b2a6279ea9ad91dfd9ea24c8d7d047d4be708b78a3713f6895f3086b0f304761

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_b50891a96174bd3b0e5f5b80fac2e3e1_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Size 52.0MB
Sample260729-avjz8adl21
SHA256 b2a6279ea9ad91dfd9ea24c8d7d047d4be708b78a3713f6895f3086b0f304761
MD5 b50891a96174bd3b0e5f5b80fac2e3e1
SHA1 2946e31a814917bdea214c03dd3f9d49ebe7fc82
SHA512 6db362b8dc5d9ff670c4c60c4421c7356e20cce6d3259d9152b825180206f803188ac8c344c79a9e5a1b20945c26cd2f7dbd6a7b7e5f484083a0086b3ebce1ee
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSyFlfFlfFlfFlfFlfFlfFlfFlfFlCnSyFlO:i33333333sx33333333sx33333333sOQ
TLSH
T129C7E146FC8650B0DD7A64704CEBE2374836BE3BC0258A9AF9CA7B067B37E61540F456
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5984	svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe
5972	svchost_BCBCBBACACABCCCBBBCAABBACBAABACAABABBBCACABCCABACACACAB.exe
2812	svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCCBBCBBBCACBCAABABBBBCACBBCBBCCAABCBCCAABCCBACCBCBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe"	2026-07-28_b50891a96174bd3b0e5f5b80fac2e3e1_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBBBABACAAABBBCCBACCCABABCCCACCBBAAABABCBCACBBBCCABABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCBBACACABCCCBBBCAABBACBAABACAABABBBCACABCCABACACACAB.exe"	svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4344	sc.exe
3996	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3760	cmd.exe
1408	cmd.exe
2136	cmd.exe
2204	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_b50891a96174bd3b0e5f5b80fac2e3e1_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCBBACACABCCCBBBCAABBACBAABACAABABBBCACABCCABACACACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1556	schtasks.exe
3932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4500	2026-07-28_b50891a96174bd3b0e5f5b80fac2e3e1_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
4500	2026-07-28_b50891a96174bd3b0e5f5b80fac2e3e1_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
4500	2026-07-28_b50891a96174bd3b0e5f5b80fac2e3e1_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
4500	2026-07-28_b50891a96174bd3b0e5f5b80fac2e3e1_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
5984	svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe
5984	svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe
5984	svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe
5984	svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe
5972	svchost_BCBCBBACACABCCCBBBCAABBACBAABACAABABBBCACABCCABACACACAB.exe
5972	svchost_BCBCBBACACABCCCBBBCAABBACBAABACAABABBBCACABCCABACACACAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	2026-07-28_b50891a96174bd3b0e5f5b80fac2e3e1_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	5984	svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe
Token: SeDebugPrivilege	5972	svchost_BCBCBBACACABCCCBBBCAABBACBAABACAABABBBCACABCCABACACACAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 3760	4500	2026-07-28_b50891a96174bd3b0e5f5b80fac2e3e1_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe	92
PID 3760 wrote to memory of 1556	3760	cmd.exe	94
PID 5984 wrote to memory of 1140	5984	svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe	95
PID 4500 wrote to memory of 1408	4500	2026-07-28_b50891a96174bd3b0e5f5b80fac2e3e1_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe	98
PID 1408 wrote to memory of 4344	1408	cmd.exe	100
PID 4500 wrote to memory of 2136	4500	2026-07-28_b50891a96174bd3b0e5f5b80fac2e3e1_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe	101
PID 2136 wrote to memory of 3996	2136	cmd.exe	103
PID 5984 wrote to memory of 2204	5984	svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe	105
PID 2204 wrote to memory of 3932	2204	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-28_b50891a96174bd3b0e5f5b80fac2e3e1_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_b50891a96174bd3b0e5f5b80fac2e3e1_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBAABBACABBCAAAABBCCAABABCACBAABBAAACCBCBCAACABCCABCBBBCCAABCAABAABBACABCACBABABCABBCABBCACAACBBACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBAABBACABBCAAAABBCCAABABCACBAABBAAACCBCBCAACABCCABCBBBCCAABCAABAABBACABCACBABABCABBCABBCACAACBBACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABABCBACBCCACBBCBABBBCAABAACBCACACBABACACBCABCBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe" start= auto displayName= "UserDataSvc_AABABCBACBCCACBBCBABBBCAABAACBCACACBABACACBCABCBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABABCBACBCCACBBCBABBBCAABAACBCACACBABACACBCABCBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe" start= auto displayName= "UserDataSvc_AABABCBACBCCACBBCBABBBCAABAACBCACACBABACACBCABCBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABABCBACBCCACBBCBABBBCAABAACBCACACBABACACBCABCBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABABCBACBCCACBBCBABBBCAABAACBCACACBABACACBCABCBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5984
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABCCBBCACCAACBCBABBBBABCBCAACBBCCABAABBCCABCAABBBBCABCAACCABAABCACCCCBCBAABABBCBCBCAACABCCCBBCABBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBACACABCCCBBBCAABBACBAABACAABABBBCACABCCABACACACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABCCBBCACCAACBCBABBBBABCBCAACBBCCABAABBCCABCAABBBBCABCAACCABAABCACCCCBCBAABABBCBCBCAACABCCCBBCABBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBACACABCCCBBBCAABBACBAABACAABABBBCACABCCABACACACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3932

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBACACABCCCBBBCAABBACBAABACAABABBBCACABCCABACACACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBACACABCCCBBBCAABBACBAABACAABABBBCACABCCABACACACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCABAACABCCACBACAABCCAACAAAABACBBABAAABBBCBACCCABCC.exe
1⤵
- Executes dropped EXE
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e1e50f56e84fd9954e618f253e41fe1ad221680fc47efcac4aa0ea363aa6b80f
MD5 9dcb4d856243e4d13556d6156a15cc6a
SHA1 763e5b143ef0ec177e232208157e356c65f74653
SHA512 dc5de7030d83e78f5c0a62d1676163669e07724e215c87f90f476c77327fe7f25d6935aafd56f8e6a07835bcc1be43acff65d6e5dc02dc837a68d209dbb5c203
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7e60e5a623e3454f1040d5f840ab4f1c3c7e21eaa8ffd07812d6a2813cb95aab
MD5 5fff9bb6cbdfc44c30ca284cc51112ff
SHA1 387ebfbf7d1606ab51f56be64cbbd224c39df27a
SHA512 003735d90cacb9af67372c3c94f9b712b473abda193bf7611562a0058a90589eb19ab2fc757befb3ee211c025fb8f0a6e03263f1d03fe94ba497c0e80ac193de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 955abe1942875ba1bd3534f211f06537ed8d219f8728d1c2f2aef39c63b00b6f
MD5 84df54299f4bca9050e3de16be33bd2b
SHA1 14a52d246c3dbdd4d9569e5e5ca4b669610b7875
SHA512 8cacb253ff78da74af0c87f5870633d646a607de1532cdb56132fbffed580365e0fd0bbf88d893a8eb97c97c7e1adb3ab20ed9aeffb4a811eb9052a62eba8270
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 47ebe336da8e4ce53143084dcf4434bd893def79b43c788b32771cc16f02605f
MD5 2946684a595fe2997015b3f747158728
SHA1 a29d5399d1c96e81afecbb9d7b7537d6d3fda290
SHA512 f27e47024034985a0dcd10dc847e65e67f7d44b1335eac31393ebc3c331a2b67e008eff4bde459e53d5eb1b0fb85dde5e65d5fb9cf57e38dba834f07b5543b91
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 17deafe6920459f5cdc3ff4dae39e0dcb0d4702ef3b2b427093ce7e8ac8d4338
MD5 12aa12882346a9038725e8436daf4337
SHA1 8f3eea10810b87980277f65dcc280f3480f59c04
SHA512 82ff265d811f8bd4652fcbcdaf6343b310df50065e932d73e7af1917de0b4166c638ce208cb52f7095b49cbc98b2619f60308d5c525386ac7459954a15244fb4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cacfb07084d759b34b694a0beeb0ab24faee9184b398c3061c450dcb5763966a
MD5 96f76b2b47c536f6a94bf4491b64a047
SHA1 f48d3866203f1128b82bcbbb33ae9af421d91fed
SHA512 bd8ab5215cca4620404ad9f80ef00035ff1733687452bec24b4208154740425272f643f741b93dc1f4fc512f3feab1f7fc39fab2e6018a94a6bb2f34cc1b02be
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7ead7b2cc25cb4d490fb9148788f5f21616e01f3650e11006b69893db9bed3fe
MD5 86522e69910e933911403b076b8393a7
SHA1 5c63769edd0956f692fce851e4a85a0d0bf94004
SHA512 e57040dd4662febd001d265694ec4d5e4119c4e3871b887d193a316ee01ac5add373150ee05129794c78cd55e2c02271303495f80ab1d95aef4f18350acd5b06
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b5717b4cf822f6271124e48b1c325b8e36b3793805c996916207eb7ec3c8f0f2
MD5 53076b37f408f1c97ea1692074329ef9
SHA1 8f20b03ef19ab22987e384664d30f7c77da93b42
SHA512 7c917a376a38c02b12b0c0da17eeb123d0568015772cbea62e36bda9f591be3c9da0f40569d27588a3fffdcf344ab67971c14c9e3c1bb5628955a98b4466fada
TLSH
T149119461D0F6DC67D12168C7AA29EBD248D47B6F68DCAA1423049318BF45863DD6D0F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d466574a161ed067748cc2cccf1766754c6a673509ec5eb0fb50d7b7e3dff068
MD5 79787e0b1b2c3d55ffc386414cc9f2b6
SHA1 06690f8ccb616643643b0465d36b448c94b6d6f7
SHA512 54df7bba80cda60f15dee42d9c6fcf3a834d133230385f2a6f0e6ae55df3688e084e7807798b397967c270db6870fb6047665384181a12bff863fb831fbdc816
TLSH
T10C119F71D0E6CC67E12168C7AA29EBD248D47BAFACDC9A0453058318BF85873DD6D0F1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2812-73-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/4500-6-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/5972-63-0x0000000000530000-0x0000000000551000-memory.dmp

Download

memory/5972-87-0x0000000000530000-0x0000000000551000-memory.dmp

Download

memory/5984-32-0x00000000004F0000-0x0000000000511000-memory.dmp

Download