ab8b15ffb8c83e0cf55916070c0e181345244a58b26312f698efb8fbb6359a25

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_24a98bf47c8dbc90c69481f59f1c1b4c_elex_glassworm_icedid_njrat_vidar.exe
Size 2.7MB
Sample260916-q4pvtsbb95
SHA256 ab8b15ffb8c83e0cf55916070c0e181345244a58b26312f698efb8fbb6359a25
MD5 24a98bf47c8dbc90c69481f59f1c1b4c
SHA1 eae5acedf209c148862bde9505461af442898b4f
SHA512 330530217dacc60c8c7125c177f49d788f090d92ccc9afae2976775873461d88c071c8bad1dd4ff29844d595f5e886ef66858f28111f1e577fcaec0e0768df46
SSDEEP 49152:U+Ez+EjIAoeqatglr+Ez+Ez+EjIAoeqatglr+Ez+Ez+EjIAoeqatglsiw2s:UXaXaX9
TLSH
T10DD57C46F69584F2D4670231889782B7DBB2B8121F22D79F6358832E6F337D0AE39751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
860	svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe
3692	svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe
3980	svchost_BCCBABBABCCACCCBCACCACCBACAACAACCBBBAAABCBACABCCBAACACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACACAACCCAAACCCBABAABABBBABBBACACABCBBCAABCBABAABBBBBCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe"	2026-09-16_24a98bf47c8dbc90c69481f59f1c1b4c_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBAABBCBABBBACBACABCBABCBAACCBABABBBCCCCCACCAACAAAACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBABBABCCACCCBCACCACCBACAACAACCBBBAAABCBACABCCBAACACA.exe"	svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1828	sc.exe
1948	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4340	cmd.exe
2272	cmd.exe
3324	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBABBABCCACCCBCACCACCBACAACAACCBBBAAABCBACABCCBAACACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_24a98bf47c8dbc90c69481f59f1c1b4c_elex_glassworm_icedid_njrat_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
460	2026-09-16_24a98bf47c8dbc90c69481f59f1c1b4c_elex_glassworm_icedid_njrat_vidar.exe
460	2026-09-16_24a98bf47c8dbc90c69481f59f1c1b4c_elex_glassworm_icedid_njrat_vidar.exe
460	2026-09-16_24a98bf47c8dbc90c69481f59f1c1b4c_elex_glassworm_icedid_njrat_vidar.exe
460	2026-09-16_24a98bf47c8dbc90c69481f59f1c1b4c_elex_glassworm_icedid_njrat_vidar.exe
860	svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe
860	svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe
860	svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe
860	svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	460	2026-09-16_24a98bf47c8dbc90c69481f59f1c1b4c_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	860	svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 4340	460	2026-09-16_24a98bf47c8dbc90c69481f59f1c1b4c_elex_glassworm_icedid_njrat_vidar.exe	90
PID 4340 wrote to memory of 4104	4340	cmd.exe	92
PID 860 wrote to memory of 4332	860	svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe	93
PID 460 wrote to memory of 2272	460	2026-09-16_24a98bf47c8dbc90c69481f59f1c1b4c_elex_glassworm_icedid_njrat_vidar.exe	94
PID 2272 wrote to memory of 1948	2272	cmd.exe	96
PID 460 wrote to memory of 3324	460	2026-09-16_24a98bf47c8dbc90c69481f59f1c1b4c_elex_glassworm_icedid_njrat_vidar.exe	97
PID 3324 wrote to memory of 1828	3324	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-09-16_24a98bf47c8dbc90c69481f59f1c1b4c_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_24a98bf47c8dbc90c69481f59f1c1b4c_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACCAACCCBBBBAAAAABBAACCABBCCCBBABABCBCCCBCBCCABBABAACAAACBCCBAAACACAABCABACAACABCBCBCCACBCBBBABCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACCAACCCBBBBAAAAABBAACCABBCCCBBABABCBCCCBCBCCABBABAACAAACBCCBAAACACAABCABACAACABCBCBCCACBCBBBABCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCABBABBBABACABABBABBABAABCCABCBBCACABAABBCCBBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe" start= auto displayName= "UserDataSvc_CBCABBABBBABACABABBABBABAABCCABCBBCACABAABBCCBBABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCABBABBBABACABABBABBABAABCCABCBBCACABAABBCCBBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe" start= auto displayName= "UserDataSvc_CBCABBABBBABACABABBABBABAABCCABCBBCACABAABBCCBBABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCABBABBBABACABABBABBABAABCCABCBBCACABAABBCCBBABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCABBABBBABACABABBABBABAABCCABCBBCACABAABBCCBBABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4332

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe
1⤵
- Executes dropped EXE
PID:3692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABBABCCACCCBCACCACCBACAACAACCBBBAAABCBACABCCBAACACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABBABCCACCCBCACCACCBACAACAACCBBBAAABCBACABCCBAACACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 57e3e356f478dde09526a200b2e3ec05f22e039457d9504e06bea328cd94ad22
MD5 f65e710a1551ed95c53da723b6944a7c
SHA1 362bb9e0d137ab0f83febe09511aa81c3d699c40
SHA512 69b47d3e8f882061ee35f92bd6809f235081caed5b37f491ceed5389582d08b15eca58db4756cb71477e08f8f8d19e91f2bafec2f3cf5ddd31ae1c8d01e92e97
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7ca59f4f6efcf7afc57dacf3d3ae4b12d80dadbaf516fed8d8e82f5c4b724b8b
MD5 9d71d76a051c4d9d06335b49320605a5
SHA1 03b8866ab886b1ed8eb8eb3d98212a5db69bc859
SHA512 1236e6d25dde0df415b188e712a185ff3fba9ce719467b5e3a0bae414208ec2261f4323ba52085c5327f6d0eb8c00e2d2aa1e5562f2ab036d071f5916763399a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c614a948a8dd5578cc08d909829811e93f2ba110e6e119c04cd0612ee46f6425
MD5 4b2a7a2fe83ee74e7c48fdddae669110
SHA1 f5ba6a13750ebb83ce6d858341e74e7b3bb3f0e4
SHA512 9abdb4ff2cdde25685092499cdf8c35465547af3fb3671cc898e864d746b7d7c42255988c29080e0771993c3a2a6bea3e17e220e0de07c2a9eb3ae481ca0a722
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 43345cc4afd35c592ea12980cc35908aeebd1a5e3c4915d610f0eb26b8dcfb53
MD5 47545984045449563182f1904cc732eb
SHA1 7ca90d259c8b5086bfe3489def094b6d61d307aa
SHA512 7a3ca31059bdfdd32d9ebdc0e1d8b7260d4d8c68b3efc85c10ae6715e2c3f952196812b14df042523e7e0433f2c358bbd97af0b752d1caba339a9738de2df0d1
MD5 SHA1 SHA512

Submit Download

svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACAABCBBCCBAACCBCCCBBAACBCCACAAAAAACACBAAACCCBCCBAACA.exe
Size 2.7MB
SHA256 ab8b15ffb8c83e0cf55916070c0e181345244a58b26312f698efb8fbb6359a25
MD5 24a98bf47c8dbc90c69481f59f1c1b4c
SHA1 eae5acedf209c148862bde9505461af442898b4f
SHA512 330530217dacc60c8c7125c177f49d788f090d92ccc9afae2976775873461d88c071c8bad1dd4ff29844d595f5e886ef66858f28111f1e577fcaec0e0768df46
SSDEEP 49152:U+Ez+EjIAoeqatglr+Ez+Ez+EjIAoeqatglr+Ez+Ez+EjIAoeqatglsiw2s:UXaXaX9
TLSH
T10DD57C46F69584F2D4670231889782B7DBB2B8121F22D79F6358832E6F337D0AE39751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/460-0-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/460-8-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/860-24-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/860-34-0x0000000000950000-0x0000000000971000-memory.dmp

Download