5692a13cc5cd9001a107e214d0b0f9d8c53b8837d82043cd921beddccef06cd7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_6fefff40a239855b7c91f801c4785260_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Size 10.8MB
Sample260811-bme7qsdl5w
SHA256 5692a13cc5cd9001a107e214d0b0f9d8c53b8837d82043cd921beddccef06cd7
MD5 6fefff40a239855b7c91f801c4785260
SHA1 db6bb9a2dc71bd988862297c9665b2fa4b01752d
SHA512 98af647f60ad3d8498c04fb1c871a72f9756e1246c608f27ddd678d34e74db8c1a82e2d175cc4ded20354bd535cda947e753c54530ad910ac5686e42db3cd271
SSDEEP 196608:8LZWLZWLZMLZWLZWLZC1tIDewjqkjiqM6:g66w66C8Kweky6
TLSH
T1A8B68D29FA94C1F2F9AB9439986B8672FA717A100933934B87D4C61E7F336815E35331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5352	svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe
5044	svchost_ACCBCBCBACAAAACBBAACBCACBBCBBCCAABAABCBCBABCCCACCCCCBCB.exe
4172	svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AACCACABACBBBCABBABBBACCBCBAABBBCAAACCACACCAAAABBCCCCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe"	2026-08-10_6fefff40a239855b7c91f801c4785260_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AABACCCACACABABACBBCCCBBABCBCABBCBBABABAABCAAAABBBCCCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBCBCBACAAAACBBAACBCACBBCBBCCAABAABCBCBABCCCACCCCCBCB.exe"	svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4108	sc.exe
220	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5908	cmd.exe
5772	cmd.exe
5280	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBCBCBACAAAACBBAACBCACBBCBBCCAABAABCBCBABCCCACCCCCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_6fefff40a239855b7c91f801c4785260_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5688	2026-08-10_6fefff40a239855b7c91f801c4785260_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
5688	2026-08-10_6fefff40a239855b7c91f801c4785260_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
5688	2026-08-10_6fefff40a239855b7c91f801c4785260_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
5688	2026-08-10_6fefff40a239855b7c91f801c4785260_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
5352	svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe
5352	svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe
5352	svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe
5352	svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5688	2026-08-10_6fefff40a239855b7c91f801c4785260_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	5352	svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5500	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5688 wrote to memory of 5908	5688	2026-08-10_6fefff40a239855b7c91f801c4785260_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	96
PID 5908 wrote to memory of 1012	5908	cmd.exe	98
PID 5352 wrote to memory of 2064	5352	svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe	99
PID 2064 wrote to memory of 5040	2064	notepad.exe	100
PID 5688 wrote to memory of 5772	5688	2026-08-10_6fefff40a239855b7c91f801c4785260_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	102
PID 5772 wrote to memory of 4108	5772	cmd.exe	106
PID 5688 wrote to memory of 5280	5688	2026-08-10_6fefff40a239855b7c91f801c4785260_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	107
PID 5280 wrote to memory of 220	5280	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-10_6fefff40a239855b7c91f801c4785260_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_6fefff40a239855b7c91f801c4785260_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCAACCBBBACAABBCBABBCBABAABCCABCAABCCCABAACAAACBBCCBAABACABABBBBBAACBCBBBBCCCAABABCBAABBBAABABAABCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCAACCBBBACAABBCBABBCBABAABCCABCAABCCCABAACAAACBBCCBAABACABABBBBBAACBCBBBBCCCAABABCBAABBBAABABAABCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAAAAAABABBBABBACABCBBBACBCBAAACCCCCBAACCBABABBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe" start= auto displayName= "UserDataSvc_BCAAAAAABABBBABBACABCBBBACBCBAAACCCCCBAACCBABABBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAAAAAABABBBABBACABCBBBACBCBAAACCCCCBAACCBABABBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe" start= auto displayName= "UserDataSvc_BCAAAAAABABBBABBACABCBBBACBCBAAACCCCCBAACCBABABBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAAAAAABABBBABBACABCBBBACBCBAAACCCCCBAACCBABABBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5280
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAAAAAABABBBABBACABCBBBACBCBAAACCCCCBAACCBABABBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5352
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBCBACAAAACBBAACBCACBBCBBCCAABAABCBCBABCCCACCCCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBCBACAAAACBBAACBCACBBCBBCCAABAABCBCBABCCCACCCCCBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5044

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe
1⤵
- Executes dropped EXE
PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 09235078643795b7f4e7ce0ddfdf0ff3df79e70c65ec8a01ce1f04f1634a5b82
MD5 5a9806291dcae8302ec9145d53ff6174
SHA1 ca6d6bf7d52bc68fedf817fcb774d51426a41d9d
SHA512 449c8139c76f7215d2b02e58717038a2de8726deba0575b77f30bde560571fe8c18454ab967bd5cf28314b92da9858c71b346456ec4bcf0a769278984238605a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2e7a59a5061b4febecc71d7bb2271f4e76f3549a99b1ea001e39d390e866484c
MD5 c1a3a48fd31b991235ca25389d348d28
SHA1 57bda0b1f1a8e8645d1670daba15076737adc9cf
SHA512 df6a79ee846210529a079daaa3ee592b376034b18c8f5a6d16545cce532ee165204d09bcc3cc2400adadd4d9b1835db3a71af5f704723083a37d172e7283413a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cfe04782cab5060b25884f81867f5ab35c75ce37966e68ee2fcf5ca31cc35b7a
MD5 82e0fe5255e82e3b0cdd39cd92cc155f
SHA1 792dab85ec23fa41ce0fe337149d4abddec6fd3d
SHA512 ffe0e94419494253a52178b669d9b58e6481e7a4748c4dbb249200d8daf9e3575f52fa29428d46b10bdaa2440a7babf096aba150ccbccbe7e452e5df78e0b006
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 577576d3424dda05a73edb6b1a0c3ed1b7912b5157a1301d92325161349bdc25
MD5 4f3ed3ca893aa0e6dbbf0986c5fba3be
SHA1 f99be32e4f93a2ca0b7d45f617709fc006419ddd
SHA512 da46c661bfbc349da44460859e479ff7b10021d197013bb641fe4c2740211f81483264f1e341cea8b25f4bc7682b45fb7ff64b6abdfffc2812ac364a7ab11212
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4cf0d393e5c01e88ef285d4fdc48fdecb9d6522e049266f77b08917aee9ae4d1
MD5 ee481e57817441bd1f22c90d4468316c
SHA1 eeab681a6978ed83dad378fb3ced25105d807058
SHA512 9e87a9b37ecac3fa51694f3a269d7d66f53ba04088d3231e66f92222e41fc0e1b3b0829865018ee4920e72f33eb8c19e0214c40bb362e1b86c0352b11bd06483
MD5 SHA1 SHA512

Submit Download

svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBABCBBBBCCBBBBAAABBCAABCABBBCCABBCBBBCACCBCCABAAB.exe
Size 10.8MB
SHA256 5692a13cc5cd9001a107e214d0b0f9d8c53b8837d82043cd921beddccef06cd7
MD5 6fefff40a239855b7c91f801c4785260
SHA1 db6bb9a2dc71bd988862297c9665b2fa4b01752d
SHA512 98af647f60ad3d8498c04fb1c871a72f9756e1246c608f27ddd678d34e74db8c1a82e2d175cc4ded20354bd535cda947e753c54530ad910ac5686e42db3cd271
SSDEEP 196608:8LZWLZWLZMLZWLZWLZC1tIDewjqkjiqM6:g66w66C8Kweky6
TLSH
T1A8B68D29FA94C1F2F9AB9439986B8672FA717A100933934B87D4C61E7F336815E35331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2064-60-0x00000000028D0000-0x00000000028D1000-memory.dmp

Download

memory/5044-79-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/5352-26-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/5352-36-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/5688-0-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/5688-7-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download