0da8b4b038d0d389879653abd29de410d2e7cecfa0077d13fa43c8f79e3650c7

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e914a0b57c698d6786eafd2e287f81d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 16.6MB
Sample260810-ec89lsvtfx
SHA256 0da8b4b038d0d389879653abd29de410d2e7cecfa0077d13fa43c8f79e3650c7
MD5 e914a0b57c698d6786eafd2e287f81d7
SHA1 b40328fbe386ab0b54c5fe85a1968f5e6b1e3f8c
SHA512 eae04a27edc9db9459dcc642aaf6f3ba2992a156a7fcedb27c1a719656739bddb02bb26996efd393b628a58d6ce7c9b299548b92f48b1129b64cb566e9962d58
SSDEEP 49152:U+ES+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+E7+ES+ES+ES+EFiw2s+ES+ES+ES+x:COU/jIEeQfoR/IuOFVjUu5+
TLSH
T1C5074C09F9874471D87B51B04CDBD3BE8A70BA2187228EEBF64DC71B6A33BA15834715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3980	svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe
3152	svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe
1772	svchost_BCBBCABAABBACCBBBCCBABAAAABACCBBCCCACCCCBAACCBCACAABCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACCCACAAACAAACCCACBBABBABCABACAAABBBCBCCBCBCCBABCCABBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBCABAABBACCBBBCCBABAAAABACCBBCCCACCCCBAACCBCACAABCBB.exe"	svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBBBAAABACACCCBCCCCBBBBCBCBAABABBBBCBAABCBAACCACCBACBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe"	2026-08-10_e914a0b57c698d6786eafd2e287f81d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3044	sc.exe
5060	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1680	cmd.exe
4324	cmd.exe
1076	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e914a0b57c698d6786eafd2e287f81d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBCABAABBACCBBBCCBABAAAABACCBBCCCACCCCBAACCBCACAABCBB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1296	2026-08-10_e914a0b57c698d6786eafd2e287f81d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1296	2026-08-10_e914a0b57c698d6786eafd2e287f81d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1296	2026-08-10_e914a0b57c698d6786eafd2e287f81d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1296	2026-08-10_e914a0b57c698d6786eafd2e287f81d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3980	svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe
3980	svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe
3980	svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe
3980	svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe
1772	svchost_BCBBCABAABBACCBBBCCBABAAAABACCBBCCCACCCCBAACCBCACAABCBB.exe
1772	svchost_BCBBCABAABBACCBBBCCBABAAAABACCBBCCCACCCCBAACCBCACAABCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1296	2026-08-10_e914a0b57c698d6786eafd2e287f81d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3980	svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe
Token: SeDebugPrivilege	1772	svchost_BCBBCABAABBACCBBBCCBABAAAABACCBBCCCACCCCBAACCBCACAABCBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1416	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1680	1296	2026-08-10_e914a0b57c698d6786eafd2e287f81d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	102
PID 1680 wrote to memory of 4140	1680	cmd.exe	104
PID 1296 wrote to memory of 4324	1296	2026-08-10_e914a0b57c698d6786eafd2e287f81d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	105
PID 4324 wrote to memory of 3044	4324	cmd.exe	107
PID 3980 wrote to memory of 4168	3980	svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe	108
PID 1296 wrote to memory of 1076	1296	2026-08-10_e914a0b57c698d6786eafd2e287f81d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	109
PID 1076 wrote to memory of 5060	1076	cmd.exe	111
PID 4168 wrote to memory of 548	4168	notepad.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e914a0b57c698d6786eafd2e287f81d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e914a0b57c698d6786eafd2e287f81d7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCCAAABBABCCBABCCACCAABBAACACCBAAABCBAAAAACAABBABBABBACACCACACBBBCAABCBACCABCCCBCACAAABCBBCAAACCCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCCAAABBABCCBABCCACCAABBAACACCBAAABCBAAAAACAABBABBABBACACCACACBBBCAABCBACCABCCCBCACAAABCBBCAAACCCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAAABCCACBBCCCCCBCBABBABBCBAABAABACAACABACBBCCCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe" start= auto displayName= "UserDataSvc_CAAAABCCACBBCCCCCBCBABBABBCBAABAABACAACABACBBCCCAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAAABCCACBBCCCCCBCBABBABBCBAABAABACAACABACBBCCCAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe" start= auto displayName= "UserDataSvc_CAAAABCCACBBCCCCCBCBABBABBCBAABAABACAACABACBBCCCAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAAABCCACBBCCCCCBCBABBABBCBAABAABACAACABACBBCCCAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAAABCCACBBCCCCCBCBABBABBCBAABAABACAACABACBBCCCAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe
1⤵
- Executes dropped EXE
PID:3152

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABAABBACCBBBCCBABAAAABACCBBCCCACCCCBAACCBCACAABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABAABBACCBBBCCBABAAAABACCBBCCCACCCCBAACCBCACAABCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 104ca706f2cd3aec68136a829f676b159849b8e3e327a5300fbef01b4debcbe2
MD5 23c08b0f8a69e8cf8d939a2907dcb88d
SHA1 a0e08bd438afd2ee20f982ad7af2a79423a862b6
SHA512 e803735009297539672867fef686e3916a8e34d662ea7b543972b7a4cd98b1415e19abb1d07f85db30e06ab7e3b4b9aeae84f3f5fe64ae0c3a462adae56375b8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 203b4f58065cfa0120fba9b54b07f3b73564a96cf503ae1fed8ebfe24a66b166
MD5 5b2cafdb5cace1a621eb5ec6c94875e9
SHA1 dcbfce9d8d4b77730a6e2e723308574a9951d065
SHA512 f52bf069ed7652053b6cb6a6095d99b23c158dc64f52197f56032101406505e05b2b4bc358086eeaa893633de4a8eb228e380c2ee0bdf19c09e7917e287b5332
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 82903b0eeec5f50bde186f984879a4f01b8e9a310086d3190db957434493f356
MD5 6b1ceafd91d84f7cb09850d44476bfc4
SHA1 81f60e56a40a87ec63e6b7933bca4b65700859ce
SHA512 712f1ffbb6f41ff0c8bad2d5ff25013eeb650d0cb53a76198be37162e9daef91e0d4f31dd7b33522939ba84637cf8298a7910733225f371eabc6ce68735c61b8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c900aa7d436bb2c843c64f37827fadca02acc40eede8d31a2dc7eba58c8a8299
MD5 b540a98dc8d6f96ddd530e2aca56cc72
SHA1 7d2c6727c6a110f7585aa062b95cbe49230a887a
SHA512 0ba032f338a2b515cf94c0adc8f33be99da552eac6c077f50a62e26b65bc66900292abfd49bd690897d9321512ce8d3cbbdb74d01f7cbec2871a6190a9e98db3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4b98f4233014b3788087a9b08ce6ecc5bdc1e25413af36fd840a0c4705eb38bb
MD5 d54828dd42925115d225c3096d48b04b
SHA1 d9ff31ec18a5befa3def03c7b5bf789ac52c1e66
SHA512 e132a18c29b305f70c762a8c90b7b65209b376cc206333216512e793855ad9c4dc2b8edea37ec2ba106bae32a26e1f4352bea917792329a5bc7407fddf93b9bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2cca17ac857db7647ae2f9c889b7433488bf6257ec4c776fbf329ea9c200ca0d
MD5 7ea970126b2a955b4c91e03c3c4d8b3b
SHA1 124bb74aef8486fe81c9f0399ecd9a537f7f62b4
SHA512 cfd393f3666ea43a057cc7bd491cba6354e917e5b8a3efe151c4b28899397c90acb17bf82ee93139393b5f8befc1b40d240885e0f95a5cbe2a1eebd986c0239c
MD5 SHA1 SHA512

Submit Download

svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBACBBBBAABCAABBCBCBCACCBBAABCCAAABBCBCCBAAACABACB.exe
Size 16.6MB
SHA256 0da8b4b038d0d389879653abd29de410d2e7cecfa0077d13fa43c8f79e3650c7
MD5 e914a0b57c698d6786eafd2e287f81d7
SHA1 b40328fbe386ab0b54c5fe85a1968f5e6b1e3f8c
SHA512 eae04a27edc9db9459dcc642aaf6f3ba2992a156a7fcedb27c1a719656739bddb02bb26996efd393b628a58d6ce7c9b299548b92f48b1129b64cb566e9962d58
SSDEEP 49152:U+ES+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+E7+ES+ES+ES+EFiw2s+ES+ES+ES+x:COU/jIEeQfoR/IuOFVjUu5+
TLSH
T1C5074C09F9874471D87B51B04CDBD3BE8A70BA2187228EEBF64DC71B6A33BA15834715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 edd9cf78b52a29a5e4363e2577d09259102648f343e3875a5975c3346f37beb1
MD5 0a2f39931d9d4333f6639ead02d0b38b
SHA1 53e8fbed87a4b4006e1813ddd255357ce018635d
SHA512 cf60e5542ac97a416350fe6fbe93f029d9a7579c465215d1c2b588542c32a299efbb03a4e8a95c5a7465699bf54b6e3bfc20433968bd3055f4c7886a404cbaf0
TLSH
T12401FE91E4A9D813E83369CB462A9FE70CD8769FBC5C5E1413884619BB98C23CD514F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1296-6-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/1772-80-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/3152-74-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/3980-38-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/3980-25-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/4168-67-0x0000000002E40000-0x0000000002E41000-memory.dmp

Download