74e34c44cfba61326678f9848ba1dd5cbfe70071c7a73f839a29411e771518c3

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_f2440d5a8dfc126c3880e39927f4557b_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Size 16.3MB
Sample260813-dct91sak2x
SHA256 74e34c44cfba61326678f9848ba1dd5cbfe70071c7a73f839a29411e771518c3
MD5 f2440d5a8dfc126c3880e39927f4557b
SHA1 c47f4b6de39690b1bac4b874f5182b767465f402
SHA512 27b9a745e379ae70ed24385571d4b7e54ff448a769a60ba2beab4d85ed46003c2df07046679c65769010a38fcf0d293a8678c0a49afcb5b8068e9d2d8e6a7894
SSDEEP 196608:lLZpLZpLZpLZ/LZpLZpLZpLZY1tIDewjqkjiqMT:zXXXFXXXY8KwekyT
TLSH
T122077E19F99280F1E96B90704DDBD37ADA707B2045238BABDAC9C61F7E336915C39231
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
204	svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe
1928	svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe
4504	svchost_BCCAAABACABBBACAACCBAACCACBCACACBCBBBBBACCCBACBBACABAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABAAACBACAABABCAAACBBAAAAABCAABACACABAACBAABBCBCABACCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe"	2026-08-13_f2440d5a8dfc126c3880e39927f4557b_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCACCBABBAACCCABABAABAABBAABBBACCCCAAAABBCABAAAABCBBCCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCAAABACABBBACAACCBAACCACBCACACBCBBBBBACCCBACBBACABAAB.exe"	svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3116	sc.exe
3476	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3064	cmd.exe
4704	cmd.exe
3364	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_f2440d5a8dfc126c3880e39927f4557b_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCAAABACABBBACAACCBAACCACBCACACBCBBBBBACCCBACBBACABAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
924	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
536	2026-08-13_f2440d5a8dfc126c3880e39927f4557b_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
536	2026-08-13_f2440d5a8dfc126c3880e39927f4557b_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
536	2026-08-13_f2440d5a8dfc126c3880e39927f4557b_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
536	2026-08-13_f2440d5a8dfc126c3880e39927f4557b_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
204	svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe
204	svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe
204	svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe
204	svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	2026-08-13_f2440d5a8dfc126c3880e39927f4557b_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	204	svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4280	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 3064	536	2026-08-13_f2440d5a8dfc126c3880e39927f4557b_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	97
PID 3064 wrote to memory of 924	3064	cmd.exe	99
PID 536 wrote to memory of 4704	536	2026-08-13_f2440d5a8dfc126c3880e39927f4557b_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	100
PID 4704 wrote to memory of 3116	4704	cmd.exe	102
PID 536 wrote to memory of 3364	536	2026-08-13_f2440d5a8dfc126c3880e39927f4557b_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	103
PID 3364 wrote to memory of 3476	3364	cmd.exe	105
PID 204 wrote to memory of 2536	204	svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe	107
PID 2536 wrote to memory of 4312	2536	notepad.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-13_f2440d5a8dfc126c3880e39927f4557b_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_f2440d5a8dfc126c3880e39927f4557b_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBCCCABBBCBACBABBABABBBCCCCCCBACBABBBBABAACCAACCBACAACCCBBBBAABCBBABCBBCCBBACABAAAABCBCBCACBABACCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBCCCABBBCBACBABBABABBBCCCCCCBACBABBBBABAACCAACCBACAACCCBBBBAABCBBABCBBCCBBACABAAAABCBCBCACBABACCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABBCCBABBACAAACAABCACBCBCCCACCACCAACACCACBBCCCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe" start= auto displayName= "UserDataSvc_CAABBCCBABBACAAACAABCACBCBCCCACCACCAACACCACBBCCCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABBCCBABBACAAACAABCACBCBCCCACCACCAACACCACBBCCCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe" start= auto displayName= "UserDataSvc_CAABBCCBABBACAAACAABCACBCBCCCACCACCAACACCACBBCCCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABBCCBABBACAAACAABCACBCBCCCACCACCAACACCACBBCCCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABBCCBABBACAAACAABCACBCBCCCACCACCAACACCACBBCCCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:204
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4312

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe
1⤵
- Executes dropped EXE
PID:1928

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4280

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAAABACABBBACAACCBAACCACBCACACBCBBBBBACCCBACBBACABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAAABACABBBACAACCBAACCACBCACACBCBBBBBACCCBACBBACABAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6b0fe093524098d55e71cb9f49dacf27e84831647ca032b38662bdfdb5f22897
MD5 c2f9922a1450873e3ac1a0437c4d2d2e
SHA1 10b08a3604a48b0e5faaed55e2bf6a4dda3f2786
SHA512 11bb9f57fac753fab6bfea70da11e468dd13d5bfb3a117dd4f7b3cf5df13e4795b154776bf8bc2cd4f043703fe1de87e133d9cf2b6c7e1553b010c0da40b8979
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3f72cceea009b9aa8e58d34214510683a5a59795251e8d98f051624601cce3d6
MD5 eac71212fdebcee50628e4a968a83af7
SHA1 c16ca974fb96431c0a52327300f4777fb3dd3646
SHA512 f73e8eb490600af9d04ffa7cc0bc550bf984554be57574b64da7c9c0e9a61b8af77351a9db323b2259ffc13bbf0c87d8ef25b144d1f886e6fd4751396e22ea9f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7cb6811fcf4db8dd4564885d8b3e9df1bfe01612dab3de65e7aed3a95ff661af
MD5 8beee8693a1947bb4ce54af846abe5c8
SHA1 43424f60403b4d5d3e20927e959986dff0e13605
SHA512 a80829593f0f67a9bee6487fb571dd482f63093db930a5c9f400bf0430cb42ab59e4ef5432a0da80f1dbabcadde6ad67e246f73639b3d1cb956731e5c8ddbbd8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4ab3ebeb9787ffb94002104b2c756c1b6a7ec02deb0b2875123984ffff9ca476
MD5 e2884942bde1b3d362aed87a3cfdfec6
SHA1 22cfdbb24d0d5c928464d696ce4c4db2a13e2609
SHA512 251f55340583508742bf7339d0b6139bcf0df7d5b8dc0dcd00543c1d75b44eea398f74fa0efe484d26057d7d4bde137316f04c5503151f71d2bc6e431da893e4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 57b27ddb1adaf9cc89bd7c07731e0e6c4878d390ce7d40862126aaf72b652a22
MD5 6dabb8e0b1bdf16b2e85e3cb303389fa
SHA1 7b560d5c7524ca38172010ed30113ab39b4dc22c
SHA512 8b38ff7064833105faaa73190c2dc35e2fbdc04586461b583e787093c3737f30c182f48bb063ac6a02ceb111c60e6c24225c3b6c893ff09dedb1c24c3fe89899
MD5 SHA1 SHA512

Submit Download

svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACAABCACBBBBBCBBBCCCBBAAAACBAABCBABBBCAABCACBAABAC.exe
Size 16.3MB
SHA256 74e34c44cfba61326678f9848ba1dd5cbfe70071c7a73f839a29411e771518c3
MD5 f2440d5a8dfc126c3880e39927f4557b
SHA1 c47f4b6de39690b1bac4b874f5182b767465f402
SHA512 27b9a745e379ae70ed24385571d4b7e54ff448a769a60ba2beab4d85ed46003c2df07046679c65769010a38fcf0d293a8678c0a49afcb5b8068e9d2d8e6a7894
SSDEEP 196608:lLZpLZpLZpLZ/LZpLZpLZpLZY1tIDewjqkjiqMT:zXXXFXXXY8KwekyT
TLSH
T122077E19F99280F1E96B90704DDBD37ADA707B2045238BABDAC9C61F7E336915C39231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-25-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/204-38-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/536-6-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/1928-73-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/2536-67-0x00000000022A0000-0x00000000022A1000-memory.dmp

Download

memory/4504-80-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download