a17bbf8e928382a50ca16670cb8758aabd20602c96abb5746471695fc8d0e1bb

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
Size 8.2MB
Sample260912-pc8cesbd69
SHA256 a17bbf8e928382a50ca16670cb8758aabd20602c96abb5746471695fc8d0e1bb
MD5 26399ed83ae8e9f1f742c6ce2f438f78
SHA1 c33e82b25eefbbb187cc8e004e71291abf7b65e8
SHA512 179168b9a5dce155113abca44246bc97851d9a02895773a212da192b97981dff0154978c545566b1da5426dd52b14de1ce2d3ff476f78beab9abe586a8a9d3d5
SSDEEP 49152:U+E7+Eg+E7+EC1+ES+EWqatglu+E7+EF+Eg+E7+EC1+ES+EWqatglu+E7+Eg+E7N:eXdXJXJXdXJXJXbO4q75Av7fbUhabgf
TLSH
T14D863A09FD4240F2D82B417148DBE2FF9B70BA118B024E9BE789835F9D33BD16935A65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4168	svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CABCACBBBCCBACBCCABAABABBBCCABCBABCABABACBBACBBABCAABAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe"	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1568	sc.exe
3576	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1056	cmd.exe
4112	cmd.exe
2248	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4620	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
4620	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
4620	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
4620	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
4168	svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe
4168	svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	4168	svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 1056	4620	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe	88
PID 1056 wrote to memory of 3980	1056	cmd.exe	90
PID 4620 wrote to memory of 4112	4620	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe	91
PID 4112 wrote to memory of 1568	4112	cmd.exe	93
PID 4620 wrote to memory of 2248	4620	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe	94
PID 2248 wrote to memory of 3576	2248	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBACAAAAACABABABCACBBCBAAABBCCAABCBCCCCBACBCBABCCBACCACAAAAACCBCBCCBBAABCBABCCACCAACAACBBABAACCCCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBACAAAAACABABABCACBBCBAAABBCCAABCBCCCCBACBCBABCCBACCACAAAAACCBCBCCBBAABCBABCCACCAACAACBBABAACCCCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABCBABBBABACABAAAAACABCBBBCABCBABBBBABABBCBAACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe" start= auto displayName= "UserDataSvc_CCABCBABBBABACABAAAAACABCBBBCABCBABBBBABABBCBAACCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABCBABBBABACABAAAAACABCBBBCABCBABBBBABABBCBAACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe" start= auto displayName= "UserDataSvc_CCABCBABBBABACABAAAAACABCBBBCABCBABBBBABABBCBAACCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABCBABBBABACABAAAAACABCBBBCABCBABBBBABABBCBAACCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABCBABBBABACABAAAAACABCBBBCABCBABBBBABABBCBAACCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4168
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  PID:2684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3b7346bf9e83a9c4c7cbb73df064d6b899e7925bbb31cf0aa0755235664ffacc
MD5 816c5bb45d581eaf5df3d6ac123d1ce7
SHA1 d4fdf1eb9fc6a05d15abd94eed03bb876dab81ce
SHA512 80597e0e2dbd152e956446d84061d7959de392fd880788bd1964d9e146169280fdfcfea9be70e2c96c3df75e8fcb9344351586e9b5aa0b3f7c87e8a330180a65
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 736b7f12a7643b2689825083c981a86db00568902b8ecb017ba675903af4f29f
MD5 eb4d835a11d27a70e561a04cc78ce4c1
SHA1 8c046828c9918356530f04697efe44a3b0e49745
SHA512 f235cf81c5bdf04ba2d83780162b33005b0b89f22da72f3f186b669368e62164dc31e9512f4d30505f614f729659e46bc89944ad426fd76244a1ab96d60b583b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 43abbaf0d9c77a52157fe7568d813d00439133a15e6c3244eda24986e7557034
MD5 7f5178d21f8d8ea18df0c96c56b029a3
SHA1 9dfb7f5de25d49b2450410c29366da689881e181
SHA512 7b2b2319b74b3dbded2ec65990483fd5ff3f65e9b64fbfa78a4e42df36c076c3cabbd76dd54602e7e05513438594f0daefc8de955ec64270a848d093d9ebe4f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 80fd88f1dc03d04186f73323f61134ce773d06ea90a6bc948e0c5c3bd534c502
MD5 cd9f948084665882d57bdd2b9eaf9848
SHA1 283a83e20587993cf177016906705f10fc654c74
SHA512 95d739e7019ba1ae8f674648819f1754f6e4ff3199d045195bbbd1d9856c33f529a4eca5092ce6800786bc6354636ad4eaac533033e967a0e4d6a97273592786
MD5 SHA1 SHA512

Submit Download

svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe
Size 8.2MB
SHA256 a17bbf8e928382a50ca16670cb8758aabd20602c96abb5746471695fc8d0e1bb
MD5 26399ed83ae8e9f1f742c6ce2f438f78
SHA1 c33e82b25eefbbb187cc8e004e71291abf7b65e8
SHA512 179168b9a5dce155113abca44246bc97851d9a02895773a212da192b97981dff0154978c545566b1da5426dd52b14de1ce2d3ff476f78beab9abe586a8a9d3d5
SSDEEP 49152:U+E7+Eg+E7+EC1+ES+EWqatglu+E7+EF+Eg+E7+EC1+ES+EWqatglu+E7+Eg+E7N:eXdXJXJXdXJXJXbO4q75Av7fbUhabgf
TLSH
T14D863A09FD4240F2D82B417148DBE2FF9B70BA118B024E9BE789835F9D33BD16935A65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAAABBCBCCBCBCACCACCABBACBCACABCCBCCBBBCBCBBABBBCAC.exe
Size 6.0MB
SHA256 f28213ef9d8d1fb3bdc8ddc7f4fc9e9341497de34906f560a5938c29f74a2745
MD5 371aa9218970e297cf3a8ac99705e994
SHA1 f6b118d3b1cd28636bdd2df2f2def920864c7bea
SHA512 16122ef06842f632d7d8a86b989e1d3ebac8bb3f8f51f4c2fd298e0607dee7dbf03d45ae5cd653b31f6f24914034f3ae4400b7e0d66e874517e70de1a4609ae3
SSDEEP 49152:U+E7+Eg+E7+EC1+ES+EWqatglu+E7+EF+Eg+E7+EC1+ES+EWqatglu+E7+Eg+E71:eXdXJXJXdXJXc
TLSH
T1EB562B09F94340B2D82B01B148CBD3BF8B70BA258B128EABE74D875FED337D16925655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4168-27-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Download

memory/4168-40-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Download

memory/4620-0-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/4620-8-0x0000000000240000-0x0000000000261000-memory.dmp

Download