b6bd09bff6f7de839e663d7cb869485b9d1ca2625f2ca4b67cc1dcd31740cc1a

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_6f25f18e93218a652691f649621bbe6e_elex_glassworm_icedid_vidar.exe
Size 3.8MB
Sample260929-2lwffawgrc
SHA256 b6bd09bff6f7de839e663d7cb869485b9d1ca2625f2ca4b67cc1dcd31740cc1a
MD5 6f25f18e93218a652691f649621bbe6e
SHA1 dfc0ce46b80f324ef86b3bf5180db3565d8277ae
SHA512 48b690af1c296f61908d69525d16a8ea1dd47811800b8b33c570add89e78bc0283fa49f2e0b3b912d670fa0f123c2d8631d4ce2730796e63ecbee357d1e45c44
SSDEEP 49152:U+ETqatglJ+ES+ETqatglu+EN+ES+ELl+ES+ETqatglJ+ES+ETqatglu+EN+ES+b:s/IC/ICR
TLSH
T1EB063A45FA8644B2D4660131089792BE4B70B915CB179E8BA3889FEEFFB37C05A31771
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1604	svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe
4412	svchost_BCBCACCAAACCCAAAABABACBABBBACBABBACBCBCBAAAACABABABBABC.exe
2456	svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBCCBCAABACACABBACACBABCAACABAAAABBCACACABBAACACABACACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCACCAAACCCAAAABABACBABBBACBABBACBCBCBAAAACABABABBABC.exe"	svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCABBCBBBCBCCBABBAACBAACCACACBCBBBACCBCCBCCBCCAACABCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe"	2026-09-29_6f25f18e93218a652691f649621bbe6e_elex_glassworm_icedid_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3484	sc.exe
4772	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4568	cmd.exe
2432	cmd.exe
2672	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_6f25f18e93218a652691f649621bbe6e_elex_glassworm_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCACCAAACCCAAAABABACBABBBACBABBACBCBCBAAAACABABABBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2804	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4952	2026-09-29_6f25f18e93218a652691f649621bbe6e_elex_glassworm_icedid_vidar.exe
4952	2026-09-29_6f25f18e93218a652691f649621bbe6e_elex_glassworm_icedid_vidar.exe
4952	2026-09-29_6f25f18e93218a652691f649621bbe6e_elex_glassworm_icedid_vidar.exe
4952	2026-09-29_6f25f18e93218a652691f649621bbe6e_elex_glassworm_icedid_vidar.exe
1604	svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe
1604	svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe
1604	svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe
1604	svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	2026-09-29_6f25f18e93218a652691f649621bbe6e_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	1604	svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4568	4952	2026-09-29_6f25f18e93218a652691f649621bbe6e_elex_glassworm_icedid_vidar.exe	92
PID 4568 wrote to memory of 2804	4568	cmd.exe	94
PID 1604 wrote to memory of 804	1604	svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe	95
PID 4952 wrote to memory of 2432	4952	2026-09-29_6f25f18e93218a652691f649621bbe6e_elex_glassworm_icedid_vidar.exe	98
PID 2432 wrote to memory of 3484	2432	cmd.exe	100
PID 4952 wrote to memory of 2672	4952	2026-09-29_6f25f18e93218a652691f649621bbe6e_elex_glassworm_icedid_vidar.exe	101
PID 2672 wrote to memory of 4772	2672	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-29_6f25f18e93218a652691f649621bbe6e_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_6f25f18e93218a652691f649621bbe6e_elex_glassworm_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCBCCABBCBACCCBAAACAACBBCBBABACCBABBACBBABABBCCCCACAABBCAAACCCCACAAACBCABCCCAABCBAAACCBCABBCABCBBCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCBCCABBCBACCCBAAACAACBBCBBABACCBABBACBBABABBCCCCACAABBCAAACCCCACAAACBCABCCCAABCBAAACCBCABBCABCBBCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCBCCBCBACACBBACBCCCBACBCBBCBAABABBABBCBCABAAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe" start= auto displayName= "UserDataSvc_BACCBCCBCBACACBBACBCCCBACBCBBCBAABABBABBCBCABAAACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCBCCBCBACACBBACBCCCBACBCBBCBAABABBABBCBCABAAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe" start= auto displayName= "UserDataSvc_BACCBCCBCBACACBBACBCCCBACBCBBCBAABABBABBCBCABAAACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCBCCBCBACACBBACBCCCBACBCBBCBAABABBABBCBCABAAACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCBCCBCBACACBBACBCCCBACBCBBCBAABABBABBCBCABAAACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4772

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACCAAACCCAAAABABACBABBBACBABBACBCBCBAAAACABABABBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACCAAACCCAAAABABACBABBBACBABBACBCBCBAAAACABABABBABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe
1⤵
- Executes dropped EXE
PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1e7cdf60101137bc35c2da05b6c3212d749e80f0b7e8957742c8699a5ce66d21
MD5 d290f0260da2760873608d0a99d1190b
SHA1 0f5273234fbe6b97b8f6157ad6b047f88c9a03dd
SHA512 d7abef5ab947f77ca89d002664041457547dd6e6ed4729e5cb5d793c005e93694117ef650d0ed53932e275cdbc19183d8bd3df4791dc2596f2259c033a5f9fc9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 10a8ad7faf528cdcd7c7a7a10b5119655641d2b64ba32cd706d3a91ef55cc2a0
MD5 8f7dcad62b20a4d25510f8c5d529bb44
SHA1 96e287a1400b21fd0c6e0d2318cc435c851ea703
SHA512 0432cc0e0dc11672b84869e25bc93b4248cf3d31e641f2c9d017415d8b73ba4b69e8b805032e2ca4e0dcc72d8199331ae308920cacc77a51d872180820600cea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f4c5abedcbf596a6dd822f17ae63ff15ab614277d537c7c48ad95e4c6d2ffc48
MD5 059867ac00396c3750c4898172f98cee
SHA1 13099082e5195d872b9f8383f430d518cde543d1
SHA512 18e7f6d83d998fd68e347b526486c9b2aace47084ce1d6e3364b9729a68de183254229d0e2aba1b97290d6b7c3386114e0a246884ed8f13dc8dd26e6f5018444
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7eb319e3e7ea53987f0729df64ccd0902359a7e213d131b98d08e1e337098a22
MD5 efd14c52531c3acf35846bd9d4cf4e04
SHA1 bf215e9df18243f73466b6127a02f9c227122485
SHA512 f3b92c71bebadc772d0f444ceace0ac3a55134f19cf72414bf253a20674e721a76e24752cf5dd85a85b8cb2e3d630b87b3b19ca9997501b9702c61d5c73e9a76
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ebc1df380d2a02af69c620b9458554968e6ea00316be05844581086b963c168b
MD5 5f2817cf6dc7b773e21ecc8c4754c531
SHA1 625c9333369bcfa754038390212eb44c57727975
SHA512 337a5eef6495533e36c6c9d4c28efbe710978d2c1273e32d37904d832c321f234f0686512120bb64fb815d87d6a4bde4131d6b72918c0903b90f9b7759f411df
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 220498c687a3db9bd493d91ceb89e75881e5f87a3946d284a1a4e2c6b3cb26e4
MD5 59732c9cef1768be05dc158324788415
SHA1 d70273b79b5ac9776ee98f56f2d45d0fa2f5c9c7
SHA512 5542d2cae182b4af535827c8fef16fd0f711d5e387c0290369e4e374d5b3074a9735e4195b3f4484a83d49fe550f845b46d9916fa5d27c4845ae4a6102ad7639
MD5 SHA1 SHA512

Submit Download

svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACBBBCBAAACCBCCBBBABCCBBAABBABABBBAAABCABACABCBBBAC.exe
Size 3.8MB
SHA256 b6bd09bff6f7de839e663d7cb869485b9d1ca2625f2ca4b67cc1dcd31740cc1a
MD5 6f25f18e93218a652691f649621bbe6e
SHA1 dfc0ce46b80f324ef86b3bf5180db3565d8277ae
SHA512 48b690af1c296f61908d69525d16a8ea1dd47811800b8b33c570add89e78bc0283fa49f2e0b3b912d670fa0f123c2d8631d4ce2730796e63ecbee357d1e45c44
SSDEEP 49152:U+ETqatglJ+ES+ETqatglu+EN+ES+ELl+ES+ETqatglJ+ES+ETqatglu+EN+ES+b:s/IC/ICR
TLSH
T1EB063A45FA8644B2D4660131089792BE4B70B915CB179E8BA3889FEEFFB37C05A31771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1604-34-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/4412-65-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/4952-0-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/4952-8-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download