427ac4859c559f8879cd484d52ea31014b3de8f80030e91c2c41eaad2a010e6f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_82fd78afb53f5e4041fbb33caf0c61fa_amadey_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Size 23.9MB
Sample260907-saqldayglc
SHA256 427ac4859c559f8879cd484d52ea31014b3de8f80030e91c2c41eaad2a010e6f
MD5 82fd78afb53f5e4041fbb33caf0c61fa
SHA1 ca06fe46a232979f4ffe194e140326608634099b
SHA512 c1aa66d38a3d9c6c279fd58f7780377d149aaceaaf233f9c3a0a0a920df1f7acbe537ebc3a41fb3152d6da87ea5e8197c5cfdacfab9560e8c98e80f21fc0cec2
SSDEEP 393216:25y5O5y5O5y5O5y5O5y5O5y5O5y5O568Kwekyu:25y5O5y5O5y5O5y5O5y5O5y5O5y5O54w
TLSH
T125475C58BBE951D1F9B7857488A782B6ED317C204F3193AF5680F22D5E336C09D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1544	svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe
460	svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe
2128	svchost_BCABBAAAAAAAACCABACCCCBAABBACACACAAAABBCACBCCACCBAAACBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AABCBCACBBACABCBCBCACCBAACCCCBAAABAABCBBAACBCBACBBACCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe"	2026-09-05_82fd78afb53f5e4041fbb33caf0c61fa_amadey_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBABBCCAABCACABABCABCABBACBABACABABBCAAAAACCBACBACABCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABBAAAAAAAACCABACCCCBAABBACACACAAAABBCACBCCACCBAAACBC.exe"	svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4252	sc.exe
3880	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1584	cmd.exe
3640	cmd.exe
3748	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_82fd78afb53f5e4041fbb33caf0c61fa_amadey_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2524	2026-09-05_82fd78afb53f5e4041fbb33caf0c61fa_amadey_elex_glassworm_icedid_njrat_vidar_wannacry.exe
2524	2026-09-05_82fd78afb53f5e4041fbb33caf0c61fa_amadey_elex_glassworm_icedid_njrat_vidar_wannacry.exe
2524	2026-09-05_82fd78afb53f5e4041fbb33caf0c61fa_amadey_elex_glassworm_icedid_njrat_vidar_wannacry.exe
2524	2026-09-05_82fd78afb53f5e4041fbb33caf0c61fa_amadey_elex_glassworm_icedid_njrat_vidar_wannacry.exe
1544	svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe
1544	svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe
1544	svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe
1544	svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2524	2026-09-05_82fd78afb53f5e4041fbb33caf0c61fa_amadey_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Token: SeDebugPrivilege	1544	svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3584	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1584	2524	2026-09-05_82fd78afb53f5e4041fbb33caf0c61fa_amadey_elex_glassworm_icedid_njrat_vidar_wannacry.exe	97
PID 1584 wrote to memory of 4568	1584	cmd.exe	99
PID 1544 wrote to memory of 1412	1544	svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe	100
PID 1412 wrote to memory of 2096	1412	notepad.exe	101
PID 2524 wrote to memory of 3640	2524	2026-09-05_82fd78afb53f5e4041fbb33caf0c61fa_amadey_elex_glassworm_icedid_njrat_vidar_wannacry.exe	103
PID 3640 wrote to memory of 4252	3640	cmd.exe	105
PID 2524 wrote to memory of 3748	2524	2026-09-05_82fd78afb53f5e4041fbb33caf0c61fa_amadey_elex_glassworm_icedid_njrat_vidar_wannacry.exe	106
PID 3748 wrote to memory of 3880	3748	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-05_82fd78afb53f5e4041fbb33caf0c61fa_amadey_elex_glassworm_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_82fd78afb53f5e4041fbb33caf0c61fa_amadey_elex_glassworm_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCBBABACBBAABCBBCABCAAACBCCACACCCABCBBACBBCBCCABCBCCAACABAACCACACBBACBBCAABAAABCCAABCBCBBBBBBCCBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCBBABACBBAABCBBCABCAAACBCCACACCCABCBBACBBCBCCABCBCCAACABAACCACACBBACBBCAABAAABCCAABCBCBBBBBBCCBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAACBBBACBBBCCABBABCABBCBAACAACAAAABBCCCBBBCCCBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe" start= auto displayName= "UserDataSvc_CBAACBBBACBBBCCABBABCABBCBAACAACAAAABBCCCBBBCCCBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAACBBBACBBBCCABBABCABBCBAACAACAAAABBCCCBBBCCCBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe" start= auto displayName= "UserDataSvc_CBAACBBBACBBBCCABBABCABBCBAACAACAAAABBCCCBBBCCCBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAACBBBACBBBCCABBABCABBCBAACAACAAAABBCCCBBBCCCBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAACBBBACBBBCCABBABCABBCBAACAACAAAABBCCCBBBCCCBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2096

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3584

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe
1⤵
- Executes dropped EXE
PID:460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBAAAAAAAACCABACCCCBAABBACACACAAAABBCACBCCACCBAAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBAAAAAAAACCABACCCCBAABBACACACAAAABBCACBCCACCBAAACBC.exe
1⤵
- Executes dropped EXE
PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 32a0b0346f94b61e78c8ef0316d01fa38d4f6d1e62a648c10b81a8b920cf82db
MD5 d2e8c4245698d0d3f6e9d2e86eb9f204
SHA1 48201adb98865fe3c058e8d2dffae3248f2e8fcb
SHA512 0ae48147f2830a29927c3e87d1875f62be84a89030f15b003c5c452a94adddc968a40efa85fe020f5a8f3b193ee51fa281d711c89bc39f1ed04b9f9f1c4c154c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 da1ac005141c04c05fe925d55ee2da30169df7ff2ec3f77d87c1c6221ef3495c
MD5 08de3685a51fda8985eb507062a68874
SHA1 37ad36967e9d46de461e2f5c95d5a621cb539aba
SHA512 c9d06fc86205478ba40edee0b4b924b3e57d4950d25713c6418d2f29a9db0ca1858f1bc6715602c7f5d090d049452bdcd26f64609390413508a63f0574e70304
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 38e54de976e45b12598d13cef9d28d6a244a60b601c7508f213bfcbcd7feebd0
MD5 b6741c3f45505e7c06b3aa5aa2998da2
SHA1 b38af720c6fff9183f2119d119f433f1c3be9516
SHA512 dff3b1fab2934cf747af6287ca3808d53f15dbb8ce09a368788cb79d99d626987fae7eeb504a1bc8c7f823fc268ded3347b9da50acf9dfce451a2f86253330d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 29858d1c1b180afe79eba55ec58556932b11118f529bc59d6d385fae78a733b6
MD5 0bf913d27b0b144ad591598305a1a0c4
SHA1 4ba62aaf43b088bd58e0d0d046fe6b3ad2f16c36
SHA512 e9eb22db70bdd68ba1d5becea5f1847fae62edc8b1b86c43d57e250133d9c61aeeaf6de4e09ea3c19e366da4bd3aceaf07bfa8395a1a682a8d284e5072473481
MD5 SHA1 SHA512

Submit Download

svchost_BCABBAAAAAAAACCABACCCCBAABBACACACAAAABBCACBCCACCBAAACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBAAAAAAAACCABACCCCBAABBACACACAAAABBCACBCCACCBAAACBC.exe
Size 197KB
SHA256 0cde5cb36fff3a642dafa7c4f46555aa736b0d7db1763edb879bdb3bd228dbf0
MD5 58689248bbe2e1123f8c29bc1962602b
SHA1 17e2b9adf6d5260eec8baca56872cc40bbbd72c0
SHA512 33e261e7a3b1b0571c9438114c00d66fdbf6f59acb478c1f7289374e375b1cf3a91971f229b35ace6bfd3d5ad4a42571007b34463f2f81900c97e73a8a888b1b
SSDEEP 6144:m+dTTUFgEs3XojAdpofOiYlrOF7ojDuUlMtq10Qo:mgUFgEsnojAD+BeDuUlEqar
TLSH
T111143944FE86C4A2D87601704C9BC3FA6531BD218F028BEBB685B37F6E336D06535A59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BCABBAAAAAAAACCABACCCCBAABBACACACAAAABBCACBCCACCBAAACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBAAAAAAAACCABACCCCBAABBACACACAAAABBCACBCCACCBAAACBC.exe
Size 896KB
SHA256 7d296074d626762dbe814659bacb398088e3ecd6e6cb5fa207589b34bdd5022a
MD5 380704fa568bbea1dfddb3c6c7d0dc1c
SHA1 b39a9fe16644e01557c0ed3b491e07de02845d8c
SHA512 6d4dc6bb69e82d8a2e2181ecb032ea495d21812bf8ad469d7189149845e629e150dbbb94076310b06fd9113e0eff389aa7b64a5ae0b7fed9a604d87aac0c2f83
SSDEEP 24576:m9+EM0GExqatgl+U49+EM0GRrCn5y9+EM0Gf:U+E3qatgl+p+EeC5g+EC
TLSH
T119153B5CB7EA1151FAB3567088AAC2F65D317C204B3097EF6640F32D5E32AD0E939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe
Size 23.9MB
SHA256 427ac4859c559f8879cd484d52ea31014b3de8f80030e91c2c41eaad2a010e6f
MD5 82fd78afb53f5e4041fbb33caf0c61fa
SHA1 ca06fe46a232979f4ffe194e140326608634099b
SHA512 c1aa66d38a3d9c6c279fd58f7780377d149aaceaaf233f9c3a0a0a920df1f7acbe537ebc3a41fb3152d6da87ea5e8197c5cfdacfab9560e8c98e80f21fc0cec2
SSDEEP 393216:25y5O5y5O5y5O5y5O5y5O5y5O5y5O568Kwekyu:25y5O5y5O5y5O5y5O5y5O5y5O5y5O54w
TLSH
T125475C58BBE951D1F9B7857488A782B6ED317C204F3193AF5680F22D5E336C09D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACACAABBBCCABBCCCAAACBCBBBCBBBABCCAACCABACBCAABCBABCA.exe
Size 20.8MB
SHA256 7139fce8077535c0f357e7db3740680dfea058b1f08430d71423791d5f640cf2
MD5 c9a9059f803e65eb438067d575ee74ae
SHA1 613e447671a90d821e522e85ceba3b649f41e6fd
SHA512 fa7b0dbb96dfc065aaafde0325d3710d8a4f9330ea43decac44231e09f22ef2996c9714775a69da20acc873b520fb9358c4585e3bff64be7a0090353be91a8d9
SSDEEP 393216:25y5O5y5O5y5O5y5O5y5O5y5O5y5O568KwY:25y5O5y5O5y5O5y5O5y5O5y5O5y5O54N
TLSH
T1D3275C49B7E95151E577827088AAC2B6EE717C204F3097EF6680F32E1F336D09939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1412-61-0x00000000054B0000-0x00000000054B1000-memory.dmp

Download

memory/1544-27-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/1544-40-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/2524-0-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/2524-8-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download