d2a1a709a45c17f9273583fb383e2d532a79cd28d3738922c83b6c228282ca27

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_6b33bad1be223b9de85f260c5fe97272_elex_glassworm_icedid_njrat_stop_vidar.exe
Size 6.6MB
Sample260908-3r846aaa82
SHA256 d2a1a709a45c17f9273583fb383e2d532a79cd28d3738922c83b6c228282ca27
MD5 6b33bad1be223b9de85f260c5fe97272
SHA1 0e724ee7f75d608570df7757a1ffec7c314033d4
SHA512 f0e7abc1c5a22e8f8f852072753f52c0465ccf506d8289a64ba735f68a9d82a0c92455d87aca4cd93b6ae25c31e9f7859d96aed34b7e06622caf4191be1a41dd
SSDEEP 49152:U+Ee+ES+Ee+ES+EXH+ES+Ee+ES+Ee+ES+EXH+ES+Ee+ES+Ee+ES+EXH+ES+Ee+Ey:6mmmCBmmmCgp77
TLSH
T177665C09F94244F1D96B417049CFD2BFCA70BA2187128EABF74D875B6E33BA16839711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5656	svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe
1780	svchost_BBCCAAAABCAABCACACCCACACCABBABAACCBBAACCAAACCCACAAABCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBBAAABABCACBCCAAABAABBCCCABBCAAABCBACAACCBBBBCCBAAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe"	2026-09-07_6b33bad1be223b9de85f260c5fe97272_elex_glassworm_icedid_njrat_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABABCBBBBBABCACBBABBCCBCCCACAACCACAABAACBABCAACCCAABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCAAAABCAABCACACCCACACCABBABAACCBBAACCAAACCCACAAABCCB.exe"	svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
700	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_6b33bad1be223b9de85f260c5fe97272_elex_glassworm_icedid_njrat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCAAAABCAABCACACCCACACCABBABAACCBBAACCAAACCCACAAABCCB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4764	2026-09-07_6b33bad1be223b9de85f260c5fe97272_elex_glassworm_icedid_njrat_stop_vidar.exe
4764	2026-09-07_6b33bad1be223b9de85f260c5fe97272_elex_glassworm_icedid_njrat_stop_vidar.exe
4764	2026-09-07_6b33bad1be223b9de85f260c5fe97272_elex_glassworm_icedid_njrat_stop_vidar.exe
4764	2026-09-07_6b33bad1be223b9de85f260c5fe97272_elex_glassworm_icedid_njrat_stop_vidar.exe
5656	svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe
5656	svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe
5656	svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe
5656	svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	2026-09-07_6b33bad1be223b9de85f260c5fe97272_elex_glassworm_icedid_njrat_stop_vidar.exe
Token: SeDebugPrivilege	5656	svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 700	4764	2026-09-07_6b33bad1be223b9de85f260c5fe97272_elex_glassworm_icedid_njrat_stop_vidar.exe	92
PID 700 wrote to memory of 3488	700	cmd.exe	94
PID 5656 wrote to memory of 5340	5656	svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-09-07_6b33bad1be223b9de85f260c5fe97272_elex_glassworm_icedid_njrat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_6b33bad1be223b9de85f260c5fe97272_elex_glassworm_icedid_njrat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCCACBAACBBBBABBAAABCBCCBAACBCCBACAAABBCACCBCCBBCBABAACAABABABCBBCACBBCCBBCBCABCCBCBACBACCBBCAAAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCCACBAACBBBBABBAAABCBCCBAACBCCBACAAABBCACCBCCBBCBABAACAABABABCBBCACBBCCBBCBCABCCBCBACBACCBBCAAAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAAAABCAABCACACCCACACCABBABAACCBBAACCAAACCCACAAABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCAAAABCAABCACACCCACACCABBABAACCBBAACCAAACCCACAAABCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2cac412037bede3331f75452cab9eecb8ddab50150b231847403a6f363754dad
MD5 c788406624081724c9a8270bdf08cb43
SHA1 c51a350023e38e6e8224831454170e2c6b6b38b7
SHA512 1baac9d41e31fe2d83a7efe8aee1700156aa89a270c15566959a5a3f2c3a14da880a40592fa4118d6a7dfb520a9f03346ecd764484f5f35e878e7ef14480411b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 27220f22026b9720c4e5d321a8ff429a90c4765e354270709326bdae03666445
MD5 422238c09f3087a6294ad7956b05ef0e
SHA1 92141103ec830e64af6bd7d989d8480d597f6d3e
SHA512 204e9b5b60e42849777b341b86f09492c41dfaf88b67ae747bc9257475af897a840e3cbd2db237ba2af0057c12498c02c4a163ccf19e1c5a3be140757f43fa9d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2d176bf3e960c375565842991828bcb3aa825b03dc9e11c02983eb31ae79d2a0
MD5 0cf4a59b63544a4498105aa4491a85d8
SHA1 ec1602c20808223265dbb0345d7e0907c563093a
SHA512 80dfe85b492f653f3c76d58e3ce1cfff1ba9abde3a651ad675e27744854fd3d8cd87dae55bab61558f28ab744d8f19f22e0945db2a3852d24d80d58575e47f0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3a58459364c2c4ec5781da13c26d732e7ea21fda2bf96b5d2098e1ad27857c8c
MD5 151f0c8c5972c329f68a5dcc05481131
SHA1 f3ac473a2937214c2d85ebd62d66a7d935163b9a
SHA512 fd97bdfd7bfefa3b1634e6ec0b9afcc26ec577929d0def6689bb5a166f55169c7c0011f21ee30b13e4db32ad4c26ebf4587a9278fd946c02c1bdc21fd0dfa4bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c699a79201368337fbde27a1423829ee8dc3c6af2df61a3aab3dbfa2d4b11bd8
MD5 7114e1af3a221600a72d2ad409a4ddb0
SHA1 d29c345cf1f84aec831bcdadd367526f7b258318
SHA512 7b8425d14cc38474b74def1680a5707f422d35ae231f55bc984035ead278240c4a66fba4050e455b9524ecdc07e16b693f222e5535768a2504d3fa6c61af5448
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f2155c67d30f11f6e47b47dc13c8af095b61af0076bbc2af4dc1360e135ac32b
MD5 d248ab6bafb17950da2670c9f871a76c
SHA1 72ff46ccecb311c37bee1f7e507fd8affe5656ab
SHA512 93bac69c8192021f52bb35875d88f478786a1631122f0cdbda70413c2913f6c91b33c1bf347e513b52003e2538771b2fc7eb2bce9f30e958caa465628eec7ca7
MD5 SHA1 SHA512

Submit Download

svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACACABBCBCABBCCBCBABACCABBACBBACABBBABCABCABBCCAAACB.exe
Size 6.6MB
SHA256 d2a1a709a45c17f9273583fb383e2d532a79cd28d3738922c83b6c228282ca27
MD5 6b33bad1be223b9de85f260c5fe97272
SHA1 0e724ee7f75d608570df7757a1ffec7c314033d4
SHA512 f0e7abc1c5a22e8f8f852072753f52c0465ccf506d8289a64ba735f68a9d82a0c92455d87aca4cd93b6ae25c31e9f7859d96aed34b7e06622caf4191be1a41dd
SSDEEP 49152:U+Ee+ES+Ee+ES+EXH+ES+Ee+ES+Ee+ES+EXH+ES+Ee+ES+Ee+ES+EXH+ES+Ee+Ey:6mmmCBmmmCgp77
TLSH
T177665C09F94244F1D96B417049CFD2BFCA70BA2187128EABF74D875B6E33BA16839711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4764-0-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/4764-8-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/5656-35-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download