8727068344ecc914fde82a8459d6b25570ead2afaede1f9cf719c6835e1e9784

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_c35b7d5befd679234605eeafafad4cf6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
Size 22.3MB
Sample260810-cdl5csygja
SHA256 8727068344ecc914fde82a8459d6b25570ead2afaede1f9cf719c6835e1e9784
MD5 c35b7d5befd679234605eeafafad4cf6
SHA1 664a124c839d9fd2a38faab0a72c81e1370c71c0
SHA512 a15057922fbde386cb54cc41d33e8ad976690e688a30c3f4d03bfb395edc3f546211615e9e2058f5a8a1a32af02682294a74366fc397a3ccd7252809a43411db
SSDEEP 196608:vBBBBIBBBBIBBBBIBBBBIBBBBIBBBBIBBBB0FIF0wuf:of
TLSH
T19D377B11B6C18032F5B329328ABFD339552DB9615F6586CFF38C162E5E70AE1A930727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1728	svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe
3988	svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe
4764	svchost_BBCBBACBBCAACCCBACCAAAACAACCAACABAAABBACBABAAABBCBACBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCABBCCCABACCBACABBCBBAAABBABABABCBABACBAABCAAABBABCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe"	2026-08-10_c35b7d5befd679234605eeafafad4cf6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBBCCBABCCCACABBBABCCBACCBBBCCCBBBABCCCABBACAACACBACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBBACBBCAACCCBACCAAAACAACCAACABAAABBACBABAAABBCBACBCC.exe"	svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3172	sc.exe
4592	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3492	cmd.exe
5940	cmd.exe
2356	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_c35b7d5befd679234605eeafafad4cf6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBBACBBCAACCCBACCAAAACAACCAACABAAABBACBABAAABBCBACBCC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
608	2026-08-10_c35b7d5befd679234605eeafafad4cf6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
608	2026-08-10_c35b7d5befd679234605eeafafad4cf6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
608	2026-08-10_c35b7d5befd679234605eeafafad4cf6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
608	2026-08-10_c35b7d5befd679234605eeafafad4cf6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
1728	svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe
1728	svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe
1728	svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe
1728	svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	608	2026-08-10_c35b7d5befd679234605eeafafad4cf6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	1728	svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 5940	608	2026-08-10_c35b7d5befd679234605eeafafad4cf6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe	94
PID 5940 wrote to memory of 4608	5940	cmd.exe	96
PID 608 wrote to memory of 2356	608	2026-08-10_c35b7d5befd679234605eeafafad4cf6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe	100
PID 2356 wrote to memory of 3172	2356	cmd.exe	102
PID 608 wrote to memory of 3492	608	2026-08-10_c35b7d5befd679234605eeafafad4cf6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe	103
PID 3492 wrote to memory of 4592	3492	cmd.exe	105
PID 1728 wrote to memory of 252	1728	svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_c35b7d5befd679234605eeafafad4cf6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_c35b7d5befd679234605eeafafad4cf6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAAABCCBBCABBCCABACABBCCBBAAACCCCBAACAACBBBCBCBBCAACACCBACACBCACBBCCCAAAACABCCABCBBCBBAAACBAACBCCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAAABCCBBCABBCCABACABBCCBBAAACCCCBAACAACBBBCBCBBCAACACCBACACBCACBBCCCAAAACABCCABCBBCBBAAACBAACBCCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAACACBABCBBCCBAABBBABABBCCBCAABBAABABBACABBACABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe" start= auto displayName= "UserDataSvc_BCAACACBABCBBCCBAABBBABABBCCBCAABBAABABBACABBACABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAACACBABCBBCCBAABBBABABBCCBCAABBAABABBACABBACABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe" start= auto displayName= "UserDataSvc_BCAACACBABCBBCCBAABBBABABBCCBCAABBAABABBACABBACABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAACACBABCBBCCBAABBBABABBCCBCAABBAABABBACABBACABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAACACBABCBBCCBAABBBABABBCCBCAABBAABABBACABBACABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:252

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe
1⤵
- Executes dropped EXE
PID:3988

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBACBBCAACCCBACCAAAACAACCAACABAAABBACBABAAABBCBACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBACBBCAACCCBACCAAAACAACCAACABAAABBACBABAAABBCBACBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ResizePop.exe

Path C:\Users\Admin\Desktop\ResizePop.exe
Size 576KB
SHA256 82c5991b8a63eaa80f220608dc5fad8f9e73adb08cfbbeb30d17a973225b6d3b
MD5 5979dde8068a3b28a3a44482ac9b0293
SHA1 3e54d40324707d733f9db931548bdba4c33f8a82
SHA512 8ded8a2cdac53235cd28bb0a354af95c7d292ae99d48b5a8d37e9af4ba8ce123e854ad4209d3c7f45fadbf2b540cab0585041e3792920bb0a0a49f5baf1b07b2
SSDEEP 12288:mgUFgEsnojAOa0wIk0BX3RKuemGd70ioGuVWW6oIagUFgEsnojAl:m9+EM03afDd70iTWCa9+EM0e
TLSH
T189C47C11FA818035F5B325724AFFE3394528B9218F298ACFE78C472E5D71AE1A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8c4995c59a1417b94f989239bbbf8b4312878b054bcb329866744ab68a7663d3
MD5 9e4456e2ffa424dc7ea81208f21029b2
SHA1 67799bafa670d8f6533a4933b2a04f6de2cb96ce
SHA512 78199f2f7566e80d5d6df15a460ca66f996293992f0744d9dfacf952a9dfc51d1d3ba629d4ef0a601c069df6108b78d9a0354fa806429f48323b6c43756a5d3e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a23882301a65b35760337585fbdb92cf2f5b8cbd71c61842db34085ec4c52361
MD5 dc1fd16226b068aacb76c12006f3b307
SHA1 0393aa03e59dde41fc8696592307f868e42e57ff
SHA512 560fabb65c2a385bd884d4925c15d94790bcd0621bd8f6ab2608f3a50c2117106376e845b19680eb16cf4835bb68cbe6cb871e6fabee77f77e2003008515620f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bfc1767812f663ea8bf6c539eb945a0714ff1fe3f940480fb806315f8c3efa16
MD5 bdcdfbd99929a12ad411156d6875c216
SHA1 39bddace0f504c050f45193bc63bb723b5fa5cfd
SHA512 cc06b1693460c02b2de21bd8bdca132cb0042237bee29f46dbbb8fb524a0bd02e27346ad33d6bc7ac4ee59f43cce846a730ee6ec32d2356c1bc8b413091bb887
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2bc60b51ab297d8c865cca08d0f2e9894e686917e180549b9604082a0a509e6d
MD5 5a5f4beacc00f7988d8f9a6a9c7c75cc
SHA1 653187d2340f73b35227f869752b36458995e6d0
SHA512 9ce1cdb00a42312fc6a7f4a4bcca9a999769c5ae09767d9f06264e108a8f7278de58e7fa808c9f6eab2c6af543de970bf3e209e390bd0b939d116e75e4c1843c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3fad2b4aa9b075001b49ffc4af16ffed90d77e3223a494b731bc3f5180005457
MD5 9ac7871c5846f441b3dd956b8e16f18c
SHA1 13d4e0845ea63f02b8b85418e4755a44a9c151aa
SHA512 7a0b177cc631304fae84c6bf8b26c68e75b7c223151eb00eaa5860b72ba662bcc75d169890c55b65b1db63c5dca1bdbebfdbf40ef4a3cd0cc764dfa0a428ded8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 81e26ca5c8072432ca0dd6d52145c47fb5eeed600001c1f7243cb5dea13f1cb1
MD5 1f03d8d4d8db97d0a6abcffb681ec79d
SHA1 ba13f2210f020b0646dd1a0e7b1288f05d60dc52
SHA512 d1a6b037ca5fcbc1e483ec09582b95218e1d0e44d12b3cf81ba4c5c07ef9757f9d9ddcdf42229b71baf0af85463828c3a019e21ad38a78d536f64f413b409cca
MD5 SHA1 SHA512

Submit Download

svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABCCBCBACACCCABACCABCCCBBCBCBBABBCBBBCABABBBAABCBCCA.exe
Size 22.3MB
SHA256 8727068344ecc914fde82a8459d6b25570ead2afaede1f9cf719c6835e1e9784
MD5 c35b7d5befd679234605eeafafad4cf6
SHA1 664a124c839d9fd2a38faab0a72c81e1370c71c0
SHA512 a15057922fbde386cb54cc41d33e8ad976690e688a30c3f4d03bfb395edc3f546211615e9e2058f5a8a1a32af02682294a74366fc397a3ccd7252809a43411db
SSDEEP 196608:vBBBBIBBBBIBBBBIBBBBIBBBBIBBBBIBBBB0FIF0wuf:of
TLSH
T19D377B11B6C18032F5B329328ABFD339552DB9615F6586CFF38C162E5E70AE1A930727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/608-34-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/608-60-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/608-0-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/608-22-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/608-11-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/608-83-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/1728-51-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/1728-33-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/1728-72-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/3988-86-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download