ae958795a80e77fbfdf4fa065905c5a6613a29f5257ea7cae73e4925bbad5109

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_c55224af351d6836a7dcea6a12b229c2_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Size 26.2MB
Sample260801-bm9rcack9v
SHA256 ae958795a80e77fbfdf4fa065905c5a6613a29f5257ea7cae73e4925bbad5109
MD5 c55224af351d6836a7dcea6a12b229c2
SHA1 1c2e8f6c4336a06ef4f6a2c1b8777fe6ed28d48d
SHA512 c5b16bb855c25dcdca20012b0f1b98469cd236680521398da05907d114012627b7f74e464e167f570e5696984d2d7efdd14769f1138aebb7e186fd013d900e1e
SSDEEP 196608:anSunSunhnSunSunhnSunSunhnSunSunhnSunSunhnSunSunhnSunSunhnSunSu2:a11h11h11h11h11h11h11h11Sx
TLSH
T1B4576D09FD4744F1D92B61B00CDFE3BF8A607B25C4228EBAFA4ECB5B6923B21541C655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c559-20.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3496	svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe
4608	svchost_BCBAACAACABABBBBCCCAABAAABCACBACAABCACACACBABAACBBACBAA.exe
2812	svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACABCCBCBCBCCAABBABBCBBCCCBBBAABBCCACBBCBCCABBBACCACCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBAACAACABABBBBCCCAABAAABCACBACAABCACACACBABAACBBACBAA.exe"	svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAABAAAACBABBBCAACCCACBCCCCCBCCABBBBAAABBABCBCCAABACCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe"	2026-07-31_c55224af351d6836a7dcea6a12b229c2_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2680	sc.exe
5820	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5852	cmd.exe
5508	cmd.exe
3408	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBAACAACABABBBBCCCAABAAABCACBACAABCACACACBABAACBBACBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_c55224af351d6836a7dcea6a12b229c2_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4200	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4920	2026-07-31_c55224af351d6836a7dcea6a12b229c2_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
4920	2026-07-31_c55224af351d6836a7dcea6a12b229c2_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
4920	2026-07-31_c55224af351d6836a7dcea6a12b229c2_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
4920	2026-07-31_c55224af351d6836a7dcea6a12b229c2_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
3496	svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe
3496	svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe
3496	svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe
3496	svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe
4608	svchost_BCBAACAACABABBBBCCCAABAAABCACBACAABCACACACBABAACBBACBAA.exe
4608	svchost_BCBAACAACABABBBBCCCAABAAABCACBACAABCACACACBABAACBBACBAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	2026-07-31_c55224af351d6836a7dcea6a12b229c2_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	3496	svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe
Token: SeDebugPrivilege	4608	svchost_BCBAACAACABABBBBCCCAABAAABCACBACAABCACACACBABAACBBACBAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 5852	4920	2026-07-31_c55224af351d6836a7dcea6a12b229c2_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe	92
PID 5852 wrote to memory of 4200	5852	cmd.exe	94
PID 3496 wrote to memory of 1324	3496	svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe	95
PID 4920 wrote to memory of 5508	4920	2026-07-31_c55224af351d6836a7dcea6a12b229c2_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe	98
PID 5508 wrote to memory of 5820	5508	cmd.exe	100
PID 4920 wrote to memory of 3408	4920	2026-07-31_c55224af351d6836a7dcea6a12b229c2_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe	101
PID 3408 wrote to memory of 2680	3408	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-07-31_c55224af351d6836a7dcea6a12b229c2_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_c55224af351d6836a7dcea6a12b229c2_amadey_coinminer_elex_glassworm_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAAAACAABBCACCBAAABBACBAABBBBCBBBBCCACCCBBACBBCAAACCBBABBBACCCBCCCCBBCABACCABCBBBBCAACACBBBAACACCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAAAACAABBCACCBAAABBACBAABBBBCBBBBCCACCCBBACBBCAAACCBBABBBACCCBCCCCBBCABACCABCBBBBCAACACBBBAACACCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAAAAACAAAABBCABAABACBBBCAAACAABBABACCBCBABACBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe" start= auto displayName= "UserDataSvc_CAAAAAACAAAABBCABAABACBBBCAAACAABBABACCBCBABACBCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5508
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAAAAACAAAABBCABAABACBBBCAAACAABBABACCBCBABACBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe" start= auto displayName= "UserDataSvc_CAAAAAACAAAABBCABAABACBBBCAAACAABBABACCBCBABACBCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAAAAACAAAABBCABAABACBBBCAAACAABBABACCBCBABACBCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAAAAACAAAABBCABAABACBBBCAAACAABBABACCBCBABACBCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACAACABABBBBCCCAABAAABCACBACAABCACACACBABAACBBACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAACAACABABBBBCCCAABAAABCACBACAABCACACACBABAACBBACBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe
1⤵
- Executes dropped EXE
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c51f73d7f5734c0bf7f035798370e1d9370374c399001a823812cdcf3e519dc
MD5 9d2bd2c035e1b20185430160f2d5a86c
SHA1 fa8dc4e0b20c0d5b73ecd35ed0e479944a99213e
SHA512 86208cf5f8a2eb000c52e4cf295f59a86417dc9193472a6559b205831d58ac81da0e8ef0efd6ce28a3748bd843fe3d92967567221fd481b4e2af129d2b606d92
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a3d31ad7f1232b8a1bcc9266c8241dd8191045269253430c65af9dbeb366445a
MD5 ecd271a17b45ae4d96bc88b0027f0155
SHA1 54c8cc218b4bddad7091d147e2ef964cecc9655f
SHA512 155ce31aebcab878048cd8f378182afa8833152d4ec5f677d6565650ce01f141644db7ca46eff0533a615dbcdeaa58045c904cc91ff296a63b2a58d4bc92c8fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a7d896c510bcfb1b5215d6005b51e5d0bd4e7ee246ed65c7581452537e32e834
MD5 3f143fd38cd073d98311fc915a224624
SHA1 bdc467b6b4e5f99afbf6e8c734ddf5c09fb5c712
SHA512 bd6f915eb012ddec38cc6a9cc9626e207b7dcc3ab305014cd6b360742ea20411e0c9c80f13a68eadc409e9c227788c40c55dd412bc4b5138dc4b8f2602402ce1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 690a85cced3ac619541e7e26770b6670eccf4bf91bc135ffdefe06e4a3a55bd2
MD5 62b07e0c50ece0d10411a39469dd93a9
SHA1 15d26ae9f8f593ad27f989846b3e850446a6574a
SHA512 19707857635c1d1235a50f591016944c2cbff11c94852d78d73e03d978a614f9de42f568bc7a446d3ff9845db01ceda151bc0fda3e07478f283238722e658f4f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 38107622f77db39a35821003e6be3a5817b8bfe633b2d485d311862c8497b0ed
MD5 9fbe08199f445e1c3574688d8abd03c8
SHA1 1de073af84a7e3822def5aa04bcf3d0a1a133052
SHA512 70578978a00ba9d7ac216a7bd40cdd49beabac4b74c08df74c2cbc6af66e3c06a024373b4d67616c2ff426e78c5b29dee43907fd2ff2258906b7632e8de4cc7d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c3767db31c28df9df8c1b784a54831b47a0892853ecd685e137e591085b828b1
MD5 469e9cac51b58a7dbf2d7c16c2bee217
SHA1 413743af0a16e0efe7103d84790fae777005cc31
SHA512 8fbbb130f97fde0f4487590997ffa2a9c9033a0207d33cade987146607f64d6d7d57238499e3b8795ba01c6235e932e31024b410f0d326add64cd6f470540bb4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d8642f57dc6d808c2baa3577207ef245c7d16d8e0a16f85c13b02e5259a3d8e5
MD5 20daae60a3cfc47e4c936ea748878448
SHA1 94450252f1f07cff88c9dad40a3ddeece85374ee
SHA512 dd72ba83f33e67d0b2637fcb4780221f0d7873046da949716e21c3269462ef02ed6601e3b439a37dfbbadd1bc48db47d1208fb7bcb76e777cb762e983cf7a5d4
MD5 SHA1 SHA512

Submit Download

svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBACCBAAAABBABCBCBBACBBCCACCBBBCACCABBACAACCACCBABCA.exe
Size 26.2MB
SHA256 ae958795a80e77fbfdf4fa065905c5a6613a29f5257ea7cae73e4925bbad5109
MD5 c55224af351d6836a7dcea6a12b229c2
SHA1 1c2e8f6c4336a06ef4f6a2c1b8777fe6ed28d48d
SHA512 c5b16bb855c25dcdca20012b0f1b98469cd236680521398da05907d114012627b7f74e464e167f570e5696984d2d7efdd14769f1138aebb7e186fd013d900e1e
SSDEEP 196608:anSunSunhnSunSunhnSunSunhnSunSunhnSunSunhnSunSunhnSunSunhnSunSu2:a11h11h11h11h11h11h11h11Sx
TLSH
T1B4576D09FD4744F1D92B61B00CDFE3BF8A607B25C4228EBAFA4ECB5B6923B21541C655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7bba7ac6bfdc74ba19fb7e022254a85b3585df7de0c22a47c590c0326b0a8e71
MD5 77798dc291af3fbc88665bd513beeac7
SHA1 1828568649944dd8dd4ff3143082df3daa582343
SHA512 75ecc8cc67793f5d4edce6ba5ad88ad2efcf9620d9913822f1a0e83463c4cffb029feedec32797ce2e0260dce31aff79a24a6dd93b07b3c9aafb7d2bc29f9ca3
TLSH
T17A11CB62D0A99C63F9332C4FD929AA534CB8368F58FC7A14D64D431CA785C31DE158F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3496-34-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/4608-64-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/4608-82-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/4920-0-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/4920-8-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download