c27c8be10fee8f9c7ebc58f4c2fc9cf263ede2de387ee0c8623208d308949ada

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_1074863083c50ea9e875d0312d002b0e_amadey_elex_glassworm_icedid_njrat_vidar.exe
Size 9.2MB
Sample260830-1l3zvasxes
SHA256 c27c8be10fee8f9c7ebc58f4c2fc9cf263ede2de387ee0c8623208d308949ada
MD5 1074863083c50ea9e875d0312d002b0e
SHA1 1cbe655d26ef6df32fe71b5b656039a2355f8f9c
SHA512 cd98d297528176c25eb36d67c5dab7523c43d8e636a10349ee4055bd17447b367dfdf0da382468a51d54b236d70a3c12ccc4d37332b21af0775b00e40ec88940
SSDEEP 98304:6W1PszYW1PszY1MbQ9yDAD7KjjqkusjmqMhV:/xslxs81tIDewjqkjiqMj
TLSH
T1DCA67D29EBF481E5F9ABE838997B8671EA727A110833570F8AD4C51F6F336514D18332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5128	svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe
2812	svchost_CCCCBBABCBACACAAAABACBAACAACCBCACCCCCABCCAAACBBAABCCAAC.exe
1612	svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCBCAAAACBBCACACACAACABACBCCCACCBBBBABCABBCBAACBBAAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe"	2026-08-30_1074863083c50ea9e875d0312d002b0e_amadey_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBBACBBABABCACCCCAACACACAAABBCBAABBBABACACABCCCCCCCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCBBABCBACACAAAABACBAACAACCBCACCCCCABCCAAACBBAABCCAAC.exe"	svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3556	sc.exe
1844	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2808	cmd.exe
4600	cmd.exe
612	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCBBABCBACACAAAABACBAACAACCBCACCCCCABCCAAACBBAABCCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_1074863083c50ea9e875d0312d002b0e_amadey_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4212	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5564	2026-08-30_1074863083c50ea9e875d0312d002b0e_amadey_elex_glassworm_icedid_njrat_vidar.exe
5564	2026-08-30_1074863083c50ea9e875d0312d002b0e_amadey_elex_glassworm_icedid_njrat_vidar.exe
5564	2026-08-30_1074863083c50ea9e875d0312d002b0e_amadey_elex_glassworm_icedid_njrat_vidar.exe
5564	2026-08-30_1074863083c50ea9e875d0312d002b0e_amadey_elex_glassworm_icedid_njrat_vidar.exe
5128	svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe
5128	svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe
5128	svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe
5128	svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe
2812	svchost_CCCCBBABCBACACAAAABACBAACAACCBCACCCCCABCCAAACBBAABCCAAC.exe
2812	svchost_CCCCBBABCBACACAAAABACBAACAACCBCACCCCCABCCAAACBBAABCCAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5564	2026-08-30_1074863083c50ea9e875d0312d002b0e_amadey_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5128	svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe
Token: SeDebugPrivilege	2812	svchost_CCCCBBABCBACACAAAABACBAACAACCBCACCCCCABCCAAACBBAABCCAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 2808	5564	2026-08-30_1074863083c50ea9e875d0312d002b0e_amadey_elex_glassworm_icedid_njrat_vidar.exe	93
PID 2808 wrote to memory of 4212	2808	cmd.exe	95
PID 5128 wrote to memory of 4284	5128	svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe	96
PID 5564 wrote to memory of 4600	5564	2026-08-30_1074863083c50ea9e875d0312d002b0e_amadey_elex_glassworm_icedid_njrat_vidar.exe	99
PID 4600 wrote to memory of 3556	4600	cmd.exe	101
PID 5564 wrote to memory of 612	5564	2026-08-30_1074863083c50ea9e875d0312d002b0e_amadey_elex_glassworm_icedid_njrat_vidar.exe	102
PID 612 wrote to memory of 1844	612	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-30_1074863083c50ea9e875d0312d002b0e_amadey_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_1074863083c50ea9e875d0312d002b0e_amadey_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCABCBCCCCBAAAABCACBBAABBACABBCCBACBAACACBACAAAABACBCCABBCBBAACCCCCAACBABCBCCCAACCABBBCCCCCBCBCAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCABCBCCCCBAAAABCACBBAABBACABBCCBACBAACACBACAAAABACBCCABBCBBAACCCCCAACBABCBCCCAACCABBBCCCCCBCBCAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBBAABCCCCCBABACBCCACBBABBCACAACCBAACAABAABCBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe" start= auto displayName= "UserDataSvc_AABBBAABCCCCCBABACBCCACBBABBCACAACCBAACAABAABCBCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBBAABCCCCCBABACBCCACBBABBCACAACCBAACAABAABCBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe" start= auto displayName= "UserDataSvc_AABBBAABCCCCCBABACBCCACBBABBCACAACCBAACAABAABCBCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBBAABCCCCCBABACBCCACBBABBCACAACCBAACAABAABCBCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBBAABCCCCCBABACBCCACBBABBCACAACCBAACAABAABCBCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1844

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5128
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4284

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBABCBACACAAAABACBAACAACCBCACCCCCABCCAAACBBAABCCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBABCBACACAAAABACBAACAACCBCACCCCCABCCAAACBBAABCCAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe
1⤵
- Executes dropped EXE
PID:1612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d68a1952f4ca8c3ba006fd0518e6635f4e188b6f8b05b39402b6b4b5c0555d4b
MD5 0f18a33e7c3e91d11070faad1f0ac989
SHA1 fbdb3b234e953fb011a1e3318a8986dbb5ddd1cf
SHA512 606b673e44de9e80d2fbf92ca265994e7cfcac7b7c09a719fa081413bdc2b2ef4c6a5adfec0bcaaeb4f6bddb7d839382f1d8d8068a8429ae9e34617e567fdd52
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 028af5eede3711ebfdf44d31cf311678e3ea96165e5866859a4a85f862d65cf0
MD5 64689e822f19708d82b76cfac45c147c
SHA1 e7ec05ad75bbb4b46345018aa35d65668818e8d7
SHA512 fb0da838c711d90daa5516223bf92d8d927611b0cd71a20471f01ca16009022379965b9698711753506f9fe40c2db24748ffe1ab1f375903ed6ec1da97fc239c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 30ab04486f39b67d9c5313b8e6237fa56bbe1869817bcc9229bfbb4c03bb6799
MD5 05c20bff806e1c57f7a9f8ef05cefe3f
SHA1 a1492c2982017d35cc81773a08916993e09d649f
SHA512 fe6d5542ff41aeb419601b5bf27dda17d7456ad540e343daa5f57e23203237f0390e66b7e66dee86beafaa5be537f9e0497627787d13b2caa778540cc5b89797
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b349406177085efcb95ee591335c33560eafb7f5cf4da752ea71a746bd4f4b63
MD5 42d8a398cfe2e40a4226d3a3c4b680c3
SHA1 42a8707563b62ffbebbe516577757f4067105717
SHA512 4c895ea54726fb4aabcb0b580642ddb79face09e2356bb8bcd90c532810108be811bc7c4e81011b97f7c3495d5063d2699c731c76c02ef30c87b183abd9601c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1939b405a70360405c5513412a4a4556833b1808a118d662d882212439ef29f5
MD5 037d77a6a8812a2828ec30caf3479fd4
SHA1 6bd8a2f84f8248726d40bab6a8ec2c1d0cdc6a12
SHA512 4cb48dd59836db7704526ef946850bd7c74e5ccf1c66c25ad63b926a46267ac86f0a2babb620fd8ce70c5c928fd2ae6a27aa74a348266f9ea61a4c61bc58f11a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2a98c7cb0a18c311e739dc2342c993dd56241c70aa91cc9797eb966ff975e283
MD5 4711348c44ac11a37cd3b5fcc5407507
SHA1 6a728ef9ef1e4bdb23bcf2dbbaa47cd4868eaeeb
SHA512 a30e32ba1b6dc2ed832d7257fc5cc08f213b4022addc1aa3db4ad668564ed345a7af4e3774a8c622ef5a71a0503a026197b87a79a940bc835c7451fb400ea073
MD5 SHA1 SHA512

Submit Download

svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABBABACBAACCCAACBCBAACBCBCBAAAACBAABBAACBABBBAAAAC.exe
Size 9.2MB
SHA256 c27c8be10fee8f9c7ebc58f4c2fc9cf263ede2de387ee0c8623208d308949ada
MD5 1074863083c50ea9e875d0312d002b0e
SHA1 1cbe655d26ef6df32fe71b5b656039a2355f8f9c
SHA512 cd98d297528176c25eb36d67c5dab7523c43d8e636a10349ee4055bd17447b367dfdf0da382468a51d54b236d70a3c12ccc4d37332b21af0775b00e40ec88940
SSDEEP 98304:6W1PszYW1PszY1MbQ9yDAD7KjjqkusjmqMhV:/xslxs81tIDewjqkjiqMj
TLSH
T1DCA67D29EBF481E5F9ABE838997B8671EA727A110833570F8AD4C51F6F336514D18332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3e582b4837b2a1ff03fb3f2ffb727c7dc4663bb30a520bdc6d0b3b70fa66d772
MD5 453753b9908999765eb2e7876f41617c
SHA1 5772d6b88cd8a679a4c92690d6e67e00c6bc0f94
SHA512 f40ad9a23244768bee97a75b292e47348c526aac3b15b54236a229fef9a3962ddfc8db991b95af63a977db5065b18fda4217781dd27be75ff1ffe2b1a2f43a44
TLSH
T133110892D0EADC73F43328EF41259E974DD0325FAC5CAA8423094218A7C98318F5D8B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2812-79-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/5128-32-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download

memory/5564-0-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/5564-8-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download