1e76070a0ce358cc36528831c091fb94747c96091bc4d03d0a115f301161bc76

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
Size 22.4MB
Sample260910-wc2m7stbmc
SHA256 1e76070a0ce358cc36528831c091fb94747c96091bc4d03d0a115f301161bc76
MD5 3eeea411af6af403f87187a02c6a0ddc
SHA1 9f6bd1a1983b5938422a38043e86a68ba7b1e864
SHA512 d24e9e3df48eb78f7d2c48eb932a0b41f44852f0dc280a0e5ec94ff3b5eb86a6944ad0ee9d4c900970a6e8e0502fafcc71fd2b681dfa825cb3f374fd2f67b1ee
SSDEEP 196608:kxsmxs81tIDewjqkjiqM7xsmxs81tIDewjqkjiqMd:W8KwekyZ8Kwekyd
TLSH
T1A2377D29EBA480E1F9BB9438997BC276EA727A100933575FCAD4C61F6F336514C28731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2392	svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe
2136	svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe
4444	svchost_BCBCABBABCBAABAABCACACBCCBCCBCCBCCCABACCAAACABCCAABBBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBACACCCBBABCCBBBACCCACABCABACCCBCCBCCABACCCAABABBACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe"	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBABAABCCAAABBABABCCAAAABACCCBAAAABABCCAACCBCCCCABABCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCABBABCBAABAABCACACBCCBCCBCCBCCCABACCAAACABCCAABBBAA.exe"	svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4348	sc.exe
6000	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2408	cmd.exe
4064	cmd.exe
3468	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCABBABCBAABAABCACACBCCBCCBCCBCCCABACCAAACABCCAABBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4300	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3116	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
3116	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
3116	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
3116	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
2392	svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe
2392	svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe
2392	svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe
2392	svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe
4444	svchost_BCBCABBABCBAABAABCACACBCCBCCBCCBCCCABACCAAACABCCAABBBAA.exe
4444	svchost_BCBCABBABCBAABAABCACACBCCBCCBCCBCCCABACCAAACABCCAABBBAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3116	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2392	svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe
Token: SeDebugPrivilege	4444	svchost_BCBCABBABCBAABAABCACACBCCBCCBCCBCCCABACCAAACABCCAABBBAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 3468	3116	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe	92
PID 3468 wrote to memory of 4300	3468	cmd.exe	94
PID 3116 wrote to memory of 2408	3116	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe	95
PID 2408 wrote to memory of 6000	2408	cmd.exe	97
PID 3116 wrote to memory of 4064	3116	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe	98
PID 4064 wrote to memory of 4348	4064	cmd.exe	100
PID 2392 wrote to memory of 2512	2392	svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCAACABCCCCCBCBACACBACACBCACACBCBBCCBAABBCBBACABACCAAACACAABBCCBACCCBCABCCBCAACCACBABABCABBBAAABCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCAACABCCCCCBCBACACBACACBCACACBCBBCCBAABBCBBACABACCAAACACAABBCCBACCCBCABCCBCAACCACBABABCABBBAAABCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABABACBACCBCABBBAAAACACACACCBACACACBCBCCAAACACBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe" start= auto displayName= "UserDataSvc_BABABACBACCBCABBBAAAACACACACCBACACACBCBCCAAACACBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABABACBACCBCABBBAAAACACACACCBACACACBCBCCAAACACBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe" start= auto displayName= "UserDataSvc_BABABACBACCBCABBBAAAACACACACCBACACACBCBCCAAACACBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABABACBACCBCABBBAAAACACACACCBACACACBCBCCAAACACBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABABACBACCBCABBBAAAACACACACCBACACACBCBCCAAACACBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2512

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe
1⤵
- Executes dropped EXE
PID:2136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABBABCBAABAABCACACBCCBCCBCCBCCCABACCAAACABCCAABBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABBABCBAABAABCACACBCCBCCBCCBCCCABACCAAACABCCAABBBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6fcda4881ae8c4d9043dbc647607483104057b44528f5ba2b9af28d1f95e9f8a
MD5 65d895427bb8eab1acc54576b2e5afe9
SHA1 68a2bbde45e8110884c70c913d7e803ff019f250
SHA512 1a2d57f7cd5297c6fc781c4aaad6a1e3359e9abc5f4e8f86bf836496e3675b540a02b9e8314d324df250552e2119ca777d7231d9acdaa5a76095aa4540c8ae1d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 750ecb807afd120dc2deeb4ac2346a0122d6a99cd543e964e58980152bb99d6d
MD5 f37f5e3d2f8e92030c4792abbe9565b8
SHA1 b5ae461a40315746ab6c4098f5d23f9090792406
SHA512 f928ddc98290cb8772f74973662a9589cde94eefc48c586d6e475bdb10b92e47ef770980296450f3e3f82e65af18b0a3e2b62b4fb82e05e10b78ec34010782a1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dea572a395e4d17e1afb6f19aa21e123e0941481e281e73e5fa201f2d38437a5
MD5 b43e713a564862967ab36fdc82b333f6
SHA1 b9190f3758d92d9441127e8b5498bba300e3e0ac
SHA512 32986b7aca736dedb5f339ab70100ab227baab83272dd594096237e89ecc1fedf3f070e57132fab43b9dd0df92de4cf035094f482022b86bc8f35235d85ae2bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 deea8032989f7ba590f06ad860b1932bdcf835f08806ca251f8b3152125b441f
MD5 b8a491b20d971aa8b0fcb1935518d58a
SHA1 cbf6148a34f0973321ad0886aec8a92cb03d7251
SHA512 60d7cf1a94db581e960c22b32d2a4787670de3adb8b13324f286085279c529e43d7af9c8541aa50acec46d758ce8692cc6d2e2b51d4e7234f91a21fc5de5cd3b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5e1577bce63ee6d5adfbaf6fd2357bc55f2f248902a68329e7472d3c64723db7
MD5 d631d1bdf9084afb771d458f9c47d399
SHA1 3f60c87b6921a1f930b56fdbf0a24cdfadb73193
SHA512 313822da38f42464906b5d1b09cb0750f12217272f12638d4529a4c013f85e789e791b152187c2a825d604213b3e7eeabeaa7aa30d9c5c88619e2ff3f21632fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e147a69246957c0f4b7e268dbcc414d4e9d53aebfff69eb032015ba2c44796e5
MD5 443a2af775fbe17bb85c5553dfdf44c9
SHA1 03c9b489202cdfb76489b3bb794ebd320b12f446
SHA512 b9c28d365868b955e5e25bbc8f051a618df5caf1df8d1d05bfd09c2ee78de288d02283691a40a4e0b04cfd8ddc244f5775604e356384273d812a12a8dbe8e55f
MD5 SHA1 SHA512

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 2.6MB
SHA256 c9702eaff6307f898f8cd26ba5b31538111670975273b22ea7e3ada0dd2d74da
MD5 23f264fec3e85de4a38a56246440a150
SHA1 8e19e8cb3a64292617f21474e1b744a00dd16eba
SHA512 d90a208f94225b832f87734b79f1fc32aa24470c942df86e37944d2f708c6422a403eed4b8528d7a66423d50f3ede17bd157e3c2e1a54f6bc331a0caf49a96a4
SSDEEP 49152:U+ES+ES+Epwth+E2+ES+ES+EpwtR+E2+ES+ES+Eph+EMW1PszNsQy+ES+ES+EC:hW1Psz/
TLSH
T19CC58E06F68700B1E97714704D9BD2BE4A317E2186318EEFE78CDA2F6A33B915834756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCCCBBAACBAAACACACCACCACBBBAACBBCBACBCBCCAAAAACCC.exe
Size 22.4MB
SHA256 1e76070a0ce358cc36528831c091fb94747c96091bc4d03d0a115f301161bc76
MD5 3eeea411af6af403f87187a02c6a0ddc
SHA1 9f6bd1a1983b5938422a38043e86a68ba7b1e864
SHA512 d24e9e3df48eb78f7d2c48eb932a0b41f44852f0dc280a0e5ec94ff3b5eb86a6944ad0ee9d4c900970a6e8e0502fafcc71fd2b681dfa825cb3f374fd2f67b1ee
SSDEEP 196608:kxsmxs81tIDewjqkjiqM7xsmxs81tIDewjqkjiqMd:W8KwekyZ8Kwekyd
TLSH
T1A2377D29EBA480E1F9BB9438997BC276EA727A100933575FCAD4C61F6F336514C28731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b9d8992967f6bd76a48ecc436fb845e324da608d3d617ace96b267d2e621c0f4
MD5 4d7c2d41a4dbdded3c42ddfb5f60cab6
SHA1 e20ecff5c19b0204ebff75dfcec892210c168aeb
SHA512 3a390a442a5eec07503157ea3080591ba4471c5ccc9debace40deb41fe0a9f3b577c1d1ea6a22c51ceb558395e6cd539e8f0f949b1a4b8a9b4124e22c4b928ce
TLSH
T129110A51F0A5DC57F57128CB6129DF570CE077AF589CAB14230D8128F719D368D258F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2136-86-0x0000000000940000-0x0000000000961000-memory.dmp

Download

memory/2392-71-0x0000000000940000-0x0000000000961000-memory.dmp

Download

memory/2392-50-0x0000000000940000-0x0000000000961000-memory.dmp

Download

memory/2392-32-0x0000000000940000-0x0000000000961000-memory.dmp

Download

memory/2392-110-0x0000000000940000-0x0000000000961000-memory.dmp

Download

memory/3116-21-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/3116-59-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/3116-83-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/3116-33-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/3116-10-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/4444-95-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download