3cebc736a72345a2ef8f37056e01e8a0f46bcdda6962db3b9716ebaab6824f11

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_09b808dcce512a257dce56e41dec0334_amadey_elex_glassworm_icedid_njrat_vidar.exe
Size 7.4MB
Sample260828-2k5bystfqb
SHA256 3cebc736a72345a2ef8f37056e01e8a0f46bcdda6962db3b9716ebaab6824f11
MD5 09b808dcce512a257dce56e41dec0334
SHA1 4fcb7b512dbe4e3a653a8e1872097fa41392ab9f
SHA512 63455ed4d36b58b134463ddd6d431f5ce2f9235012e9d111e29564d241be15d2a9d1b0cf134bb293dc436c59b88f8841e2d81d8fb4590d39453f5f67a3db5fdc
SSDEEP 49152:U+EX/O+EX/4ozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLno:ywQ1MbQ9yDAD7KjjqkusjmqMhx
TLSH
T11D766C39ABB485E5F9ABD83CA97B8631FA7279510833530B89E1C21F6F336524D18731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5472	svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe
5512	svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe
1444	svchost_ABBBBBCCCAAABBABAACCCCBABBCACCABCCCCCAAACCABACBCAAACACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCACACCBAACBBACBAACCBACCBCBACACCBACABABCBCACCAACCBCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe"	2026-08-28_09b808dcce512a257dce56e41dec0334_amadey_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCCCAABBACCBABABCAACACCCCACBBCAACBCCBCCAAACCBBCCAAAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBBCCCAAABBABAACCCCBABBCACCABCCCCCAAACCABACBCAAACACB.exe"	svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3612	sc.exe
3832	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6120	cmd.exe
3108	cmd.exe
4744	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_09b808dcce512a257dce56e41dec0334_amadey_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBBBCCCAAABBABAACCCCBABBCACCABCCCCCAAACCABACBCAAACACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1096	2026-08-28_09b808dcce512a257dce56e41dec0334_amadey_elex_glassworm_icedid_njrat_vidar.exe
1096	2026-08-28_09b808dcce512a257dce56e41dec0334_amadey_elex_glassworm_icedid_njrat_vidar.exe
1096	2026-08-28_09b808dcce512a257dce56e41dec0334_amadey_elex_glassworm_icedid_njrat_vidar.exe
1096	2026-08-28_09b808dcce512a257dce56e41dec0334_amadey_elex_glassworm_icedid_njrat_vidar.exe
5472	svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe
5472	svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe
5472	svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe
5472	svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe
1444	svchost_ABBBBBCCCAAABBABAACCCCBABBCACCABCCCCCAAACCABACBCAAACACB.exe
1444	svchost_ABBBBBCCCAAABBABAACCCCBABBCACCABCCCCCAAACCABACBCAAACACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1096	2026-08-28_09b808dcce512a257dce56e41dec0334_amadey_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5472	svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe
Token: SeDebugPrivilege	1444	svchost_ABBBBBCCCAAABBABAACCCCBABBCACCABCCCCCAAACCABACBCAAACACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 6120	1096	2026-08-28_09b808dcce512a257dce56e41dec0334_amadey_elex_glassworm_icedid_njrat_vidar.exe	92
PID 6120 wrote to memory of 2216	6120	cmd.exe	94
PID 5472 wrote to memory of 4304	5472	svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe	95
PID 1096 wrote to memory of 3108	1096	2026-08-28_09b808dcce512a257dce56e41dec0334_amadey_elex_glassworm_icedid_njrat_vidar.exe	96
PID 3108 wrote to memory of 3612	3108	cmd.exe	98
PID 1096 wrote to memory of 4744	1096	2026-08-28_09b808dcce512a257dce56e41dec0334_amadey_elex_glassworm_icedid_njrat_vidar.exe	99
PID 4744 wrote to memory of 3832	4744	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-28_09b808dcce512a257dce56e41dec0334_amadey_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_09b808dcce512a257dce56e41dec0334_amadey_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAABACBCBAAAAAACABBAAABABBBCBABCBCCCCBCCBBAAAABBCBBABACCCCABCAACCCCCCBACAABCBBABBBCABCCAABABBAABCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAABACBCBAAAAAACABBAAABABBBCBABCBCCCCBCCBBAAAABBCBBABACCCCABCAACCCCCCBACAABCBBABBBCABCCAABABBAABCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAABABCBBBACACBBAACBABCCACCBACBABBACACCBCABAACCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe" start= auto displayName= "UserDataSvc_CCAABABCBBBACACBBAACBABCCACCBACBABBACACCBCABAACCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAABABCBBBACACBBAACBABCCACCBACBABBACACCBCABAACCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe" start= auto displayName= "UserDataSvc_CCAABABCBBBACACBBAACBABCCACCBACBABBACACCBCABAACCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAABABCBBBACACBBAACBABCCACCBACBABBACACCBCABAACCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAABABCBBBACACBBAACBABCCACCBACBABBACACCBCABAACCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5472
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4304

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe
1⤵
- Executes dropped EXE
PID:5512

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCCCAAABBABAACCCCBABBCACCABCCCCCAAACCABACBCAAACACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCCCAAABBABAACCCCBABBCACCABCCCCCAAACCABACBCAAACACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 32047c9b6fef2aa6478aafd4f86c0052be2847cb9100cb191f6d4aad43e7ee86
MD5 cad3cb8f36e4b38f4c98b7bc3563a374
SHA1 cbc00b6d88efef6f243991684526533d017a6afa
SHA512 7c14dad2237b7cbac87dd59403be7b94ab77f52805a9ba6c3434de42646f7b54768ec9e04cd93285cdce26b74e873c540a43b54a21bae0020d65031c794e4ebd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c38ee8628ab2f9798880149b21ab9a4eb874bac40d34d294a0bbd18ad883bfdb
MD5 11178f735068229af427bb8e4e594902
SHA1 c307796475112cba38ccdd66897126c61b88b2ac
SHA512 a24aa4a08facacb10bd36fe57d44aae87648dfb1d2b83676f48f01ebf46e179b6b29cd548ffa72f260334212f2fe0dce3ba65a83e791b1265b4839c24452bb0e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5ce1b87d36745be55ef753b57b8fcde415a271e03945da8a42653b3ed5f2de96
MD5 4b21b879ef05353c5bf9aa41cb1fd91f
SHA1 0bf90c98dfb786d2dca1f271b9e05a7af06ce772
SHA512 5393c24de98cdc476ea2f5ada1c9b2420731da8a70a546e5f1448d971a52c5511cfd8dd3a42130ed61a94417a2bf06d72a58f3e820bc189b87e1d9f096d51f92
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 27030c0577ab38c72222bceaa5cc542de3767c3f784f378a3ad587b0cfb07305
MD5 15a48ba5b4f1d9e0c646a41a5ce51408
SHA1 4fa51666ee3d43811b7b4d81a8b4ad14d0fa9ac4
SHA512 073ea971913ec8b555cbfbffce8d0522ad3ba3dd6649a585795cb1210821f91a9c1f22cd3bcb5a263241f12b3cc4cad8252fed8297c6a59fc847eca0983145ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f588fd2fb793c7e8364a427002cc6e8bb166e439a6ff6ad9fa13155499dfabf6
MD5 48934e273fac25f32e742dce3b1531a4
SHA1 6a4b55c7d319297603d71e5aa807c54fdd5c92aa
SHA512 6c986791b4e665c433d021c38c00ee291c29e947079dfb23d891a9bf782761eb4d3e66e0c857fe9df4b58b7d359f3ca06e9346c5be416b886c63373a292b34a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cb794f1ce3dc44c6d3d3b5db0ad7108d5158194a5ee97db67b29901f985fd254
MD5 f3ba78f2cf4a600cf4fffbd155dca51e
SHA1 3b5e89d6ab43e95cf42d63d80bbf365c83421f83
SHA512 276c61e13961e198b4b2521b6914cc2457278acce0b7085515bbd211dce55b26eabb067e4b1694bd14de14b68be6f5a06550001e7c2325fe702a9cbeeb7c37d3
MD5 SHA1 SHA512

Submit Download

svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCABCABCABCBAACBBABBBBACAACBCBCCAACAABACCBAABBBCABCC.exe
Size 7.4MB
SHA256 3cebc736a72345a2ef8f37056e01e8a0f46bcdda6962db3b9716ebaab6824f11
MD5 09b808dcce512a257dce56e41dec0334
SHA1 4fcb7b512dbe4e3a653a8e1872097fa41392ab9f
SHA512 63455ed4d36b58b134463ddd6d431f5ce2f9235012e9d111e29564d241be15d2a9d1b0cf134bb293dc436c59b88f8841e2d81d8fb4590d39453f5f67a3db5fdc
SSDEEP 49152:U+EX/O+EX/4ozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLno:ywQ1MbQ9yDAD7KjjqkusjmqMhx
TLSH
T11D766C39ABB485E5F9ABD83CA97B8631FA7279510833530B89E1C21F6F336524D18731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 0a6ab5c452f756c96f69cd49d43469f359bdfa99d5179388f2d98fe1f998da1a
MD5 d3b95edd05775572ea2792ecd3d7219f
SHA1 687d44cbefd29b1dc895d0be7e57ee715e02a47b
SHA512 9393fcc75edb70472e9a8c2b686cbb32cefbf35ed0d8de3cad62b737288000605cf48017066b2acc69c9fbb8e1bf38d7b9bf5ecf6f8225c62b9f8980ea72a558
TLSH
T1FD014925F0F9D423F5332CCB422DAE522CF8369E9C5CAA991218461CBB54C319D698E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1096-0-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/1096-7-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/1444-81-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Download

memory/5472-36-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/5472-23-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/5512-76-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download