Analysis
- max time kernel
148s - max time network
103s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 06:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe
- Size 8.0MB
- Sample260913-hn4eaagc79
- SHA256 65271f22a91c9b502c4a74dce001430d2e02cc7c92fb1520226334012e129357
- MD5 0a21209cc715dd2a5425840d68dc0cf7
- SHA1 ac1af227be52e1db72bafc874ebef94393b926c4
- SHA512 b3e6d95ffeab75585909cb3bac4eedae0cc94e54f4aff41d52fb3568f92dbf38853c4b04b921da5a7eed4ce61410a60e721f8be8693cf30fed93ec4ef2e0cba4
- SSDEEP 98304:s/vN1SERbX7PLixQeMjLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22H:6zBeGZF6bUpMBF1p/kjRm4OWi2b
- TLSH T18D8612117BE04172D1B3563589B59622A97AB8221F30D68F13D9177E0F33391AF3A72B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dism.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\wextract.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\curl.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\mshta.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\msra.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\attrib.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\msdt.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\compact.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\find.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\netsh.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\clip.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\expand.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\logman.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\sort.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\tar.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\logagent.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\choice.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\dialer.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\doskey.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\raserver.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\setx.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\autochk.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\cmd.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\cttune.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\r\WerFaultSecure.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiFileFetcher.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.26100.1150_none_88f06bccebd86289\r\w32tm.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_75b5554a02bcd133\AtBroker.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\r\IMJPDCT.EXE 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_d07e775d9a3de1d6\r\CapturePicker.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_90ebc90aafaeeb97\r\pcwrun.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmmon32.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_0f19119bcdcaf335\r\SpeechModelDownload.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.27000.360_none_ad704d12215bf117\aspnet_regiis.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.26100.1591_none_80585f5752dd6955\EoAExperiences.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.26100.1150_none_0c04974f069bcd17\r\cliconfg.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\phoneactivate.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\ROUTE.EXE 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_10.0.26100.1_none_a7b1b2421ae9ec27\WsatConfig.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\r\IMTCPROP.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.26100.1_none_6c3a7829113ddd25\rasdial.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DesktopStickerEditorWin32Exe\DesktopStickerEditorWin32Exe.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.26100.1150_none_74a667b087b1ac17\r\PerceptionSimulationService.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.26100.1591_none_2bf6278ffa2525b6\r\vmconnect.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmLpac.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\aspnetca.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.26100.1_none_2e87dc5d933c136a\reg.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.26100.1_none_d11ede0471c43ced\help.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.26100.1150_none_de2664616a7b438a\OOBENetworkCaptivePortal.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.26100.1591_none_756d2e37dd0406ef\ApplicationFrameHost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.26100.1591_none_7622b05853a7428c\BitLockerDeviceEncryption.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6157b26c767f49a2\ttdinject.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.26100.1591_none_99f9c6049c838786\TpmTool.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-where_31bf3856ad364e35_10.0.26100.1_none_5ac6e18046b72d8c\where.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cipher_31bf3856ad364e35_10.0.26100.1_none_b45ed20d4205ffbb\cipher.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.26100.1591_none_09f5b9f9e6fe0f73\r\hvsiproxyapp.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\ROUTE.EXE 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-sk-helper.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\msil_smsvchost_b03f5f7f11d50a3a_10.0.26100.1_none_b6996f0c07fabc7a\SMSvcHost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\diskperf.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.26100.1591_none_6237f51eb608e6f4\r\WSReset.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.26100.1591_none_8f56b2193eadb75b\r\CertEnrollCtrl.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_7b25a93731217002\sdbinst.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\SearchIndexer.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.26100.1_none_6eba2dc7c1074207\aspnet_regiis.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.26100.1591_none_f83c41b7a549ff24\r\CCG.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..microsoftedgebchost_31bf3856ad364e35_10.0.26100.1150_none_faa81bed523ab303\MicrosoftEdgeBCHost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_971a4fc44ce4ae24\r\XGpuEjectDialog.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_70cfc556f1a01eb7\r\CredentialUIBroker.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_a4b44acdd9ec4aa3\r\DWWIN.EXE 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_196dbbee022bb530\r\SpeechModelDownload.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVNice.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_a661f954ca482f71\Win32WebViewHost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.26100.1591_none_087ed6682bae0fd0\wifitask.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_10.0.26100.1_none_d80a0abbc02dc6d0\InstallUtil.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\WUDFCompanionHost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\iisreset.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\r\EASPolicyManagerBrokerHost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_37c9b95250fac754\perfmon.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellhost_31bf3856ad364e35_10.0.26100.1591_none_e7ad5a201ddffac9\r\ShellHost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_windows.networking.vpn.nethost_31bf3856ad364e35_10.0.26100.1_none_ca6f6ae66cca19d0\NetHost.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.26100.1_none_ac6c889a5b4138e1\aspnet_regsql.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe File created C:\Windows\WinSxS\amd64_edmgen_b77a5c561934e089_4.0.15912.0_none_b064199c91afa844\EdmGen.exe 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_0a21209cc715dd2a5425840d68dc0cf7_amadey_elex_glassworm_icedid_luca-stealer_njrat_redline-.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1844