5ecbe86789849353ccfc1cee1a34adc95cf4a7ed91f214cf39ab8a4c12211cec

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
Size 10.6MB
Sample260831-hya6gsen8x
SHA256 5ecbe86789849353ccfc1cee1a34adc95cf4a7ed91f214cf39ab8a4c12211cec
MD5 a73b014a009e575b60ebb2fb90152612
SHA1 1e77fbac206821dfa8c03db5fd97b33c8c38c5f3
SHA512 3205d151f9cae159f404c0dcd1d81285b10bc14f62324084f146c290a60e4752f3fa7de85027d878b3149187c272761be6c5e888d97e71c540fcb5d31d1a0b70
SSDEEP 49152:U+ES+ES+ES+EA92+ES+ES+ES+ES+EAh+ES+EI+ER+ES+ES+ES+ES+EAh+ES+EI+e:eDAAA61MbQ9yDAD7KjjqkusjmqMh
TLSH
T1A2B64A29EAA480F1E86B947459A7C27EEA717A10C4234F5BC995CECFFFB36514C18231
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3868	svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe
2696	svchost_CBCBAACBCACCCBBCBABAACBCBCBCBABAABBCCAABACCACCCBABCBCBB.exe
4912	svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBBCCAACCBABBCAAAAAACBCBACBBBBAACACCCBBBCBBACBACBABABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBAACBCACCCBBCBABAACBCBCBCBABAABBCCAABACCACCCBABCBCBB.exe"	svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACABBABACAACABCBCBCACABCBCBACAACBAAAABBACBCAAACCCABBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe"	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5852	sc.exe
1968	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1740	cmd.exe
8	cmd.exe
4804	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBAACBCACCCBBCBABAACBCBCBCBABAABBCCAABACCACCCBABCBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2148	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1864	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
1864	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
1864	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
1864	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
3868	svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe
3868	svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe
3868	svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe
3868	svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe
2696	svchost_CBCBAACBCACCCBBCBABAACBCBCBCBABAABBCCAABACCACCCBABCBCBB.exe
2696	svchost_CBCBAACBCACCCBBCBABAACBCBCBCBABAABBCCAABACCACCCBABCBCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1864	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3868	svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe
Token: SeDebugPrivilege	2696	svchost_CBCBAACBCACCCBBCBABAACBCBCBCBABAABBCCAABACCACCCBABCBCBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1740	1864	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe	91
PID 1740 wrote to memory of 2148	1740	cmd.exe	93
PID 3868 wrote to memory of 4740	3868	svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe	94
PID 1864 wrote to memory of 8	1864	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe	97
PID 8 wrote to memory of 5852	8	cmd.exe	99
PID 1864 wrote to memory of 4804	1864	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe	100
PID 4804 wrote to memory of 1968	4804	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCCBAAABAABABCBAABBBBABBACACAAAAAACBCABBBCAABABCCCABBBABCCBACABCBBBABBCAAACBCBCBCACBBABABBCABABBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCCBAAABAABABCBAABBBBABBACACAAAAAACBCABBBCAABABCCCABBBABCCBACABCBBBABBCAAACBCBCBCACBBABABBCABABBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABCBBABAABABACCBAAAABBABCBCACBBBCCBBCBBCBCABACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe" start= auto displayName= "UserDataSvc_BBABCBBABAABABACCBAAAABBABCBCACBBBCCBBCBBCBCABACACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABCBBABAABABACCBAAAABBABCBCACBBBCCBBCBBCBCABACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe" start= auto displayName= "UserDataSvc_BBABCBBABAABABACCBAAAABBABCBCACBBBCCBBCBBCBCABACACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABCBBABAABABACCBAAAABBABCBCACBBBCCBBCBBCBCABACACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABCBBABAABABACCBAAAABBABCBCACBBBCCBBCBBCBCABACACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1968

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4740

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACBCACCCBBCBABAACBCBCBCBABAABBCCAABACCACCCBABCBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACBCACCCBBCBABAACBCBCBCBABAABBCCAABACCACCCBABCBCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe
1⤵
- Executes dropped EXE
PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9c8f84860acd5bf32c4f9cb0beab9a2bfb757a09c1f6dcfe1e6871ad706602e8
MD5 a315c7dfda8408762837b9ec7dc77cf6
SHA1 6b45f3d7c9e16d8424f3b6621446dc0ce62e828c
SHA512 f6206b818de88edb540c079784ad4300bd4901b35301ec001a7c347781cd3392a664b95aea0d117060259d06321a314a9bddfc5016d06f75120613c8911a3b1b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 16dab6a25bf44757e5fadb9583e7ad7e286a94b9c2616734b029366171a8e474
MD5 2bb7a86e6f3aafb7a950d964e880b994
SHA1 923ec09d934cd1fc5c91d860ad7bfc6df44601f3
SHA512 b2d1807f415c61711a09465209f8163a85867739342e46675b867b3f7f3a0b78cfe1f82962614f1a6bf92eb68ffbb00657f7761aba654f564a085661e13887b9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 056a7cadadb47d9258becc658155cbe8c97ba90ba3ac3befcb6e91e179e53271
MD5 943d3ebaa68cabbf351e004b88fa32a2
SHA1 cac40f21e93aaa399d62677d59a91224cfeb91fe
SHA512 86cc884f66c2d6f2554f75a56daa37d6f7bccaaf9db01fe21a4e10d2b8bf443ea112d945d9b5bb2c29d293d61bde386a9aa83c8bc52d0de92d78e9f692f1f2e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5973f51e6119d0c06800be9911422d7b0cbc95fed13bae9d156bd7a1dfe5a768
MD5 5709c38ab73a35cda5a528e9c446d8d7
SHA1 05651dd623ea9d7971010fbb5e110484fa28551c
SHA512 abb3ff08bed0a914f880dd0439eea50d8d6faf3cecf8c454dff49f828c258fba50b14dfefc2e3c5f1528eec51a13f8ef3f396444aafaa1fb6b2f2693d301260d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 28883fd615ea87bbe6e372460c69be1bf1d7770f7a72930a66fc5ab8421b8aa9
MD5 5d23529a57d45518c8c49ce4a6aa3e79
SHA1 87abae65704de25f7b6d48a610af3ea2188d62b6
SHA512 7109ef8c44c3eea45fbe94867e95a80a3af30dda8573bcf4a2343e72357e08f7b671d66fee0c66b031027fd247006fea3ecea8ab3c54e96471654d514899cde0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b435e1140719796adc1d04fe8e4aa341d4dff312f3c29bf9342e6b01f3f92d0e
MD5 59a2eb0fd3796362938760e2f4e2621a
SHA1 12c721b9d6fdc3319bd3912b5df62825f400c112
SHA512 85463df263d27fc23730d7b3f1ea1610ff1a8f26468d89a69ad708e2743d5a7127429bfcea239c6940ca1ab014db8f0dd9c11c5a86d00dbd4027f5a2b09bb83d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d33378014d151f06b5626b5f72da409ad10bf5e4418ae7ea808e3ba2200dfa7e
MD5 581bfa34832a93ea32c07b0ad07ef565
SHA1 0ad0a6cb6ae24143979c7e01006c5645e2f3ccde
SHA512 f6324d50c3fa1cb24383ffdc7d5bb1502684de60fece76365e092bb2269e25f95f1617bcaf88ee25d71b8335ff5e5142301e9cbfce5d9a71908b631c34aabee3
MD5 SHA1 SHA512

Submit Download

svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAAACBBCCBBCBCCABABCABCACAABABBABCACCABBBBACACACBCAC.exe
Size 10.6MB
SHA256 5ecbe86789849353ccfc1cee1a34adc95cf4a7ed91f214cf39ab8a4c12211cec
MD5 a73b014a009e575b60ebb2fb90152612
SHA1 1e77fbac206821dfa8c03db5fd97b33c8c38c5f3
SHA512 3205d151f9cae159f404c0dcd1d81285b10bc14f62324084f146c290a60e4752f3fa7de85027d878b3149187c272761be6c5e888d97e71c540fcb5d31d1a0b70
SSDEEP 49152:U+ES+ES+ES+EA92+ES+ES+ES+ES+EAh+ES+EI+ER+ES+ES+ES+ES+EAh+ES+EI+e:eDAAA61MbQ9yDAD7KjjqkusjmqMh
TLSH
T1A2B64A29EAA480F1E86B947459A7C27EEA717A10C4234F5BC995CECFFFB36514C18231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 81fc2fa5978a79251a6067eba66fe42f3f3cd50ffb9ec9f28e96cb1305991c86
MD5 c7b7e94e24a3696503d53f73f6444472
SHA1 09aff9b167f143360b9421824a84b1e703237276
SHA512 b052bedab3d8d0757ada73dc1fa9a47e0c9a14b400a8649882f05ffb7182a525a088723c85fd8205371203fb99c150fc2892a95139ef482c13697e8ce0545ada
TLSH
T196112761E0F5886BF533A4CBD635E9EB0CA676CB5C786A04231D8118A7EDC344F194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1864-8-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/1864-0-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/2696-64-0x0000000000B10000-0x0000000000B31000-memory.dmp

Download

memory/3868-34-0x0000000000550000-0x0000000000571000-memory.dmp

Download