0c003883e89fc7d4e68d064e1f4656a461f1da7ec631777e21fe6c53d485ae2f

Analysis

max time kernel
151s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_af4ed0b3ab853c674c8b29fc9acf1735_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Size 48.0MB
Sample260819-fbkejayvgv
SHA256 0c003883e89fc7d4e68d064e1f4656a461f1da7ec631777e21fe6c53d485ae2f
MD5 af4ed0b3ab853c674c8b29fc9acf1735
SHA1 0eebe6b0841880e52435d7e7b3fe111b56d377be
SHA512 6cf469d9296a22f48a6ae435f26f8a52040dac56766388a8eeefffe80aa4199a6bda5d7668377fd5e41c2fdec2b0a47e690ec401009ead4d42a0f4d61ffeef86
SSDEEP 98304:yssssssssssssssssssnLZ1oossssssssssssssssssnLZ1o81MbQ9yDAD7KjjqC:iLZjLZX1tIDewjqkjiqMw
TLSH
T188B74B09F94380F2D92B01B14CDBD3BF8A70BA158B128AEBE74DC71F6D337916925265
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4560	svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe
5092	svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe
4320	svchost_CCAACABBBABACCABCBBBCABBBABABABCCBABCAAACCCCBCABCBABCAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBBABCBCBBABABCCACBCAABAACBCCBBCCACCCBCABBBBCCBACACCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe"	2026-08-19_af4ed0b3ab853c674c8b29fc9acf1735_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBACAABAACCCAAACBCBCCCCBABAAAACBAAACACABABBABAAAAACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAACABBBABACCABCBBBCABBBABABABCCBABCAAACCCCBCABCBABCAA.exe"	svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1104	sc.exe
5816	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1608	cmd.exe
5772	cmd.exe
5688	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAACABBBABACCABCBBBCABBBABABABCCBABCAAACCCCBCABCBABCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_af4ed0b3ab853c674c8b29fc9acf1735_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3332	2026-08-19_af4ed0b3ab853c674c8b29fc9acf1735_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
3332	2026-08-19_af4ed0b3ab853c674c8b29fc9acf1735_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
3332	2026-08-19_af4ed0b3ab853c674c8b29fc9acf1735_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
3332	2026-08-19_af4ed0b3ab853c674c8b29fc9acf1735_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4560	svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe
4560	svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe
4560	svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe
4560	svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe
4320	svchost_CCAACABBBABACCABCBBBCABBBABABABCCBABCAAACCCCBCABCBABCAA.exe
4320	svchost_CCAACABBBABACCABCBBBCABBBABABABCCBABCAAACCCCBCABCBABCAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	2026-08-19_af4ed0b3ab853c674c8b29fc9acf1735_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	4560	svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe
Token: SeDebugPrivilege	4320	svchost_CCAACABBBABACCABCBBBCABBBABABABCCBABCAAACCCCBCABCBABCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 1608	3332	2026-08-19_af4ed0b3ab853c674c8b29fc9acf1735_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	92
PID 1608 wrote to memory of 5584	1608	cmd.exe	94
PID 4560 wrote to memory of 1620	4560	svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe	95
PID 3332 wrote to memory of 5772	3332	2026-08-19_af4ed0b3ab853c674c8b29fc9acf1735_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	96
PID 5772 wrote to memory of 1104	5772	cmd.exe	98
PID 3332 wrote to memory of 5688	3332	2026-08-19_af4ed0b3ab853c674c8b29fc9acf1735_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	99
PID 5688 wrote to memory of 5816	5688	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-19_af4ed0b3ab853c674c8b29fc9acf1735_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_af4ed0b3ab853c674c8b29fc9acf1735_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCACCAABBCAAAABABBABBCCBCBBBCCBACCACCABCBCBBAACBCCAACAABACBBABBBCBCBACCBAAABBABCAABACBCCCCAABCCABACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCACCAABBCAAAABABBABBCCBCBBBCCBACCACCABCBCBBAACBCCAACAABACBBABBBCBCBACCBAAABBABCAABACBCCCCAABCCABACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABBBCACAACAAAACBCACABCBBABCACBBACBCCABACABCAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe" start= auto displayName= "UserDataSvc_CBABBBCACAACAAAACBCACABCBBABCACBBACBCCABACABCAAABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABBBCACAACAAAACBCACABCBBABCACBBACBCCABACABCAAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe" start= auto displayName= "UserDataSvc_CBABBBCACAACAAAACBCACABCBBABCACBBACBCCABACABCAAABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABBBCACAACAAAACBCACABCBBABCACBBACBCCABACABCAAABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABBBCACAACAAAACBCACABCBBABCACBBACBCCABACABCAAABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1620

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe
1⤵
- Executes dropped EXE
PID:5092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACABBBABACCABCBBBCABBBABABABCCBABCAAACCCCBCABCBABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACABBBABACCABCBBBCABBBABABABCCBABCAAACCCCBCABCBABCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6276d7e209f2bced94d38a5e4d462378549a5812b46703033fa743aa5e520600
MD5 fc96e2fb6906c7d2a183d4fa79e7a4f1
SHA1 4e895f7ca17e53a4f6a2cc00c416040f8d3a1170
SHA512 cc1d978272406fc5df4e1424b3e475b7b77da6d7b2cc1bb5a744d9c50a816cea96b190f2ea7b83946122535a4ff0eaf075d005a23b73545d9ab1d222d75ac37e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 58c4c0bf0d6b2168ab868e092fac563eb78eb7ba45384af9690ccbfcdfb14ad9
MD5 a4c249042bf6fc2949032f37293fd368
SHA1 d4a21688238824d851a0ed5ed10658910afca332
SHA512 9d2e134c361215310259939f6d422684c441ea45cea45e8849ed40a2646e87038cc6d534a2f1df846bcdaeec24bf53c909f77477e35bbf4d906477b0de7ee456
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9a181bfb176702aa3f23bfeb42ae3659855923e20e5f68ab16e17c43d347475
MD5 c89a8d256723798b7df8b40ce8ab6408
SHA1 b53812d2ffbbdd06c694a8e6696baee2bacca86b
SHA512 e1b806ecc773981e2a43b55eb8b831c2fb7e56cff14a659cee3d6f3bd47c9f85e6ec6d45832e2829661ba40e4c35872517e386439536facc317c2b5447622da3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 015a2028ab8279c25b5bb8606af175fde2ffb8c6d246b501ea580ed5ae819e67
MD5 c2fd0d8dd885b07d593a949030673d7f
SHA1 fea16826bab4f2d61eb5a888fea8d0e3d9d04ca6
SHA512 c9752805bee380ea74b4ad58a9b989c04a1d2a4d4719405ab074cad841012318d35ff13c85374860fa87866fad65a9e8e40439ba12df0ff83a09b941cb104f57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4a513edc35b5745feb899a2ea319149f0d4dcd3745c39b68316dd53dc21e542d
MD5 1cca4c3431e0cc5cc96127b28206114b
SHA1 dd751bb680b0a3849ca2f41eb1ac45d1c20c9e0c
SHA512 aae9451092f00fa28b90bab30993d834b28bb2991beaa582cd45bcd6777741d677616b71df885d7b11bca120d98e884b43f72e32cb5b1d3e57b8d844d7d87e93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bbf8885ff5e9e337949818d359fa8142433bd62b7441fb3a24af5376cee4fba1
MD5 c375206f77547b0f93405bf46502ae05
SHA1 245e8eff247bb0ff35375a08549ae213fa71b0e5
SHA512 304bcb5cc9b380b679b8e175fee4f5131d2e0253664e1c8cf9fbaeb12528921b09d53cb197323a8939164b7d864373dc515e75311623212bd528318c65c3b102
MD5 SHA1 SHA512

Submit Download

svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBCCBCAAACCBCBCBABCBCABBACCBCCBBAACCCACBAABACAAAACA.exe
Size 48.0MB
SHA256 0c003883e89fc7d4e68d064e1f4656a461f1da7ec631777e21fe6c53d485ae2f
MD5 af4ed0b3ab853c674c8b29fc9acf1735
SHA1 0eebe6b0841880e52435d7e7b3fe111b56d377be
SHA512 6cf469d9296a22f48a6ae435f26f8a52040dac56766388a8eeefffe80aa4199a6bda5d7668377fd5e41c2fdec2b0a47e690ec401009ead4d42a0f4d61ffeef86
SSDEEP 98304:yssssssssssssssssssnLZ1oossssssssssssssssssnLZ1o81MbQ9yDAD7KjjqC:iLZjLZX1tIDewjqkjiqMw
TLSH
T188B74B09F94380F2D92B01B14CDBD3BF8A70BA158B128AEBE74DC71F6D337916925265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3eb39a61dceddf9688902e355a272155ca1230baae247dec9b60b3c7f0f72670
MD5 e3cb9fe1e6327b56c5da2f46137799db
SHA1 2f1eddb951026009580a67c83ed057e5cf732eff
SHA512 e3447e243bfc7a2516e8fff0486bda1b79b02ba5b65c28fa94f56cb6e3e4b33d5c52a7315a1f6f3ca632f015a7fba24c56bc2ec552ce4a5753d19aa5ba99a1af
TLSH
T1BE112B51E8B5C43BFD3328C7923DEAC28CE0265F9C9CAA94230A411863EDD608D598D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3332-7-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/3332-0-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/4320-72-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/4560-23-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/4560-36-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/5092-66-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download