a17bbf8e928382a50ca16670cb8758aabd20602c96abb5746471695fc8d0e1bb

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
Size 8.2MB
Sample260912-pc8cesbd69
SHA256 a17bbf8e928382a50ca16670cb8758aabd20602c96abb5746471695fc8d0e1bb
MD5 26399ed83ae8e9f1f742c6ce2f438f78
SHA1 c33e82b25eefbbb187cc8e004e71291abf7b65e8
SHA512 179168b9a5dce155113abca44246bc97851d9a02895773a212da192b97981dff0154978c545566b1da5426dd52b14de1ce2d3ff476f78beab9abe586a8a9d3d5
SSDEEP 49152:U+E7+Eg+E7+EC1+ES+EWqatglu+E7+EF+Eg+E7+EC1+ES+EWqatglu+E7+Eg+E7N:eXdXJXJXdXJXJXbO4q75Av7fbUhabgf
TLSH
T14D863A09FD4240F2D82B417148DBE2FF9B70BA118B024E9BE789835F9D33BD16935A65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2240	svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe
5040	svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe
2000	svchost_BBCCABCCCBBCACBCACCCCAABABCBCCCBBBACABCABABACCCACBBCABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAABCCBACBABBBCCAABCCCBCBBBCCCABCCBBACCAACAAACACBAABABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe"	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBABAAACCCBCCABCCACBCACBCCCABBAACBABCBAABCBBBAACBBCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCABCCCBBCACBCACCCCAABABCBCCCBBBACABCABABACCCACBBCABC.exe"	svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5612	sc.exe
1824	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1344	cmd.exe
3524	cmd.exe
1008	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCABCCCBBCACBCACCCCAABABCBCCCBBBACABCABABACCCACBBCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2316	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
2316	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
2316	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
2316	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
2240	svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe
2240	svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe
2240	svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe
2240	svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe
2000	svchost_BBCCABCCCBBCACBCACCCCAABABCBCCCBBBACABCABABACCCACBBCABC.exe
2000	svchost_BBCCABCCCBBCACBCACCCCAABABCBCCCBBBACABCABABACCCACBBCABC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	2240	svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe
Token: SeDebugPrivilege	2000	svchost_BBCCABCCCBBCACBCACCCCAABABCBCCCBBBACABCABABACCCACBBCABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1008	2316	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe	88
PID 1008 wrote to memory of 5352	1008	cmd.exe	90
PID 2316 wrote to memory of 1344	2316	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe	91
PID 1344 wrote to memory of 5612	1344	cmd.exe	93
PID 2316 wrote to memory of 3524	2316	2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe	94
PID 3524 wrote to memory of 1824	3524	cmd.exe	96
PID 2240 wrote to memory of 4440	2240	svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-11_26399ed83ae8e9f1f742c6ce2f438f78_elex_glassworm_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBCACCBBCBAAACBACBAACBCCBCBCABBACBCBAABCBABBABAACCBBABCBABAAACACABABBCBCCABAACBCCCBACCCBCCCBBAACBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBCACCBBCBAAACBACBAACBCCBCBCABBACBCBAABCBABBABAACCBBABCBABAAACACABABBCBCCABAACBCCCBACCCBCCCBBAACBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBACAAAABBAABBCABBBCAAABABCBABBBCCACCAABACACCBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe" start= auto displayName= "UserDataSvc_BCCBACAAAABBAABBCABBBCAAABABCBABBBCCACCAABACACCBCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBACAAAABBAABBCABBBCAAABABCBABBBCCACCAABACACCBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe" start= auto displayName= "UserDataSvc_BCCBACAAAABBAABBCABBBCAAABABCBABBBCCACCAABACACCBCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBACAAAABBAABBCABBBCAAABABCBABBBCCACCAABACACCBCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBACAAAABBAABBCABBBCAAABABCBABBBCCACCAABACACCBCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1824

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe
1⤵
- Executes dropped EXE
PID:5040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABCCCBBCACBCACCCCAABABCBCCCBBBACABCABABACCCACBBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABCCCBBCACBCACCCCAABABCBCCCBBBACABCABABACCCACBBCABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41506ce97a3e9040c3deb6c7b124acce6734757440540a609ffc290be965b84d
MD5 8a3feb21794c2b639e758bf2e00f3a3b
SHA1 7af38b41e943073b31783ec5f245e723797b4af1
SHA512 1a57a33a380ea616a2502840dc18f1c10c62af1fa4e0d18e579c0928e61b8d16aefe5cfc10768426de51f679bd514b275da39e0ae02bb549b24d0302903f06a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4e87d8c045ec9ef29e2b0c4538cca3b5ff6fdaaddc4730ffaad7948503eacc9b
MD5 4193e45ea049834c420e95ac9c71c44f
SHA1 1d3acea9c0889d61837038d9af6a2da0176bc408
SHA512 ff82286b9a369640a5a5c1f5821fc87373fefdea7622f44c02a8b8fea1ceac2c141744aa33214578cfec6f89e2466369d11100bad1b78fba72c3796015aa0550
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e44cb0f1c8d4f6ec0641b72ddea7b87d893e9e4a839b7c68b7f22b19fc06af8b
MD5 9e2b80b1cea04d2e2b1439d46a66ff6a
SHA1 f1d2ff00d396173f0cc439920d460e059d1139b5
SHA512 c24ae11660777ec2ebaab39d155d45f743d5f03e56f286749dc6a7df92c38cbf30e6154ff4c3a4279251381e84b798362e0a0aa9e917bf6030c56fd3b0e43d6e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 197ab84cf7ce0d53dbd86d8a1ab580e41a4c7e5b4da3f3235e9adabb7222b1b0
MD5 cae8ea39cd4bf0673402bec55d180690
SHA1 5d45ef8d14901e331424122df7dab5dc1a46a223
SHA512 10150c38654a181f43e92b13920d2347080e0835c18fec265e82503e783efc655ff9181594b75cc19e94af166af72e00e14bdd6efb61144a1f91d814518e72fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 51a3f133e3fc53e1164218745e9a7aad86fa32c5feb865182116c775217ccdba
MD5 87d86ba4e974c15b64aab319d7db2440
SHA1 c2174ddae5eff3d8f480b4e2c20db5fef201ce3e
SHA512 cc772216ba7658865488b2f19b10dbf013b69bbe1404469720e1763ce1d8147098e4eead392df569bad4bccc9a160715fc15191cbbef4bba0beba38b9bfd85c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 17690a4e0d2fc9fc922f5acc70e2fac3825d9de929f58f1ca3058d0510e9f68f
MD5 3651949c7e7c9e364d4f80f22da800fc
SHA1 0479c618b07f4090427d802ccfab500a26a7c9c1
SHA512 a9885edea3e97c24350993ed5445c7abe79bf58d5248d401053be5b279691f0e09f36cf507d4093af3091eb374f759fea27fce6b33b35c7c545a260e83c04f88
MD5 SHA1 SHA512

Submit Download

svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBBCBCBABCBBCCBCCABABBCCACBBAAACABCBACBBABCBBBBABAC.exe
Size 8.2MB
SHA256 a17bbf8e928382a50ca16670cb8758aabd20602c96abb5746471695fc8d0e1bb
MD5 26399ed83ae8e9f1f742c6ce2f438f78
SHA1 c33e82b25eefbbb187cc8e004e71291abf7b65e8
SHA512 179168b9a5dce155113abca44246bc97851d9a02895773a212da192b97981dff0154978c545566b1da5426dd52b14de1ce2d3ff476f78beab9abe586a8a9d3d5
SSDEEP 49152:U+E7+Eg+E7+EC1+ES+EWqatglu+E7+EF+Eg+E7+EC1+ES+EWqatglu+E7+Eg+E7N:eXdXJXJXdXJXJXbO4q75Av7fbUhabgf
TLSH
T14D863A09FD4240F2D82B417148DBE2FF9B70BA118B024E9BE789835F9D33BD16935A65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 221eadc05ecf9f984b266eb00cea709f9f77ea42ecb2b2066cf672d70eaed9c8
MD5 876a6af44046052b23b7a2abdcc0ae47
SHA1 fe9a179f4976981e054c12afe45d0fa0e9ee237c
SHA512 b3a74a3b5e7df68064763d9dde74faa8dea8d6cd6020da95c9a1cb00435a085383b204ce5322a7fdb08b33d34d02b0071f48c09a1cab076c285e51df4d103469
TLSH
T12D112350B0B5C893E170759EA6B9CBE708E433EBAC78EB00234A4218BB49C358F190D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2000-81-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/2240-22-0x00000000005F0000-0x0000000000611000-memory.dmp

Download

memory/2240-35-0x00000000005F0000-0x0000000000611000-memory.dmp

Download

memory/2316-6-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/5040-66-0x00000000005F0000-0x0000000000611000-memory.dmp

Download