07b8182850784e8741c79d49c88896410a09cc5ab19028090a90df732d59234d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 03:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_32bce65b841b8bd65295ade4a5541b55_elex_glassworm_icedid_vidar.exe
Size 2.2MB
Sample260930-dycxvsdf72
SHA256 07b8182850784e8741c79d49c88896410a09cc5ab19028090a90df732d59234d
MD5 32bce65b841b8bd65295ade4a5541b55
SHA1 a66e0df044ccdd2de00b86ee64de38af206d04b6
SHA512 584eb405890d3c0cb93e0835c414f1e4b6017e6f9c13592e477f07259de085b20e921d6b8486581d964ef6312c60e826a16ec3923c7ccba501873e4fb46803d8
SSDEEP 49152:U+ES+EWqatglu+E7+E9b0+ES+EWqatglu+E7+E9bYijC5H:ywh+5H
TLSH
T117B51945B79551F1E477057048A782BE5A31BC20CB238FAF6244AAADBFB27C09D35B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5044	svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe
1572	svchost_CACBCABBBBBAABBBAABCBBABBAACBBCCBABBBAACAACBCABCAAACBCB.exe
4996	svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABCCCCAABABACBACBCBAAAABCBBCBBBACBBCBAACCCBCCABCBCCCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe"	2026-09-29_32bce65b841b8bd65295ade4a5541b55_elex_glassworm_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCACAACBCBBCCAAABCAAAACABACCCACCACBABACCACAACCAABBCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBCABBBBBAABBBAABCBBABBAACBBCCBABBBAACAACBCABCAAACBCB.exe"	svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5664	sc.exe
1928	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2420	cmd.exe
2724	cmd.exe
3904	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBCABBBBBAABBBAABCBBABBAACBBCCBABBBAACAACBCABCAAACBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_32bce65b841b8bd65295ade4a5541b55_elex_glassworm_icedid_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
932	2026-09-29_32bce65b841b8bd65295ade4a5541b55_elex_glassworm_icedid_vidar.exe
932	2026-09-29_32bce65b841b8bd65295ade4a5541b55_elex_glassworm_icedid_vidar.exe
932	2026-09-29_32bce65b841b8bd65295ade4a5541b55_elex_glassworm_icedid_vidar.exe
932	2026-09-29_32bce65b841b8bd65295ade4a5541b55_elex_glassworm_icedid_vidar.exe
5044	svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe
5044	svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe
5044	svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe
5044	svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	2026-09-29_32bce65b841b8bd65295ade4a5541b55_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	5044	svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 2420	932	2026-09-29_32bce65b841b8bd65295ade4a5541b55_elex_glassworm_icedid_vidar.exe	91
PID 2420 wrote to memory of 1852	2420	cmd.exe	93
PID 5044 wrote to memory of 4440	5044	svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe	94
PID 932 wrote to memory of 2724	932	2026-09-29_32bce65b841b8bd65295ade4a5541b55_elex_glassworm_icedid_vidar.exe	97
PID 2724 wrote to memory of 5664	2724	cmd.exe	99
PID 932 wrote to memory of 3904	932	2026-09-29_32bce65b841b8bd65295ade4a5541b55_elex_glassworm_icedid_vidar.exe	100
PID 3904 wrote to memory of 1928	3904	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-29_32bce65b841b8bd65295ade4a5541b55_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_32bce65b841b8bd65295ade4a5541b55_elex_glassworm_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCACBAACBCCABCBBBCBCBBBCCCBBCBACCABCBBCABCBACAABABCBBAABCACCCCCAABBABAABCCCCCBCCCABCACAAABBBAACBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCACBAACBCCABCBBBCBCBBBCCCBBCBACCABCBBCABCBACAABABCBBAABCACCCCCAABBABAABCCCCCBCCCABCACAAABBBAACBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCAABCACABBABBCACACCAAABACCCACCCCBACBABBAACACAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe" start= auto displayName= "UserDataSvc_ACCAABCACABBABBCACACCAAABACCCACCCCBACBABBAACACAABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCAABCACABBABBCACACCAAABACCCACCCCBACBABBAACACAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe" start= auto displayName= "UserDataSvc_ACCAABCACABBABBCACACCAAABACCCACCCCBACBABBAACACAABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCAABCACABBABBCACACCAAABACCCACCCCBACBABBAACACAABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCAABCACABBABBCACACCAAABACCCACCCCBACBABBAACACAABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCABBBBBAABBBAABCBBABBAACBBCCBABBBAACAACBCABCAAACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCABBBBBAABBBAABCBBABBAACBBCCBABBBAACAACBCABCAAACBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe
1⤵
- Executes dropped EXE
PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f66993e5f3a4c16fcfc9edb19a1b18d143f7f9792e414e2baa26f84e1a40247d
MD5 b9e04c305df0f5af19fcaad1f7445f43
SHA1 7708f5261bf6bcdbfb291edd773e595e124adc58
SHA512 63fcf39f3f86352c8fc4edcecaef7b75033c2551cc62115d09b9236db5c3ed9bf1fc34593657939a79e1ec510d0ac43d3800ad90df5e0bbbfab200b618fbd7e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0ad3ac671d12ba799d23a85daf2c422dc71bc452074c335caad924064597f2ac
MD5 5ab3b272e68ecc2ac7db3ab19c1de77e
SHA1 f07767dca4466b6b97b9f409c40d68e8a309e852
SHA512 d74ee68a95c54bfc7e5f2d2bf4fb3978866cf7758a7949370b036df7db3e5e36391fa1f25e7f759d69daeb681740123be311e24fb57a1834c883a19dff3627db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 611965f69cdaab297e5ff32313612d0b3eba33e914f19be980ea451071ebf12b
MD5 173e43de406f61243ffdfce16d919797
SHA1 cfa0693b077c9c0560c755f433cb24872f8d3fa8
SHA512 21e3aa7c4012e220c92a0460836d72846a24202f63e739d4bed5afad646d2172c6eab67e0cceaad9c59109981872c5d7f3cd0bd7f8522f174fb3f2739e7ad720
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 41d57e7fc1c35188e102b1e259f9f32c4fee6531deea340fb20f78e621c2224f
MD5 86cb21833816cd98acf808598a2376d3
SHA1 2d6f81372a44fdc28db694c1548e2b363404c969
SHA512 bb7c68d1e17393fea140db8a472c0749937633c71e90e1431520d8f7e8a6ea5ffdaeff0d3ce948bee792880fe12d7eaa2cae37f5fd1faa30f88753855c829f21
MD5 SHA1 SHA512

Submit Download

svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBBACACACCACBBBBCACABBCBCBBACCACCBBBBBCBBCAAAAABAB.exe
Size 2.2MB
SHA256 07b8182850784e8741c79d49c88896410a09cc5ab19028090a90df732d59234d
MD5 32bce65b841b8bd65295ade4a5541b55
SHA1 a66e0df044ccdd2de00b86ee64de38af206d04b6
SHA512 584eb405890d3c0cb93e0835c414f1e4b6017e6f9c13592e477f07259de085b20e921d6b8486581d964ef6312c60e826a16ec3923c7ccba501873e4fb46803d8
SSDEEP 49152:U+ES+EWqatglu+E7+E9b0+ES+EWqatglu+E7+E9bYijC5H:ywh+5H
TLSH
T117B51945B79551F1E477057048A782BE5A31BC20CB238FAF6244AAADBFB27C09D35B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-0-0x00000000004B0000-0x00000000004D1000-memory.dmp

Download

memory/932-8-0x00000000004B0000-0x00000000004D1000-memory.dmp

Download

memory/5044-24-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/5044-34-0x0000000000110000-0x0000000000131000-memory.dmp

Download