961919484c526367e477aee8b6bb44734f89bf0da1ea5de3f819f5051b1c39ae

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_d5fff36dbec66d6031495848a7bf30bf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 19.3MB
Sample260810-can5jsde35
SHA256 961919484c526367e477aee8b6bb44734f89bf0da1ea5de3f819f5051b1c39ae
MD5 d5fff36dbec66d6031495848a7bf30bf
SHA1 0c3a0835bb0105133164a3ac4adeaf90e6084c1e
SHA512 12a010a420a766a811e69a8396a5d8db2333e39b20a28af182afcc97fa48f41651bc3d595f48ce922d0badc809e5791a4d95c72ed67080c08a62b12cc3f1a239
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMV+ElwM8hOh+ElwMV+ElwMV+ElwMV+ElwMV+ElwMf:LzzzzzzzROU/jIEeQfoR/IuOFVjUu5U
TLSH
T1F6177E19F6980CE1E87351388996C619DA7274251B21CBCBB2ACC33F6F336D5AD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3708	svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe
5680	svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe
2700	svchost_CBAABBCCABACCCABBCACCBCACBCAACBBACBBCBCCBCAAAACACACACCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACCAAACABAACCACBCACBAAACBACAAACCAACCABABBBBCBCCAACCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe"	2026-08-10_d5fff36dbec66d6031495848a7bf30bf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCCBCABAABCAAAABCBBAAABABCCCBCCCCBBBCACBBBCACCACAAAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAABBCCABACCCABBCACCBCACBCAACBBACBBCBCCBCAAAACACACACCA.exe"	svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1660	sc.exe
2348	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5448	cmd.exe
1752	cmd.exe
5940	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAABBCCABACCCABBCACCBCACBCAACBBACBBCBCCBCAAAACACACACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_d5fff36dbec66d6031495848a7bf30bf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4680	2026-08-10_d5fff36dbec66d6031495848a7bf30bf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4680	2026-08-10_d5fff36dbec66d6031495848a7bf30bf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4680	2026-08-10_d5fff36dbec66d6031495848a7bf30bf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4680	2026-08-10_d5fff36dbec66d6031495848a7bf30bf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3708	svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe
3708	svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe
3708	svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe
3708	svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	2026-08-10_d5fff36dbec66d6031495848a7bf30bf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3708	svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 5940	4680	2026-08-10_d5fff36dbec66d6031495848a7bf30bf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	91
PID 5940 wrote to memory of 704	5940	cmd.exe	93
PID 3708 wrote to memory of 3792	3708	svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe	94
PID 4680 wrote to memory of 5448	4680	2026-08-10_d5fff36dbec66d6031495848a7bf30bf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	95
PID 5448 wrote to memory of 1660	5448	cmd.exe	97
PID 4680 wrote to memory of 1752	4680	2026-08-10_d5fff36dbec66d6031495848a7bf30bf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 1752 wrote to memory of 2348	1752	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-10_d5fff36dbec66d6031495848a7bf30bf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d5fff36dbec66d6031495848a7bf30bf_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACBBABCBABACBBBCBCBBACBBACBBBABBACAACCBBCBABAAACCAACBBBCCCCABCAABBBBABCBCBAACCABCABCAAACCCCBCCABBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACBBABCBABACBBBCBCBBACBBACBBBABBACAACCBBCBABAAACCAACBBBCCCCABCAABBBBABCBCBAACCABCABCAAACCCCBCCABBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBACBCCCACAABBAAABBCACABABBACBCBAABABCBCCBAAABCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe" start= auto displayName= "UserDataSvc_ABBACBCCCACAABBAAABBCACABABBACBCBAABABCBCCBAAABCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5448
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBACBCCCACAABBAAABBCACABABBACBCBAABABCBCCBAAABCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe" start= auto displayName= "UserDataSvc_ABBACBCCCACAABBAAABBCACABABBACBCBAABABCBCCBAAABCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBACBCCCACAABBAAABBCACABABBACBCBAABABCBCCBAAABCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBACBCCCACAABBAAABBCACABABBACBCBAABABCBCCBAAABCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3792

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe
1⤵
- Executes dropped EXE
PID:5680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCCABACCCABBCACCBCACBCAACBBACBBCBCCBCAAAACACACACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCCABACCCABBCACCBCACBCAACBBACBBCBCCBCAAAACACACACCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 179ac730bf652e45755475708128e54975ca348d13822b2c4a20e3816de6d1c2
MD5 8937043e9e4833601c9c0d1e9b7bc7a7
SHA1 3166f31a615078ffcf65f873da658440cccad041
SHA512 c3091bcb0ab40e15e5324e30b51a40d7d466355a0d9f0f19b91069347b3c3655a162ebdf2bf25f52a622226b5466387dc2f35286599cb44bdc216d49ec6783bd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 79b3a3981e5f85013dbd5d3c9716dab6547997c5727d6a42ed9e1cfabb7865e5
MD5 70b67dee0184986417cbc4a5341025c5
SHA1 d6d95f31c6b89a8d79b7b7413b5ea118a5f64e8b
SHA512 73fc2310e420206f7baee8d53e6039b4bf9bca0ce7d162e35370de350c46cf87950611e93f398e03d97d2de3e7c294de99b7c5f0975bae250b92ab7b0f7a7609
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b9780fce754a8c7d7f9b5fc5fd6ba2a16e72b7ab400b9fcaa086314c3553f78
MD5 f07795bbae192353f9d7303e8698ac36
SHA1 4d3f17539db3c68ce40797ac54e07bff9719cf26
SHA512 0a0bf142908440276d5b8532e76a8a1255ac75e8584be3e30f3b96976f1b2ae6822c1c5cee834431c91e73db9183150daf94e397eabad426876c7918658420c6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7c5991e0c84e5c97e1b8b21676b7afc46a0e16422e5366c005a0333c7c31fe82
MD5 6448ea99fdce39f9fb0c4904bfd02df5
SHA1 816e667bda6c7bbe42018128c21dda9b1aa99a83
SHA512 afdf97d6a997bd36e678c98d2116ec46fe869d9a38849f479189b2f214fc5c74f55409a5ed5c65d273e815738bfb3002e263e7cc25ae2c92904baf938dbda80c
MD5 SHA1 SHA512

Submit Download

svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCACBAAABCBCBBCBCBACABCAAAACABBCBBABBCCABACBACABACA.exe
Size 19.3MB
SHA256 961919484c526367e477aee8b6bb44734f89bf0da1ea5de3f819f5051b1c39ae
MD5 d5fff36dbec66d6031495848a7bf30bf
SHA1 0c3a0835bb0105133164a3ac4adeaf90e6084c1e
SHA512 12a010a420a766a811e69a8396a5d8db2333e39b20a28af182afcc97fa48f41651bc3d595f48ce922d0badc809e5791a4d95c72ed67080c08a62b12cc3f1a239
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMV+ElwM8hOh+ElwMV+ElwMV+ElwMV+ElwMV+ElwMf:LzzzzzzzROU/jIEeQfoR/IuOFVjUu5U
TLSH
T1F6177E19F6980CE1E87351388996C619DA7274251B21CBCBB2ACC33F6F336D5AD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3708-24-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/3708-37-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/4680-0-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/4680-7-0x0000000000900000-0x0000000000921000-memory.dmp

Download