304b186f263279700ce5cf88d47ddbb9364b0a36fa83f37cf30f97454e8d3f03

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_d7f2331b19d66852db10bc4d41f212b6_amadey_elex_glassworm_icedid_njrat_vidar.exe
Size 13.6MB
Sample260815-v31cdsem91
SHA256 304b186f263279700ce5cf88d47ddbb9364b0a36fa83f37cf30f97454e8d3f03
MD5 d7f2331b19d66852db10bc4d41f212b6
SHA1 a417ce1cad9f9275020cbcd675a7cdb4f615ae2e
SHA512 ceaf8e384f6115800d92282948f75f091b094bbcc47637f933ae936f528ffa71266b95d684b26818995f4182673551889129770ad6eac9a9369929d449fe3282
SSDEEP 98304:1QXQXQIQXQXQz1MbQ9yDAD7KjjqkusjmqMh6:a1tIDewjqkjiqM8
TLSH
T1A5E66C55FB9880E2F47B413498AB82B6EA71B9110F23939F9694C31E6E337C19E35731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5320	svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe
1832	svchost_AACCACAACACACABCCCAACABCBBABACABBCCCCAABBABACAACCBBACBA.exe
5812	svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBBCBBAACACAAABCCBCCACAAACBBABAABBABAABAABBAABACCCAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe"	2026-08-15_d7f2331b19d66852db10bc4d41f212b6_amadey_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACAABAABBBABBBBCBBABBCCCBCABCBACCAABAACCBACABAACABBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCACAACACACABCCCAACABCBBABACABBCCCCAABBABACAACCBBACBA.exe"	svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
588	sc.exe
2636	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2376	cmd.exe
4540	cmd.exe
2644	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCACAACACACABCCCAACABCBBABACABBCCCCAABBABACAACCBBACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_d7f2331b19d66852db10bc4d41f212b6_amadey_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2252	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5400	2026-08-15_d7f2331b19d66852db10bc4d41f212b6_amadey_elex_glassworm_icedid_njrat_vidar.exe
5400	2026-08-15_d7f2331b19d66852db10bc4d41f212b6_amadey_elex_glassworm_icedid_njrat_vidar.exe
5400	2026-08-15_d7f2331b19d66852db10bc4d41f212b6_amadey_elex_glassworm_icedid_njrat_vidar.exe
5400	2026-08-15_d7f2331b19d66852db10bc4d41f212b6_amadey_elex_glassworm_icedid_njrat_vidar.exe
5320	svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe
5320	svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe
5320	svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe
5320	svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe
1832	svchost_AACCACAACACACABCCCAACABCBBABACABBCCCCAABBABACAACCBBACBA.exe
1832	svchost_AACCACAACACACABCCCAACABCBBABACABBCCCCAABBABACAACCBBACBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5400	2026-08-15_d7f2331b19d66852db10bc4d41f212b6_amadey_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5320	svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe
Token: SeDebugPrivilege	1832	svchost_AACCACAACACACABCCCAACABCBBABACABBCCCCAABBABACAACCBBACBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5400 wrote to memory of 2376	5400	2026-08-15_d7f2331b19d66852db10bc4d41f212b6_amadey_elex_glassworm_icedid_njrat_vidar.exe	92
PID 2376 wrote to memory of 2252	2376	cmd.exe	94
PID 5320 wrote to memory of 3296	5320	svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe	95
PID 5400 wrote to memory of 4540	5400	2026-08-15_d7f2331b19d66852db10bc4d41f212b6_amadey_elex_glassworm_icedid_njrat_vidar.exe	98
PID 4540 wrote to memory of 588	4540	cmd.exe	100
PID 5400 wrote to memory of 2644	5400	2026-08-15_d7f2331b19d66852db10bc4d41f212b6_amadey_elex_glassworm_icedid_njrat_vidar.exe	101
PID 2644 wrote to memory of 2636	2644	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_d7f2331b19d66852db10bc4d41f212b6_amadey_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_d7f2331b19d66852db10bc4d41f212b6_amadey_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABACBCBCBCCCAACABABABBBAAAACAABACBBACABCCCAACACBACABAAAABAABCAAAABCCAACBBCCACACBBCBACCAABABABBCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABACBCBCBCCCAACABABABBBAAAACAABACBBACABCCCAACACBACABAAAABAABCAAAABCCAACBBCCACACBBCBACCAABABABBCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBAACCCCBBACBBAACCACCCBCCACBABBCBBBBCABABABBCBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe" start= auto displayName= "UserDataSvc_CBCBAACCCCBBACBBAACCACCCBCCACBABBCBBBBCABABABBCBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBAACCCCBBACBBAACCACCCBCCACBABBCBBBBCABABABBCBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe" start= auto displayName= "UserDataSvc_CBCBAACCCCBBACBBAACCACCCBCCACBABBCBBBBCABABABBCBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBAACCCCBBACBBAACCACCCBCCACBABBCBBBBCABABABBCBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBAACCCCBBACBBAACCACCCBCCACBABBCBBBBCABABABBCBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2636

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCACAACACACABCCCAACABCBBABACABBCCCCAABBABACAACCBBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCACAACACACABCCCAACABCBBABACABBCCCCAABBABACAACCBBACBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe
1⤵
- Executes dropped EXE
PID:5812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1768c7a71a489a2f46d89edb4286e65f129b79055f5ce7cc7230d34ffc846fdf
MD5 60df2c241d5d01279d9aad2188a41f62
SHA1 e508232abf07c2ec1c20af6930edd2fba003cf4d
SHA512 8a23f95264b7dce9f19e67d4bb95a99ca9cd42157a97a3374f03a426593e1673f7db7d9d86c6fd6b850db406cd6d4016d7092ecb9fe4763a4c6f1a0da9cf938a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cc6319dd97903900807e98137cbd3e4b0e342b1f5095ad7a4a8f01fe0fa19f55
MD5 d4f6fd5f4ad75e7bc7a057b3dedd81b6
SHA1 060107154f590a75b856df70de01bf5f81be7fdd
SHA512 00778f667171229118d817d0c173b9df482040771e68c221314f8c4fb6bc94855f6dfbdbf72862fe0364651eea75649141acf90a7cc21bbe2c723822e7f61cde
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bd837dcbf00181d7777ddcc9e6e2cf8baa8c560aa7a44573aaabbde98d598ed1
MD5 49b14957c044d5b32e6a72345d38dab2
SHA1 a33f2af428181864e53315e26afbdac96bf7bc39
SHA512 297091c7532400a1dd2534e86ef351a2749a18bb5709de409e183812464f2fb449ba3dd0dc4efa9fd347c1df9c90749a46744a723e80bbe9631c4f31a4207479
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0abae73ad210a75558a1f861c14fcae313bed74bf5bad8dbeca852e7a683e71e
MD5 ed6912d77753d0f33a7fde69dec91a51
SHA1 577e76d5c227cb320c9f5456a83d99839df1fbe6
SHA512 e26117046266488d5a55c50ad4c7d6deaeb248815e5010dc3d1d291615c50dce53ce45028ac67a4665d6cb3fd39162f36954811d09cebdacf686a8067f7f3c37
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7939da47968033d15bc0a5cd25eb7fe85f3f63f3be25b7aa7a2976dac44cdd10
MD5 4c07cc823b7f1c2ead7053e11d8f232f
SHA1 6bac71335fb83be072a67ec7318d665e63f067e7
SHA512 b9b37cc8254aa3793be2aaa6ac25b3a0987b7c0f315ef2a748e1e6b49d17ff19d770aedb65001469e4ca5e67f9aab4f4edd9cee5ad1e94fa1def12a2f47856b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3c71ec6f91e87a03345ca8f2f118fb2a5ad2ebb3c64e19d60236977badf8da66
MD5 8d35d8e7f1ba0164a2575aef5898bb3b
SHA1 d46559a96337456a09f14a7edb8cac87ca6082ba
SHA512 6c56928bc0d2554492cc538fc9e517a35d1f1b8d51eca998a7ad8195b5a71ee68a5449940102398f83a76e1e052774bfc649d9562974e2343d681281e9bbf932
MD5 SHA1 SHA512

Submit Download

svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACCACBCAACCABABCCBAABCBBCAABBBABCABBCBABABABBCC.exe
Size 13.6MB
SHA256 304b186f263279700ce5cf88d47ddbb9364b0a36fa83f37cf30f97454e8d3f03
MD5 d7f2331b19d66852db10bc4d41f212b6
SHA1 a417ce1cad9f9275020cbcd675a7cdb4f615ae2e
SHA512 ceaf8e384f6115800d92282948f75f091b094bbcc47637f933ae936f528ffa71266b95d684b26818995f4182673551889129770ad6eac9a9369929d449fe3282
SSDEEP 98304:1QXQXQIQXQXQz1MbQ9yDAD7KjjqkusjmqMh6:a1tIDewjqkjiqM8
TLSH
T1A5E66C55FB9880E2F47B413498AB82B6EA71B9110F23939F9694C31E6E337C19E35731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 085e4763dbae2ba8df4ae73f905a08923f9a5f59d42854870ce8bc57cc4415bf
MD5 f5c78ae9f08fd3db6ddde32735d8c3e1
SHA1 b4f99378531493d3e777b0ee026d8015f134bafa
SHA512 ceca4b33875cc31e03923b27e62f4e9758905ff66d3f6bb5532c39d5294e13cd04b0469a0ce83c94960723cac7be30b5fa4670a52bcb0fb482319218c6177296
TLSH
T1AA112B12D8E5EC33FD72288BA56EBB430DF43BBB9C58AE042245811977C8831DD150D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1832-79-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/5320-34-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/5320-24-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/5400-0-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/5400-7-0x00000000007E0000-0x0000000000801000-memory.dmp

Download