6c3bd71ee7f70ce287206ab1f977f70e0b78dd8402ee6aa55d1278691df476a7

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Size 9.2MB
Sample260814-e8wcmavwbx
SHA256 6c3bd71ee7f70ce287206ab1f977f70e0b78dd8402ee6aa55d1278691df476a7
MD5 4589331b72042d6e17b530b9d251031d
SHA1 787b3ded64d06ee41cf615abe20f8b8378833a38
SHA512 15a53868d5e32174897aa67b293f6b959df0440b59a2f8ba2c43986e8ee3301789c8647c9ec0cd3ab5d8314bfcf92aad117f066884ff87f88eed7f821f43e04e
SSDEEP 98304:8LZ1oy5XLZ1oy5XLZ1oy5z1MbQ9yDAD7KjjqkusjmqMhF:8LZT5XLZT5XLZT5z1tIDewjqkjiqMP
TLSH
T124A66C29ABF485E5FABBD938A8778271FD717A100932934F89D1C60E6F335914D29332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4864	svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe
2764	svchost_AACAABCCCCACACAACBBABCACCBCCCBBCAABCBAAABABABBBCBABBCCC.exe
3048	svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAACABBBACCACABCCCAABABCBCCBBCAACCBCBAAAAACAABBCABBBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe"	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBAABCCABACCCCBBACCBBCBCABCCABABAAAAABAACCBACBCBCBBBCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACAABCCCCACACAACBBABCACCBCCCBBCAABCBAAABABABBBCBABBCCC.exe"	svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4480	sc.exe
2284	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2104	cmd.exe
5424	cmd.exe
1804	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACAABCCCCACACAACBBABCACCBCCCBBCAABCBAAABABABBBCBABBCCC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5272	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
5272	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
5272	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
5272	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4864	svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe
4864	svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe
4864	svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe
4864	svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe
2764	svchost_AACAABCCCCACACAACBBABCACCBCCCBBCAABCBAAABABABBBCBABBCCC.exe
2764	svchost_AACAABCCCCACACAACBBABCACCBCCCBBCAABCBAAABABABBBCBABBCCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5272	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	4864	svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe
Token: SeDebugPrivilege	2764	svchost_AACAABCCCCACACAACBBABCACCBCCCBBCAABCBAAABABABBBCBABBCCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5272 wrote to memory of 2104	5272	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	91
PID 2104 wrote to memory of 3328	2104	cmd.exe	93
PID 4864 wrote to memory of 3268	4864	svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe	94
PID 5272 wrote to memory of 5424	5272	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	97
PID 5424 wrote to memory of 4480	5424	cmd.exe	99
PID 5272 wrote to memory of 1804	5272	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	100
PID 1804 wrote to memory of 2284	1804	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBCCBCBBABABBBBCBCBCBAABCBCAAABCCCCCABBBBCBCABBCAACCABCACAABCACACBABAACACCCACBBCCCBBCAABCABCBBCCCCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBCCBCBBABABBBBCBCBCBAABCBCAAABCCCCCABBBBCBCABBCAACCABCACAABCACACBABAACACCCACBBCCCBBCAABCABCBBCCCCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABBBBACCCCCCAAACBACBACBABACBBAABBBAACCBBAACABAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe" start= auto displayName= "UserDataSvc_ACABBBBACCCCCCAAACBACBACBABACBBAABBBAACCBBAACABAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABBBBACCCCCCAAACBACBACBABACBBAABBBAACCBBAACABAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe" start= auto displayName= "UserDataSvc_ACABBBBACCCCCCAAACBACBACBABACBBAABBBAACCBBAACABAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABBBBACCCCCCAAACBACBACBABACBBAABBBAACCBBAACABAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABBBBACCCCCCAAACBACBACBABACBBAABBBAACCBBAACABAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2284

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAABCCCCACACAACBBABCACCBCCCBBCAABCBAAABABABBBCBABBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAABCCCCACACAACBBABCACCBCCCBBCAABCBAAABABABBBCBABBCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe
1⤵
- Executes dropped EXE
PID:3048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 61d9d1ba1bbe22b7a9f367c7b22c6a7e0679b775f1a72c161e7b47ca5078b77b
MD5 c38e10265a0705fc43ad0a1c19ca61df
SHA1 b2d95a34bc549bcd39589563e62ec34f6335bccb
SHA512 b62c2ded9b6ed31b9590ee7e73308736f33bf94eeb239e5bcfb8c31b8bb67aee946962c0c643cbd6d06598ca433040ff1446402d7f6a616c980fac66e177123f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f9177eb2a60131d95ec208f5ea1217ea0e2a01a38d5ea4b3b941ccbf5e41be9a
MD5 7c5e58a2da8f682fdb6fd0925db49c57
SHA1 0e34796192bddbd72a5bb1f1220f5dc9313347e8
SHA512 a77f2a2527ea191e08e902c83920d515e76a3b06e635649981fe38183db3439b968064a7d71269ef72fa37da348216f1def5d6b748556ec6598b83239c8a169a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5ec6357e2602e7f511db3e6218e5386a395f405574afcee1ab3917375be258d5
MD5 bdf6ec53971571b3c1346cb2d80dd6e9
SHA1 078ff1b64f59b86d624bcdc1624f4142de69a750
SHA512 d47703b2425eb31b97863c1a495d621e9a402c59f1a303b1200892b1541df80c55619bbed8ea44e151ac13dbb835bb5dfb5c20410f9e84a2b3d2531c05868819
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d7f308744a703191e2eecce7a02e3037b142b0a3ed5a79f908ef3bfdf7bd0a5
MD5 40361b7d225e1be70842d6c100d51f2c
SHA1 2a9f374efe030f5e61cc014ac3498b30cc4f36c8
SHA512 ee7b3452fb9e776d01ab47bca9acae9e3312979d9736eb76b7617ec7cb6075ed2b4f0f066f5ab18277bc3fc0f0e27219c56ccfdb036784a58c3593d4bd41a6fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 90eb48938bce2699214439801d41efc5f41bdab3216886a463aed336007ff36c
MD5 9a73d72d20a71df5acb29b6f9a2d3105
SHA1 dc1d580768195e45a954a8a16367faac7ee7c12a
SHA512 f96582377f93c1e71918b878922ba089ce3ef1fcc353d255279a057152d9e7068387da97edd7f79cb1257d0952f5c3847e32c0beba6cd08dd9adf5eb2e184a52
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 07d715417e261c204ff904b5f43500351b7eb5301227bad33cb619d883625ed9
MD5 3d1fb4bc41e72ef1f1ac7a4711fe7305
SHA1 e1c20adb312e31700e836074c7c100349b1d7f41
SHA512 e350571d13990e5589ee7a5f89a023c9c82bcf0bc6aba6248286f077b244c5cf623da9aac7ae671f13ce78aed28c7297beaf97e8e700f502c8e144461e7a339f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6ba1ac8ebea82762ad387d6ce3dd1e70f61bdc100cd5266ee4588345b8cb5d48
MD5 0ac3a862d8da3ddbe2edd2f1718fe334
SHA1 6c62d0033734186cbf561b82b6cd06eff5a555c4
SHA512 6bec2e0f4c6cedcfa24acaddd13f4a02af8afc4826d52714b4f2bbb5daeb6fe0119ac56d3758c0dee2bb5ec2d3c7b2105df557988b7b0bf91b6cf29f97649292
MD5 SHA1 SHA512

Submit Download

svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCCCBCAABCACAABCBBCBAABCABCCCBCAAACBBACCCCBBCABBCACB.exe
Size 9.2MB
SHA256 6c3bd71ee7f70ce287206ab1f977f70e0b78dd8402ee6aa55d1278691df476a7
MD5 4589331b72042d6e17b530b9d251031d
SHA1 787b3ded64d06ee41cf615abe20f8b8378833a38
SHA512 15a53868d5e32174897aa67b293f6b959df0440b59a2f8ba2c43986e8ee3301789c8647c9ec0cd3ab5d8314bfcf92aad117f066884ff87f88eed7f821f43e04e
SSDEEP 98304:8LZ1oy5XLZ1oy5XLZ1oy5z1MbQ9yDAD7KjjqkusjmqMhF:8LZT5XLZT5XLZT5z1tIDewjqkjiqMP
TLSH
T124A66C29ABF485E5FABBD938A8778271FD717A100932934F89D1C60E6F335914D29332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 0969c0ec999d1c34e7d195daa3f10517260f4c6cc678e1e1bb7e88010f901771
MD5 de432d7b01ed80046d07ce36b3d6e1d0
SHA1 6bb5a6265fd866c823289b2c8ac9e7c864925af7
SHA512 c7fe9c7b37e79d2ea5bb12a3f91eb1a89bb3446fba06de4400b9859266f805632f24e66678369c4db988a5c813b7cef39dab61304ceea8783f279a11e8b1c1b4
TLSH
T13F11EE61ECE5D837FD32AC8F5126DBA308F477DB981CAA54130941289BC5D71CE550D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2764-74-0x0000000000030000-0x0000000000051000-memory.dmp

Download

memory/4864-34-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/5272-0-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/5272-8-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download