4902d7607809062dd56724db9e8b06fda07670538838327f609d268c5fba1d15

Analysis

max time kernel
151s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_aaa3f400a9079707a14d057efe20814e_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
Size 37.3MB
Sample260810-ernlfs1brc
SHA256 4902d7607809062dd56724db9e8b06fda07670538838327f609d268c5fba1d15
MD5 aaa3f400a9079707a14d057efe20814e
SHA1 22ae9db58e68d454ebe5369b6b143a7800f39f62
SHA512 5a8b91f6801edb65275c6a754aecdf8c2480ac64f6b6ffed90b30cde5c774ec91328aa7e132d342df672f84c8433e549e65fa7e006f65287ad0c7985b6d04cdb
SSDEEP 98304:T7pW7pW7pW7pW7pW7pW7pW7pW7pW7pW7pV7pW7pW7pW7pW7pW7pW7pW7pW7pW7pA:ZFIF0wuR
TLSH
T106874A02B7E99034F6F31B30AEB992754A7ABD629D35C64F73845A0D1D70A80E934B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5928	svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe
5140	svchost_BABCABBBCAAAACAABABAACBBBAACAAAAAAAABACCBBCACCACBACBCCB.exe
860	svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAABBCBBAAAACABCBABCCAAACAABCCCACAAACBCACCCABAACCBBACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe"	2026-08-10_aaa3f400a9079707a14d057efe20814e_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCABBBCACBCACACBAACAABBBCCBAAACBABBCAABBAABCCABCCCBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCABBBCAAAACAABABAACBBBAACAAAAAAAABACCBBCACCACBACBCCB.exe"	svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5980	sc.exe
2264	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5076	cmd.exe
4784	cmd.exe
5840	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_aaa3f400a9079707a14d057efe20814e_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCABBBCAAAACAABABAACBBBAACAAAAAAAABACCBBCACCACBACBCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
704	2026-08-10_aaa3f400a9079707a14d057efe20814e_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
704	2026-08-10_aaa3f400a9079707a14d057efe20814e_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
704	2026-08-10_aaa3f400a9079707a14d057efe20814e_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
704	2026-08-10_aaa3f400a9079707a14d057efe20814e_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
5928	svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe
5928	svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe
5928	svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe
5928	svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe
5140	svchost_BABCABBBCAAAACAABABAACBBBAACAAAAAAAABACCBBCACCACBACBCCB.exe
5140	svchost_BABCABBBCAAAACAABABAACBBBAACAAAAAAAABACCBBCACCACBACBCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	704	2026-08-10_aaa3f400a9079707a14d057efe20814e_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
Token: SeDebugPrivilege	5928	svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe
Token: SeDebugPrivilege	5140	svchost_BABCABBBCAAAACAABABAACBBBAACAAAAAAAABACCBBCACCACBACBCCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 5076	704	2026-08-10_aaa3f400a9079707a14d057efe20814e_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe	92
PID 5076 wrote to memory of 4580	5076	cmd.exe	94
PID 5928 wrote to memory of 2472	5928	svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe	95
PID 704 wrote to memory of 4784	704	2026-08-10_aaa3f400a9079707a14d057efe20814e_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe	98
PID 4784 wrote to memory of 5980	4784	cmd.exe	100
PID 704 wrote to memory of 5840	704	2026-08-10_aaa3f400a9079707a14d057efe20814e_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe	101
PID 5840 wrote to memory of 2264	5840	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_aaa3f400a9079707a14d057efe20814e_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_aaa3f400a9079707a14d057efe20814e_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACBABBCBBBCAABCCBBCCCAABABBBCBBBABCAABAAABCAAACBACBCCCCCBCCAACAABCCBABAAACBACACCBACBACABAABBBBCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACBABBCBBBCAABCCBBCCCAABABBBCBBBABCAABAAABCAAACBACBCCCCCBCCAACAABCCBABAAACBACACCBACBACABAABBBBCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCBBCAAAACAAAACAACACCAAABCBACCABAABACCCCBCBACCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe" start= auto displayName= "UserDataSvc_BCBCBBCAAAACAAAACAACACCAAABCBACCABAABACCCCBCBACCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCBBCAAAACAAAACAACACCAAABCBACCABAABACCCCBCBACCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe" start= auto displayName= "UserDataSvc_BCBCBBCAAAACAAAACAACACCAAABCBACCABAABACCCCBCBACCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCBBCAAAACAAAACAACACCAAABCBACCABAABACCCCBCBACCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5840
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCBBCAAAACAAAACAACACCAAABCBACCABAABACCCCBCBACCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5928
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABBBCAAAACAABABAACBBBAACAAAAAAAABACCBBCACCACBACBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCABBBCAAAACAABABAACBBBAACAAAAAAAABACCBBCACCACBACBCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe
1⤵
- Executes dropped EXE
PID:860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cfa378e6e035a22b391fa2cf7e220994dae1b3958ec5263b242ea854452f3787
MD5 73c1b6309fe257e1908ce1aa7930446e
SHA1 c1946751fe5cadd833b6baf0968dc66e3304295d
SHA512 091757014c51ca695276bf7da5c4797711778b9bc0fb9a9e6c7a5eefd1be7e037946c7f35d8408cd3e7324a160a67ec297e89c5c5d8d33aa37bbbae2df44c58f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ea797cb2a88909e6e17f00f3859c7e9f165f94a72f674182826e44496696f39e
MD5 af1e91947fd168f553df17bc5636d0a1
SHA1 fa195fe476ef3e19c2dc6ecf3b4e665b8eae13b0
SHA512 5d8e760fe68e7a4b0b84ce41a33762f05feb60e9c7b432707fd5faf93fa13170affbd6265912590321e581f1ce2f0a544c666dde3cf0a3d1cd82e4ab22827965
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b7dc644c38b18bd40b300254f2c4273ff1501965db3466c926a43c41f2d0dbff
MD5 b33b0c3d34e0acdd58c6ebb2729cea06
SHA1 e9e72c43ac4a13ff125c1e3f7db54297eef7a144
SHA512 f79ee748be99cf902d5a2a19a2436931a150d60c94c5cfb1bebe0c427b28df33ad224f7d286cc41fe6b85b3b786112c338a0322844f204e51cc01523c402a7cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b79ddd7e8fe80766f3260569fc7fb3b398a9089bad6d2a0b800d44cba846cbd5
MD5 d88493f4f5db37e8249c73259abacf94
SHA1 e4154d9bb257f33b819fa064fffdfd16d412024e
SHA512 7d83e4aec92891331be1699e69a515b447c98917b26fc1e56ec3efe7a49080fae116e5be8501502189827c406dad4d46555dc895a6e4fb64c201cab8e96c2254
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 26bccfc028a11a34a57118d63e5b6fbbc87c5da4a56cc35ffcd2c7adb9ec7660
MD5 e8353b7ec9c9bb76f0e89683af622d0b
SHA1 1851971e5fbc7f5184e8903eeac55526a3b59292
SHA512 10e340c9f2fe637ccf019abfd44bf160c78e5191b04bca724d988b0c5a0f5746b4e3a5f67a8dad6978f156830865d7625d34aa1730d3c49ddd68abca2aea5e76
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f0829bef57d7c7aa04ea27204a70068e0ec6973da7aa59ece27915cb839facdb
MD5 59806959987aebdb741a34d38122f729
SHA1 452531bc4eb05c47009f8603ccdd5861e553f553
SHA512 6f85a176cf7c2c961d1fd77b2b04b675c13146b039c7627ca4f10765e2eefb4f3ee939df6f38ad9902ef88f01f1ff2783f7a036690d8d6647cfbc7c304816c3f
MD5 SHA1 SHA512

Submit Download

svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCCCBBBAABABBBACABCAAABCBACCCCCACAACCACCBBCCAABBAC.exe
Size 37.3MB
SHA256 4902d7607809062dd56724db9e8b06fda07670538838327f609d268c5fba1d15
MD5 aaa3f400a9079707a14d057efe20814e
SHA1 22ae9db58e68d454ebe5369b6b143a7800f39f62
SHA512 5a8b91f6801edb65275c6a754aecdf8c2480ac64f6b6ffed90b30cde5c774ec91328aa7e132d342df672f84c8433e549e65fa7e006f65287ad0c7985b6d04cdb
SSDEEP 98304:T7pW7pW7pW7pW7pW7pW7pW7pW7pW7pW7pV7pW7pW7pW7pW7pW7pW7pW7pW7pW7pA:ZFIF0wuR
TLSH
T106874A02B7E99034F6F31B30AEB992754A7ABD629D35C64F73845A0D1D70A80E934B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 69971686f89bd07deaa1580db3a09a759ed24dee8cdfad5d82193b1494034fb1
MD5 d7607aba7ce0f1e563d67014fd0b5cee
SHA1 9860c3dc0874cce707a2122066f2e8b6b37d2c4c
SHA512 f9cb7c8ace770764e1aeda626df037bb0936f20acd04b51b9a2f5696c5ecb3f14fad592337c1a33c743f33cd9af50da60b2abef3c40aab096c4bea09d1de77d7
TLSH
T1B6112B75ECE9DC53FD23288B5229AB630DF0368B7CAC6A4813404118BB55D30CE994E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/704-0-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/704-8-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/5140-70-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/5928-24-0x0000000000820000-0x0000000000841000-memory.dmp

Download