Overview

overview

7

Static

static

3

2026-11-01...ar.exe

windows10-2004-x64

7

2026-11-01...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 07:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_d46aba5ad9c983b3a0f488d3ff283897_elex_glassworm_icedid_njrat_vidar.exe
  • Size 10.0MB
  • Sample261102-jfp3csas6n
  • SHA256 55759280eadddd2027cb19f985722958ea931dbf0f9981c1ea873a0cc7e7aaf6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_d46aba5ad9c983b3a0f488d3ff283897_elex_glassworm_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_d46aba5ad9c983b3a0f488d3ff283897_elex_glassworm_icedid_njrat_vidar.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4592
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABAAABCABBBBCBCBABCBABABAACCCCACBBBABCABAABCBBCAACAABBACCAAACCCABCCCBCBBBCACCCCBAACBABBABABBCACBABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAABCBCACABCCCBAAACCCBABCACBABCABCCBCCBCCAACBCCAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:356
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABAAABCABBBBCBCBABCBABABAACCCCACBBBABCABAABCBBCAACAABBACCAAACCCABCCCBCBBBCACCCCBAACBABBABABBCACBABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAABCBCACABCCCBAAACCCBABCACBABCABCCBCCBCCAACBCCAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:5964
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCACAABAAABBCABABBACCABACACBCCACACBCAAACBABABABACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAABCBCACABCCCBAAACCCBABCACBABCABCCBCCBCCAACBCCAABBC.exe" start= auto displayName= "UserDataSvc_CCCACAABAAABBCABABBACCABACACBCCACACBCAAACBABABABACB"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6120
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_CCCACAABAAABBCABABBACCABACACBCCACACBCAAACBABABABACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAABCBCACABCCCBAAACCCBABCACBABCABCCBCCBCCAACBCCAABBC.exe" start= auto displayName= "UserDataSvc_CCCACAABAAABBCABABBACCABACACBCCACACBCAAACBABABABACB"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2784
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCACAABAAABBCABABBACCABACACBCCACACBCAAACBABABABACB"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4748
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_CCCACAABAAABBCABABBACCABACACBCCACACBCAAACBABABABACB"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1888
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAABCBCACABCCCBAAACCCBABCACBABCABCCBCCBCCAACBCCAABBC.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAABCBCACABCCCBAAACCCBABCACBABCABCCBCCBCCAACBCCAABBC.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3528
    • C:\Windows\notepad.exe
      "notepad.exe"
      2⤵
        PID:1016
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBBACACACABBCABBCABCCACCBBBBBAABBCABBBBCACBBBCBBCBABBACCBCCAABAABACAACBCACAABBBCACCBBBABCACABCACABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABBABCCCBACACAAABAAAABAABBCBAAACBBCCABAACAABABBCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4544
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBBACACACABBCABBCABCCACCBBBBBAABBCABBBBCACBBBCBBCBABBACCBCCAABAABACAACBCACAABBBCACCBBBABCACABCACABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABBABCCCBACACAAABAAAABAABBCBAAACBBCCABAACAABABBCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1672
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABBABCCCBACACAAABAAAABAABBCBAAACBBCCABAACAABABBCAAA.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABBABCCCBACACAAABAAAABAABBCBAAACBBCCABAACAABABBCAAA.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:948
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAABCBCACABCCCBAAACCCBABCACBABCABCCBCCBCCAACBCCAABBC.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAABCBCACABCCCBAAACCCBABCACBABCABCCBCCBCCAACBCCAABBC.exe
      1⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4800

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VC_redist.x86.exe
          • Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
          • Size 10.6MB
          • SHA256 67c6987ad2e7ae802c27d22340d4c34844c6656ca6a163a1a571de8d7d3c77db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\qap`g`v~dtlq
          • Size 10B
          • SHA256 be84564f5d4467c1f75f9d579da4253cc355609a5a759f8bbd8d8bf9a6fc9a78
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
          • Size 10B
          • SHA256 30c9be95e8fc1bf451e09e4a85041fdf9d7ea6a0ee118502b4d0f584a02db100
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\x64\qap`g`v~dtlq
          • Size 10B
          • SHA256 2966f67290bf6a90d19d4bb682feed1e67a3f6192368d3cc6d4ab018b7f9cb93
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\CacheStorage\qap`g`v~dtlq
          • Size 10B
          • SHA256 2b60213edeac0487216ae207efbdbd2e1e106e95d711f5f3103559df9eefe806
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Low\ESE\qap`g`v~dtlq
          • Size 10B
          • SHA256 9733440e11125bbecc106ba30be55400aad5e57499c7f07dd31a93ade3cb55bd
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\u2g4b6zf.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\qap`g`v~dtlq
          • Size 10B
          • SHA256 c890026d6e23bbc9ffca3f9822352591c5dfac6c311a696dfaa64ec5fde63daa
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 1d7b94d85f76792b5d3265120d05f4619173c718033f121cfc62c7f8cc6d72e4
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 c12315d9fdf9341cb6e5a0cc61efdd5b4d8ba7f2ed5f5fc8033a7e23e3da9940
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 3330a9f61ee480cd40d4b5659b121ab66ab2293f2f54c1e04566d14a6b4ebce5
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 b3289b5fde76d878b5861681db6b62ff9fb768c25ef9abf86c1b4bb1fd2950f2
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 85335906311d84e799a27556af3f7900fa9ab3d941c0c5642932fbc1e1b38349
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 78e9ae2b1d9f4d33d167b736014d85704be0a253407457c46299e24f762e2994
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
          • Size 10B
          • SHA256 cca0c3281b63e605e9ec5edbb307dba13e6913e5221bb746f1fe3796493da28d
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
          • Size 10B
          • SHA256 1d7b94d85f76792b5d3265120d05f4619173c718033f121cfc62c7f8cc6d72e4
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
          • Size 10B
          • SHA256 0dd555c982e77125ea26d4d67d4d23c35bed5e8f29f4a7effa3a0f6ba19b9b06
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
          • Size 10B
          • SHA256 48fbc31a21d8430d13667cbff0e21b170b37b9c3eb20be5cd5bfd41b650c16ca
          • MD5 SHA1 SHA512
          Submit Download

          svchost_CCCAAABCBCACABCCCBAAACCCBABCACBABCABCCBCCBCCAACBCCAABBC.exe
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAABCBCACABCCCBAAACCCBABCACBABCABCCBCCBCCAACBCCAABBC.exe
          • Size 10.0MB
          • SHA256 55759280eadddd2027cb19f985722958ea931dbf0f9981c1ea873a0cc7e7aaf6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 1KB
          • SHA256 7120a1247f92a16eeea83579cbcbfa07d8ede267b3ad4b1e8dc03277e7350476
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 926B
          • SHA256 cdbfaaacdcde9cadd5911f9fd1fcc6a432c9c71f5628b852deddab0d1e973cd1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 1KB
          • SHA256 b1c780b0f21e761bf11c6d8dbb7616a80ab2c427b08ed0493643874674fae890
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\qap`g`v~dtlq
          • Size 10B
          • SHA256 e836634d0876557567dd9b9fbb2370ef3e868d558fbc31a3bf9f1c440a4f2a4e
          • MD5 SHA1 SHA512
          Submit Download

          memory/948-1897-0x0000000000200000-0x0000000000221000-memory.dmp
          Download

          memory/948-63-0x0000000000200000-0x0000000000221000-memory.dmp
          Download

          memory/3528-33-0x0000000000970000-0x0000000000991000-memory.dmp
          Download

          memory/4592-6-0x0000000000660000-0x0000000000681000-memory.dmp
          Download

          memory/4800-75-0x0000000000970000-0x0000000000991000-memory.dmp
          Download