0044b7c1cd1c9b3a82113cf72a816380bcc75c4e5466dc8cf62e48b423e06eaa

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_a8fd1d2656eb98750486be2a25fbd67d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Size 10.8MB
Sample260815-2ck84saa56
SHA256 0044b7c1cd1c9b3a82113cf72a816380bcc75c4e5466dc8cf62e48b423e06eaa
MD5 a8fd1d2656eb98750486be2a25fbd67d
SHA1 74ea3f484f0a5edac35038c07ef9621bac834558
SHA512 bd9d5b3fbdc0e75f1db8dc86b8ba3968200aeb96b8829f3b526c917c69b92ae4a19505ac9b3b408a2d00c0835e8611c6d870eb31baa69e6795f4fb74e057ff47
SSDEEP 196608:8LZWLZWLZMLZWLZWLZC1tIDewjqkjiqM9:g66w66C8Kweky9
TLSH
T18CB68D29FA94C1F2F9AB9439986B8672FA717A100933934B87D4C61E7F336815E35331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4416	svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe
4108	svchost_ABBCBACCCCACBAAACAACCBACCAAACBBCACBCABBCAABBAACBCBCAAAB.exe
4748	svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBAAABBBACCABCCCACBACBBBCCAAABBAACCCCBCBBBCAACAABCAACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe"	2026-08-15_a8fd1d2656eb98750486be2a25fbd67d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBBABAABBACCCABCACBACAAABCBBABBBBABACCCAAACBABCBACAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCBACCCCACBAAACAACCBACCAAACBBCACBCABBCAABBAACBCBCAAAB.exe"	svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6016	sc.exe
472	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2892	cmd.exe
1132	cmd.exe
4760	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_a8fd1d2656eb98750486be2a25fbd67d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCBACCCCACBAAACAACCBACCAAACBBCACBCABBCAABBAACBCBCAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4112	2026-08-15_a8fd1d2656eb98750486be2a25fbd67d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4112	2026-08-15_a8fd1d2656eb98750486be2a25fbd67d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4112	2026-08-15_a8fd1d2656eb98750486be2a25fbd67d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4112	2026-08-15_a8fd1d2656eb98750486be2a25fbd67d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4416	svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe
4416	svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe
4416	svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe
4416	svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe
4108	svchost_ABBCBACCCCACBAAACAACCBACCAAACBBCACBCABBCAABBAACBCBCAAAB.exe
4108	svchost_ABBCBACCCCACBAAACAACCBACCAAACBBCACBCABBCAABBAACBCBCAAAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4112	2026-08-15_a8fd1d2656eb98750486be2a25fbd67d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	4416	svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe
Token: SeDebugPrivilege	4108	svchost_ABBCBACCCCACBAAACAACCBACCAAACBBCACBCABBCAABBAACBCBCAAAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 2892	4112	2026-08-15_a8fd1d2656eb98750486be2a25fbd67d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	92
PID 2892 wrote to memory of 624	2892	cmd.exe	94
PID 4416 wrote to memory of 4788	4416	svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe	95
PID 4112 wrote to memory of 1132	4112	2026-08-15_a8fd1d2656eb98750486be2a25fbd67d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	98
PID 1132 wrote to memory of 6016	1132	cmd.exe	100
PID 4112 wrote to memory of 4760	4112	2026-08-15_a8fd1d2656eb98750486be2a25fbd67d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	101
PID 4760 wrote to memory of 472	4760	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_a8fd1d2656eb98750486be2a25fbd67d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_a8fd1d2656eb98750486be2a25fbd67d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCBABBACBBBAAAACBABACBAAABACABBABBCAAABAAAABCCACBAACBACABBCABCABBCABACABABBCCBCBBCBBCAABBBBACBBABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCBABBACBBBAAAACBABACBAAABACABBABBCAAABAAAABCCACBAACBACABBCABCABBCABACABABBCCBCBBCBBCAABBBBACBBABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACACACCAAAAABCAACAABBBAACAABBBABACBBABBACABCACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe" start= auto displayName= "UserDataSvc_ABACACACCAAAAABCAACAABBBAACAABBBABACBBABBACABCACCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACACACCAAAAABCAACAABBBAACAABBBABACBBABBACABCACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe" start= auto displayName= "UserDataSvc_ABACACACCAAAAABCAACAABBBAACAABBBABACBBABBACABCACCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACACACCAAAAABCAACAABBBAACAABBBABACBBABBACABCACCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACACACCAAAAABCAACAABBBAACAABBBABACBBABBACABCACCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBACCCCACBAAACAACCBACCAAACBBCACBCABBCAABBAACBCBCAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBACCCCACBAAACAACCBACCAAACBBCACBCABBCAABBAACBCBCAAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe
1⤵
- Executes dropped EXE
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ce629b938c10ba7d91813b7240b920dada6ef283e09ba92e03f2057d25663aae
MD5 144f97296809ab987839159c29ec1ae9
SHA1 bedff065f6dc13ab19df5cdc908e8416a5b7063e
SHA512 021ddd00de7c77c9ba6ca011146c2dc97693288fc4bd4bd50aa458b98df0c182a538c433ba75101fe2c1792f4135c12265040e54c4392f5533470f7d14af2fc7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 44e3ccae28a4315e6bc2a8f85ea622133332bca90b5be2f10b8cd81c667591b4
MD5 958e31993c183dcac922f817837c7f0f
SHA1 900e56eb5f3ba42d4a36acc7e9b0f756d37f04e8
SHA512 b18912e62593ad0aece2772157249278849e37e25e47968430f34d17fd10e1b75489fd5cee4d4b31c3bf7dc4aaaec875e855988b9c2213bd0aaaca907681bbf1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8d0cbe8897341a064b8fb5736f6b80e5917413586d2cdbfe292c796900a13577
MD5 d203747a63797b5e301d10ed23673b3b
SHA1 ed2fa15343b2de12a3e3f9f8e0015f69a9aee6c2
SHA512 d79fac1e4d75f4208145f5c3e73e191b37399af73818569ffac228c9378c500095c30193e60ba8f5e7b7b6dd23982556a6237d08bf3e593288b5d256e037e502
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 054db6126d89c435eb71760d84617e197a38a1df4de89a85ac122afde82ad2fd
MD5 600a6c8a719ab808c9362fc13891bd18
SHA1 911aeb795b9510de15226b5ab93c29e2f19237e9
SHA512 0e7f934cccdf69ebf032fabeaef52f03d53ab9efa25b9ecfa755c61907071e8e6f5251abffdef897847fc212d391bceceff2f92a95c884dfe9d2f2792d3ea726
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 83b92fdd7ad449b7c5bbf1662ed583a4f720a8543a194bef9c6e4a24909bb4a3
MD5 fbc154671f22102082170f4938f29f06
SHA1 a7b34c3b0c056e369557537d9fc0af091bbe3561
SHA512 3710300b09b8057c1793936d833d4161db4a170cdb71ad275e84fcce0e216b01d1a6a081bcbeece51f0b4451e5b05d256ad70cbc141d4cab0edcccaff31ecc6e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1c601b358e8afcdeeb57d1dc751ecee181ee0be21d42891c600abac65efd2b10
MD5 2f28a1052a527260b8bab70e5de31d53
SHA1 ac3d21f81d681e4e1d6efc515d060f820de48426
SHA512 8fce6f9bd46c96becb91630290f3e037313c3270ddb34a01244fcf5175addec771f0be1bd02a797cb136275d74c51288526b24fd53c38a94034a7ca08196d0cf
MD5 SHA1 SHA512

Submit Download

svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCACBABACABBBBBAABACCBCCBCACCCBBBCCCCBCAAABABCACCABC.exe
Size 10.8MB
SHA256 0044b7c1cd1c9b3a82113cf72a816380bcc75c4e5466dc8cf62e48b423e06eaa
MD5 a8fd1d2656eb98750486be2a25fbd67d
SHA1 74ea3f484f0a5edac35038c07ef9621bac834558
SHA512 bd9d5b3fbdc0e75f1db8dc86b8ba3968200aeb96b8829f3b526c917c69b92ae4a19505ac9b3b408a2d00c0835e8611c6d870eb31baa69e6795f4fb74e057ff47
SSDEEP 196608:8LZWLZWLZMLZWLZWLZC1tIDewjqkjiqM9:g66w66C8Kweky9
TLSH
T18CB68D29FA94C1F2F9AB9439986B8672FA717A100933934B87D4C61E7F336815E35331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3c977d2b52a8c060ff959beaf73fc9c16c53e3f6086e176630a77a8b8578db51
MD5 b3972389d50cfeb75538055c37eebb45
SHA1 46202de69513ebf3a76555c1fc5781fb468a10ad
SHA512 78803ed010cab4bce34dcfcbcd00dab92bc144d5e0e65bddec61a3ed713abb5efba74c9540d48d08a6e7d01e008e353c8bd72beb2c20ccdf4dcfb954ed648af6
TLSH
T1E711C456A4F9D463F83268CF6A198A524CF43F9F98546E981308C21DBBA5C328D19CE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4108-70-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/4112-7-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/4112-0-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/4416-34-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/4416-24-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/4748-81-0x0000000000160000-0x0000000000181000-memory.dmp

Download