05edc736fd73ac5526ac88da8eca0371b1145bd65e3fabc6f801d2660770b7a8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_4a70e830b1c058c5b10cf6585e1511bf_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Size 16.6MB
Sample260814-e6grfsvvft
SHA256 05edc736fd73ac5526ac88da8eca0371b1145bd65e3fabc6f801d2660770b7a8
MD5 4a70e830b1c058c5b10cf6585e1511bf
SHA1 2d660896335ecef639e2795ae43e557ce3dd059d
SHA512 8686685f847772cdea40dd3026dde5b75d137954c75eb8c286d8e0394c92522d10d77573c345474c13340d81a1eefd30109a26c78961760a48f2dccd3e4b842f
SSDEEP 196608:8LZULZ+fLZULZ+fLZULZ+fLZULZ+fLZULZ+fLZULZ+fLZULZ+fLZULZ+fLZULZ+S:gYMYMYMYMYMYMYMYMYN
TLSH
T18C078E05F94240B2EA6701714D9FD27BA674BB204A12CEDBE7C8DA1F7E33BC15A36215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244a2-22.dat	INDICATOR_EXE_Packed_Fody

Executes dropped EXE 1 IoCs

pid	Process
4260	svchost_ABBBBBACCBABCCBAAABBBAACCABAAABBABABAAAABBBACABABBABCBC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCBCACBCBACCCBBABBCABCACACCACAABBCCBCBCBBBBBCCBBBABABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBBACCBABCCBAAABBBAACCABAAABBABABAAAABBBACABABBABCBC.exe"	2026-08-14_4a70e830b1c058c5b10cf6585e1511bf_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4784	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_4a70e830b1c058c5b10cf6585e1511bf_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBBBACCBABCCBAAABBBAACCABAAABBABABAAAABBBACABABBABCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4108	2026-08-14_4a70e830b1c058c5b10cf6585e1511bf_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4108	2026-08-14_4a70e830b1c058c5b10cf6585e1511bf_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4108	2026-08-14_4a70e830b1c058c5b10cf6585e1511bf_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4108	2026-08-14_4a70e830b1c058c5b10cf6585e1511bf_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4260	svchost_ABBBBBACCBABCCBAAABBBAACCABAAABBABABAAAABBBACABABBABCBC.exe
4260	svchost_ABBBBBACCBABCCBAAABBBAACCABAAABBABABAAAABBBACABABBABCBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	2026-08-14_4a70e830b1c058c5b10cf6585e1511bf_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	4260	svchost_ABBBBBACCBABCCBAAABBBAACCABAAABBABABAAAABBBACABABBABCBC.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4784	4108	2026-08-14_4a70e830b1c058c5b10cf6585e1511bf_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	97
PID 4784 wrote to memory of 2688	4784	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-14_4a70e830b1c058c5b10cf6585e1511bf_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_4a70e830b1c058c5b10cf6585e1511bf_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAABCACACBCCBCCCAAAACBCABABCBABCABCAAABCACABCCABAAAABCCABAACBCCBCACACABACBCACBBAABACABCAAABBCACAAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBACCBABCCBAAABBBAACCABAAABBABABAAAABBBACABABBABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAABCACACBCCBCCCAAAACBCABABCBABCABCAAABCACABCCABAAAABCCABAACBCCBCACACABACBCACBBAABACABCAAABBCACAAACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBACCBABCCBAAABBBAACCABAAABBABABAAAABBBACABABBABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2688

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBACCBABCCBAAABBBAACCABAAABBABABAAAABBBACABABBABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBACCBABCCBAAABBBAACCABAAABBABABAAAABBBACABABBABCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 92ab8427389610725e24c3bc9479107d46fd7f98ceeff3ce885baba8503a0677
MD5 18bcbcc3ff61e5b85084fb68aad5ad3f
SHA1 5a0eedb023bed0203ccc9f36e6be3a9f89b25297
SHA512 380031f8de54aca3fb416f49be6318345956a413ad107cccb4b89c91134bd47fd069726e1141aeffcd43e90e53e580bee7b583b8bf253e77dc1b27765fa3a320
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 93a264edf5cddc7d865454c9e54e9dca1f2541cb1a1f68fa8621771a49167a76
MD5 1e5928f6111fd8c1fb3eb4f33a26aa8f
SHA1 6e833fed56d501d1536123c66f6849549584071f
SHA512 a48a12785d04489ea06c702b7318f21aac6bcee8bd97f2518bd7d5a19b1313d0d672790c4b83a336d4fceb8d1238a24037910b52ce2a5f7e465f5dca25d37a0e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c750651a8f29d39eaa87255392c75790d82d98755b45f4130a09f94adf9dc9d
MD5 22f551532c9056f45230d0212861a360
SHA1 86c548859b76e3d406827ec5c738c342b1f13369
SHA512 fa86bf148779d2fd7c17f3f3f3d3d2ae7629aa70be20ff4729f4c226cea9ac85f6a891545bfdd3dbb67ea7ba605cb35fe44f46f53dcaf64cac478bb9686013e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6da1895aa491ff1f28fe2b7b59f9aa3cf5ad1675f3f198d572eb2f2ff961020a
MD5 a918d37ae7435668319812d07d21e79f
SHA1 32324e2b4d770502cca130785e7b5eb51b582ce0
SHA512 0f04c5456d134e9c10acdea32434e0e72d8fac1238d7b9f13d405fb4aaaa20c2730714a821e447c2377552d3fe51656e99b23bfd0c0a5d6feb96c0f070adbd55
MD5 SHA1 SHA512

Submit Download

svchost_ABBBBBACCBABCCBAAABBBAACCABAAABBABABAAAABBBACABABBABCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBACCBABCCBAAABBBAACCABAAABBABABAAAABBBACABABBABCBC.exe
Size 16.6MB
SHA256 05edc736fd73ac5526ac88da8eca0371b1145bd65e3fabc6f801d2660770b7a8
MD5 4a70e830b1c058c5b10cf6585e1511bf
SHA1 2d660896335ecef639e2795ae43e557ce3dd059d
SHA512 8686685f847772cdea40dd3026dde5b75d137954c75eb8c286d8e0394c92522d10d77573c345474c13340d81a1eefd30109a26c78961760a48f2dccd3e4b842f
SSDEEP 196608:8LZULZ+fLZULZ+fLZULZ+fLZULZ+fLZULZ+fLZULZ+fLZULZ+fLZULZ+fLZULZ+S:gYMYMYMYMYMYMYMYMYN
TLSH
T18C078E05F94240B2EA6701714D9FD27BA674BB204A12CEDBE7C8DA1F7E33BC15A36215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4108-0-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4108-8-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4260-28-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/4260-41-0x0000000000290000-0x00000000002B1000-memory.dmp

Download