c6873bb55196ef9496ea2738afcf3b17a37821d36b699d7ecc7e2cef4b5348bb

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 05:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_33eaa7d33dfb068c47d03259de07372e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 21.4MB
Sample260810-fsa77abn3v
SHA256 c6873bb55196ef9496ea2738afcf3b17a37821d36b699d7ecc7e2cef4b5348bb
MD5 33eaa7d33dfb068c47d03259de07372e
SHA1 ad751d919ec6a5fdbc9baa8a2da06708e4fb8d43
SHA512 9e3b140a2f0ebc7b972531a8f2dcfc41067155ebeea784f1e6c1d170dfe6556755c11bbd4d765acb7c7f0711db7095bf58e96ae8a4a26a0daa5121dbdf686849
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMV+ElwMzwqP+ElwMV+ElwMV+ElwMV+ElwMV+ElwM5:JOU/jIEeQfoR/IuOFVjUu5w
TLSH
T10D379E25FAE80CE2E573513989A2CA159E72B5260731C6CBB5AC831F2F337D09D36752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2056	svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe
3412	svchost_BCCBBAAABBBCABABCACAAAAACBBBCCBAACCAAABAAABBCABBCCCABCB.exe
3348	svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABCCAABAABCAAAACCCACBABACBACBCBBACBCCACCBCAABBABBBBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe"	2026-08-10_33eaa7d33dfb068c47d03259de07372e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAABBBCBCAAABCBBAABBCCBCBBBCBACCBACCBAAACBABABBCACBACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBAAABBBCABABCACAAAAACBBBCCBAACCAAABAAABBCABBCCCABCB.exe"	svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5312	sc.exe
4392	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2452	cmd.exe
3936	cmd.exe
3652	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_33eaa7d33dfb068c47d03259de07372e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBAAABBBCABABCACAAAAACBBBCCBAACCAAABAAABBCABBCCCABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2960	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4820	2026-08-10_33eaa7d33dfb068c47d03259de07372e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4820	2026-08-10_33eaa7d33dfb068c47d03259de07372e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4820	2026-08-10_33eaa7d33dfb068c47d03259de07372e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4820	2026-08-10_33eaa7d33dfb068c47d03259de07372e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2056	svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe
2056	svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe
2056	svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe
2056	svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe
3412	svchost_BCCBBAAABBBCABABCACAAAAACBBBCCBAACCAAABAAABBCABBCCCABCB.exe
3412	svchost_BCCBBAAABBBCABABCACAAAAACBBBCCBAACCAAABAAABBCABBCCCABCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4820	2026-08-10_33eaa7d33dfb068c47d03259de07372e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	2056	svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe
Token: SeDebugPrivilege	3412	svchost_BCCBBAAABBBCABABCACAAAAACBBBCCBAACCAAABAAABBCABBCCCABCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 2452	4820	2026-08-10_33eaa7d33dfb068c47d03259de07372e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 2452 wrote to memory of 2960	2452	cmd.exe	94
PID 2056 wrote to memory of 5540	2056	svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe	95
PID 4820 wrote to memory of 3936	4820	2026-08-10_33eaa7d33dfb068c47d03259de07372e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 3936 wrote to memory of 5312	3936	cmd.exe	100
PID 4820 wrote to memory of 3652	4820	2026-08-10_33eaa7d33dfb068c47d03259de07372e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 3652 wrote to memory of 4392	3652	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_33eaa7d33dfb068c47d03259de07372e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_33eaa7d33dfb068c47d03259de07372e_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBAAACAABAACBABBABBBCBACBBBCCAABACBACAABAACBBBBBCBBAACCBCCBBAAABBBBBAABACBACBCABABAABBABACAAAAAAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBAAACAABAACBABBABBBCBACBBBCCAABACBACAABAACBBBBBCBBAACCBCCBBAAABBBBBAABACBACBCABABAABBABACAAAAAAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBABAABCACBCABCBBBCCAABBBAABACABACCABBCABBAABABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe" start= auto displayName= "UserDataSvc_CABBABAABCACBCABCBBBCCAABBBAABACABACCABBCABBAABABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBABAABCACBCABCBBBCCAABBBAABACABACCABBCABBAABABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe" start= auto displayName= "UserDataSvc_CABBABAABCACBCABCBBBCCAABBBAABACABACCABBCABBAABABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBABAABCACBCABCBBBCCAABBBAABACABACCABBCABBAABABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBABAABCACBCABCBBBCCAABBBAABACABACCABBCABBAABABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAAABBBCABABCACAAAAACBBBCCBAACCAAABAAABBCABBCCCABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAAABBBCABABCACAAAAACBBBCCBAACCAAABAAABBCABBCCCABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe
1⤵
- Executes dropped EXE
PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d9076cfe7c07672d015aeb63ff66d7b684af34fb34c103ac2b4e8c922df413db
MD5 b1f12481d287ef5f6f47e76aa8dfafba
SHA1 b4e023ae0f6774963c3c32916cb8e258d4e8d51d
SHA512 c1313f055a3ddd57473c173284f93417ec3f4fc177b5fbf50aaa27a46d4f244dcebe9c7a80a8d39fa1696efec9df2e08b2332eba294cc9f4c4b8f96c39a97b75
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 13c1abca3f17c15aab589da55a33818049b79a4f42a1c5c57b96f66782b7bbd0
MD5 8a6bcdae4324c7b55cf2d9b31d9aeda8
SHA1 e2c9946d69f8ac2cda3c04c6cf4b2c9635fd4c9a
SHA512 d5c5b26a674a5b4deeeade1a5fb96483672c5a7fa85bf86a12d9cd8a93619ce1e7df87a1da8211730f342158fcd7ddcf9c246fdb0f9dac4fe665b30c73a1ce06
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9321634b1bf1ec1759884d6c8e517dbfadcdd0881f224e31bf88f010556cedf
MD5 7e0470afa2cafbd8cb87434dc9386490
SHA1 eb8a586c685e39b6fa65f697bf6bbad8dd5bf64d
SHA512 ddc8cca5eb5fe43a3e08a5413666d9154c2b4ebe073d879ee891c06f6194f73d8dbdaea896bb257d91ef463ce7e68a6fc279fc1c552622d43fa29bdd638eaf78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8e701d2cc0746df191f5140b1b8538777dc774cf7c85189c40ff7d71d7c8e5f9
MD5 eae50888daefbbc73c120e3b179f0bd6
SHA1 7fdb8a5bb0b2c967b36c793c78319d40046f7497
SHA512 08c1c505cfc3a6252563126ce0b7348ebcd021c10ba34b07b56af39d2e315f6b9386a2beba8dfe2a449e41233982702f34592af8de9936dcc27f69f8f976438a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 69f6ba44d6f7b5089eebfb4ea6017703974ef686978b1245c5213fbe12c97a4b
MD5 ed484b67247992ee8ad9cf237bee95ad
SHA1 49bcf5ea9a199b68399061533d15454bd53d4b32
SHA512 ee054043d9da189afa7bdb33b2eabdf05bbc52a07b78dba04b87eef198a3ba953daaae5bd8df39dcdc90871bd623844d40d5c127e2d5885f266ea0a83f6d3709
MD5 SHA1 SHA512

Submit Download

svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACACCBCAABACABBBAABCBCACBABCABCBCCCBBABBABBABBBBCAA.exe
Size 21.4MB
SHA256 c6873bb55196ef9496ea2738afcf3b17a37821d36b699d7ecc7e2cef4b5348bb
MD5 33eaa7d33dfb068c47d03259de07372e
SHA1 ad751d919ec6a5fdbc9baa8a2da06708e4fb8d43
SHA512 9e3b140a2f0ebc7b972531a8f2dcfc41067155ebeea784f1e6c1d170dfe6556755c11bbd4d765acb7c7f0711db7095bf58e96ae8a4a26a0daa5121dbdf686849
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMV+ElwMzwqP+ElwMV+ElwMV+ElwMV+ElwMV+ElwM5:JOU/jIEeQfoR/IuOFVjUu5w
TLSH
T10D379E25FAE80CE2E573513989A2CA159E72B5260731C6CBB5AC831F2F337D09D36752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 45a37da2f4c360a8b55a420077790516512d1b4fa49e17eb43012bf4c784428d
MD5 5a52b9f0caceaa18efdfa59ca38df960
SHA1 97512df3276490bc1dde497ead91265dbbdedf84
SHA512 f85dd90fe73217375df783b64b8554de874209cbba2a656fd118f69d30c8abdcbf2fc1a62686907d118037c5c665f7824724c19178dc9ce20bcedf6debbf244e
TLSH
T17B113A11A4AAD893F873684797299BE30CE073CB78A87B1422004119DFC8C29CE964F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2056-24-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/2056-34-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/4820-0-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/4820-8-0x0000000000040000-0x0000000000061000-memory.dmp

Download