d41edfeb9ba545669bdaa47a77a10fff1f1ab327eb12b1da604dfb158778d788

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_12c714ea91f1dba16c8feadce779cc4a_amadey_elex_icedid_vidar.exe
Size 6.4MB
Sample260827-2jls8a1enc
SHA256 d41edfeb9ba545669bdaa47a77a10fff1f1ab327eb12b1da604dfb158778d788
MD5 12c714ea91f1dba16c8feadce779cc4a
SHA1 f58dfe09926c944787b1a2397dd65b51341a374a
SHA512 1327a58ef5344cc504541395a8ff6fb94262081fac2467936ecb66e6dd60cc419a91cfd0d0cf738a249fdb843e432e4fb9407c64ee60a128ab0a4a2cf2a0250f
SSDEEP 49152:U+EBv+E7+ES+EBnI+E7+ES+EBv+E7+ES+EBnI+E7+ES+EBv+E7+ES+EBnG+EBv+y:m4f4f4Y4f4f40
TLSH
T114661A0AFA4240B1D46609704997E37E8720BA25C5134FABF6899FCFFFF2A915D24631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5188	svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe
5856	svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe
6120	svchost_BCABCACACCCACBABACCBCCBACABABCCBBBCAABCCCCABAABACACBACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABACBBACABBCACCAABAACABBCCCACCBBCAAACCCBBBBCBCABBBBABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe"	2026-08-27_12c714ea91f1dba16c8feadce779cc4a_amadey_elex_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCBAACBBCBCCAACAAACCACBACBACAAAAAACCCACACBABCAABBBACAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCACACCCACBABACCBCCBACABABCCBBBCAABCCCCABAABACACBACC.exe"	svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5696	sc.exe
5972	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1936	cmd.exe
6132	cmd.exe
5136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABCACACCCACBABACCBCCBACABABCCBBBCAABCCCCABAABACACBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_12c714ea91f1dba16c8feadce779cc4a_amadey_elex_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2224	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3464	2026-08-27_12c714ea91f1dba16c8feadce779cc4a_amadey_elex_icedid_vidar.exe
3464	2026-08-27_12c714ea91f1dba16c8feadce779cc4a_amadey_elex_icedid_vidar.exe
3464	2026-08-27_12c714ea91f1dba16c8feadce779cc4a_amadey_elex_icedid_vidar.exe
3464	2026-08-27_12c714ea91f1dba16c8feadce779cc4a_amadey_elex_icedid_vidar.exe
5188	svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe
5188	svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe
5188	svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe
5188	svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	2026-08-27_12c714ea91f1dba16c8feadce779cc4a_amadey_elex_icedid_vidar.exe
Token: SeDebugPrivilege	5188	svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 1936	3464	2026-08-27_12c714ea91f1dba16c8feadce779cc4a_amadey_elex_icedid_vidar.exe	92
PID 1936 wrote to memory of 2224	1936	cmd.exe	94
PID 3464 wrote to memory of 6132	3464	2026-08-27_12c714ea91f1dba16c8feadce779cc4a_amadey_elex_icedid_vidar.exe	95
PID 6132 wrote to memory of 5696	6132	cmd.exe	97
PID 3464 wrote to memory of 5136	3464	2026-08-27_12c714ea91f1dba16c8feadce779cc4a_amadey_elex_icedid_vidar.exe	98
PID 5136 wrote to memory of 5972	5136	cmd.exe	100
PID 5188 wrote to memory of 4996	5188	svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-27_12c714ea91f1dba16c8feadce779cc4a_amadey_elex_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_12c714ea91f1dba16c8feadce779cc4a_amadey_elex_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBABBABCBAACACBCAABAAABBBCBACAAACACBBACABBCBBBABBABCBBBAAAABBABAACCBCACBCBAABCCAACBCBCBCACACABACACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBABBABCBAACACBCAABAAABBBCBACAAACACBBACABBCBBBABBABCBBBAAAABBABAACCBCACBCBAABCCAACBCBCBCACACABACACCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACBCAACABCCBCBBBCACCACABBCCCABCBBBAAABCCBCBBAAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe" start= auto displayName= "UserDataSvc_ABACBCAACABCCBCBBBCACCACABBCCCABCBBBAAABCCBCBBAAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACBCAACABCCBCBBBCACCACABBCCCABCBBBAAABCCBCBBAAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe" start= auto displayName= "UserDataSvc_ABACBCAACABCCBCBBBCACCACABBCCCABCBBBAAABCCBCBBAAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACBCAACABCCBCBBBCACCACABBCCCABCBBBAAABCCBCBBAAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACBCAACABCCBCBBBCACCACABBCCCABCBBBAAABCCBCBBAAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5188
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe
1⤵
- Executes dropped EXE
PID:5856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCACACCCACBABACCBCCBACABABCCBBBCAABCCCCABAABACACBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCACACCCACBABACCBCCBACABABCCBBBCAABCCCCABAABACACBACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ea9d29bb3a72769a51e12a63b5596188430bf1176e503c21ee5e38cb19b49e4e
MD5 edff2b0770a9665a45604274d5a5bacc
SHA1 c30f23a1193f79ae5e2627ceccce373376ef1b52
SHA512 e3f358818651a789bf9152c883f01531e36baeaacfcb4d0ec27d9e347cc94730f17c399c16dcc233fd2b142f9343c95071e5c580a25bbf683ff36f27dbea310c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 48fac7d258fe72a3eaa512cb748e62929ebc281bc93be9d8de7747e6ab832b1e
MD5 9f11577d4098ce8a344da3be9599ef43
SHA1 35adc89415654e16a9e6a2147691388072721ed7
SHA512 e1219b450e9e69744040a999159cdb5ea8ef36949e77aed784e51a71624b740dfe9f6a402601fb55b02ed4c5ec4b4854aae8d68f10ee49c88b5563fdd7755e69
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d83b1f4b147ea16ec7f50df25b4d14c816f047a86c3b1a11ac2a60fedee09efc
MD5 0fddaaaf95b1f96e8066a9ec4e429618
SHA1 0812f522ffa6ef1b81c08f7baa692652a439f49f
SHA512 331c86f918bcc7ee7e8566e451735360f8c4e9c3c84e8ae59f60820c301c3ad2576452c4e334705774967b3a1eafe89671b8b25d02e325745bfa253313ea0714
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a9048dfe2a17eb0c04c88cdb1fcdcdb67942d651064171f3b0c5d06d9c7767e6
MD5 618793459e804f138e91b0a6d9bf0e0e
SHA1 08ddbaf10ddc3737c70bbd9f8c1676654e86c52d
SHA512 aa79b581c30d429fa545cc4304d9b145035f8781be52e675ea791c45db25ca7cb45d6b5e3f4a272fa09e9ebeacf0d25183531425f865ca95e8bc7338d6c7bc94
MD5 SHA1 SHA512

Submit Download

svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABBAAAAABAAACAACCAAAABCACCABACCCBAABCCBAABAAACACCCAA.exe
Size 6.4MB
SHA256 d41edfeb9ba545669bdaa47a77a10fff1f1ab327eb12b1da604dfb158778d788
MD5 12c714ea91f1dba16c8feadce779cc4a
SHA1 f58dfe09926c944787b1a2397dd65b51341a374a
SHA512 1327a58ef5344cc504541395a8ff6fb94262081fac2467936ecb66e6dd60cc419a91cfd0d0cf738a249fdb843e432e4fb9407c64ee60a128ab0a4a2cf2a0250f
SSDEEP 49152:U+EBv+E7+ES+EBnI+E7+ES+EBv+E7+ES+EBnI+E7+ES+EBv+E7+ES+EBnG+EBv+y:m4f4f4Y4f4f40
TLSH
T114661A0AFA4240B1D46609704997E37E8720BA25C5134FABF6899FCFFFF2A915D24631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3464-0-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/3464-8-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/5188-24-0x0000000000710000-0x0000000000731000-memory.dmp

Download

memory/5188-37-0x0000000000710000-0x0000000000731000-memory.dmp

Download