5e3094b1d65950b7ec4abb74dde4b09684ac4b24e050bef611b144773151fcc7

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_9a449c298d2a57c44128842088077894_amadey_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Size 47.5MB
Sample260808-v4fpdaef59
SHA256 5e3094b1d65950b7ec4abb74dde4b09684ac4b24e050bef611b144773151fcc7
MD5 9a449c298d2a57c44128842088077894
SHA1 06347f7ebd2b100ff02b3dca9e1694fe0e8f0c4e
SHA512 33cfc025e686ff10ebb59deb9c016ba79815a326fffe7247fc80d9748d21a1b403eb363b1d645a98628fb9493d271fe60674b6e7433d995785337522cafd8411
SSDEEP 393216:i33333333s88Kweky033333333s88Kwekyfc:i33333333s+C33333333s+a
TLSH
T151B7D05AFE9580E0FD7BA43458ABD232D9327E364433874B99D5F60A7F33A515C0A232
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4fc-19.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1040	svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe
3260	svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe
2128	svchost_ACACBCABABCAAAAACCACBCBBBACBABACAACABABCBCAAABBCACCBCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCABCBAAAACCBACBAACCAABCCCAAAAACCAAABCCBBABBABABCABCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe"	2026-08-08_9a449c298d2a57c44128842088077894_amadey_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACACCBABCABBBCACABBCBCAACBBBACCCBBCAAABAABCABBCAABCBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACBCABABCAAAAACCACBCBBBACBABACAACABABCBCAAABBCACCBCCA.exe"	svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6064	sc.exe
4880	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1452	cmd.exe
5040	cmd.exe
4168	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_9a449c298d2a57c44128842088077894_amadey_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACBCABABCAAAAACCACBCBBBACBABACAACABABCBCAAABBCACCBCCA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3584	2026-08-08_9a449c298d2a57c44128842088077894_amadey_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
3584	2026-08-08_9a449c298d2a57c44128842088077894_amadey_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
3584	2026-08-08_9a449c298d2a57c44128842088077894_amadey_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
3584	2026-08-08_9a449c298d2a57c44128842088077894_amadey_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
1040	svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe
1040	svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe
1040	svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe
1040	svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe
2128	svchost_ACACBCABABCAAAAACCACBCBBBACBABACAACABABCBCAAABBCACCBCCA.exe
2128	svchost_ACACBCABABCAAAAACCACBCBBBACBABACAACABABCBCAAABBCACCBCCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3584	2026-08-08_9a449c298d2a57c44128842088077894_amadey_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1040	svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe
Token: SeDebugPrivilege	2128	svchost_ACACBCABABCAAAAACCACBCBBBACBABACAACABABCBCAAABBCACCBCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 1452	3584	2026-08-08_9a449c298d2a57c44128842088077894_amadey_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	91
PID 1452 wrote to memory of 3460	1452	cmd.exe	93
PID 3584 wrote to memory of 5040	3584	2026-08-08_9a449c298d2a57c44128842088077894_amadey_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	94
PID 5040 wrote to memory of 6064	5040	cmd.exe	96
PID 1040 wrote to memory of 4088	1040	svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe	97
PID 3584 wrote to memory of 4168	3584	2026-08-08_9a449c298d2a57c44128842088077894_amadey_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	98
PID 4168 wrote to memory of 4880	4168	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-08_9a449c298d2a57c44128842088077894_amadey_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_9a449c298d2a57c44128842088077894_amadey_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAABAAABABAAACCBBACBBCBABBCACCCABBBCBAAABCBBBCCBCBACAACCACACCBACCBBCBCAACCBCCBAAACCABCAAABAABCBBBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABAABAAABABAAACCBBACBBCBABBCACCCABBBCBAAABCBBBCCBCBACAACCACACCBACCBBCBCAACCBCCBAAACCABCAAABAABCBBBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCABCAABBCAABCCBCBAABBBCCCCCCCABBBACBCCCACCBBCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe" start= auto displayName= "UserDataSvc_BBCABCAABBCAABCCBCBAABBBCCCCCCCABBBACBCCCACCBBCCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCABCAABBCAABCCBCBAABBBCCCCCCCABBBACBCCCACCBBCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe" start= auto displayName= "UserDataSvc_BBCABCAABBCAABCCBCBAABBBCCCCCCCABBBACBCCCACCBBCCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCABCAABBCAABCCBCBAABBBCCCCCCCABBBACBCCCACCBBCCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCABCAABBCAABCCBCBAABBBCCCCCCCABBBACBCCCACCBBCCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe
1⤵
- Executes dropped EXE
PID:3260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCABABCAAAAACCACBCBBBACBABACAACABABCBCAAABBCACCBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCABABCAAAAACCACBCBBBACBABACAACABABCBCAAABBCACCBCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cc25bb1643d6c124104190ec89af4b54968679aac066506e6977c35638d5f37e
MD5 c6a63c322bb8addca9279f600cc39167
SHA1 d8322e1930c70a0dddf761d50aa762dca932b891
SHA512 80ddcf64d2730ee6dfd41cedc6f0692a94476c0d65d84c2698a97f544402de9ba30a09b3c34ffd6043ab96c1318888ff0ffc0bfa483b3112418b6d1a59d2ed3c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d3f4d34df28a70f7b96835a6cdf090cb3719256ebe7712ee7bc6693253434cb7
MD5 a84f4ffd0517deddc9b2c56bbf65d23d
SHA1 ddfa06edddb79a1aa165226aecc6ca9f263f92d3
SHA512 95ff64cf8813842fe5190106d3c53544dc3563aada8b6eae0d06ffc44bda67019ae717f635f306071e4a9d88281406484e264f961ed97237e63a6d965d53b4aa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eb3bd99f4e69d895ac409caedd9c1090fc4a12bbc2dbe0b1c8442f9d9f8cdfe6
MD5 e995f282a9c17ed89b78132c19a6a926
SHA1 9e634f3d1b3d219ad63cda0eb27a9c01939e969c
SHA512 c418d4db21fe80edd08d550753ffa86cb292ffe7ffba6dfd5a5d92943a42d8c45d5a8513c9043f220a357d701987209630906225c61ac0d36eb287fb5ba71ac1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d03045685a5b419e298fbac1ae942c2439f2431fc23cba3f8c5c420dc7f4b1bf
MD5 2587e09e5a75d09a5b3198423149ce76
SHA1 d0b0cdcaee8a550d68d925ff830652357ad12088
SHA512 8ac060626a42ebe9f7d438f8494d43dfc428f82b031fc432bb0701067cbf5b5a71c028ae503ac6dfc817b52d98e5a8afde4ef03c16c9842dfc6c03956f3caedf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4b4b2643e0d1aae85fa46a6f7c0e444f2f3a0f7333c3af95fd943b7e3ba51f10
MD5 12874aa9f7bc56da4d1d1513d49b199e
SHA1 a2002f74303af19a929f1f2e7b2f82504771e8ef
SHA512 f4bdfe241cc02b807c3ee4363c80c555b4f3a23397cb1bc1f8a1918af966a7b4133f5b48ea1bfc4eca4095e61242b3525602bc29eeb3a95ccb394e3de6da9dbc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e8a3b0f5ad1305240224776e67b61579d270e48d33058b4590c0f0376eb7c422
MD5 8c02971793f9ad5e98b627d657e261f7
SHA1 7c4ec4f6af553270a04c6481689e1d7c697dfea6
SHA512 7ac848859bf86a3e9d32012a11ddbe1454b39320397a1a4fb32679343fe6c78f2d02ce885967d8ea6cee0de854972961ddd5179bcb47f86c5f8e42a5e46c88c1
MD5 SHA1 SHA512

Submit Download

svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABACBCABBBAABAACCCCBABBACAACAACCCCAAACABAABBBCACBCA.exe
Size 47.5MB
SHA256 5e3094b1d65950b7ec4abb74dde4b09684ac4b24e050bef611b144773151fcc7
MD5 9a449c298d2a57c44128842088077894
SHA1 06347f7ebd2b100ff02b3dca9e1694fe0e8f0c4e
SHA512 33cfc025e686ff10ebb59deb9c016ba79815a326fffe7247fc80d9748d21a1b403eb363b1d645a98628fb9493d271fe60674b6e7433d995785337522cafd8411
SSDEEP 393216:i33333333s88Kweky033333333s88Kwekyfc:i33333333s+C33333333s+a
TLSH
T151B7D05AFE9580E0FD7BA43458ABD232D9327E364433874B99D5F60A7F33A515C0A232
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e823ad12b0421bde4fdb6001e8b09dc5926fe483a1276fbd62bcdf32e00d3624
MD5 f3fcb1c36c6aaf93b8a7215310292ce1
SHA1 6a0c532b4ef56746c0e82ffbbd64a979a6ca4e60
SHA512 2e49682b24b3e5e5a1daa10bf1da74bdf47ae144a20e90bef97e6b7db09b01bd4c94f5e1bce1fd03d730240e82691328642618e1489540a6be46b19681defb28
TLSH
T137113D6474E9E8A7FE332CD79915AA821CF033877D5CAA2753454218BA45C31CD128D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1040-23-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/1040-36-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/2128-81-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/3260-66-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/3584-0-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/3584-7-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download