192944634d034c9aae16cc8a35524fd2183cf93f404b7351ca2dcf38545a20b7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-22_944c394a1881eabccc55279bf869f221_elex_glassworm_icedid_vidar.exe
Size 4.1MB
Sample260922-xd894sda86
SHA256 192944634d034c9aae16cc8a35524fd2183cf93f404b7351ca2dcf38545a20b7
MD5 944c394a1881eabccc55279bf869f221
SHA1 b7ee1858472134d9ddf60f665434f141ccd23f85
SHA512 1644ebbc68fe9b289445c952903956612e8388d92036ebbaa47fd0c44e9f3ed647bbd130286fdce77b924649fb91b434758014629682dbe059374e2a80f3518c
SSDEEP 49152:U+Eat+Ea2+ES+E9oqatglJ+EaG+E9oqatglJ+Ea9+Eat+Ea2+ES+E9oqatglJ+Ex:xWI7v7mWI7k
TLSH
T1CA160846FA4580B2D4660570499792BE9730B815CB038EDBB284AFDEFFF2BD05E25631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4788	svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe
5584	svchost_CBBBAAAACBAABBAABABCAABCACABACCABBBBBCCCABCAAAACACBCBAC.exe
3696	svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCAABACCABBAACBABAABACAAABBBCCCBAAABABABCACCBCCBBAACACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe"	2026-09-22_944c394a1881eabccc55279bf869f221_elex_glassworm_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCBAABABAACAACCBCACABCCAABCAACABBAABAACACBACBACCBBACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBAAAACBAABBAABABCAABCACABACCABBBBBCCCABCAAAACACBCBAC.exe"	svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2288	sc.exe
1084	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6080	cmd.exe
5488	cmd.exe
4644	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-22_944c394a1881eabccc55279bf869f221_elex_glassworm_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBAAAACBAABBAABABCAABCACABACCABBBBBCCCABCAAAACACBCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3160	2026-09-22_944c394a1881eabccc55279bf869f221_elex_glassworm_icedid_vidar.exe
3160	2026-09-22_944c394a1881eabccc55279bf869f221_elex_glassworm_icedid_vidar.exe
3160	2026-09-22_944c394a1881eabccc55279bf869f221_elex_glassworm_icedid_vidar.exe
3160	2026-09-22_944c394a1881eabccc55279bf869f221_elex_glassworm_icedid_vidar.exe
4788	svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe
4788	svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe
4788	svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe
4788	svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3160	2026-09-22_944c394a1881eabccc55279bf869f221_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	4788	svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
840	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 6080	3160	2026-09-22_944c394a1881eabccc55279bf869f221_elex_glassworm_icedid_vidar.exe	100
PID 6080 wrote to memory of 4116	6080	cmd.exe	102
PID 4788 wrote to memory of 5916	4788	svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe	103
PID 5916 wrote to memory of 3084	5916	notepad.exe	104
PID 3160 wrote to memory of 5488	3160	2026-09-22_944c394a1881eabccc55279bf869f221_elex_glassworm_icedid_vidar.exe	111
PID 5488 wrote to memory of 2288	5488	cmd.exe	113
PID 3160 wrote to memory of 4644	3160	2026-09-22_944c394a1881eabccc55279bf869f221_elex_glassworm_icedid_vidar.exe	114
PID 4644 wrote to memory of 1084	4644	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-09-22_944c394a1881eabccc55279bf869f221_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-22_944c394a1881eabccc55279bf869f221_elex_glassworm_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBABBAAABCACBCABCBCACCABAACBCBCBCCBACCBBCCCACCCABCBBCBABCABCCCACBAABBBCBCCCCCACACAABACBCACACACBCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBABBAAABCACBCABCBCACCABAACBCBCBCCBACCBBCCCACCCABCBBCBABCABCCCACBAABBBCBCCCCCACACAABACBCACACACBCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCBCCBABBABBBBAACABCBCCCBACCCCCCCBCBABCCCCBACCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe" start= auto displayName= "UserDataSvc_CABCBCCBABBABBBBAACABCBCCCBACCCCCCCBCBABCCCCBACCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCBCCBABBABBBBAACABCBCCCBACCCCCCCBCBABCCCCBACCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe" start= auto displayName= "UserDataSvc_CABCBCCBABBABBBBAACABCBCCCBACCCCCCCBCBABCCCCBACCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCBCCBABBABBBBAACABCBCCCBACCCCCCCBCBABCCCCBACCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCBCCBABBABBBBAACABCBCCCBACCCCCCCBCBABCCCCBACCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAAACBAABBAABABCAABCACABACCABBBBBCCCABCAAAACACBCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAAAACBAABBAABABCAABCACABACCABBBBBCCCABCAAAACACBCBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5584

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe
1⤵
- Executes dropped EXE
PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 82b87d89768942b9f446705041258081e134e66c8e2ab661022ee024500ea54a
MD5 8d28b64054e545e7044e21b90bc7d642
SHA1 b89d7121fd93bf3ca435c7187d57bbe445e5232f
SHA512 47177dc7b4ab482fc0926cefa022c0a3d5351efd290312e010e6b1d8e5c657373601514506ca19a4a97880d9b49d0d8eb6dcf6e733d9dbbaef37320f30a47f3e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d68f631f2af264b63b05e6f2fa2c702a3f917d510fac988e3d1b468ef66848ec
MD5 e36bf613ef0d4a41443ecc1afeed7f0e
SHA1 4904b9cf2298f5f486807dd341817092fada9399
SHA512 06630abaf033aee8aac17c0dd8af251dcfcc2ff01496b2747f519d1ba33755ad8549d2c4ec9adc643a533b458171634ea3e813f35dc975884c6fa81d5b8d224b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1b30dfda892cd03b2dae7985b330fa1e62d7f1bc992c221ccd92e4ea4792885e
MD5 509f2a2cca874abd6e58670c6c75c641
SHA1 fddfe86bf956d595c35f2e8f14632a1738f5cd66
SHA512 6fbd1e2af74de9d9b49653d941db3dfd486d73ccc1983b63c0f9b6e62378f5f436863aaeee634c69bbbd56fa6d849244e4c913a3bb847b98b6b59aec9e7083a1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7b078fd371c1bae32d8d3f17ace9a6157d83a42611b1943eb4394f9e42c76088
MD5 e14a757ccfc39483adba050a719a302e
SHA1 84cce324b21a25b5c6608c88f27575673689e710
SHA512 21fad842843b7040f5b33ab023b488f9f796e29a31114f81a3804271ff0da53b083dbc8d5218f5ba29a853bbf006d7b15bba90d8ca7453c3664168dc2deae436
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c7d9305750e9c8524eb9d5e5a4288a23d2144039de3a171ba83bfba0b6b1f45c
MD5 0e95866d975caaf8d07e35a35e79bce3
SHA1 59a160f0f13bd44407bfff5b71459bb1088e5cb3
SHA512 adaf04605a132332d643924c6dfc4394c6bfaee514dbf276bb2df846997efcb078eb0a97d802298293378619c1647d12bc1248925cd2b9c5db07ecb33689bc2e
MD5 SHA1 SHA512

Submit Download

svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACCACBABAACABBBAAAABCBAACABBCBCCBBBACAAABBCBCBBAC.exe
Size 4.1MB
SHA256 192944634d034c9aae16cc8a35524fd2183cf93f404b7351ca2dcf38545a20b7
MD5 944c394a1881eabccc55279bf869f221
SHA1 b7ee1858472134d9ddf60f665434f141ccd23f85
SHA512 1644ebbc68fe9b289445c952903956612e8388d92036ebbaa47fd0c44e9f3ed647bbd130286fdce77b924649fb91b434758014629682dbe059374e2a80f3518c
SSDEEP 49152:U+Eat+Ea2+ES+E9oqatglJ+EaG+E9oqatglJ+Ea9+Eat+Ea2+ES+E9oqatglJ+Ex:xWI7v7mWI7k
TLSH
T1CA160846FA4580B2D4660570499792BE9730B815CB038EDBB284AFDEFFF2BD05E25631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3160-0-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/3160-8-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/4788-27-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/4788-37-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/5584-78-0x00000000004B0000-0x00000000004D1000-memory.dmp

Download

memory/5916-59-0x00000000059F0000-0x00000000059F1000-memory.dmp

Download