bee5ad3897149e75f9443f3d250a9a898fc54279a604bff3437dc8c11423ea7d

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_ce19920ca043f5807f2907cd6f0ab598_amadey_elex_glassworm_icedid_njrat_vidar.exe
Size 22.5MB
Sample260910-mg6naa1gnd
SHA256 bee5ad3897149e75f9443f3d250a9a898fc54279a604bff3437dc8c11423ea7d
MD5 ce19920ca043f5807f2907cd6f0ab598
SHA1 71f59800c754b742edad2e55e7f0e81c97b89822
SHA512 773fa20e3ab423df370b9b06802a0a0e1c050a70c44f95b257678d3423ec625a0e8bda580d960d9754134d2fe92fa4106e20713c08bb9bc22e78122ac4a08011
SSDEEP 98304:8HADADHADAD3KRuy5aiHADADHADAD3KRuy5aiHADADHADAD3KRuy5aB:9EUEbqUEUEbqUEUEbqg
TLSH
T169376D46FA4344F2D92B017148CBD3BB8B70BA114B128EABE748876F6E33BD06935755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3484	svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe
2536	svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe
1300	svchost_CCBABBBABCABCCACAAAAACACACBCCCCAABABAABCCABCBCCACCBBBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACBBBCACABCCACACAAACAACBACBBCBBBBBCAACABBBAAACACBBCBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe"	2026-09-10_ce19920ca043f5807f2907cd6f0ab598_amadey_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACCACBCACBABCABABABCBCABACCACABCBABAABABABBBCBABBABCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBABBBABCABCCACAAAAACACACBCCCCAABABAABCCABCBCCACCBBBAB.exe"	svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2680	sc.exe
4088	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5228	cmd.exe
6084	cmd.exe
1972	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_ce19920ca043f5807f2907cd6f0ab598_amadey_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBABBBABCABCCACAAAAACACACBCCCCAABABAABCCABCBCCACCBBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4632	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4824	2026-09-10_ce19920ca043f5807f2907cd6f0ab598_amadey_elex_glassworm_icedid_njrat_vidar.exe
4824	2026-09-10_ce19920ca043f5807f2907cd6f0ab598_amadey_elex_glassworm_icedid_njrat_vidar.exe
4824	2026-09-10_ce19920ca043f5807f2907cd6f0ab598_amadey_elex_glassworm_icedid_njrat_vidar.exe
4824	2026-09-10_ce19920ca043f5807f2907cd6f0ab598_amadey_elex_glassworm_icedid_njrat_vidar.exe
3484	svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe
3484	svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe
3484	svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe
3484	svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe
1300	svchost_CCBABBBABCABCCACAAAAACACACBCCCCAABABAABCCABCBCCACCBBBAB.exe
1300	svchost_CCBABBBABCABCCACAAAAACACACBCCCCAABABAABCCABCBCCACCBBBAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	2026-09-10_ce19920ca043f5807f2907cd6f0ab598_amadey_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3484	svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe
Token: SeDebugPrivilege	1300	svchost_CCBABBBABCABCCACAAAAACACACBCCCCAABABAABCCABCBCCACCBBBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 5228	4824	2026-09-10_ce19920ca043f5807f2907cd6f0ab598_amadey_elex_glassworm_icedid_njrat_vidar.exe	92
PID 5228 wrote to memory of 4632	5228	cmd.exe	94
PID 4824 wrote to memory of 6084	4824	2026-09-10_ce19920ca043f5807f2907cd6f0ab598_amadey_elex_glassworm_icedid_njrat_vidar.exe	95
PID 6084 wrote to memory of 2680	6084	cmd.exe	97
PID 4824 wrote to memory of 1972	4824	2026-09-10_ce19920ca043f5807f2907cd6f0ab598_amadey_elex_glassworm_icedid_njrat_vidar.exe	98
PID 1972 wrote to memory of 4088	1972	cmd.exe	100
PID 3484 wrote to memory of 6012	3484	svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-10_ce19920ca043f5807f2907cd6f0ab598_amadey_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_ce19920ca043f5807f2907cd6f0ab598_amadey_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAABABACABCABCCBBACACCBCCBBBBCBBCCBCAABACACBCCCAACBBACAACCACBBBCCCCABBACABACBCBABBABBBACACACAABABCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAABABACABCABCCBBACACCBCCBBBBCBBCCBCAABACACBCCCAACBBACAACCACBBBCCCCABBACABACBCBABBABBBACACACAABABCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBCACCBBCBBBBABBACACBBCBABBCCBAAABCCCAABCBCBCBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe" start= auto displayName= "UserDataSvc_ABCBCACCBBCBBBBABBACACBBCBABBCCBAAABCCCAABCBCBCBBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6084
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBCACCBBCBBBBABBACACBBCBABBCCBAAABCCCAABCBCBCBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe" start= auto displayName= "UserDataSvc_ABCBCACCBBCBBBBABBACACBBCBABBCCBAAABCCCAABCBCBCBBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBCACCBBCBBBBABBACACBBCBABBCCBAAABCCCAABCBCBCBBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBCACCBBCBBBBABBACACBBCBABBCCBAAABCCCAABCBCBCBBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6012

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe
1⤵
- Executes dropped EXE
PID:2536

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBBABCABCCACAAAAACACACBCCCCAABABAABCCABCBCCACCBBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABBBABCABCCACAAAAACACACBCCCCAABABAABCCABCBCCACCBBBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0583e468db59653b6d3b02c81c0e65d214dd67b56f03bd7aac216051b081d920
MD5 ff5326c7ec9683366bd48d35fe1c4b1f
SHA1 62f04d7913aba288b81643c8eb95fc2a2d3843b1
SHA512 3fd976738a1d3d919c92b6562bcc3261cbc24b2a4d87f71250f3a61f0bcb257af32fea4b04cdfe79a5d729cc8de282105b50673f3350c6125bd860551f55d237
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e943ea5a2fde127755c73663efee96192a51f88d4601eedd5b542779dce7dca5
MD5 69bfcf1e5fdc72181789998808ad8a45
SHA1 0273e02f9d863dc76515dbbb1a481bc63388fd26
SHA512 13680bade1f3561d1bc41b0e1ce2f0d57deec5c7c7d2c16200b9828f8f51669036c7f72ee83dbb079c1ce417326d11037595c042deb43c73394235674198e39f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 23f0d4c26e5cc2f328062c4162ec57d63476ff514d2c6ea6ea4d713a07406e15
MD5 52c97f8dfb3ea7250def190bdb4b9a88
SHA1 442b66e9c1be76896062d58225eb6abe6646d267
SHA512 0b946fb6881fdb9743dbfaa4f1e7ed25cdb0ad30f9cccc634e1b80783780a798f03a09c2460938ce382962f9ccaae8626624d01ca492b73970b48e31d30b7234
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6afa515ba59cd6d9d081b3a7959e59a24796027f7275bb828b118621cfcdbe1
MD5 28a9c9a8079425198e92147f394f7502
SHA1 bb1cde162cf00e00e4d764eb8df87ee99186a314
SHA512 a75c5c394527f4482983c7a4f0a5d6ff90ef2558076fe85e3ae91fe0f15438a0ef5633a53c4ed5d4cb1bfda87bb765ad6639fb6c362be5b802a863796047bf8c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1c8d7fc70b17d8eb9555e8a276f8ad1695937a322eb4d37828433ac4dcf45049
MD5 1024f790f498d0d7a91e82e3ee15b104
SHA1 08a57a8f61f0d415fbadfeaf75efcd22f53ab243
SHA512 e5df74481bfbb329d961bc57b03b0821730efe5624d216602ed3bad241f436651806995e6f10f39090b97377fe54bb274b5cfcd32d3ff933c662e908b6d1aedf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 561caee86f0742ea50cdc38a2fd6a6dd7907bba4c5822a07e373007989c6e34f
MD5 d2246169f95d3dfc7133f3a8d666907f
SHA1 41e748a6f049cb116f2aab850167930ba33936a0
SHA512 05b7a783ec27171824160f7ea22757a7392564a353952cf563e8cdb307871ffca49a44a6ab6f1394d6e80afe74351ba994576ad6bbd673d0f8ae73f88cbb24b9
MD5 SHA1 SHA512

Submit Download

svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBABAABBCCAABCCCABABBABBCBABBCCCCBAAAAAABABAABBBBBBBB.exe
Size 22.5MB
SHA256 bee5ad3897149e75f9443f3d250a9a898fc54279a604bff3437dc8c11423ea7d
MD5 ce19920ca043f5807f2907cd6f0ab598
SHA1 71f59800c754b742edad2e55e7f0e81c97b89822
SHA512 773fa20e3ab423df370b9b06802a0a0e1c050a70c44f95b257678d3423ec625a0e8bda580d960d9754134d2fe92fa4106e20713c08bb9bc22e78122ac4a08011
SSDEEP 98304:8HADADHADAD3KRuy5aiHADADHADAD3KRuy5aiHADADHADAD3KRuy5aB:9EUEbqUEUEbqUEUEbqg
TLSH
T169376D46FA4344F2D92B017148CBD3BB8B70BA114B128EABE748876F6E33BD06935755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a06c2860b6de43ef63134cb235d82317b4621c73f0ced409412f73272d7f5248
MD5 0db1710dc42d1fd759397819d1d3870f
SHA1 9ac08f1d71ee01afb84697b0c6aa7a3e318003b7
SHA512 6f9fbf4c279f8ebe6bea0991c0a61eade9b38ac39fda9136f2533bb94910b5f2b3c3bc3da8cd5db5a35131955427727ef8645cdaf89ebdeed11ff22367dfa531
TLSH
T1AE11A7B1E0A5E457F0722887662DDB860DA837ABEC6CAB64230A412DE759E348D154F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2536-64-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download

memory/3484-22-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download

memory/3484-35-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download

memory/4824-6-0x00000000001F0000-0x0000000000211000-memory.dmp

Download