083d3f501aa8d20955cd5a1434cd1f9c5ae2239f8b85abcbd3db079bcfc2c25a

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_a01d0f3c45d974180c7c8a67558064ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 6.2MB
Sample260810-cmjetstsbx
SHA256 083d3f501aa8d20955cd5a1434cd1f9c5ae2239f8b85abcbd3db079bcfc2c25a
MD5 a01d0f3c45d974180c7c8a67558064ed
SHA1 d1055affdbda066ef680ab93a7fe13d5a0731bdb
SHA512 91efc9c809e822069437046bbbf2156e052e472d8391c569afda86eb7b58c1590299507a5ee5d1c5bb4e166ec0a357c023184e933ad557915e088346d99be9f3
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+E6+EF+Ei+EF+Ei+EF+E6+EF+Ei+EF+Ei+EF+E6+EF+Ei+EE:JOU/jIEeQfoR/IuOFVjUu5l
TLSH
T11B666C09FD8344B1D92B11B00CDBD3BF8A70BA25C5228DABFB4DC71B6B32B515829756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3808	svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe
4744	svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe
5976	svchost_AABCAACCCABCCABBCBBCBCABCABBCABBBCBBCACBABABBBAACABBBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCBCCCBCBAACBAACCBBCACCCCBCCBACCACCACBCCCACBACBBACAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe"	2026-08-10_a01d0f3c45d974180c7c8a67558064ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAACCBAABBBCACBABABCBCCAAAABBCBAAACCCCCBAACBBCBCBACBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCAACCCABCCABBCBBCBCABCABBCABBBCBBCACBABABBBAACABBBAB.exe"	svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1100	sc.exe
1496	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5072	cmd.exe
1520	cmd.exe
2108	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCAACCCABCCABBCBBCBCABCABBCABBBCBBCACBABABBBAACABBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_a01d0f3c45d974180c7c8a67558064ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4816	2026-08-10_a01d0f3c45d974180c7c8a67558064ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4816	2026-08-10_a01d0f3c45d974180c7c8a67558064ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4816	2026-08-10_a01d0f3c45d974180c7c8a67558064ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4816	2026-08-10_a01d0f3c45d974180c7c8a67558064ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3808	svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe
3808	svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe
3808	svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe
3808	svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4816	2026-08-10_a01d0f3c45d974180c7c8a67558064ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	3808	svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 5072	4816	2026-08-10_a01d0f3c45d974180c7c8a67558064ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 5072 wrote to memory of 1908	5072	cmd.exe	94
PID 4816 wrote to memory of 1520	4816	2026-08-10_a01d0f3c45d974180c7c8a67558064ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	95
PID 1520 wrote to memory of 1100	1520	cmd.exe	97
PID 4816 wrote to memory of 2108	4816	2026-08-10_a01d0f3c45d974180c7c8a67558064ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 2108 wrote to memory of 1496	2108	cmd.exe	100
PID 3808 wrote to memory of 6100	3808	svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_a01d0f3c45d974180c7c8a67558064ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_a01d0f3c45d974180c7c8a67558064ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAAAACBACBCACBCCBBACCBCAAAACACCABBABBCBACBBBBBCCCCABACACACABCBABBCAAABCCAAACBAABBCAAAAAABBBCCAABCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAAAACBACBCACBCCBBACCBCAAAACACCABBABBCBACBBBBBCCCCABACACACABCBABBCAAABCCAAACBAABBCAAAAAABBBCCAABCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCCAAACBACAAAACBACCAABCCBCCCBBABCCBBCCACBBBBCBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe" start= auto displayName= "UserDataSvc_BBCCCAAACBACAAAACBACCAABCCBCCCBBABCCBBCCACBBBBCBCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCCAAACBACAAAACBACCAABCCBCCCBBABCCBBCCACBBBBCBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe" start= auto displayName= "UserDataSvc_BBCCCAAACBACAAAACBACCAABCCBCCCBBABCCBBCCACBBBBCBCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCCAAACBACAAAACBACCAABCCBCCCBBABCCBBCCACBBBBCBCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCCAAACBACAAAACBACCAABCCBCCCBBABCCBBCCACBBBBCBCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1496

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe
1⤵
- Executes dropped EXE
PID:4744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACCCABCCABBCBBCBCABCABBCABBBCBBCACBABABBBAACABBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAACCCABCCABBCBBCBCABCABBCABBBCBBCACBABABBBAACABBBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 52b5f081def73ac75cc5d5c9a51049ca933b4b6f5f6942b9d53d6fda6cd34b9d
MD5 0047ae8642f2730920997e0c10986ca5
SHA1 a5c29d6e05d0c71072681172c8b2532e198461b3
SHA512 ac8775545b173464de7a19bc5a11ddbcfb04c7ca6c04f8eb5c711dbfd7b8d90ff84bdd31caa980ba99e19deebb0dd964916487cc442490904bd25a86be4ca9cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 829e73640d995a04fd04fc2a9ce52a721e0b990d1fdd93bd6f41d136e0e09c92
MD5 f63464c01643489554555593abab2c27
SHA1 6ea33ec60cbe1e60b0ebf4557df79f244c133a9e
SHA512 bc88057241e82cd9472ac60d68427c69cd5b8b69701db665ee7b8d3a2ad0221817bdb1dcfd086d91cd4c9fd849ca3bedba49ef7428832a0f3420d7b3c5afa7f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 332618243842b0d23af5b786bd628b12d769610424883be2b63441633aae86c2
MD5 672352a32c8241ade9241daa04cec02e
SHA1 e215834d3026e90795574f29068c23f3c8e9652e
SHA512 ad47c3d38d35fef7680c90b5f7f36484b462dc8a3317a2feccad9f55912ca539ea7fd4bb7c1f71941bf06867a613e8e2bc46079a30c097ffc1b2e333dd5153c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 eb6ab406949f9729c28de45ad958f99ffc438519d81c86f7aac38c0109d4b419
MD5 784b1202e6e4b24790443ebe3c95ba98
SHA1 20c551ebdbc6cc08066cf938ded4da4fba967a04
SHA512 7cb58820af7ba58d0cfa66193dd082cbfc86387562363759d67e28596f9c1bbca45f062e1c73ba2afe3224a55f97aa81c967ab4e40f6f03bdb6dcb6f7d6645e9
MD5 SHA1 SHA512

Submit Download

svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCBBBCBBCCAAAABBAAAACACAACBAACCAACCCCCBCBAACBBBCAA.exe
Size 6.2MB
SHA256 083d3f501aa8d20955cd5a1434cd1f9c5ae2239f8b85abcbd3db079bcfc2c25a
MD5 a01d0f3c45d974180c7c8a67558064ed
SHA1 d1055affdbda066ef680ab93a7fe13d5a0731bdb
SHA512 91efc9c809e822069437046bbbf2156e052e472d8391c569afda86eb7b58c1590299507a5ee5d1c5bb4e166ec0a357c023184e933ad557915e088346d99be9f3
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+E6+EF+Ei+EF+Ei+EF+E6+EF+Ei+EF+Ei+EF+E6+EF+Ei+EE:JOU/jIEeQfoR/IuOFVjUu5l
TLSH
T11B666C09FD8344B1D92B11B00CDBD3BF8A70BA25C5228DABFB4DC71B6B32B515829756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3808-23-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/3808-36-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/4744-67-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/4816-0-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download

memory/4816-7-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download