59e2af98384cb1bc13fc4757b8a5246f9a05e7c44469f4fc89f3c132dea045d7

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_f7d9d9d490fbaa8a0d115b4d609d62ff_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 17.9MB
Sample260813-c95xcazflb
SHA256 59e2af98384cb1bc13fc4757b8a5246f9a05e7c44469f4fc89f3c132dea045d7
MD5 f7d9d9d490fbaa8a0d115b4d609d62ff
SHA1 b7bbf0a2ef20752952cf8f07fa5e94a589f6fa11
SHA512 d87f650853db82871ba627b43adfb05ee281b44938cd8de177702d87444c490d14afe3ca65b11d3d8e9d54c3841f6a3dbab7970a3f882913a2651c4e2c179b70
SSDEEP 98304:8/1/1/1/1/1/1/1/eOU/jIEeQfoR/IuOFVjUu5Q:JFIF0wu6
TLSH
T1A4175C09F58740B5D97751704DABC27A8A31B92187228AEFF68CC63F6E33BD16834B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4940	svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe
3664	svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe
1944	svchost_CBCBBBBCBACBCBACAABBACABCAABBBABBACBCBBBAACAABCABBCACBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACCABCABCACCBBCCABAAACCAAACCBACBCAACCBCABBABCBCCCACABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe"	2026-08-13_f7d9d9d490fbaa8a0d115b4d609d62ff_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCABCBCACCABAABACBACACACBBCCCCCBCCABAACCCABCBCCAABCCBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBBBBCBACBCBACAABBACABCAABBBABBACBCBBBAACAABCABBCACBC.exe"	svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4420	sc.exe
2324	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4892	cmd.exe
5796	cmd.exe
1976	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBBBBCBACBCBACAABBACABCAABBBABBACBCBBBAACAABCABBCACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_f7d9d9d490fbaa8a0d115b4d609d62ff_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2164	2026-08-13_f7d9d9d490fbaa8a0d115b4d609d62ff_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2164	2026-08-13_f7d9d9d490fbaa8a0d115b4d609d62ff_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2164	2026-08-13_f7d9d9d490fbaa8a0d115b4d609d62ff_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2164	2026-08-13_f7d9d9d490fbaa8a0d115b4d609d62ff_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4940	svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe
4940	svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe
4940	svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe
4940	svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	2026-08-13_f7d9d9d490fbaa8a0d115b4d609d62ff_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4940	svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 5796	2164	2026-08-13_f7d9d9d490fbaa8a0d115b4d609d62ff_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 5796 wrote to memory of 3436	5796	cmd.exe	94
PID 2164 wrote to memory of 1976	2164	2026-08-13_f7d9d9d490fbaa8a0d115b4d609d62ff_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	95
PID 1976 wrote to memory of 4420	1976	cmd.exe	97
PID 2164 wrote to memory of 4892	2164	2026-08-13_f7d9d9d490fbaa8a0d115b4d609d62ff_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 4892 wrote to memory of 2324	4892	cmd.exe	100
PID 4940 wrote to memory of 1204	4940	svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-13_f7d9d9d490fbaa8a0d115b4d609d62ff_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_f7d9d9d490fbaa8a0d115b4d609d62ff_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCCBABABBCCBCCACCAAACCBCCBBAAACCCBACCCCCCCCCCCACCACAABACBBABACABCAACCBABACBBBCAAABCBBAACBCAABAACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCCBABABBCCBCCACCAAACCBCCBBAAACCCBACCCCCCCCCCCACCACAABACBBABACABCAACCBABACBBBCAAABCBBAACBCAABAACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAAACAAACBBBBAABBBABBBABCCAAABAACABBCBAAAACCBCABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe" start= auto displayName= "UserDataSvc_BBAAACAAACBBBBAABBBABBBABCCAAABAACABBCBAAAACCBCABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAAACAAACBBBBAABBBABBBABCCAAABAACABBCBAAAACCBCABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe" start= auto displayName= "UserDataSvc_BBAAACAAACBBBBAABBBABBBABCCAAABAACABBCBAAAACCBCABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAAACAAACBBBBAABBBABBBABCCAAABAACABBCBAAAACCBCABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAAACAAACBBBBAABBBABBBABCCAAABAACABBCBAAAACCBCABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe
1⤵
- Executes dropped EXE
PID:3664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBBCBACBCBACAABBACABCAABBBABBACBCBBBAACAABCABBCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBBCBACBCBACAABBACABCAABBBABBACBCBBBAACAABCABBCACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d46235b4cd2b8eaaefe25b7d4a620050611e7025a984f3be09d3642c63b7f580
MD5 74e10ba956fd29e702e085d6366c9cc0
SHA1 da4a3577212542eb8faf66753a13b0e371d48ebf
SHA512 5560f62f7070b5b68a54ba3a50cd648a55ec67c112b73790e7d21e1f453a2785217bb9b7390cd5678bcc1f374fa22012e0d8cf7c9eccde6073ae40562b0b55b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5e0269fe6bd3327fc1f34e8a18e86f3660f6f2b0c5bee1b4449a9e0e13dff814
MD5 f96b0ab274593ad167c193a73e73c098
SHA1 478340d184de625a0c0e51fda60568299c78e442
SHA512 c09dd8c538cb4f0241cc510d99852461ace6479845216c13dd55cb0eb23780e2eff21883c4c723726837f1b56f10ad27332527314192054e4e65b166db4b6483
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e352291080ce82a42a9db48ef920d13b4c011bfdb99a87dd745f0632b7a323b8
MD5 8ffb2707e1f31258167e8532ed89d9d7
SHA1 5cb6a0b1110ffdba4c177b8f7a6a841f4940ada4
SHA512 611120158acf4b8b2b888fc546ed0bc7a9133ea6b96293d8f966c43785fa1b976e282fd5b702ec00c2ebcb72fdfae4a635b7ece3b86ebade3780cec78eafc8e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 190911f4bdfc54a2a3e7e43adbe174021b219e33030663b3223faafedcd22526
MD5 1f49668ce9eccb5acff16021fd7de226
SHA1 2411c8b4f110f953ed98bc169a0013a43b8b9f1d
SHA512 1162fea8c80a6e0d7a73827d75e61ace3395ab7820cb0515e99fd7e2448059f8f4b44d8d2506325f7c2287510af2705216b74f0766a5b2d053133e7af7dc1f5f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 77fabc55318b7886a8fbd8b3ccbfb703e6956b02aab3df763fe664e5628b8318
MD5 6f0d24047fe2a58b10b3ad7e432f0579
SHA1 8f3ac368dba574f7ca59bc71be8f92f151876465
SHA512 f4d096f291c4835107ebb30b52e29bdedacce1a878162dbe22e03c481230e7f93557f38c3a3f147ec0ea71864fadb822f0109b6eec1dfdeca83935544cd1a00d
MD5 SHA1 SHA512

Submit Download

svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAABBABBBBAACBBABCAACAAABCAABBCCABAABBAAABCAABACCCBB.exe
Size 17.9MB
SHA256 59e2af98384cb1bc13fc4757b8a5246f9a05e7c44469f4fc89f3c132dea045d7
MD5 f7d9d9d490fbaa8a0d115b4d609d62ff
SHA1 b7bbf0a2ef20752952cf8f07fa5e94a589f6fa11
SHA512 d87f650853db82871ba627b43adfb05ee281b44938cd8de177702d87444c490d14afe3ca65b11d3d8e9d54c3841f6a3dbab7970a3f882913a2651c4e2c179b70
SSDEEP 98304:8/1/1/1/1/1/1/1/eOU/jIEeQfoR/IuOFVjUu5Q:JFIF0wu6
TLSH
T1A4175C09F58740B5D97751704DABC27A8A31B92187228AEFF68CC63F6E33BD16834B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1944-73-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download

memory/2164-6-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download

memory/3664-66-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/4940-22-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/4940-35-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download