660e81172d90c4baff23b55f2b1d59efbad5

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_81aafaf1027e526012d527bb78f4f0da_elex_glassworm_icedid_njrat_remcos_vidar.exe
Size 18.6MB
Sample260908-1ynqpaydnd
SHA256 a2efa30797e2a5bcf2dfe81ed045660e81172d90c4baff23b55f2b1d59efbad5
MD5 81aafaf1027e526012d527bb78f4f0da
SHA1 63bbd19f964c92127b63f77af18a2751bde61bf8
SHA512 dba0e22080fa308fba3a2b735ffa4d6c28d8a938a0794d12e3771697b3d4681da9dd4d6288ea91f6122ca9e85e24adc37ced895598f092406006a40a49201596
SSDEEP 49152:U+E2+ESM+ES+ETqatglu+ES+EgbB+ESN+ES+Ek+ES+ES+E2+ESM+ES+ETqatglui:WlMmmlMmmlArU5f
TLSH
T1C5172C05F94680B1D82B027048CBD2BB4A707D114B128AFFEB69B72EEA377E0553D675
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3796	svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe
4704	svchost_ABCCACBCCBACACBBABAABACCBCBAACABCACACBCACABAABABAACACCA.exe
816	svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBCCCCABBCACBCBACCBCAAAAACBBCABBBAABAAAABAACCBABABBBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe"	2026-09-07_81aafaf1027e526012d527bb78f4f0da_elex_glassworm_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBBCCCACAABBABCBCCCBBABABBABCBAAAAACACABACACBCBACBCACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCACBCCBACACBBABAABACCBCBAACABCACACBCACABAABABAACACCA.exe"	svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3308	sc.exe
4688	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4424	cmd.exe
2528	cmd.exe
3868	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_81aafaf1027e526012d527bb78f4f0da_elex_glassworm_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCACBCCBACACBBABAABACCBCBAACABCACACBCACABAABABAACACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5000	2026-09-07_81aafaf1027e526012d527bb78f4f0da_elex_glassworm_icedid_njrat_remcos_vidar.exe
5000	2026-09-07_81aafaf1027e526012d527bb78f4f0da_elex_glassworm_icedid_njrat_remcos_vidar.exe
5000	2026-09-07_81aafaf1027e526012d527bb78f4f0da_elex_glassworm_icedid_njrat_remcos_vidar.exe
5000	2026-09-07_81aafaf1027e526012d527bb78f4f0da_elex_glassworm_icedid_njrat_remcos_vidar.exe
3796	svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe
3796	svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe
3796	svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe
3796	svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe
4704	svchost_ABCCACBCCBACACBBABAABACCBCBAACABCACACBCACABAABABAACACCA.exe
4704	svchost_ABCCACBCCBACACBBABAABACCBCBAACABCACACBCACABAABABAACACCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	2026-09-07_81aafaf1027e526012d527bb78f4f0da_elex_glassworm_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	3796	svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe
Token: SeDebugPrivilege	4704	svchost_ABCCACBCCBACACBBABAABACCBCBAACABCACACBCACABAABABAACACCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2436	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4424	5000	2026-09-07_81aafaf1027e526012d527bb78f4f0da_elex_glassworm_icedid_njrat_remcos_vidar.exe	101
PID 4424 wrote to memory of 1524	4424	cmd.exe	103
PID 3796 wrote to memory of 1084	3796	svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe	104
PID 1084 wrote to memory of 4264	1084	notepad.exe	105
PID 5000 wrote to memory of 2528	5000	2026-09-07_81aafaf1027e526012d527bb78f4f0da_elex_glassworm_icedid_njrat_remcos_vidar.exe	109
PID 2528 wrote to memory of 3308	2528	cmd.exe	111
PID 5000 wrote to memory of 3868	5000	2026-09-07_81aafaf1027e526012d527bb78f4f0da_elex_glassworm_icedid_njrat_remcos_vidar.exe	112
PID 3868 wrote to memory of 4688	3868	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-07_81aafaf1027e526012d527bb78f4f0da_elex_glassworm_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_81aafaf1027e526012d527bb78f4f0da_elex_glassworm_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCCABCCABCABCCAACACACABBAABBCAABABACBBCABBCBCAAABAABABBBACBBAABAACBBCCACACBCBCACBCABCAAAACBCAABCABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCCABCCABCABCCAACACACABBAABBCAABABACBBCABBCBCAAABAABABBBACBBAABAACBBCCACACBCBCACBCABCAAAACBCAABCABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABBBACBBBCBBABBBACBCCCABBACBCBCCAACACBAABBBABCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe" start= auto displayName= "UserDataSvc_CBABBBACBBBCBBABBBACBCCCABBACBCBCCAACACBAABBBABCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABBBACBBBCBBABBBACBCCCABBACBCBCCAACACBAABBBABCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe" start= auto displayName= "UserDataSvc_CBABBBACBBBCBBABBBACBCCCABBACBCBCCAACACBAABBBABCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABBBACBBBCBBABBBACBCCCABBACBCBCCAACACBAABBBABCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABBBACBBBCBBABBBACBCCCABBACBCBCCAACACBAABBBABCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4688

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4264

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACBCCBACACBBABAABACCBCBAACABCACACBCACABAABABAACACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCACBCCBACACBBABAABACCBCBAACABCACACBCACABAABABAACACCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe
1⤵
- Executes dropped EXE
PID:816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 433b43f8f6d8f78b155c659f09fd1972d9843057179dd6fada970aed24ec80dc
MD5 3671b0c9e5e68f2ef262039791c46703
SHA1 3474712457bd81c6c9b931d7fa19e7383523c1b8
SHA512 72ded52d7a53eaf99530773bd3beb7150117ce05cb85b809166fdd8d2fbbaf1a060f0e94bdeaf7d6a347e5e9052848a05582fd9c77a017176ccfcdf7080679c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 35ceee4b9b537f4c3b94238b12331ac84914106153c76adf906d3c927f5c4d8f
MD5 4aec6badd1bc64c95b9dc507cb341f71
SHA1 9cdde68e96af5ff088b2363d0817785fd856a994
SHA512 b2a5b6f79c88b19ed7701ed14ec7af7921825d103f106b19da497b2de1a786c7d60d3488c912f2e3ff6bd385e0edce1eb971d018bb62d0f20d8cdad907cd7e5a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f743bac484730879d0d8d647112d1320361eee35a2c3adeee78ef3bece6161ad
MD5 e95af3dd186d2025e8b7da0acf9780ba
SHA1 07d7febbac80af66bc9dfee1039694830ba9ec28
SHA512 47f880aa0e64c9d1b1e5798a715a2b9c720f0322ecd4c43935010da508d9fcf4df5f55a5e29948a3fdd33ce80f5d22bfb176a6adb0fd2a4726e398c7d5db7b55
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1aa5db35e2052d0f64ca5df5c74fe682380f6624aba93be174562ed3c4437ce1
MD5 9365ddac7f7a1617e0feaf1b646ea09e
SHA1 edb17f21246156b46957257ef993e94b7ebf86d5
SHA512 2c5d1f57c03f6b6f5ce076c4bf990d74bbbe676f64635e466f129fb5d7fa17a589ca398d6fd0c939b57be947fa511dafb257bfd740b0ec62d4c8d2baa392f673
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b4e9b03c146d0c0aab34d71f64af70cf43ea2baf8c2f83181f3ec0cce503ae95
MD5 a84bdd1e474dffe2b0f0597035438272
SHA1 1becbcfe780e137c4bdea99d6699c60d35583483
SHA512 0e9541a1904bd553afb20209772d58a3c52137869ff7ae3f2ff03c3ce1b991b622c388f20de32dffed54d4abed8015f400c1ab8dda4e05ebef6d4618929af2ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 816a8af945d2b330ddc8211815df8089edc439b1042bb5139f5c8c7dafb5147b
MD5 5354a3867cb37a6fd5baa0b6fb70edc8
SHA1 81b62ba8ade030eec81ec64d6d5825a329e44fad
SHA512 33efc8338d1516397b121075b10f920c541b90e4d0fbe12e400052691255282c43c78a67a6b319214bab5350e99491b9e9378748626ce7b51a85d5d66e411554
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 56f8b2f20b0a5003eea33b83460c402546f4100b5d2690533cfc9f4058a34ddb
MD5 da3b30949e7d604f68086a296f80cca8
SHA1 d068ca840747f083bddd22211968ba504ed57c16
SHA512 e9dc2abb8d83ee5a6e4ffea9b6354bf534e1159e173a9b06a9652488782829c920d44548097083cc2728dbe6cd70e255b1c6209856bc9a2e29821c1c733b4b5a
MD5 SHA1 SHA512

Submit Download

svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABACBCCCBBBCCBCCBBBACBABCABCACBBBCCAAABBCBCABACCBA.exe
Size 18.6MB
SHA256 a2efa30797e2a5bcf2dfe81ed045660e81172d90c4baff23b55f2b1d59efbad5
MD5 81aafaf1027e526012d527bb78f4f0da
SHA1 63bbd19f964c92127b63f77af18a2751bde61bf8
SHA512 dba0e22080fa308fba3a2b735ffa4d6c28d8a938a0794d12e3771697b3d4681da9dd4d6288ea91f6122ca9e85e24adc37ced895598f092406006a40a49201596
SSDEEP 49152:U+E2+ESM+ES+ETqatglu+ES+EgbB+ESN+ES+Ek+ES+ES+E2+ESM+ES+ETqatglui:WlMmmlMmmlArU5f
TLSH
T1C5172C05F94680B1D82B027048CBD2BB4A707D114B128AFFEB69B72EEA377E0553D675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 67b232e5466c6deddb6527eeda9712fbf1a0632fda162de6c98114c5070bd184
MD5 5ce3d6a26d2f96ba51c1ffbc2b96e0bd
SHA1 5c91c0b0a2b2c4ef30322433c44ddd03171b86d0
SHA512 ee5a8b464c3094137010708fd2e06f02ecf1430522d0772b74aba4bc68146c2cab910eb7ed2f868539047dd95c6de5f78750d80a6d342d022a4e92f860f07a9d
TLSH
T1D311C162B5F5DC13F23124C3952D9B9708F43B9BA8DCAB486309421A77188BECE194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1084-60-0x00000000029B0000-0x00000000029B1000-memory.dmp

Download

memory/3796-37-0x0000000000A10000-0x0000000000A31000-memory.dmp

Download

memory/4704-80-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/5000-0-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/5000-8-0x0000000000950000-0x0000000000971000-memory.dmp

Download