d5108ad89cf23205f7e6fbd61cae5e5d600fe6ce4095e08f8a839af073f07b05

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_433a19df3629c94eda5c2d20a93466a8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 43.2MB
Sample260810-c8ad2shq2y
SHA256 d5108ad89cf23205f7e6fbd61cae5e5d600fe6ce4095e08f8a839af073f07b05
MD5 433a19df3629c94eda5c2d20a93466a8
SHA1 a37f3c5127e242ff58a0498c673abc71e132445a
SHA512 ce470f0099c36b5acc23355203ab68648b0c852efbcaed1798a688dd1824570389b22e5102ef45da55d5618d7561cf09903f797bf993c5d3e43ef10a71df26d6
SSDEEP 196608:kFlfFlfFlfFlfFlfFl4FlfFlfFlfFlfFlfFl4FlfFlfFlfFlfFlfFl4FlfFlfFlC:i33333833333833333833333zY
TLSH
T1EDA7F146FC8640B0DD7A60700CEBE27B4935BE3AC026899AF9CE7B067B37E61541F456
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002456a-20.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2992	svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe
2648	svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe
4436	svchost_AACCBCACCAACAAABACAAABBABCABCCCBACCCBABAABCBACBCBAACCAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCAAACBBABBBBABACACBBAACBBAABCAACCAACAACCCBCCBACAABCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCBCACCAACAAABACAAABBABCABCCCBACCCBABAABCBACBCBAACCAC.exe"	svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAABCBAABACABAAABABBCCBBCAACBBCCAAAACBBCACCACACCBABCAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe"	2026-08-10_433a19df3629c94eda5c2d20a93466a8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1260	sc.exe
2552	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1164	cmd.exe
4480	cmd.exe
4616	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_433a19df3629c94eda5c2d20a93466a8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCBCACCAACAAABACAAABBABCABCCCBACCCBABAABCBACBCBAACCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
560	2026-08-10_433a19df3629c94eda5c2d20a93466a8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
560	2026-08-10_433a19df3629c94eda5c2d20a93466a8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
560	2026-08-10_433a19df3629c94eda5c2d20a93466a8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
560	2026-08-10_433a19df3629c94eda5c2d20a93466a8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2992	svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe
2992	svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe
2992	svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe
2992	svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe
4436	svchost_AACCBCACCAACAAABACAAABBABCABCCCBACCCBABAABCBACBCBAACCAC.exe
4436	svchost_AACCBCACCAACAAABACAAABBABCABCCCBACCCBABAABCBACBCBAACCAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	2026-08-10_433a19df3629c94eda5c2d20a93466a8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2992	svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe
Token: SeDebugPrivilege	4436	svchost_AACCBCACCAACAAABACAAABBABCABCCCBACCCBABAABCBACBCBAACCAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2196	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 1164	560	2026-08-10_433a19df3629c94eda5c2d20a93466a8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	96
PID 1164 wrote to memory of 4916	1164	cmd.exe	98
PID 2992 wrote to memory of 4764	2992	svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe	99
PID 560 wrote to memory of 4480	560	2026-08-10_433a19df3629c94eda5c2d20a93466a8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	100
PID 4480 wrote to memory of 1260	4480	cmd.exe	102
PID 560 wrote to memory of 4616	560	2026-08-10_433a19df3629c94eda5c2d20a93466a8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	103
PID 4616 wrote to memory of 2552	4616	cmd.exe	105
PID 4764 wrote to memory of 1488	4764	notepad.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_433a19df3629c94eda5c2d20a93466a8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_433a19df3629c94eda5c2d20a93466a8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABBACBBBCCBCCBACABBBCABBCAABBCBACCABBCABCBBBCCCBCACBACABBAAAACBCAACBBBABBBACCACAABABCACACBBBCACCAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABBACBBBCCBCCBACABBBCABBCAABBCBACCABBCABCBBBCCCBCACBACABBAAAACBCAACBBBABBBACCACAABABCACACBBBCACCAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBCACCCBCCBCCCBCACBCCABAAABBACBACBBBBAABCAAABBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe" start= auto displayName= "UserDataSvc_CCCBCACCCBCCBCCCBCACBCCABAAABBACBACBBBBAABCAAABBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBCACCCBCCBCCCBCACBCCABAAABBACBACBBBBAABCAAABBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe" start= auto displayName= "UserDataSvc_CCCBCACCCBCCBCCCBCACBCCABAAABBACBACBBBBAABCAAABBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBCACCCBCCBCCCBCACBCCABAAABBACBACBBBBAABCAAABBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBCACCCBCCBCCCBCACBCCABAAABBACBACBBBBAABCAAABBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe
1⤵
- Executes dropped EXE
PID:2648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2196

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCACCAACAAABACAAABBABCABCCCBACCCBABAABCBACBCBAACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCACCAACAAABACAAABBABCABCCCBACCCBABAABCBACBCBAACCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 192e26f0ae172154e37a9d53590bdf6a6c1740db4911199b439b013a19ce521d
MD5 d80e9b030637479120cf234d594d7105
SHA1 fb466b9116c44dc25c2bfe4a23c6416cfbe9dae1
SHA512 b7f8f1fd9ba4abb1a1b521cf06731ba55c32172781426523db83eee4535510a0a7530b414e5574959100c78d117cd8890eb9a89763e4259acaff030f2184c0f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ca5ce70b5813796c06d5d0360b6f40c5debca8d7d7e8715d966427a25a19185d
MD5 ba2eb919a93266d5c250113a8df6e0ef
SHA1 0211c5c73bfe51e3b835d3ad4a62dfdacdd69f43
SHA512 a0dd04d2e489047d57aa7d2404fed14404f07b327e4f83c7980e040792ab64a998575a1619ce3c31683a426ad51165ce1263c871a8bde084c5578e5bb036bb3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b0b2964bf89de07d2602755e3f31215f997b1b241a075c9cc4776ff54d03fb67
MD5 5127baf1844a30107badb548a71eb9f0
SHA1 af443353137339c05a67b7f61a8547f4de9ce648
SHA512 e185df17d66340f2d64ac09bb39bdf2baa6cd74d74ec36739b1ae86a01076b89add277a9df06a60f7f83bc8de657bc42fa0d1843344d7c9f4bf0598355e02ecb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2c0d8362f3ee084a2abff5f31c40a9873f951deb49b4fc63c5c4e015a517255c
MD5 b5478a201856c643a8dd92dc363abe8b
SHA1 c4424eaea85b6148872d56e263bd5b132f063696
SHA512 274a2874e14308940839b0c3c0852343f643ee8c359778ded7bc6410232fb0b11e4b99a6592af0b8efe3b79189140f588e3e8b281b60deaa4aeb595588cf05ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4b5cf615f0789d0b581618975fc09df28759fb657bd467673d1a60328b6ace74
MD5 05ade2fe99aa758856e2d1be0bbe20ab
SHA1 c7bc2515e8a3a32f84cf60bed774700b33e9698c
SHA512 e56849c6fea9e43e70fd918b5b37d8d4b48baf0656ca48db00c966e2b6a7eab82ecde95d33037a1037be22114a7ee021c44f885b9a75297cb35bad51b2a4ced9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 91d2bb73a36c0b6f6b3a554e829925db6b60b0d9eb41cf6dd6f428245057f148
MD5 31643aff88407a65d10d3589fd273a47
SHA1 74538b113f7a842ec693de9b917f885a7b1a9647
SHA512 6abcf2f7be2b36e8275eaaab3d2fc7ee04013ca08f9e2adfc53d418db8ae36fe79c23ade5265ad05a71ae79580a97a1ed06ecf768fb8271e763e87852061f2ff
MD5 SHA1 SHA512

Submit Download

svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBACABAACCABCABCCBCBCBAACBBBCCACBBCBACCBBCCBCBABCCA.exe
Size 43.2MB
SHA256 d5108ad89cf23205f7e6fbd61cae5e5d600fe6ce4095e08f8a839af073f07b05
MD5 433a19df3629c94eda5c2d20a93466a8
SHA1 a37f3c5127e242ff58a0498c673abc71e132445a
SHA512 ce470f0099c36b5acc23355203ab68648b0c852efbcaed1798a688dd1824570389b22e5102ef45da55d5618d7561cf09903f797bf993c5d3e43ef10a71df26d6
SSDEEP 196608:kFlfFlfFlfFlfFlfFl4FlfFlfFlfFlfFlfFl4FlfFlfFlfFlfFlfFl4FlfFlfFlC:i33333833333833333833333zY
TLSH
T1EDA7F146FC8640B0DD7A60700CEBE27B4935BE3AC026899AF9CE7B067B37E61541F456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 a2f52b67d13151ff064c75c330edcea1e09ef4bb7d16948a479a491a381b9f23
MD5 29260fa852df0f9544e343f56452c95b
SHA1 216da9a4f3c5b5e8cac3cb497a3a235cefbc5523
SHA512 6a3864577357826559393e5f65ae8fd9ad86acfd6169d63804a47c297dcb9e7672aa333a782c67da289057b6e64afee3bb21b470a7befabf214fb2bb6f2f3ca6
TLSH
T12511945195B9D863E83268DF86299BF20CE036AFBC5C6E54230D421D6BA9C32CD55CE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/560-6-0x0000000000820000-0x0000000000841000-memory.dmp

Download

memory/2648-83-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/2992-38-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/2992-25-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/4436-89-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/4764-66-0x0000000002520000-0x0000000002521000-memory.dmp

Download