0ef0ea7acaef846b9f8ebc1b7b48eb5ca893ddb443cd06778934b9448e9b6d57

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_80936c823d5af30d7b085da875176796_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 42.8MB
Sample260810-e7tgms1ejf
SHA256 0ef0ea7acaef846b9f8ebc1b7b48eb5ca893ddb443cd06778934b9448e9b6d57
MD5 80936c823d5af30d7b085da875176796
SHA1 7c1023918df3cd3caebfc86ff6b17fb3de46f178
SHA512 635ae3717d9269a8a8ec0521fa6b261e67ec4a088d49cd4420a569c9db830068404526125983ef379aa5f67c9e41ffbe1cf27bbaa50f9de06cb51fb8d3736e5a
SSDEEP 786432:N5U5U5H5U5U5U5H5U5U5U5H5U5U5U5M5U5U5H5U5U5U5H5U5U5U5H5U5U5U5M5U7:E
TLSH
T1BBA72B18F7D71161FA7756B08CEBC2FA5D307E2087318AEFE605E60A2D26AD0D439716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5752	svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe
2448	svchost_BACCCABACABCCBAABCCBACABCBABABBCBCAACBACCACAABCACCCCCBB.exe
2872	svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACAABBAAAACCCAAAABBACCACCCCBCCBBCAAAABAAABCBBAAABBBABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe"	2026-08-10_80936c823d5af30d7b085da875176796_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBCABCCBBAACCBABCACBBBBCBCBBACAAACCCBBBBBACCCCABAAAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCCABACABCCBAABCCBACABCBABABBCBCAACBACCACAABCACCCCCBB.exe"	svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5816	sc.exe
4388	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4912	cmd.exe
3904	cmd.exe
2976	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCCABACABCCBAABCCBACABCBABABBCBCAACBACCACAABCACCCCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_80936c823d5af30d7b085da875176796_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3068	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3464	2026-08-10_80936c823d5af30d7b085da875176796_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3464	2026-08-10_80936c823d5af30d7b085da875176796_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3464	2026-08-10_80936c823d5af30d7b085da875176796_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3464	2026-08-10_80936c823d5af30d7b085da875176796_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5752	svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe
5752	svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe
5752	svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe
5752	svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	2026-08-10_80936c823d5af30d7b085da875176796_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5752	svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 4912	3464	2026-08-10_80936c823d5af30d7b085da875176796_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 4912 wrote to memory of 3068	4912	cmd.exe	94
PID 5752 wrote to memory of 4628	5752	svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe	95
PID 3464 wrote to memory of 3904	3464	2026-08-10_80936c823d5af30d7b085da875176796_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 3904 wrote to memory of 4388	3904	cmd.exe	100
PID 3464 wrote to memory of 2976	3464	2026-08-10_80936c823d5af30d7b085da875176796_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 2976 wrote to memory of 5816	2976	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_80936c823d5af30d7b085da875176796_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_80936c823d5af30d7b085da875176796_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCAACAAABACCBCABCBCBACCCABCAABCAACACBCCCABABBABBCBCCABBCABBAABBCACBCCACABABCCCBCBCAAABBCCCAACCAACACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCAACAAABACCBCABCBCBACCCABCAABCAACACBCCCABABBABBCBCCABBCABBAABBCACBCCACABABCCCBCBCAAABBCCCAACCAACACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBCCACBAACCBABBBCCBBBCCBAABBBBACABBCCCABBBACCCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe" start= auto displayName= "UserDataSvc_AACBCCACBAACCBABBBCCBBBCCBAABBBBACABBCCCABBBACCCAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBCCACBAACCBABBBCCBBBCCBAABBBBACABBCCCABBBACCCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe" start= auto displayName= "UserDataSvc_AACBCCACBAACCBABBBCCBBBCCBAABBBBACABBCCCABBBACCCAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBCCACBAACCBABBBCCBBBCCBAABBBBACABBCCCABBBACCCAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBCCACBAACCBABBBCCBBBCCBAABBBBACABBCCCABBBACCCAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5752
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4628

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCABACABCCBAABCCBACABCBABABBCBCAACBACCACAABCACCCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCABACABCCBAABCCBACABCBABABBCBCAACBACCACAABCACCCCCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe
1⤵
- Executes dropped EXE
PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 39b606bcce0e9b66e989fc44de46eb7166721cd1b06008fd5c3de36b9d338f9d
MD5 f7c6b70347207265807719c3cde2b7c8
SHA1 154ac00dbdabae0b8d3a49254b2bda0fded9ea6d
SHA512 cc6fb0774168d27f5fa3b94d22c8469563ced6a79f570f7baa9c59a4df277d6146e707f17f0df3f6a00562b1935fb0e06b96803d8a56822a06ce310955a1ebbc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 69648e726817aaa139ee1a32daaf6e962ae927fa3e6c056a49c7901c1aab2ef2
MD5 a3ad0a86682a7b69b8c8116f2c7b8932
SHA1 a61f6e2ed1317db583ae94caee76f6da0ea6b35e
SHA512 a510a7825ba0b1845d2cc099f2ee9132b217d5de35965b3efc6a3af6d8e20378ba73f3caa88dfe1f8201b96ec2030342172b3c422bfc1e9c59e7b5c973448fc4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 54d046d3649fa1b4153b0e197dfc06bb16b404992b4597c17c58b00071adb89a
MD5 16b6b0a7fd41f0d7f85edf7ca6594216
SHA1 f3ebb7e5c3b20555d9a1a43535bf2e8fae23eb9d
SHA512 92339fd22ac5efc050c12dbc8869393b5f2d35ba66944ec391d1187686b30ca3d3da8a551b439e88dc8c71e11aeb741f7e2f662e56621ffc814ff215374b219b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 66b9950cac2cf29879c3fac1d15f8ce6c1bca1ddd07a204b89c286e6b9e06cfd
MD5 7a595d7cc5ceb7d6385540996e6f776c
SHA1 7993c6fdf75e3420ade7144e82f2ec8ea1e7480f
SHA512 fbbd2690f92f8f364a886f01c09208b7384bae266cd60b11a6ef426275e8c766f14da47f1393ac4fa1802d569a4b7e9375d9d6d5159b5a1dc4fb058e3a68206b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0940a78bb116b6878418d9e019c3d4860f4e52ef0a6748ef3d150e4160e565a0
MD5 4d934bbde28b0f1bead15e56892b6d53
SHA1 e1864245f09b7d9b278a814c8a6cc6de2a69c51a
SHA512 623046c4714e853ac7e22c87601c416152a2ded8b687c284d122ecd489a64faba27b586a42fe9694ecaefaed21e88b8fac20a49f77802787814b8a8d42a731f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 852833b41c7d3d065010a6018207e10776b9960e26f32b64133d4ad5c33583ea
MD5 bea21997bea8ebb150ac39561947807a
SHA1 0162657f2e8d9bd5643226de8324d073f6078a1c
SHA512 c14c70069d2e18414927e51ac6d6e6233f479fea05218807bdf27a834e4e117e9380ec4d49d2df98c74f94d0fb4b0efb5d41aceba8c895e413f864d6bb10a218
MD5 SHA1 SHA512

Submit Download

svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCACBCACCAABCBCABACCBBACCAAAABACCACCACCBCABCCCCBA.exe
Size 42.8MB
SHA256 0ef0ea7acaef846b9f8ebc1b7b48eb5ca893ddb443cd06778934b9448e9b6d57
MD5 80936c823d5af30d7b085da875176796
SHA1 7c1023918df3cd3caebfc86ff6b17fb3de46f178
SHA512 635ae3717d9269a8a8ec0521fa6b261e67ec4a088d49cd4420a569c9db830068404526125983ef379aa5f67c9e41ffbe1cf27bbaa50f9de06cb51fb8d3736e5a
SSDEEP 786432:N5U5U5H5U5U5U5H5U5U5U5H5U5U5U5M5U5U5H5U5U5U5H5U5U5U5H5U5U5U5M5U7:E
TLSH
T1BBA72B18F7D71161FA7756B08CEBC2FA5D307E2087318AEFE605E60A2D26AD0D439716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2448-65-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download

memory/3464-0-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/3464-8-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/5752-34-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download