42c7f00f305830f6778a48e5740951113b20547ec1b0d24d34a8362a131ec6c5

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 10:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_89f5f5a3498b1e2e8686388a4c67f5f5_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Size 14.3MB
Sample260815-m1drlsam8x
SHA256 42c7f00f305830f6778a48e5740951113b20547ec1b0d24d34a8362a131ec6c5
MD5 89f5f5a3498b1e2e8686388a4c67f5f5
SHA1 07ab461a23c7c34933430f0e758f841c0c374825
SHA512 09c559f0e1c7d43c4fac6e53d459a1eb09ecfc047aaa7c93e1ad4d947460a29c30d92269c2c69b26ffa80069328b40916a3da4612d84b5167434caa3caf30398
SSDEEP 196608:lLZWLZULZWLZULZWLZULZWLZULZWLZULZpmHpn6F44IAWvc:z6Y6Y6Y6Y6YpmHN6+Jrvc
TLSH
T13FE69E15F48350F6E56B9071496BD336E6707D1206328B9BA7ECDA1B3F336906E39322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1588	svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe
3252	svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe
3296	svchost_BBBCACCBCCCABBCCBBCCACCABBACCCBBABBABAACABCCABCABBCBABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABABBBBBCCBBACACAACAABCBCBCAAABAAAACCACABBCCBCCACAAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCACCBCCCABBCCBBCCACCABBACCCBBABBABAACABCCABCABBCBABC.exe"	svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBAABBCBABBCCABBBBACCBCBAACAAABBABAABBBACAACACBBCACBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe"	2026-08-15_89f5f5a3498b1e2e8686388a4c67f5f5_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2492	sc.exe
5400	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3256	cmd.exe
3564	cmd.exe
2016	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCACCBCCCABBCCBBCCACCABBACCCBBABBABAACABCCABCABBCBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_89f5f5a3498b1e2e8686388a4c67f5f5_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4920	2026-08-15_89f5f5a3498b1e2e8686388a4c67f5f5_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4920	2026-08-15_89f5f5a3498b1e2e8686388a4c67f5f5_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4920	2026-08-15_89f5f5a3498b1e2e8686388a4c67f5f5_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4920	2026-08-15_89f5f5a3498b1e2e8686388a4c67f5f5_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
1588	svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe
1588	svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe
1588	svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe
1588	svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	2026-08-15_89f5f5a3498b1e2e8686388a4c67f5f5_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	1588	svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 3256	4920	2026-08-15_89f5f5a3498b1e2e8686388a4c67f5f5_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	92
PID 3256 wrote to memory of 4372	3256	cmd.exe	94
PID 4920 wrote to memory of 3564	4920	2026-08-15_89f5f5a3498b1e2e8686388a4c67f5f5_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	95
PID 3564 wrote to memory of 2492	3564	cmd.exe	97
PID 4920 wrote to memory of 2016	4920	2026-08-15_89f5f5a3498b1e2e8686388a4c67f5f5_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	98
PID 2016 wrote to memory of 5400	2016	cmd.exe	100
PID 1588 wrote to memory of 3996	1588	svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-15_89f5f5a3498b1e2e8686388a4c67f5f5_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_89f5f5a3498b1e2e8686388a4c67f5f5_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBACBBBCCACBAAAABBABBCACAAACBABCACBBCBABBCCBBCABBAAAAAACBABBACBAACCABACABAACBCCACABABCCAABCBCCCABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBACBBBCCACBAAAABBABBCACAAACBABCACBBCBABBCCBBCABBAAAAAACBABBACBAACCABACABAACBCCACABABCCAABCBCCCABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBBCCAAACABACCCCBCBBBBACACABBBACCACCAACACBBCCAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe" start= auto displayName= "UserDataSvc_BACBBCCAAACABACCCCBCBBBBACACABBBACCACCAACACBBCCAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBBCCAAACABACCCCBCBBBBACACABBBACCACCAACACBBCCAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe" start= auto displayName= "UserDataSvc_BACBBCCAAACABACCCCBCBBBBACACABBBACCACCAACACBBCCAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBBCCAAACABACCCCBCBBBBACACABBBACCACCAACACBBCCAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBBCCAAACABACCCCBCBBBBACACABBBACCACCAACACBBCCAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5400

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe
1⤵
- Executes dropped EXE
PID:3252

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCBCCCABBCCBBCCACCABBACCCBBABBABAACABCCABCABBCBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCBCCCABBCCBBCCACCABBACCCBBABBABAACABCCABCABBCBABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 13ea03a5b59196a19cd8696f38c03bc704edcca3514fc68262f59938614870b4
MD5 93381cc072528373d5cd2c125c05c3e5
SHA1 a71ad5cfdc8bf31e4e2852daff1994526ddc2c6d
SHA512 97d06e9d22cbeb8f5a9d59bfd730abe7fedb99ec1a4dc8f1437ebe69fae22b9cafb846826eb3985232a61e545e3fbb3cd14d74268983e94a23603e3c373ab8b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9b63699d672b7cc70792ba358c5cace10a2cfc0ba27ac92b5613e4a2c23c9ae6
MD5 f755a2770aeb7603c036a0362b2576ea
SHA1 d56d89801e28dd607e9e4a1544675d22bfc697a6
SHA512 5274ec6ca2ffba7a9f3ea8aabaec24fe7886f9d54a845128a59ba4d489e4bfcaf0b7a02173a90d74a66b82fe412b360ed9e4bf4799d84d95418b2725b278af4e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c12f8d4444c6d2213612b5abc477383d88cd4861c78d8d779f9e546f64ab8c2f
MD5 7ca2b4332c1bf102f1dee360eb541a90
SHA1 145b079fb1690b6985e281202b0a75e3d3f1a677
SHA512 a2e6c081f2e8bd3445f963f85641ac402e54dd1a4cb7a308725ccaf73c83ea8519dd2218a8ddd3858ccb4fb6e876ee0dcd80362f67feb6f7ed262e52c9c509fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6e9028b7e6e75a115f6ca7768a438e1f30518a01d814dfeda8873f14c0e2fd55
MD5 343e5358acf4ff3b0d6c6a96b5760319
SHA1 c2c94f80b8698070fd03292e17664eaecac9f8b1
SHA512 af1666779876645691b440049a714ac5dcd68ca7fcb1c5c7774ec60d21d14403f95efad47f6aa54765d3220506e2a4c7293d28d9c4a9213f3c7b97c4c56908e9
MD5 SHA1 SHA512

Submit Download

svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBACBBCAAAACBCCBAABBBCCABAACBBBCBBABCABCAACBBBCBA.exe
Size 14.3MB
SHA256 42c7f00f305830f6778a48e5740951113b20547ec1b0d24d34a8362a131ec6c5
MD5 89f5f5a3498b1e2e8686388a4c67f5f5
SHA1 07ab461a23c7c34933430f0e758f841c0c374825
SHA512 09c559f0e1c7d43c4fac6e53d459a1eb09ecfc047aaa7c93e1ad4d947460a29c30d92269c2c69b26ffa80069328b40916a3da4612d84b5167434caa3caf30398
SSDEEP 196608:lLZWLZULZWLZULZWLZULZWLZULZWLZULZpmHpn6F44IAWvc:z6Y6Y6Y6Y6YpmHN6+Jrvc
TLSH
T13FE69E15F48350F6E56B9071496BD336E6707D1206328B9BA7ECDA1B3F336906E39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BBBCACCBCCCABBCCBBCCACCABBACCCBBABBABAACABCCABCABBCBABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCBCCCABBCCBBCCACCABBACCCBBABBABAACABCCABCABBCBABC.exe
Size 8.2MB
SHA256 c420b2fb1c1050b364f871f8a6b9adcfff5561217aee4ba04a0d1a5d1fd027b0
MD5 931712d3b76fafea04b787b2bf963243
SHA1 adb9869b0b3dcb10bcb43996d5af98793a81ef9d
SHA512 88faf0a526f59a7b7786efe810b5b81636e74ae894a9eafb93c731d4e89b5d585eb889a8f6de705f2de382974633d29b9601d1ffbaf0946b7ee0333de911f728
SSDEEP 196608:lLZWLZULZWLZULZWLZULZWLZULZWLZULZL:z6Y6Y6Y6Y6YL
TLSH
T169867D05F84380B3EA6611714D8FE2BB6674AB204B128DEBF7CDDA1F7A33AC15636115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1588-24-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/1588-37-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/4920-0-0x0000000000AD0000-0x0000000000AF1000-memory.dmp

Download

memory/4920-8-0x0000000000AD0000-0x0000000000AF1000-memory.dmp

Download