Overview

overview

7

Static

static

3

2026-08-14...ar.exe

windows10-2004-x64

7

2026-08-14...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/08/2026, 04:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-14_574a2352ea10235af1526ff17e4934d1_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
  • Size 13.2MB
  • Sample260814-e1ckjscn9x
  • SHA256 902e01812ae36771961a2fa2e3c1a2a2cbded90b8e5006bbd15b5b36b07d1dd5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 4 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_574a2352ea10235af1526ff17e4934d1_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_574a2352ea10235af1526ff17e4934d1_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:6228
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBACBBAAAAACABABBBBAABABBAAABACACCBBBBCABBBCCBBBCCABCBBBAABBACBABBACACAABABCBBABBCABCABACCBCACCAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACAACAABABCABCCBBABCABCCCAAAAABAAAABBCCBAAABCABABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3800
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBACBBAAAAACABABBBBAABABBAAABACACCBBBBCABBBCCBBBCCABCBBBAABBACBABBACACAABABCBBABBCABCABACCBCACCAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACAACAABABCABCCBBABCABCCCAAAAABAAAABBCCBAAABCABABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3472
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABCACAABAABBBCCBCBAACCCBCBABACBBCABBBCAAAABAABCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACAACAABABCABCCBBABCABCCCAAAAABAAAABBCCBAAABCABABAA.exe" start= auto displayName= "UserDataSvc_BAABCACAABAABBBCCBCBAACCCBCBABACBBCABBBCAAAABAABCBB"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_BAABCACAABAABBBCCBCBAACCCBCBABACBBCABBBCAAAABAABCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACAACAABABCABCCBBABCABCCCAAAAABAAAABBCCBAAABCABABAA.exe" start= auto displayName= "UserDataSvc_BAABCACAABAABBBCCBCBAACCCBCBABACBBCABBBCAAAABAABCBB"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1288
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABCACAABAABBBCCBCBAACCCBCBABACBBCABBBCAAAABAABCBB"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2908
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_BAABCACAABAABBBCCBCBAACCCBCBABACBBCABBBCAAAABAABCBB"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2924
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACAACAABABCABCCBBABCABCCCAAAAABAAAABBCCBAAABCABABAA.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACAACAABABCABCCBBABCABCCCAAAAABAAAABBCCBAAABCABABAA.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5776
    • C:\Windows\notepad.exe
      "notepad.exe"
      2⤵
        PID:5296
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBABCBCCACCBACACACBBAABBCABCACBBBACACCCCACBBABBAABCBCCBACACBCBAACBCABACCACABBABAACBABBAAABBCCACBBBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBBCBBBBABACABCAAACBCABACCCCBBCCBCBBAAAACAABBCCACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6052
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBABCBCCACCBACACACBBAABBCABCACBBBACACCCCACBBABBAABCBCCBACACBCBAACBCABACCACABBABAACBABBAAABBCCACBBBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBBCBBBBABACABCAAACBCABACCCCBBCCBCBBAAAACAABBCCACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1816
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBBCBBBBABACABCAAACBCABACCCCBBCCBCBBAAAACAABBCCACCB.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBBCBBBBABACABCAAACBCABACCCCBBCCBCBBAAAACAABBCCACCB.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6424
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACAACAABABCABCCBBABCABCCCAAAAABAAAABBCCBAAABCABABAA.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACAACAABABCABCCBBABCABCCCAAAAABAAAABBCCBAAABCABABAA.exe
      1⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5064

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          qap`g`v~dtlq
          • Path C:\PerfLogs\qap`g`v~dtlq
          • Size 10B
          • SHA256 3bfea4bd79c064c6e6eecf6a566177d11f7abb937fc61bbc3152fb972dcf5d30
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
          • Size 10B
          • SHA256 121000553dc76483c65b4dd5d03cf8c551d7ab909a99facb29c06d14824937ed
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Microsoft\Windows Defender\LocalCopy\qap`g`v~dtlq
          • Size 10B
          • SHA256 9844bc0f953965efc17485f33a54ef44a3878d1413869ea341a1bfc1001b01e4
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
          • Size 10B
          • SHA256 f3099d2582fd859cbce73815b3bcb5c117ed5cc62acf4b0d36f657577bcb9eec
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
          • Size 10B
          • SHA256 6b2bc1edaace58b189601791a6498546e227f14d84ec09db3b018f38968fb238
          • MD5 SHA1 SHA512
          Submit Download

          windowsdesktop-runtime-8.0.15-win-x64.exe
          • Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
          • Size 13.7MB
          • SHA256 e38e76b278425c49c13a3b0073f5dedaa47ab77179a81c542e679e3ad399cd3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
          • Size 10B
          • SHA256 c3ad04184c14d7d75aba40bf0944981ab66fb03865a9bcf365bac4ce1353a585
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
          • Size 10B
          • SHA256 2677f03c7a86097da9e39cb9a08b13ab98348b05ab5238ef78d2dbd779f373c2
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
          • Size 10B
          • SHA256 bd37b2e29eb1481cf4ed8d18ad45a5121b7870c859702b4084ea5303f624e0fb
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\qap`g`v~dtlq
          • Size 10B
          • SHA256 019f760a5366c208745b9ffd577366497338abb6eb10f9652c5f4d1aedb89235
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\or-IN\qap`g`v~dtlq
          • Size 10B
          • SHA256 96c7271c77f0bdbbf8901bf369f10c61265d3f22cf3dbc26c54a7d4420b95fba
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\AC\qap`g`v~dtlq
          • Size 10B
          • SHA256 de3577662a9f179ec13de0bcca98711569d2f5bd169e0c1b15ef9dbb4d2957b9
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\qap`g`v~dtlq
          • Size 10B
          • SHA256 a7d19f2ff8b5032eabacb0546befe05fc8783fbe874feb4002c2879c23804a90
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 b34ae401037cb2124f06fd5c9cdcf440d62ace4113e4d0556004529b3d7601bf
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 c391f74f94f18b8bf95f76e0989cfe69a98a7d63d18c67beed8bd3c24763b458
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 39353bc0904d1f04a6e2c72e74b99fe28443def31e297d9a2dc6efc15388f97e
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
          • Size 10B
          • SHA256 95f526c7786f9c4c0751c5ddd994a555045a9c44a2a0bdb02d63694523026d46
          • MD5 SHA1 SHA512
          Submit Download

          svchost_CCBAACAACAABABCABCCBBABCABCCCAAAAABAAAABBCCBAAABCABABAA.exe
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACAACAABABCABCCBBABCABCCCAAAAABAAAABBCCBAAABCABABAA.exe
          • Size 13.2MB
          • SHA256 902e01812ae36771961a2fa2e3c1a2a2cbded90b8e5006bbd15b5b36b07d1dd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 1KB
          • SHA256 18b7d8b200584ae71e6090949a08c4d87251c2ab057e34af8bfb318d4f703844
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 926B
          • SHA256 a3861b5f711a1e9c823de0636c65e3410cb82bcfcadb115d61c1844b598cffef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 1KB
          • SHA256 3664f143100b88d7aa44a892b7ef04408b94c3ed8a7fa22db57e48769fdefa95
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/5064-1631-0x0000000000400000-0x0000000000421000-memory.dmp
          Download

          memory/5776-33-0x0000000000400000-0x0000000000421000-memory.dmp
          Download

          memory/6228-6-0x00000000004C0000-0x00000000004E1000-memory.dmp
          Download

          memory/6424-69-0x0000000000340000-0x0000000000361000-memory.dmp
          Download

          memory/6424-1630-0x0000000000340000-0x0000000000361000-memory.dmp
          Download