Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 06:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe
- Size 8.0MB
- Sample260913-hn4eaagc79
- SHA256 65271f22a91c9b502c4a74dce001430d2e02cc7c92fb1520226334012e129357
- MD5 0a21209cc715dd2a5425840d68dc0cf7
- SHA1 ac1af227be52e1db72bafc874ebef94393b926c4
- SHA512 b3e6d95ffeab75585909cb3bac4eedae0cc94e54f4aff41d52fb3568f92dbf38853c4b04b921da5a7eed4ce61410a60e721f8be8693cf30fed93ec4ef2e0cba4
- SSDEEP 98304:s/vN1SERbX7PLixQeMjLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22H:6zBeGZF6bUpMBF1p/kjRm4OWi2b
- TLSH T18D8612117BE04172D1B3563589B59622A97AB8221F30D68F13D9177E0F33391AF3A72B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ctfmon.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\attrib.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\wusa.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\fc.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\findstr.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\at.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\sethc.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\sfc.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\subst.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\Dism.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\setup16.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\cmd.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\recover.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\fontview.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\makecab.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\mshta.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\printui.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.19041.1_none_58793261dd0b5f7a\grpconv.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\relog.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\r\usocoreworker.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.19041.1_none_8bf94097c23f5fb8\MDEServer.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1_none_82af78fa7992ecce\uwfmgr.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.19041.1_none_bd38794249e3d110\LockScreenContentServer.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\f\hvsiproxyapp.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_ac2441dbb712f006\f\sdchange.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1202_none_574a25a5ee347454\f\memtest.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1_none_1f29a4ae2c282494\winresume.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_fb1129caa00e000f\f\msinfo32.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_5163f0069562aff6\r\powershell.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_cdf422107d2779cf\cttunesvr.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.746_none_122a74c9827fe81a\f\IEChooser.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\ResetEngine.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2b8b5a41940eac9f\prevhost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.746_none_2c2bcd67e9d4665c\f\FileHistory.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.19041.1_none_3711e18b51638445\InetMgr6.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.1_none_b3f4f49ac9993d28\SensorDataService.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\f\PrintBrmUi.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\rwinsta.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..vercommandlinetools_31bf3856ad364e35_10.0.19041.1_none_70349c6644208282\flattemp.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1_none_6df323382219b604\PickerHost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.1202_none_05856bbd8f935e6b\DataStoreCacheDumpTool.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.84_none_d062347205e52d46\PerceptionSimulationService.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\r\recdisc.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\f\wsmprovhost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_b4441130315b5f1f\f\mmgaserver.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1_none_b0493212512a7f1a\ntprint.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_7dd23580df04442f\DWWIN.EXE 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.1_none_03831cf8d49cee55\prevhost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.19041.1_none_345cbd92bc885eba\curl.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\r\SysResetErr.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6012c8cabf808ff7\f\pcaui.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\f\FileExplorer.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3563a6b72868b6d9\wmprph.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.1151_none_15ecde7059d11b7f\wslconfig.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\f\cmdiag.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.1_none_6314a7411fa6f2ec\FXSSVC.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.19041.746_none_b0a3ebd117ec81d4\hh.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_5f22b28b2f384ed0\PATHPING.EXE 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.1_none_2eeab9eac7c3eb5c\WFS.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.19041.1_none_e7854180ca0cff60\reg.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.1_none_1776a3602eb73133\netiougc.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\wsmprovhost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1_none_b817dbd29134ec4d\GameBarPresenceWriter.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\f\mavinject.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.19041.1_none_687f28352b92068b\attrib.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.746_none_7946fb11bf19dc87\r\coredpussvr.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1_none_3c360c9e8a3e64cb\msinfo32.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.19041.746_none_61e0347e850155a8\r\UserOOBEBroker.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.746_none_8457b34a3423f6d0\resmon.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.1_none_7c69077ba55f962b\WSReset.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\r\phoneactivate.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.19041.1288_none_91a5fb477b6af5a0\r\SIHClient.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_f5ba41fece31d7fe\SpatialAudioLicenseSrv.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1_none_a639f4b392ec604e\autofmt.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_908b22903a403149\ndadmin.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-write_31bf3856ad364e35_10.0.19041.1_none_1fc88a05b0d625c5\write.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_63b0fc68ee30f2cb\f\IMESEARCH.EXE 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1_none_8298e4b5b7fd2c26\iexplore.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmcreate_31bf3856ad364e35_10.0.19041.1_none_8d387dde0a6c6d14\VMCreate.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1460
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.19041.1_none_d3e3ad84b24cfdfe\NisSrv.exe
- Size 10.8MB
- SHA256 b40482e31a7e3f21a8a78aebb2d5f6dd5bb88ea84d4884ae818ea6f447c1e08e
- MD5 96524403a88ce7a5613434e6ea88e65c
- SHA1 0620a157e1e7d88e9fc1231d83e79b1edba280ce
- SHA512 1464a97b1da4433d12ce4240438eaec509f3e6e65a01ac7520579ff1ecd3207896e9bec9a6469204991d64efa75e9f37705711316858af9b295452fd76da5799
- SSDEEP 196608:6zBeGZF6bUpMBF1p/kjRm4OWi2b3KhLajki:2IbUwF1VERmj2b3Gi
- TLSH T1ECB6E012A7A880A1C1BAC07D8567DA12F6727C0D8B30A6DB0691567F1F377E05F7E722
- MD5 SHA1 SHA512 SSDEEP TLSH