961d0fcda16c835b3c0c62d3013e0c40be0f2a33af94ec6dd2bd7c8738bb6877

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_8b8ace6d37acc0a740db66894bbd98b8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 56.9MB
Sample260810-e3gbhsbj2s
SHA256 961d0fcda16c835b3c0c62d3013e0c40be0f2a33af94ec6dd2bd7c8738bb6877
MD5 8b8ace6d37acc0a740db66894bbd98b8
SHA1 8d06a471f6fd4b9bf9d32004f8112eecae6ad1d9
SHA512 8ebb8fde81a664761d6c371b049d2776ad0adddd1c1d3425bbd9c019df04ea1fadc4be5d5f8579f032cf3d445f94e14d94b36f9d8c5cb9e49e427aec4d11be3b
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+EN:lOU/jIEeQfoR/IuOFVjUu5A
TLSH
T176D75C09F94340B1D92B11B04DCBD2BF8A70BA2587128EF7FA4DDB1B7A33BA16434655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4300	svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe
4788	svchost_CACCCCABAAACABCABACBCBAABAABCABCBCACBBAACBCABBAACCCBAAB.exe
4384	svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBAABCCBCBBBBCABACCCCBCBBACCCBAAAAACBACCABCCBBCBBACBCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe"	2026-08-10_8b8ace6d37acc0a740db66894bbd98b8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCBBBCBABCACAAABBAACCBABBAABACCABBCCAACBCABCAAAAABCBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCCCABAAACABCABACBCBAABAABCABCBCACBBAACBCABBAACCCBAAB.exe"	svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4036	sc.exe
516	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
456	cmd.exe
1800	cmd.exe
1664	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_8b8ace6d37acc0a740db66894bbd98b8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCCCABAAACABCABACBCBAABAABCABCBCACBBAACBCABBAACCCBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2852	2026-08-10_8b8ace6d37acc0a740db66894bbd98b8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2852	2026-08-10_8b8ace6d37acc0a740db66894bbd98b8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2852	2026-08-10_8b8ace6d37acc0a740db66894bbd98b8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2852	2026-08-10_8b8ace6d37acc0a740db66894bbd98b8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4300	svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe
4300	svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe
4300	svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe
4300	svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe
4788	svchost_CACCCCABAAACABCABACBCBAABAABCABCBCACBBAACBCABBAACCCBAAB.exe
4788	svchost_CACCCCABAAACABCABACBCBAABAABCABCBCACBBAACBCABBAACCCBAAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	2026-08-10_8b8ace6d37acc0a740db66894bbd98b8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4300	svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe
Token: SeDebugPrivilege	4788	svchost_CACCCCABAAACABCABACBCBAABAABCABCBCACBBAACBCABBAACCCBAAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4248	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1664	2852	2026-08-10_8b8ace6d37acc0a740db66894bbd98b8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 1664 wrote to memory of 5100	1664	cmd.exe	103
PID 4300 wrote to memory of 3228	4300	svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe	104
PID 3228 wrote to memory of 2304	3228	notepad.exe	108
PID 2852 wrote to memory of 456	2852	2026-08-10_8b8ace6d37acc0a740db66894bbd98b8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	112
PID 456 wrote to memory of 4036	456	cmd.exe	114
PID 2852 wrote to memory of 1800	2852	2026-08-10_8b8ace6d37acc0a740db66894bbd98b8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	115
PID 1800 wrote to memory of 516	1800	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-08-10_8b8ace6d37acc0a740db66894bbd98b8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_8b8ace6d37acc0a740db66894bbd98b8_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACBBACBCCAAABACCCAAABBCBABABCCCCBBACBAAABCCAABBABACCACACCBABABAABACAACABAACBBAAACABBACCBCBCBCCCACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACBBACBCCAAABACCCAAABBCBABABCCCCBBACBAAABCCAABBABACCACACCBABABAABACAACABAACBBAAACABBACCBCBCBCCCACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBCBCACCBBCCCBCBABCBCCBBAACCBABCBBACBCBACABBCCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe" start= auto displayName= "UserDataSvc_BBCBCBCACCBBCCCBCBABCBCCBBAACCBABCBBACBCBACABBCCAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCBCBCACCBBCCCBCBABCBCCBBAACCBABCBBACBCBACABBCCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe" start= auto displayName= "UserDataSvc_BBCBCBCACCBBCCCBCBABCBCCBBAACCBABCBBACBCBACABBCCAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBCBCACCBBCCCBCBABCBCCBBAACCBABCBBACBCBACABBCCAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCBCBCACCBBCCCBCBABCBCCBBAACCBABCBBACBCBACABBCCAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:516

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCABAAACABCABACBCBAABAABCABCBCACBBAACBCABBAACCCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCABAAACABCABACBCBAABAABCABCBCACBBAACBCABBAACCCBAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCBCCBBBBCCCCBACBAABCAABABCABBCCCBBCBABCACCBBACABBB.exe
1⤵
- Executes dropped EXE
PID:4384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 13b14a21c775b2f02170ed7880adb07bfdc11d4b8ef56f3a90ae76b239af626f
MD5 c2a1e7dc79bb8f978c2e88a0a4ba56f0
SHA1 f6925db4313c40fab378481654e30c3e6c544e75
SHA512 44ecfa37ccd47869ddd85463e292eb85bdafa78a78f889b4e64ee6f55e04b349b90b6f2924e30efa384f337487429dc321d8aa849d70d1e5487260e3ae919949
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 726020785ab325eba10d6684ee6bff9f41a7ff5a6edeb006cf03b218c2a8d5c8
MD5 596bb4ed4753c1387cc75c0e6f7b8335
SHA1 9c2c6d60f5442f9b38bf71c6a8584ef931459e5c
SHA512 c31f3865aa2f54eb4dc2a2d2c8417fbd76fb20a005836512a78c0940c6a4625efc698f7a38c84f7877914e43e1e58928e4ef21937d6bf9b10c8ca139a8ae88cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 418fdb193ac878f9559020aac188cf2862a4f6b9a9dc1b9e55ff285a6c8449a4
MD5 34362bfaa7575ee867ea3c112a0d3b88
SHA1 bb81c59184baafb63ac0db1a0bbe1f438ed4af83
SHA512 bdab016532060148ecf63ec88c98ff16e95bc04d886ee1a19a0939a5b4b0569028e3e60196d479d4f87d2bec0df110223a9af51772eeb0a9b7cd4bb97f1e7671
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dde4bda412717d06da3cd93b4188e441decca46d311638b5382be660614932c5
MD5 f229d357b4fddd9fe292933acf88abbe
SHA1 1559361f2a84fcc5be5f97d197d720302e9a893c
SHA512 e74dac1a9128e77f8d28ffe47625c649f40358a2df27c1a85cd95ddca4aa99a45a5ef5e5400b14af2b20497efd48f90caa9ad39e256bdae6396b3034d67d84f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2f0384d71b1b7d3048d13fd57b4ef793ca4cdd5a37727d0db94ed73ffcc08477
MD5 0e648609c9b3561ddef618a66c15330a
SHA1 6c06db2c091855493659676ee66ed86d217c3105
SHA512 6125402f19bb5aaf1ac267bb16d02e87bad1d5e3e3c3242f0fc79d5766a437ad38def351332a43f75d2da6490d29cc520932fe94bda0e298bb54d95bbeaf1f32
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 0300dfcc731efcf1775b1064f0966ed19f0db72a24ee47d19ba1b39f9ac76b78
MD5 9f24c4fa2b96d6aba66f9ec2554df9ce
SHA1 75c5471998ef9ef5f7ea4fdc7862a54009b07d40
SHA512 8ae8df2db6a2ab1b2bf4515dc17ab66ef0e8c25835fad51f65c83d3b2c49e47abc1ce1e1acd205ff9be4c803db705617ddf862fcd8f8f49b6a41f6ff00805997
TLSH
T1CE11A760A8E9DC17FE3228CB562ACA7308F0778BBC9CAA1463084218BB55D35CD954F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2852-0-0x0000000000490000-0x00000000004B1000-memory.dmp

Download

memory/2852-8-0x0000000000490000-0x00000000004B1000-memory.dmp

Download

memory/3228-61-0x0000000002D80000-0x0000000002D81000-memory.dmp

Download

memory/4300-27-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/4300-37-0x0000000000990000-0x00000000009B1000-memory.dmp

Download