d382e3d8a576b9cabf8d56d1c477da037decf0e88982022a427995324a270995

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_21fe5d8b318d0dc8cf1290287058129f_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 18.8MB
Sample260810-denv1shr4t
SHA256 d382e3d8a576b9cabf8d56d1c477da037decf0e88982022a427995324a270995
MD5 21fe5d8b318d0dc8cf1290287058129f
SHA1 9e718a6e4253401e2e666c5753427facac421313
SHA512 1ee4c0df94e80ec8017ca5d72dfd93e1469725a7c73dcc00bf339541c5f6a2d09b0b8fce5a64058d4ad225909ddefa88643c22c3fbf49c38bc466470924d6b23
SSDEEP 196608:vBBB+BBB+BBB+BBB+BBB+BBB+BBB+BBBdKWQc0gEYnvL1:tcZEIvJ
TLSH
T111178D01B7818032F4B315328ABFD37A5578B9615F6986CFE388172E5E717E0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5528	svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe
2772	svchost_ABBABCCCAABCCAAAACCAABABBABCCACABCCABACCBCBCCCACAABBCCB.exe
1028	svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBAACAABABBAAAAACABBBCAAABAACAABCCACABABACABCBBBBACBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe"	2026-08-10_21fe5d8b318d0dc8cf1290287058129f_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBBAACCAACBCCBCBABBCACCBCABBCCAACABCABCBACCACCBAAACACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBABCCCAABCCAAAACCAABABBABCCACABCCABACCBCBCCCACAABBCCB.exe"	svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4800	sc.exe
3880	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6060	cmd.exe
3592	cmd.exe
3396	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_21fe5d8b318d0dc8cf1290287058129f_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBABCCCAABCCAAAACCAABABBABCCACABCCABACCBCBCCCACAABBCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1488	2026-08-10_21fe5d8b318d0dc8cf1290287058129f_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1488	2026-08-10_21fe5d8b318d0dc8cf1290287058129f_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1488	2026-08-10_21fe5d8b318d0dc8cf1290287058129f_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1488	2026-08-10_21fe5d8b318d0dc8cf1290287058129f_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5528	svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe
5528	svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe
5528	svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe
5528	svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe
2772	svchost_ABBABCCCAABCCAAAACCAABABBABCCACABCCABACCBCBCCCACAABBCCB.exe
2772	svchost_ABBABCCCAABCCAAAACCAABABBABCCACABCCABACCBCBCCCACAABBCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	2026-08-10_21fe5d8b318d0dc8cf1290287058129f_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	5528	svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe
Token: SeDebugPrivilege	2772	svchost_ABBABCCCAABCCAAAACCAABABBABCCACABCCABACCBCBCCCACAABBCCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 6060	1488	2026-08-10_21fe5d8b318d0dc8cf1290287058129f_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	92
PID 6060 wrote to memory of 5168	6060	cmd.exe	94
PID 5528 wrote to memory of 6036	5528	svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe	95
PID 1488 wrote to memory of 3592	1488	2026-08-10_21fe5d8b318d0dc8cf1290287058129f_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	98
PID 3592 wrote to memory of 4800	3592	cmd.exe	100
PID 1488 wrote to memory of 3396	1488	2026-08-10_21fe5d8b318d0dc8cf1290287058129f_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	101
PID 3396 wrote to memory of 3880	3396	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_21fe5d8b318d0dc8cf1290287058129f_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_21fe5d8b318d0dc8cf1290287058129f_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCACCAAAABABAAAABBCBABBCBBCACCBBCCABCBBCCCACACABBBBCCCCCBACCBCCABCBACCBBCBACBCACBBBBBBAAACACBABABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCACCAAAABABAAAABBCBABBCBBCACCBBCCABCBBCCCACACABBBBCCCCCBACCBCCABCBACCBBCBACBCACBBBBBBAAACACBABABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACCCACABCCCAABACCAACBABACBCCCBBAACAABCCCABACACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe" start= auto displayName= "UserDataSvc_CAACCCACABCCCAABACCAACBABACBCCCBBAACAABCCCABACACBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACCCACABCCCAABACCAACBABACBCCCBBAACAABCCCABACACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe" start= auto displayName= "UserDataSvc_CAACCCACABCCCAABACCAACBABACBCCCBBAACAABCCCABACACBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACCCACABCCCAABACCAACBABACBCCCBBAACAABCCCABACACBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAACCCACABCCCAABACCAACBABACBCCCBBAACAABCCCABACACBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5528
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCCAABCCAAAACCAABABBABCCACABCCABACCBCBCCCACAABBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCCCAABCCAAAACCAABABBABCCACABCCABACCBCBCCCACAABBCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe
1⤵
- Executes dropped EXE
PID:1028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed4de74c2400fd53f3fdf2a8a7a1847dc62a8f3b4d91f15d8a2a75090a76d05d
MD5 8a0f872e2f5165d3378e862458c6c074
SHA1 a44418e74c1b4f6e122e9c9866880741415daae0
SHA512 fed50bc58196613bb4710cdc3b29a07fe637b58e208fe05edbc8e265ce03f5568fd87762aaf943b8ede3dc78c4b0eab835c32540b291a92c42a946849c484294
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 02d8b0487695d6bc69332eefebf23567fa4018bf4bc4a77a47d3285a6b358378
MD5 2019d3267e67a34123388dc45d96afaa
SHA1 2a7f911f86a5609ec7aa88cb013c814fda192c0d
SHA512 71002ed07388eb810159239cfad279473c9685436ed57a0eea512b63ed8299b1357930f6611c88af8e248756b31ca181aa9f85a2e6eadc7e99a968287951f80c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 83d49489d6639188bf0945df7391f77bf0dfc2cfeb3f4a917b3cbe14fede49c8
MD5 3125d1ee969fedb19e54796ac15c507e
SHA1 26756d785fa593316e3dd625ad06af694bc1a264
SHA512 42818a7397eeb6c95ee0520c44b6f3ed01e7b05ee2b9bff56643c7b4b3c5fbb6ffce06345b5fef6b4f7f7d4f7bad1094036f24dfeb3392bcf5b9e85b893a8122
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b4e2721d9c5ca8ae93e9c000eeefbc28432ff993931af7398c0d47c093d8b600
MD5 607f07cf864815c01ff5787e53327e9b
SHA1 d4988195f8810fec5601a947400105611af20c5b
SHA512 b6d6535fee4a33ea61157b5efe14a548ed3969983e96a44f35c54651adfdadff5a4cfa76135f7b532fb5613bbb02000e9ba1597bf7f4c8a487263799879dfb0f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 491903846fd15282935c78241da324aee88a19a01e605029f7eaa2810616ff28
MD5 0527db361ba225e47634f16b4bcab1e3
SHA1 042ea4c23bf25474f3b933f6b05e377c48998f9a
SHA512 c3783325647bdf75e52a79116156894ff9a2e4ec256c9a4476a3cec8d74546f39d4ff7a3ed40b9204aa3c39a273cfa8699e0f4895984b6e4f6f3e7a2d5ae1851
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 de1333bfc84a475a5e98e183b68b4d835f5b94d8201e8643720db3d119a01f13
MD5 95867ad22060a353a556356deba2888c
SHA1 5aa649f02ecddcd872a82457a396fa928abed40f
SHA512 54250964caebf272be8f6f45e225b65ee757cf5f4e780e66518d93217aa4ed8e63ccf6d030f13dc185381c761897a427bd646e0a7ec3e8dad828d43476a92c86
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 54836a4b06a9932d2b77ccae04f49c18e70184434b06cd57834b71bba0e76a9f
MD5 5f4d421be9d60422f4745f21ab222650
SHA1 a8d99c7d90899d5d71e2602eece3b7ef7d3e15a4
SHA512 da006066a31050219ae5546d2af8da0bd837eac9b14f7d4e7b23b65c1339800da97a653619889a0af1ce834177c89feacf92bef55385e7c2043eadf11321e563
MD5 SHA1 SHA512

Submit Download

svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBABCBACABABCBACBACCCBCCABCCCACABCACCBAABBCAABCBCA.exe
Size 18.8MB
SHA256 d382e3d8a576b9cabf8d56d1c477da037decf0e88982022a427995324a270995
MD5 21fe5d8b318d0dc8cf1290287058129f
SHA1 9e718a6e4253401e2e666c5753427facac421313
SHA512 1ee4c0df94e80ec8017ca5d72dfd93e1469725a7c73dcc00bf339541c5f6a2d09b0b8fce5a64058d4ad225909ddefa88643c22c3fbf49c38bc466470924d6b23
SSDEEP 196608:vBBB+BBB+BBB+BBB+BBB+BBB+BBB+BBBdKWQc0gEYnvL1:tcZEIvJ
TLSH
T111178D01B7818032F4B315328ABFD37A5578B9615F6986CFE388172E5E717E0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 14499305d7c2faff01e25c7d810f9ee4f2f436170bad5bcaae23c6aa893375ec
MD5 bb645ef0726b883c67e23e56f9390ba4
SHA1 e2bf151b0f262d0e3c35e3244db589d58d21c190
SHA512 eaf5e912227cb5041f81e59edd38433f5d71bf0e80c07e9824a2ada6a13ec24c9c2b301c0f09a2ca914d64594bb3f1e1f6484430416659bb3abe30567e40b621
TLSH
T17D112770E8B9C867E93369CE511DEBB20CD033AFAC5C6E501346811C6E61C31CD618D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1028-84-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download

memory/1488-7-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/1488-0-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/2772-64-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/2772-82-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/5528-33-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download