9a6badf8b176a408ef2366d636b7676841a641760c944e13cfe4ec336ee29e43

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_eaea12837ce456a601fb30024a629674_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
Size 19.3MB
Sample260810-b7j2esyepd
SHA256 9a6badf8b176a408ef2366d636b7676841a641760c944e13cfe4ec336ee29e43
MD5 eaea12837ce456a601fb30024a629674
SHA1 732f968de95b92d611f2cd29034b9139866b7c70
SHA512 41898a101916b75b1becee31cfaaa56e1e61c2a5f8d2bde970f818296f9bd36c7cfc571393245fdf68de4f7703fd946f27b036cc77774747b671088c9b9b2cb4
SSDEEP 196608:vBBBBDBBBBDBBBBDBBBBDBBBBDBBBBDBBBB9FIF0wuY:VY
TLSH
T1B3177C11B6C18035F5B329728ABFD339552CB9614F6986CFF38C062E5E70AE1A934727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5176	svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe
3852	svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe
1408	svchost_CACBBAABCACCCAACBBABCCABCCACCBCCCACCBCCBBABCBCBABCBCCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBAAABBABABBBCAABACCBAABBABCCBACCBCCACAABBCAAACCBACACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe"	2026-08-10_eaea12837ce456a601fb30024a629674_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCABBAABACACCCACABBCCBABCAABAAACBABCACAAABBCBBACCBAACAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBBAABCACCCAACBBABCCABCCACCBCCCACCBCCBBABCBCBABCBCCAB.exe"	svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3932	sc.exe
2072	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3316	cmd.exe
4036	cmd.exe
2280	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBBAABCACCCAACBBABCCABCCACCBCCCACCBCCBBABCBCBABCBCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_eaea12837ce456a601fb30024a629674_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2196	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1612	2026-08-10_eaea12837ce456a601fb30024a629674_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
1612	2026-08-10_eaea12837ce456a601fb30024a629674_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
1612	2026-08-10_eaea12837ce456a601fb30024a629674_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
1612	2026-08-10_eaea12837ce456a601fb30024a629674_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
5176	svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe
5176	svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe
5176	svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe
5176	svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	2026-08-10_eaea12837ce456a601fb30024a629674_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	5176	svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3316	1612	2026-08-10_eaea12837ce456a601fb30024a629674_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe	92
PID 3316 wrote to memory of 2196	3316	cmd.exe	94
PID 1612 wrote to memory of 4036	1612	2026-08-10_eaea12837ce456a601fb30024a629674_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe	95
PID 4036 wrote to memory of 3932	4036	cmd.exe	97
PID 1612 wrote to memory of 2280	1612	2026-08-10_eaea12837ce456a601fb30024a629674_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe	98
PID 2280 wrote to memory of 2072	2280	cmd.exe	100
PID 5176 wrote to memory of 4152	5176	svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_eaea12837ce456a601fb30024a629674_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_eaea12837ce456a601fb30024a629674_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBBABABCACBAABAABBAAABCAAAABACAABBBBACBCAABAABCCBABCBACCBBCCAABBABACCCBACBBBAABCBAAAABACAAABACBACCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBBABABCACBAABAABBAAABCAAAABACAABBBBACBCAABAABCCBABCBACCBBCCAABBABACCCBACBBBAABCBAAAABACAAABACBACCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBACCCBBBCBBBCABABCCBCBBACABABACACCABBAABACBCCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe" start= auto displayName= "UserDataSvc_BCBBACCCBBBCBBBCABABCCBCBBACABABACACCABBAABACBCCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBACCCBBBCBBBCABABCCBCBBACABABACACCABBAABACBCCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe" start= auto displayName= "UserDataSvc_BCBBACCCBBBCBBBCABABCCBCBBACABABACACCABBAABACBCCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBACCCBBBCBBBCABABCCBCBBACABABACACCABBAABACBCCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBACCCBBBCBBBCABABCCBCBBACABABACACCABBAABACBCCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5176
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe
1⤵
- Executes dropped EXE
PID:3852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBAABCACCCAACBBABCCABCCACCBCCCACCBCCBBABCBCBABCBCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBAABCACCCAACBBABCCABCCACCBCCCACCBCCBBABCBCBABCBCCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 016d11d6775402ba366a9e9586e3e229c70d82d2714519c9426cbdbe6c61d405
MD5 e4aba1ec4726ef0cb9008b0b9549907e
SHA1 20a1ce3b786d6e2bdf4a72127c3a0f3f3e26bd69
SHA512 4b94dfcb66231a9f1c412258233b65fe10a2d88412c57f418354e54e1ddc6eb15a9fafe698dc41cc7cded4e1d08dfdd1a3d89de6026215e4f714e00fe1cd046a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 38a4150c276749c8f82ecf5325dbe68a276810867bf40ba027a78cac7b7c1b2b
MD5 bca05030342b83320dbba6d6e65ad572
SHA1 68a8f4db358badbb0605c175f358864d50ade671
SHA512 2b4800a47339489a4bec0b50db01bac6289aa66ba3a8ccc54a70d9f8073d59fa51b4e5b911ec50c7c5ed4d86d6441709de28ad3317502db11eba3849de3616d1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 14d94c6e0f2921ba104b093eea1a4b99443d8503feee70deae5ff1922360cd0d
MD5 5245f6887b19223c5f5ac85d6794da81
SHA1 413e500b3482dd77ebd0310ad69c53664a6886ab
SHA512 04c4cc0e51e890119eae9a78af3041c5e762cae7a1e356ddca6d6120624f62c3b1692676089c0b7f50ef7f85ada5e5c13e76abedcb67412c4f0b674ab4f45d64
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 807b71845fb09117c366e9f8437666c074330c279816a5eb28ad3e819ad42e57
MD5 11c1e2da9159893bde90ed2883d81111
SHA1 a8d8756b5ba971c8e376e9a0eb97a85a4d60edec
SHA512 118d7a7d035cf4bee2fc37346bc3dab11a1560233f0f97c12ccc280555e539c52035090dfaff9dc243b45924607a673be903b391765dfd41eaeeb4d0aa50727a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e4ad658adb159869d56a957f28e8293946c0334f6fa2b52ba9dc8137598147ac
MD5 6bca38b9e556ba4504830054a20b718d
SHA1 3c510254de6360f2784582812ea5b587777e5e67
SHA512 6d6fb1e54f96aa84faca8b33b77c2f25ae47ec10c768f589d51bc587f78ad00799509931fc6816912ddad57d7a501f306d419b6127f05e4eb0676afb3eed7894
MD5 SHA1 SHA512

Submit Download

svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCBCAABBBCAABBBCCCACBACABABCBCAABABCCABACCBCACABBBC.exe
Size 19.3MB
SHA256 9a6badf8b176a408ef2366d636b7676841a641760c944e13cfe4ec336ee29e43
MD5 eaea12837ce456a601fb30024a629674
SHA1 732f968de95b92d611f2cd29034b9139866b7c70
SHA512 41898a101916b75b1becee31cfaaa56e1e61c2a5f8d2bde970f818296f9bd36c7cfc571393245fdf68de4f7703fd946f27b036cc77774747b671088c9b9b2cb4
SSDEEP 196608:vBBBBDBBBBDBBBBDBBBBDBBBBDBBBBDBBBB9FIF0wuY:VY
TLSH
T1B3177C11B6C18035F5B329728ABFD339552CB9614F6986CFF38C062E5E70AE1A934727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1408-74-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/1612-6-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/3852-66-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/5176-22-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/5176-35-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download