48ce7e40221d3b28a5455b70ee3f92bd63f31c1d7f963b81f0432c40bc58b804

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_ac315eff3e13e12a9e9263e1603faf57_amadey_elex_glassworm_icedid_njrat_vidar.exe
Size 8.5MB
Sample260813-2ach7ayyht
SHA256 48ce7e40221d3b28a5455b70ee3f92bd63f31c1d7f963b81f0432c40bc58b804
MD5 ac315eff3e13e12a9e9263e1603faf57
SHA1 4218486bea72a281c983c197459bff33b9fa54de
SHA512 5ff6b3807a9569fd965c2ed4e05278609fecc9c4a84f83f283db1677d9396f8766867f5e7a4dfd5eeb7df0d4c0a329bd1f2d255903958d2b178030467fa5e79e
SSDEEP 49152:U+ESgX+ESm+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgtozMlTM:R1MbQ9yDAD7KjjqkusjmqMh
TLSH
T1B1968D2DEBA481F5F9ABD47898ABC276EA717A110833571BCAD1C61F6F336524C18331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4348	svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe
2920	svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe
4668	svchost_BBABBCCBCBACACCAABCCAABCCBCAABCACCCCABAAABCBAABCBCCBBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBAAABBAAAACABCACACACAACBBCBAAACBCACABBBCCCACAAACBBCCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe"	2026-08-13_ac315eff3e13e12a9e9263e1603faf57_amadey_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBCCBAAAABBBBCCBBABCABBCCBCBBBBCCAACACCBCCBBACBCACCAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABBCCBCBACACCAABCCAABCCBCAABCACCCCABAAABCBAABCBCCBBAB.exe"	svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1804	sc.exe
1948	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1708	cmd.exe
5524	cmd.exe
4772	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_ac315eff3e13e12a9e9263e1603faf57_amadey_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABBCCBCBACACCAABCCAABCCBCAABCACCCCABAAABCBAABCBCCBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3324	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6016	2026-08-13_ac315eff3e13e12a9e9263e1603faf57_amadey_elex_glassworm_icedid_njrat_vidar.exe
6016	2026-08-13_ac315eff3e13e12a9e9263e1603faf57_amadey_elex_glassworm_icedid_njrat_vidar.exe
6016	2026-08-13_ac315eff3e13e12a9e9263e1603faf57_amadey_elex_glassworm_icedid_njrat_vidar.exe
6016	2026-08-13_ac315eff3e13e12a9e9263e1603faf57_amadey_elex_glassworm_icedid_njrat_vidar.exe
4348	svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe
4348	svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe
4348	svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe
4348	svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe
4668	svchost_BBABBCCBCBACACCAABCCAABCCBCAABCACCCCABAAABCBAABCBCCBBAB.exe
4668	svchost_BBABBCCBCBACACCAABCCAABCCBCAABCACCCCABAAABCBAABCBCCBBAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6016	2026-08-13_ac315eff3e13e12a9e9263e1603faf57_amadey_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4348	svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe
Token: SeDebugPrivilege	4668	svchost_BBABBCCBCBACACCAABCCAABCCBCAABCACCCCABAAABCBAABCBCCBBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6016 wrote to memory of 1708	6016	2026-08-13_ac315eff3e13e12a9e9263e1603faf57_amadey_elex_glassworm_icedid_njrat_vidar.exe	92
PID 1708 wrote to memory of 3324	1708	cmd.exe	94
PID 4348 wrote to memory of 5304	4348	svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe	95
PID 6016 wrote to memory of 5524	6016	2026-08-13_ac315eff3e13e12a9e9263e1603faf57_amadey_elex_glassworm_icedid_njrat_vidar.exe	96
PID 5524 wrote to memory of 1804	5524	cmd.exe	98
PID 6016 wrote to memory of 4772	6016	2026-08-13_ac315eff3e13e12a9e9263e1603faf57_amadey_elex_glassworm_icedid_njrat_vidar.exe	99
PID 4772 wrote to memory of 1948	4772	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-13_ac315eff3e13e12a9e9263e1603faf57_amadey_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_ac315eff3e13e12a9e9263e1603faf57_amadey_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCACBABACACABCAAABACBCCCCCCBBBCABBBBBCCBACACCCCABBAABABBBBCCBCCAABBBCBBBAAAABAABAABBBCBABABCABAABABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCACBABACACABCAAABACBCCCCCCBBBCABBBBBCCBACACCCCABBAABABBBBCCBCCAABBBCBBBAAAABAABAABBBCBABABCABAABABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCCCCBABACBBAACBCCBACBCBCBCBACCABBBBBABCCACBABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe" start= auto displayName= "UserDataSvc_BBCCCCCBABACBBAACBCCBACBCBCBCBACCABBBBBABCCACBABBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5524
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCCCCBABACBBAACBCCBACBCBCBCBACCABBBBBABCCACBABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe" start= auto displayName= "UserDataSvc_BBCCCCCBABACBBAACBCCBACBCBCBCBACCABBBBBABCCACBABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCCCCBABACBBAACBCCBACBCBCBCBACCABBBBBABCCACBABBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCCCCBABACBBAACBCCBACBCBCBCBACCABBBBBABCCACBABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5304

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe
1⤵
- Executes dropped EXE
PID:2920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCCBCBACACCAABCCAABCCBCAABCACCCCABAAABCBAABCBCCBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBCCBCBACACCAABCCAABCCBCAABCACCCCABAAABCBAABCBCCBBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7858acc47e00406bbe94139fa737260f4f2c5872255c8b916c26faa2c816904c
MD5 409f3d23d79a61575a4159006165ee42
SHA1 d4c5e96f31f886fd89e5a2cd2e27dabc05dd0e48
SHA512 d02917ee489f3ca4c7559231153ce307e5697e6ee8183c1de3943736815edd92b26cfce802ddb91e9e2b22c82b27b8073130c51abad948451f793f8e797db3f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 493feba5d8cccc51a64c2a29e9596b8a7cecfcb4bebc33ead9b2d612a05d4ba7
MD5 2c77a2e2c87fce9229dbd8afd34fe923
SHA1 af9252af02379d2ea63ab6e3f30bdea4da14f3dc
SHA512 0d390e4c0dde5ac0b343e44acd0d7a528c39244df070d77a6630d01da5b204a2bc3e3ecc9672772856430d1c50262c938a1ecb263f969176569521e216c41349
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa263ce514550d5fc5a4bb5809994989e48c719b33f48699388cc7a4cb548c1d
MD5 5d9ccda9a88b432d79669a952dc4d013
SHA1 56ac8325803cf9b9bf641043e1af3f447fd10a79
SHA512 0330b6576690cc758602c44afe34fc9657197b1c7007a9055676095cf51cbbf8c4868e4e4a4b561bd80e6ed266cb17a03ebf68a952e79630b04f8f050a36cfcc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d847de3cc494cf4e780db49cf69b891e30be85ee3792cf29fed24377996dd99f
MD5 f81acd40ab471aecf0b256c62eee83f2
SHA1 c1760372adffc6d2c4044fa3f7bddd27d0a27409
SHA512 206a5617735cf60cde1efa82985cb03fa6ead4a46f35c16da081f08677f8c2da9c99cab9d49f440c7d8a1bf3acfcc0df5981201755b96121bf4131a2707cc8ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2faeceec5c98f30d9100a400103b805e9cd45be2e684fe89f9bc2f4c42f5ae73
MD5 3955d99c35b3519773c1d6575766adb3
SHA1 28dbce11a3a037263cf96c7aa420a71b1cb96030
SHA512 3c12efdd8bf29521657612261e2498c9ee185ade7581c06f3f151fddc89152bd566ee914726d6834c6200e00240f223aa35721a9dd33ffc96bc42f7818f351fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 66bf12eb6d639950821326cde1b4e324697ee6e3c26af81bb8b0f84962754615
MD5 ad160bd3e65556303b0f160d92f2af99
SHA1 638740b251985ee483225588e4b0740fc01803ee
SHA512 5c92418c46cec3c03e12ec9b296dcafe6fae82039d6eea7c4e63e1fcb0f14a5dc8a7abd6dfb52f3a2d43246dedf26f758c1677ae7f6a4ac35c6067c6a73a455e
MD5 SHA1 SHA512

Submit Download

svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAACACACCCABCBCAAAABCCCABBCBBBBBABCABABCCACCAAAACC.exe
Size 8.5MB
SHA256 48ce7e40221d3b28a5455b70ee3f92bd63f31c1d7f963b81f0432c40bc58b804
MD5 ac315eff3e13e12a9e9263e1603faf57
SHA1 4218486bea72a281c983c197459bff33b9fa54de
SHA512 5ff6b3807a9569fd965c2ed4e05278609fecc9c4a84f83f283db1677d9396f8766867f5e7a4dfd5eeb7df0d4c0a329bd1f2d255903958d2b178030467fa5e79e
SSDEEP 49152:U+ESgX+ESm+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgtozMlTM:R1MbQ9yDAD7KjjqkusjmqMh
TLSH
T1B1968D2DEBA481F5F9ABD47898ABC276EA717A110833571BCAD1C61F6F336524C18331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f60fa756580142b1fa2f97324f9d11aa8cce13af72b177762a1bc547ae532826
MD5 1865e5abb1938a384743eda931fd1bb9
SHA1 48830910d5b0915633da0a72ef5e8e090efa78f6
SHA512 5c4ecf825c9540aa5cf35d1f54a6ad2ab5d1d49c738e6e4cfa2c3b53b846a7cb9607180593b7cad040a7dbce8151a00564cc0383cffb506d5ebbb9d27aabd489
TLSH
T148110B61B4F9C863F9332CCB6A1FDAC24CA433DB9C586A8C230D561EA7858518D15CE1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2920-66-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/4348-35-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/4348-22-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/4668-72-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/6016-6-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download