e5d1c96d651d98169fce8a7318d26587c7c4559cc32183e6ec09e11a1af14d5e

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e6c64b4ab60f79bd63e55c73f55d276e_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
Size 9.0MB
Sample260814-dd779stbmc
SHA256 e5d1c96d651d98169fce8a7318d26587c7c4559cc32183e6ec09e11a1af14d5e
MD5 e6c64b4ab60f79bd63e55c73f55d276e
SHA1 5345c9133a4bc8d4554ea678fdbd60690010b69d
SHA512 64637abcecf17588eef679b3b697f66668134f8269d988af3bba8b60a6331a6df23bf49bab66d293c82bec9e3e3377fd1c3af994d9cd0529d106291027783deb
SSDEEP 98304:8LZ1oy5DLZ1oKLZ1oy5DLZ1o81MbQ9yDAD7KjjqkusjmqMhu:8LZT5DLZDLZT5DLZX1tIDewjqkjiqM4
TLSH
T17BA67C39ABF481E1FAB79439A97B8271FA717A100933934F8AD0D61E6F335914D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3304	svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe
2296	svchost_CCACCCBBABCBCCBCBBABBBBBACBAAACBCBBAAACBBABACCAABBABAAC.exe
1596	svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACCABBCBAABACCCBBCBBCACACBBCCCBCBCBCCBBCBBACCCCCBCACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe"	2026-08-14_e6c64b4ab60f79bd63e55c73f55d276e_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABACACCACCAAAAACCBCBBAAABABACCCBAAAACBAAABBCACACCCCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACCCBBABCBCCBCBBABBBBBACBAAACBCBBAAACBBABACCAABBABAAC.exe"	svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5424	sc.exe
1160	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6060	cmd.exe
1188	cmd.exe
4800	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_e6c64b4ab60f79bd63e55c73f55d276e_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACCCBBABCBCCBCBBABBBBBACBAAACBCBBAAACBBABACCAABBABAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
724	2026-08-14_e6c64b4ab60f79bd63e55c73f55d276e_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
724	2026-08-14_e6c64b4ab60f79bd63e55c73f55d276e_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
724	2026-08-14_e6c64b4ab60f79bd63e55c73f55d276e_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
724	2026-08-14_e6c64b4ab60f79bd63e55c73f55d276e_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
3304	svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe
3304	svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe
3304	svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe
3304	svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe
2296	svchost_CCACCCBBABCBCCBCBBABBBBBACBAAACBCBBAAACBBABACCAABBABAAC.exe
2296	svchost_CCACCCBBABCBCCBCBBABBBBBACBAAACBCBBAAACBBABACCAABBABAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	724	2026-08-14_e6c64b4ab60f79bd63e55c73f55d276e_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
Token: SeDebugPrivilege	3304	svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe
Token: SeDebugPrivilege	2296	svchost_CCACCCBBABCBCCBCBBABBBBBACBAAACBCBBAAACBBABACCAABBABAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 6060	724	2026-08-14_e6c64b4ab60f79bd63e55c73f55d276e_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe	92
PID 6060 wrote to memory of 5168	6060	cmd.exe	94
PID 3304 wrote to memory of 5480	3304	svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe	95
PID 724 wrote to memory of 1188	724	2026-08-14_e6c64b4ab60f79bd63e55c73f55d276e_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe	98
PID 1188 wrote to memory of 5424	1188	cmd.exe	100
PID 724 wrote to memory of 4800	724	2026-08-14_e6c64b4ab60f79bd63e55c73f55d276e_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe	101
PID 4800 wrote to memory of 1160	4800	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e6c64b4ab60f79bd63e55c73f55d276e_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e6c64b4ab60f79bd63e55c73f55d276e_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_rugmi_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAAABAAAACABCCCCAABAAACCAAAABAABBACBCACAAACCBAABCCACBCABAABBBAABBBABCCBCABCBABBBCCCACCCCCCBAACBCAAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAAABAAAACABCCCCAABAAACCAAAABAABBACBCACAAACCBAABCCACBCABAABBBAABBBABCCBCABCBABBBCCCACCCCCCBAACBCAAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAABABACCBACAACCCCAABAABBBACACACCCCBABACACCCBCACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe" start= auto displayName= "UserDataSvc_CBAABABACCBACAACCCCAABAABBBACACACCCCBABACACCCBCACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAABABACCBACAACCCCAABAABBBACACACCCCBABACACCCBCACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe" start= auto displayName= "UserDataSvc_CBAABABACCBACAACCCCAABAABBBACACACCCCBABACACCCBCACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAABABACCBACAACCCCAABAABBBACACACCCCBABACACCCBCACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAABABACCBACAACCCCAABAABBBACACACCCCBABACACCCBCACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1160

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBBABCBCCBCBBABBBBBACBAAACBCBBAAACBBABACCAABBABAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBBABCBCCBCBBABBBBBACBAAACBCBBAAACBBABACCAABBABAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe
1⤵
- Executes dropped EXE
PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 180f4fd55e112e103f5af2789d49f657d74538926efdabd672407f5a16605321
MD5 231a2d06a5a3e1a9b201fc22d8d86d1f
SHA1 47da3ee0d64218d8e8d19b39589e03c90284265d
SHA512 dc08981ebacd25875e362eca5a098b1c6184d47ded304e1dcf159af0ef63213cc45e7aa3097f175c33d39d8222ac85b6a23d4931583d063f67f17d75e0ed2548
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 df3930c9516a98f71ad74e442429827c30d386ac3fc5e421f9d6ddae79be453d
MD5 9b42cce2d81c285ef0eafb75284eee85
SHA1 38cdce6b26664d80814ec3ca23f85b3482a986c4
SHA512 4fe4a255e7fcb3f8d94b20ecf38445e26c4a2d228081eca7f9526e4388ca0a90d1c0fea1378ae502b464d7fef68febebc02c7b3d01e6c13767e4a175827f6858
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b78dea85e1cdcf99ea24eef5ce6dccf88e360aaf076be3e0bf4515c0683f28d2
MD5 e0e4502bfac14cfa204fb0c11453a056
SHA1 c989d0fd9f5b572821f361eeacf586d9ecd415a8
SHA512 82f60ca12783119055f37bc930c170d3f20eee8600397cca021d63e8d2b97c83d3f73a4b43d54d3dec3e4da31cc68b73be065783cfd2f023a4ecbb87a1bdf148
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b55dfc95c5acb7bb2ce051529466407b156859f3356fad00d3fe5c0f430f7655
MD5 76f360b36011ca6f2f7d30db42f0470b
SHA1 0eceeac8e25d5f51ecfb01a85d29fa74b662ab9e
SHA512 afbc9ea78d2e66ecf9e478e6d7bbc155651dcc73f999dce47ca269e9c6667b35e7d85faa9aee9e9a4e68f2453d707d81909ad7ecf717e2b0041ab58f47190ba0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d272a4867d39f0a6ba6911cca3d6608799987fa071e4d62a3b8f7455bf3c088f
MD5 59ebb1845ae7f8e398c9d94a6b3bd775
SHA1 a9d82ce0f33186c994066ebb6a171d849da7bcfa
SHA512 b423e1b7d0db66aff64cf9541ebcd23772c3e1ef49a06749669744f44407db3bedf6fe2e18e45da03b76ff619c690df965f634e8187a6e1486c68fcfe76bcf67
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cdfbd3ad64d8448a86e7e8ea7f2888afc82bcf98034dae510763dead71ea7d3e
MD5 5d7043f1b7f528436b682ebe07fc231f
SHA1 8d0ecb229d6f85280087f6ccb316c4c2ce26a416
SHA512 0b47de6f45df0f838ee2410642f7643a5f689d2e31f8ad5538ef188df19b73c8cedff722ecf43fbb4fb90bf13b82adc9a0553c2e7258986b0337dc3770835af2
MD5 SHA1 SHA512

Submit Download

svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBBAABCCACCABCBBCACBBBBBBAACBACBBCCBCBCCCBAABABAAAC.exe
Size 9.0MB
SHA256 e5d1c96d651d98169fce8a7318d26587c7c4559cc32183e6ec09e11a1af14d5e
MD5 e6c64b4ab60f79bd63e55c73f55d276e
SHA1 5345c9133a4bc8d4554ea678fdbd60690010b69d
SHA512 64637abcecf17588eef679b3b697f66668134f8269d988af3bba8b60a6331a6df23bf49bab66d293c82bec9e3e3377fd1c3af994d9cd0529d106291027783deb
SSDEEP 98304:8LZ1oy5DLZ1oKLZ1oy5DLZ1o81MbQ9yDAD7KjjqkusjmqMhu:8LZT5DLZDLZT5DLZX1tIDewjqkjiqM4
TLSH
T17BA67C39ABF481E1FAB79439A97B8271FA717A100933934F8AD0D61E6F335914D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 593648a4d8d933c07378f0089142638cb1b0d41b165bd6ad7e211f535345bb7d
MD5 6eb65881c89592c401952416c19a1743
SHA1 e493bb581c67d2cd3b8afbb61024e54a29cf8b7c
SHA512 49a57f3ca0d28a1f2c2b775534f23c3d324dd69218a82abb96e6b7f312b50692d2f135b2396a40a757f26f44d5a42740b65c9bcc1fc9076f3a5707a2614cdd99
TLSH
T14E11A740F4F59857B93269CFC62DCBD248BC77476C5CAB14234A422CBB99C325D1D4EA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/724-0-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download

memory/724-7-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download

memory/1596-72-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/2296-71-0x00000000004B0000-0x00000000004D1000-memory.dmp

Download

memory/3304-33-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/3304-23-0x0000000000080000-0x00000000000A1000-memory.dmp

Download