57b5ce3d4693d607bfbb5ab49ecf3a79c107b30953680760dc7793ec482f6948

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 13:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_4330795279b43e2cbbbef569f4977791_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Size 19.1MB
Sample260916-p9fcxa1cjf
SHA256 57b5ce3d4693d607bfbb5ab49ecf3a79c107b30953680760dc7793ec482f6948
MD5 4330795279b43e2cbbbef569f4977791
SHA1 d3ca36f08a99a19ee85760f3a511b4e5697b3cd1
SHA512 085de797cbbefb29a83178c99d98ad635f07b9abf3d5f3c964c62563afecda26de5544b8b92e47da085336587a1147c9a6218133ae39ef27882cfb296b0a9572
SSDEEP 196608:600PnSA00PnSA00PnSA00PnSA00PnSA00PnSA00PnSf:sBBBBBBW
TLSH
T138178D49FA4244F2D82B017148CBD3BB8B70BA114B128FABE759C71F6F33791A929751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4c4-20.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1392	svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe
5356	svchost_CAABABAACACCAAACCBCBABABBBCBBACCBCBBCBCBACCCCABBABBCCCA.exe
4160	svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABABCACCBCCABACCBBCCBCCAAAABCACBBBCAACCBBCCCCACABABCBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABABAACACCAAACCBCBABABBBCBBACCBCBBCBCBACCCCABBABBCCCA.exe"	svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBAAAACAACBAACAABBBACACBAAABBBBBABCCCCAABBCCAABAACBCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe"	2026-09-16_4330795279b43e2cbbbef569f4977791_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3624	sc.exe
2472	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1580	cmd.exe
1872	cmd.exe
1100	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_4330795279b43e2cbbbef569f4977791_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABABAACACCAAACCBCBABABBBCBBACCBCBBCBCBACCCCABBABBCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2448	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1516	2026-09-16_4330795279b43e2cbbbef569f4977791_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
1516	2026-09-16_4330795279b43e2cbbbef569f4977791_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
1516	2026-09-16_4330795279b43e2cbbbef569f4977791_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
1516	2026-09-16_4330795279b43e2cbbbef569f4977791_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
1392	svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe
1392	svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe
1392	svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe
1392	svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe
5356	svchost_CAABABAACACCAAACCBCBABABBBCBBACCBCBBCBCBACCCCABBABBCCCA.exe
5356	svchost_CAABABAACACCAAACCBCBABABBBCBBACCBCBBCBCBACCCCABBABBCCCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	2026-09-16_4330795279b43e2cbbbef569f4977791_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1392	svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe
Token: SeDebugPrivilege	5356	svchost_CAABABAACACCAAACCBCBABABBBCBBACCBCBBCBCBACCCCABBABBCCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1580	1516	2026-09-16_4330795279b43e2cbbbef569f4977791_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	90
PID 1580 wrote to memory of 2448	1580	cmd.exe	92
PID 1392 wrote to memory of 4928	1392	svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe	93
PID 1516 wrote to memory of 1872	1516	2026-09-16_4330795279b43e2cbbbef569f4977791_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	96
PID 1872 wrote to memory of 3624	1872	cmd.exe	98
PID 1516 wrote to memory of 1100	1516	2026-09-16_4330795279b43e2cbbbef569f4977791_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	99
PID 1100 wrote to memory of 2472	1100	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-16_4330795279b43e2cbbbef569f4977791_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_4330795279b43e2cbbbef569f4977791_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABCCCCBBACBCABABCCCAAAACCAACABBACCABCACBCBCBBCAABBAAACCAAACBCACACABCCAABBBCABCCABCCBABCBABABCABBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABCCCCBBACBCABABCCCAAAACCAACABBACCABCACBCBCBBCAABBAAACCAAACBCACACABCCAABBBCABCCABCCBABCBABABCABBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABACCBCBCCCCBAAAABBCABBAAABBAABACABBCCBCCBACABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe" start= auto displayName= "UserDataSvc_ACABACCBCBCCCCBAAAABBCABBAAABBAABACABBCCBCCBACABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABACCBCBCCCCBAAAABBCABBAAABBAABACABBCCBCCBACABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe" start= auto displayName= "UserDataSvc_ACABACCBCBCCCCBAAAABBCABBAAABBAABACABBCCBCCBACABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABACCBCBCCCCBAAAABBCABBAAABBAABACABBCCBCCBACABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABACCBCBCCCCBAAAABBCABBAAABBAABACABBCCBCCBACABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABAACACCAAACCBCBABABBBCBBACCBCBBCBCBACCCCABBABBCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABAACACCAAACCBCBABABBBCBBACCBCBBCBCBACCCCABBABBCCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe
1⤵
- Executes dropped EXE
PID:4160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d25580cfad4995f5d30657c7e520104462e29bc548e6c778d6426c4df95ccb20
MD5 c8b759f734d6d8b9e2fb75d77f801d68
SHA1 59bc50b4bc2e7dcaf7a77362d060e652618105d2
SHA512 51893f76cd3adb0a1678dbc111e9a43b074e4e379b002b20559907f06d9ca3640eea8f11e30bf397661125ccd0cfb7a055c68bc678d5ac9da65461940c3de217
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 919140393b908698e8688772790acc61044adecddde9f32cb93a078067ce4a05
MD5 3444ba1e06f70089ec0f8c105211483e
SHA1 5e8327630981adea52c257dc65d9a4ab97553d52
SHA512 4a4f1ba57eb18e936ca318f6097cd9a3734fbc3eae40557278ad7b0e1b588d37892125b90ec9211606a9aca45fa61e84fbf9c001a0c7b05a29e7fd5aad0a2366
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2980058c0e608805cbb22d84511b80d4ab1e13a5eefb3c92e77716558c1c1a2b
MD5 663d7bb3ff813f0aa048b0d66ba14b91
SHA1 f05e0e84f1ac28118ee01bee1ae8eb55fb5eae88
SHA512 b7251a57924521ab8db5224bca3aa00a5c378f49252cc6fcb7098b6d77022f148f5c70f4b93a84bcd7f6772d4a8f76fdedf68b66d4f4bb8be56cd141eed89f37
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 205aa5ddd61ccfce27218f4614d552a1400d2f177f2d5602df2d2617f1122c89
MD5 850664e890647600bab45aa097503deb
SHA1 d3dfffc622034324315ea5ae5b1fde81197dc517
SHA512 a1704e729d2247622f96b195516ccce98efebde8c568b851d2ba0ae0669442009297f5117c0b40ea9e895f967543666b81e3f6286527af45759dcdde5714dbfd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 116d42f6927f7171f30a8830b961b8f00789f767aab9a256f3c3b28e7b67e6fd
MD5 c3d09832731d327b472915032ad7d575
SHA1 63c67fb1d4c0abeba8d243f21c9865458a0acee3
SHA512 30354da58b8cb98ec4e22ca53868f66b2416eef79411499af9b2a85531cc8e132561d9a7ccba196d857a14ce682ad5e4a5527dda578eea518f727984427f518e
MD5 SHA1 SHA512

Submit Download

svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAABCCCABCCCBBAACBABBCBABACABCCABABACBBBBCBABAAABCCC.exe
Size 19.1MB
SHA256 57b5ce3d4693d607bfbb5ab49ecf3a79c107b30953680760dc7793ec482f6948
MD5 4330795279b43e2cbbbef569f4977791
SHA1 d3ca36f08a99a19ee85760f3a511b4e5697b3cd1
SHA512 085de797cbbefb29a83178c99d98ad635f07b9abf3d5f3c964c62563afecda26de5544b8b92e47da085336587a1147c9a6218133ae39ef27882cfb296b0a9572
SSDEEP 196608:600PnSA00PnSA00PnSA00PnSA00PnSA00PnSA00PnSf:sBBBBBBW
TLSH
T138178D49FA4244F2D82B017148CBD3BB8B70BA114B128FABE759C71F6F33791A929751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b14a623f5e760015d9f61d214727df7b7d25e896ff60fe4f6fe60425fb5cd2da
MD5 ae36d9f3214e7bd4e3eb1cb9d85edff7
SHA1 3ab84a0c6140cbe63996a1bb38f78778297c762a
SHA512 2694c54cfad62508995f24418975fba6123bd585df7af80a1ef9be67019f98e12957e2441088a1e6689d55d95854315315de07ae7671ba0a10a229c074f66c44
TLSH
T12411042070B6CC23F1726882D66EAFE708A877AB5C5CEF14130A4128B35DC248E110D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1392-32-0x0000000000530000-0x0000000000551000-memory.dmp

Download

memory/1516-0-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/1516-8-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/5356-79-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download