f5ac91ebaf6c1b4af0a34a3eb73f0a8c56555fb0d35512134898424e82994fb9

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_7640ae53d1778c2a647faaab1bece92e_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
Size 35.7MB
Sample260807-azelasvala
SHA256 f5ac91ebaf6c1b4af0a34a3eb73f0a8c56555fb0d35512134898424e82994fb9
MD5 7640ae53d1778c2a647faaab1bece92e
SHA1 5bd3454dc3d888d5a67a6c06fa4da559fcbeb2b6
SHA512 870abff5b77987d23d962db12c88eac0912de682c49dfe6be40eb72a3ce726c8adefd1a436db112c2186f0a42f918b390b4ffa66dd260a6a1e806405acf694e6
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUzFlfFlfFlfFlfFlfFlfFlfFlfFlCnSU75:i33333333s133333333sv5
TLSH
T11287E147FD8680B0EC7A25304CE7E2374936BE3AC425CA8AB9C97B097F33E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x0003000000022c8f-20.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4484	svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe
4536	svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe
1032	svchost_BCBABACAACBAAAAABBCACCBBBABCACACBCAAABBCBAACBCACAAABCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBBCAACBACABCCCCCAABCCBABACACACCABCCBBCCBABCACBBCBABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe"	2026-08-06_7640ae53d1778c2a647faaab1bece92e_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBCBBBCCBABCBCBBAACBBACBCABBCAACABCACBABBAAABABCCCABAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBABACAACBAAAAABBCACCBBBABCACACBCAAABBCBAACBCACAAABCBB.exe"	svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3564	sc.exe
3900	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4204	cmd.exe
4252	cmd.exe
852	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_7640ae53d1778c2a647faaab1bece92e_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBABACAACBAAAAABBCACCBBBABCACACBCAAABBCBAACBCACAAABCBB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4012	2026-08-06_7640ae53d1778c2a647faaab1bece92e_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
4012	2026-08-06_7640ae53d1778c2a647faaab1bece92e_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
4012	2026-08-06_7640ae53d1778c2a647faaab1bece92e_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
4012	2026-08-06_7640ae53d1778c2a647faaab1bece92e_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
4484	svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe
4484	svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe
4484	svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe
4484	svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe
1032	svchost_BCBABACAACBAAAAABBCACCBBBABCACACBCAAABBCBAACBCACAAABCBB.exe
1032	svchost_BCBABACAACBAAAAABBCACCBBBABCACACBCAAABBCBAACBCACAAABCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4012	2026-08-06_7640ae53d1778c2a647faaab1bece92e_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
Token: SeDebugPrivilege	4484	svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe
Token: SeDebugPrivilege	1032	svchost_BCBABACAACBAAAAABBCACCBBBABCACACBCAAABBCBAACBCACAAABCBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
988	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 852	4012	2026-08-06_7640ae53d1778c2a647faaab1bece92e_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe	113
PID 852 wrote to memory of 4772	852	cmd.exe	115
PID 4012 wrote to memory of 4204	4012	2026-08-06_7640ae53d1778c2a647faaab1bece92e_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe	117
PID 4204 wrote to memory of 3564	4204	cmd.exe	119
PID 4012 wrote to memory of 4252	4012	2026-08-06_7640ae53d1778c2a647faaab1bece92e_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe	120
PID 4252 wrote to memory of 3900	4252	cmd.exe	122
PID 4484 wrote to memory of 2016	4484	svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe	124
PID 2016 wrote to memory of 4548	2016	notepad.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-08-06_7640ae53d1778c2a647faaab1bece92e_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_7640ae53d1778c2a647faaab1bece92e_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAAABBACCCCBACAAACABBCBABABCCBCCCCCCBBBABAAABAABBABBBAABBCCCBAAABCBBAABCAAAAAABABACCBCCBABBBBBCABAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAAABBACCCCBACAAACABBCBABABCCBCCCCCCBBBABAAABAABBABBBAABBCCCBAAABCBBAABCAAAAAABABACCBCCBABBBBBCABAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCAACCBAAACCBBCCACBAAABBABBBBBBCABACAAABBCACBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe" start= auto displayName= "UserDataSvc_CABCAACCBAAACCBBCCACBAAABBABBBBBBCABACAAABBCACBBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCAACCBAAACCBBCCACBAAABBABBBBBBCABACAAABBCACBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe" start= auto displayName= "UserDataSvc_CABCAACCBAAACCBBCCACBAAABBABBBBBBCABACAAABBCACBBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCAACCBAAACCBBCCACBAAABBABBBBBBCABACAAABBCACBBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCAACCBAAACCBBCCACBAAABBABBBBBBCABACAAABBCACBBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe
1⤵
- Executes dropped EXE
PID:4536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:988

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABACAACBAAAAABBCACCBBBABCACACBCAAABBCBAACBCACAAABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABACAACBAAAAABBCACCBBBABCACACBCAAABBCBAACBCACAAABCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6b4867558d034934d5fddb4491069246d8902efe04206f5ba158f50bc93a7d09
MD5 f607f4ab3383ba5d3274970067b382d3
SHA1 1d7b8d403d47ea7f550e0d873ed303c34883299a
SHA512 924b4dcf24aeaf61b53b42a4cce81a768f8cb557bed89ce20e398e50e80466fb5887cf0204bb046d06a65f79430128573edca47495fd5740d60822acbebaf119
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f58ccffb68150cbb292b9f7c93736728dcfc7cda0a7cbb373ab19c36388ad28b
MD5 a95a631089d4aca9e44e13ac9fb00e98
SHA1 1399827aade53506f787859e6072c861786c3aa0
SHA512 ba5ad83ca5f0ed604238fcc37fa25195a4b9d7a10fb0e1573042bf296eb1060140bce3fc2b8b49749c0438008deddcc8132d6d2cdc0aa62dc27616c3a817d92a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 96c47571db27df1ca740c50b9e528eaffabbaa8a01c793ec5410fb67e3341679
MD5 14bcc283c9a25a4f2ccf73b8c884e5ac
SHA1 4840acdb07eb330362c3cd5cb35388402f22acf5
SHA512 f79394714145e05f996684851711663a312dc2374dabba369c5019e28ba077900fa47ac04dbb048283e411c581aea4f11d0b7a1ed47a3b2d442b95c1c8489c20
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f218e8cee105c0bdd1b7dbc6bd37c581495728fceeaba14ebe60c37d35dbe6b5
MD5 19e09f45e189283729d655941beba0de
SHA1 ef7b0d178aaf53f97be901ebbe77d136c7509155
SHA512 ff5d84a9e4431a22af4a2cb521482275e0dbf2184bbab0d759c0c14e1f096345079899f09e63d210fa1a7ec5e396720496320ad20d2591f6978a07ac02d82c7b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2762accaaa070b7a4318b93119407285df14019f517b4d424729795db6c00ded
MD5 c96400512e5af9af552d94ee6a17b755
SHA1 f18b87b0c347df6045f40256ce45fe2a0a66c0a4
SHA512 3277cb6296b8c7ba6134ae47516bde6c3b754944f2f4040c5e6081578b10d916b01047c764660241073b6deb20ff0bc09982be50a3bc21c908fc2b25ea29aeb4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a9a647eaafbd5faf5d4b97c1d55438ce74012dc1fcd4f4b33e4fe58790e54599
MD5 4bb95bb660cbc5d5532d80359eefc4e1
SHA1 b29b2f073de2d6e111635a579cc1d83a511b3a91
SHA512 0d4550bece421a05311038d7df7b7ed4814b05061b14ddde99b67c0239a5cd1aced78f9463b4b7959f5e91705ae93dbc1a50c5048f402df007925277150bace0
MD5 SHA1 SHA512

Submit Download

svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBABCBCABBCCCAABBCABAABBABABABCBCACCABACBBAABBAACABA.exe
Size 35.7MB
SHA256 f5ac91ebaf6c1b4af0a34a3eb73f0a8c56555fb0d35512134898424e82994fb9
MD5 7640ae53d1778c2a647faaab1bece92e
SHA1 5bd3454dc3d888d5a67a6c06fa4da559fcbeb2b6
SHA512 870abff5b77987d23d962db12c88eac0912de682c49dfe6be40eb72a3ce726c8adefd1a436db112c2186f0a42f918b390b4ffa66dd260a6a1e806405acf694e6
SSDEEP 196608:kFlfFlfFlfFlfFlfFlfFlfFlfFlCnSUzFlfFlfFlfFlfFlfFlfFlfFlfFlCnSU75:i33333333s133333333sv5
TLSH
T11287E147FD8680B0EC7A25304CE7E2374936BE3AC425CA8AB9C97B097F33E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 51b2979a97bf11433e1b624ce05b7cf668963abd5fb246811c4abe8b4910f367
MD5 4960200ab4254bc8ab711d1ba029876a
SHA1 0aefc0f829e730d2405cc9fc61ee3db676aa3e07
SHA512 3c82d9bc7cfa6e6e706eac5492bba6654a02d7e2febc830535810f52a9371864ca3ee8c1a7b71a40a1884cc16f25b35171dd0310245daf08ba0fdd9704a7d245
TLSH
T1CD11236170EADC53E933245BAA119ED30CE975DF2D986A1863095708A7DCC32CE11CF2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1032-80-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/2016-66-0x00000000055A0000-0x00000000055A1000-memory.dmp

Download

memory/4012-6-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/4484-38-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/4484-25-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/4536-74-0x0000000000760000-0x0000000000781000-memory.dmp

Download