5f875f0d9e724ee633efe9f2689c0e34331d20b61469134e3f4be68d8640df37

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_bde478cbdb3639a5c4ff4e20ef52f57b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 40.6MB
Sample260810-emsplsea26
SHA256 5f875f0d9e724ee633efe9f2689c0e34331d20b61469134e3f4be68d8640df37
MD5 bde478cbdb3639a5c4ff4e20ef52f57b
SHA1 ec5d07768a150165f5c72461b01071a37c54512e
SHA512 f286ab20ef81ed16a65c25f9c2a9043685f0d64ff5db9718081d6608388ce63fdd4323f4fcfb3a960b1e175cf1a811c94b2adb66165b5c6ff744c1d84c0e5364
SSDEEP 196608:kFlfFlVFlfFl24FlfFlVFlfFl24FlfFlVFlfFl24FlfFlVFlfFl2wKWQc0gEYnvx:i3Z3sO3Z3sO3Z3sO3Z3sxcZEIvx
TLSH
T19797E006FE5980E0C82AC0744897E637D6317C1D8731EAEB9AC5B62B2F777A0593E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c439-19.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4892	svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe
4824	svchost_BBAACBCCBCABCBAAACABCBBBACBCCACBCBAABCAABABCBCCCACBBBBC.exe
3540	svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCACCCABABACBCBABACBBCCBACAABCCCAAACCBBCCABCBBBBAABACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe"	2026-08-10_bde478cbdb3639a5c4ff4e20ef52f57b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAACCBAABBACCBAABABACCBCACBBACAABBABBCACCAAACBCCCAAAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAACBCCBCABCBAAACABCBBBACBCCACBCBAABCAABABCBCCCACBBBBC.exe"	svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1744	sc.exe
2484	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1332	cmd.exe
4172	cmd.exe
1060	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_bde478cbdb3639a5c4ff4e20ef52f57b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAACBCCBCABCBAAACABCBBBACBCCACBCBAABCAABABCBCCCACBBBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5804	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4120	2026-08-10_bde478cbdb3639a5c4ff4e20ef52f57b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4120	2026-08-10_bde478cbdb3639a5c4ff4e20ef52f57b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4120	2026-08-10_bde478cbdb3639a5c4ff4e20ef52f57b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4120	2026-08-10_bde478cbdb3639a5c4ff4e20ef52f57b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4892	svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe
4892	svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe
4892	svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe
4892	svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe
4824	svchost_BBAACBCCBCABCBAAACABCBBBACBCCACBCBAABCAABABCBCCCACBBBBC.exe
4824	svchost_BBAACBCCBCABCBAAACABCBBBACBCCACBCBAABCAABABCBCCCACBBBBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4120	2026-08-10_bde478cbdb3639a5c4ff4e20ef52f57b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4892	svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe
Token: SeDebugPrivilege	4824	svchost_BBAACBCCBCABCBAAACABCBBBACBCCACBCBAABCAABABCBCCCACBBBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 1332	4120	2026-08-10_bde478cbdb3639a5c4ff4e20ef52f57b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	92
PID 1332 wrote to memory of 5804	1332	cmd.exe	94
PID 4892 wrote to memory of 620	4892	svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe	95
PID 4120 wrote to memory of 4172	4120	2026-08-10_bde478cbdb3639a5c4ff4e20ef52f57b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	98
PID 4172 wrote to memory of 1744	4172	cmd.exe	100
PID 4120 wrote to memory of 1060	4120	2026-08-10_bde478cbdb3639a5c4ff4e20ef52f57b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	101
PID 1060 wrote to memory of 2484	1060	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_bde478cbdb3639a5c4ff4e20ef52f57b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_bde478cbdb3639a5c4ff4e20ef52f57b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBAABCBCABABACABBBACCBABBABCCCBBCBACACACCBBCBACBACCAABBCCBCCBACCCACABAABBABAABACACABCACACCBACBBCCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBAABCBCABABACABBBACCBABBABCCCBBCBACACACCBBCBACBACCAABBCCBCCBACCCACABAABBABAABACACABCACACCBACBBCCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABBBBBCCCBCABABCABBBBBAACBABBBCCCAACBACABBCACBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe" start= auto displayName= "UserDataSvc_CCABBBBBCCCBCABABCABBBBBAACBABBBCCCAACBACABBCACBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABBBBBCCCBCABABCABBBBBAACBABBBCCCAACBACABBCACBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe" start= auto displayName= "UserDataSvc_CCABBBBBCCCBCABABCABBBBBAACBABBBCCCAACBACABBCACBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABBBBBCCCBCABABCABBBBBAACBABBBCCCAACBACABBCACBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABBBBBCCCBCABABCABBBBBAACBABBBCCCAACBACABBCACBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:620

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCBCABCBAAACABCBBBACBCCACBCBAABCAABABCBCCCACBBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACBCCBCABCBAAACABCBBBACBCCACBCBAABCAABABCBCCCACBBBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4824

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe
1⤵
- Executes dropped EXE
PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8e84f714e942a4e4e8d38dfa3b8e51ee8569a57407faabc412776b90ab1269b3
MD5 3fbfe44a47d71c9556ba6f868e59c724
SHA1 9c0f4fb24f904aefafc4d6c22ac7f94f2195fc3d
SHA512 b05d550c2f61d520279d6f2ccaa1ddb2acceab52d12974e7abcad8c3d1e4577b493483b67608fb62598772e0f764a892b84768cbb1a5d9966cbf2f1a494b4042
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5f54e68787f29115ce378398d4719f2ca6424030f49cb50f60be2941df444e84
MD5 2a265d6ac3d5b9e941bb5d7b4dc61a14
SHA1 52f6213c3885d9425e5530423372b534a8cec950
SHA512 c1182b71840e9471987e9801da2c2734fd96669c42ba33dd2addea598be1791bbc41018805aaa4f7cde949e269a55de9e1a32f608aadd41280bcc4651112fd2d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9342a13cdc9b98f5eedbb2b0d06a11cbcd41121910b4c6ccf5477645f9a3e87e
MD5 aee4a27a28462786ca5c661cbdd8e164
SHA1 ebad957074d59a7b4056830109bc21612e4aa4e2
SHA512 653347b6abf6ca97ae03c8ca255fbe9128b79defce964fc48b6aaaa8f9ca5d01e1389f791084e775a718797edd2d56642cf10455c33277426fdf5c14bb4d78fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d32ccf5905e16b29e6d4ef9052f1abb850d42fbb9c50067ee2af07bb67a22b39
MD5 fe02711e8daf580faa75e912f6432c0c
SHA1 52ddee6e00e97fde1c141691425d446df897a9db
SHA512 1cc5aea4619368454c9c93ff5d528543ac8a6a1b39cf9af263cde153c4b7f4eab092948c3c13e1065129002169e84f07b1b7441b1c5fc249fd62a05fb9ab6455
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 48c572e62365842675ed193f47d2d19f3662d2b48bdbb71e1361bbfe5d37be00
MD5 9ab53e0b192780f450a64d457834ab3c
SHA1 570a3dc38456147afd10eaf55ce6831ba221ff7d
SHA512 4ea59757475749a08cd33f65d85468311028dd5219502971ff24237e2cd6a0144f47a60f10da161fcf6b53ed24ee9a071229a375c364082b351a18d69ac8779d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 142bd81013f06256b067c3f94277872ad1b4304969087a7cd19a596c9c165f97
MD5 45c75882d72a11990670c1c24144d85d
SHA1 4470a0706dfaa29b2e473e665072823c398e888c
SHA512 9296615dceffe274a4fafe1018c67726b0c6fce758e7a536c2f30cbf04e203358719234f56a0fbae0906da51ca16d0fe748f7e5d70700449b29d1d070c0338b1
MD5 SHA1 SHA512

Submit Download

svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACACBBCBBBABAABCCCCBCBCBABCCACBACAABAABBABAACCAABC.exe
Size 40.6MB
SHA256 5f875f0d9e724ee633efe9f2689c0e34331d20b61469134e3f4be68d8640df37
MD5 bde478cbdb3639a5c4ff4e20ef52f57b
SHA1 ec5d07768a150165f5c72461b01071a37c54512e
SHA512 f286ab20ef81ed16a65c25f9c2a9043685f0d64ff5db9718081d6608388ce63fdd4323f4fcfb3a960b1e175cf1a811c94b2adb66165b5c6ff744c1d84c0e5364
SSDEEP 196608:kFlfFlVFlfFl24FlfFlVFlfFl24FlfFlVFlfFl24FlfFlVFlfFl2wKWQc0gEYnvx:i3Z3sO3Z3sO3Z3sO3Z3sxcZEIvx
TLSH
T19797E006FE5980E0C82AC0744897E637D6317C1D8731EAEB9AC5B62B2F777A0593E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 ede47a6d727d8e0f914c3216f00c8f8dc1590dd3e56a360630058f52e832dcfc
MD5 16fd9ae06abd9837bf5e5a7b3422d643
SHA1 5357510dfe605b883b1f66c5236180b1835226d4
SHA512 b1c590566f3db07bb0103a94356f91ce690f82a8d2996e733d16f4dcada348507a40404afa95715cf477be982852dab1f09685f2af2ff2ce8b719fdd2da64fb7
TLSH
T1AA11E762B8E9D857E93338CA621ACFF30CA437CB781C6B5423484518FB49D31CE954E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3540-81-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/4120-0-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/4120-7-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/4824-79-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/4892-33-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/4892-23-0x00000000006F0000-0x0000000000711000-memory.dmp

Download