93e0926a5ffa7a31c18db2e9f457379d463321a776bdf88fb045ef30aa5ca9e1

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_eb9cdeb49c12df5728e85de504f9dbb6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 19.0MB
Sample260813-df7phsyvhs
SHA256 93e0926a5ffa7a31c18db2e9f457379d463321a776bdf88fb045ef30aa5ca9e1
MD5 eb9cdeb49c12df5728e85de504f9dbb6
SHA1 7016d1363ab2883d9333d65b82ac4fa0e5f76744
SHA512 13534c3acfa7e25cc11e87cc01ed848c341ee8caeb99770dbe4a4ca2d425d5a4319bff11bd9965c3aea0035507783a060f33e40aada3ae12f452f7be2a70283f
SSDEEP 49152:U+ES+E8+ES+ES+ES+E7+ES+ES+ES+E0+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+ED:xOU/jIEeQfoR/IuOFVjUu5E
TLSH
T13D174C09F94340B1D92B51B04CCFE3BF8A60BB25C6128DF7FB4DCB5B6923BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5876	svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe
4452	svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe
4700	svchost_CACBBBACCBBCBCABCACCBCACACCCCCCCCCACBBABCCACCACBBBBBACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCBABABBBBCBCCACBACABCBCBACAAABCBACABBBACCCACCCBAACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe"	2026-08-13_eb9cdeb49c12df5728e85de504f9dbb6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCAACCBCBCACCCAACCAACBABCCCCABCBBBABACBABCABBCACCCAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBBBACCBBCBCABCACCBCACACCCCCCCCCACBBABCCACCACBBBBBACB.exe"	svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3936	sc.exe
7104	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5272	cmd.exe
6032	cmd.exe
5336	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBBBACCBBCBCABCACCBCACACCCCCCCCCACBBABCCACCACBBBBBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_eb9cdeb49c12df5728e85de504f9dbb6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4084	2026-08-13_eb9cdeb49c12df5728e85de504f9dbb6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4084	2026-08-13_eb9cdeb49c12df5728e85de504f9dbb6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4084	2026-08-13_eb9cdeb49c12df5728e85de504f9dbb6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4084	2026-08-13_eb9cdeb49c12df5728e85de504f9dbb6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
5876	svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe
5876	svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe
5876	svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe
5876	svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4084	2026-08-13_eb9cdeb49c12df5728e85de504f9dbb6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	5876	svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 5272	4084	2026-08-13_eb9cdeb49c12df5728e85de504f9dbb6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	94
PID 5272 wrote to memory of 7040	5272	cmd.exe	96
PID 5876 wrote to memory of 1696	5876	svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe	97
PID 4084 wrote to memory of 6032	4084	2026-08-13_eb9cdeb49c12df5728e85de504f9dbb6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 6032 wrote to memory of 3936	6032	cmd.exe	100
PID 4084 wrote to memory of 5336	4084	2026-08-13_eb9cdeb49c12df5728e85de504f9dbb6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	101
PID 5336 wrote to memory of 7104	5336	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-13_eb9cdeb49c12df5728e85de504f9dbb6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_eb9cdeb49c12df5728e85de504f9dbb6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBACCCBCABCAACAAACABBCACABBBAACBCCBBAACAABACCBABAAABCBBBACAABBCBACCABAACABCAAABBBBCBBCBBBBCCCBBBBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBACCCBCABCAACAAACABBCACABBBAACBCCBBAACAABACCBABAAABCBBBACAABBCBACCABAACABCAAABBBBCBBCBBBBCCCBBBBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACBACBCBAACCABCBBBCCACCBCBCCBBCBBBBBCBBACAABCCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe" start= auto displayName= "UserDataSvc_CBACBACBCBAACCABCBBBCCACCBCBCCBBCBBBBBCBBACAABCCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACBACBCBAACCABCBBBCCACCBCBCCBBCBBBBBCBBACAABCCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe" start= auto displayName= "UserDataSvc_CBACBACBCBAACCABCBBBCCACCBCBCCBBCBBBBBCBBACAABCCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACBACBCBAACCABCBBBCCACCBCBCCBBCBBBBBCBBACAABCCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACBACBCBAACCABCBBBCCACCBCBCCBBCBBBBBCBBACAABCCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:7104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5876
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe
1⤵
- Executes dropped EXE
PID:4452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBACCBBCBCABCACCBCACACCCCCCCCCACBBABCCACCACBBBBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBACCBBCBCABCACCBCACACCCCCCCCCACBBABCCACCACBBBBBACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3931a7b1d21cb69e26dff517383678e39d38ba410a0613d41144080f49fb68c6
MD5 20e4270c409358a3fc1325de28bdab60
SHA1 d719f346fa917e23f66d5c39be3aa31df202d9f4
SHA512 5f7822be5f98693f8b16cf922d0f4853d9bc8beac3e58b01e49e6434fdd959c7751cd68996ede40a17c28301ef41f23722504c1a5613f685996490f3578c6e4c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ad00899c123f8dce5d7a1c8b6642c043b3d2535b96cd0e52e28e995aec36f120
MD5 65836628ececb69e9768701b8a094cd0
SHA1 57dde2730a933d2d2d714d739ba67b2814d58a5e
SHA512 eff2a3e086469516dc851a8de298daa4b0e047fe34d8265066c3958b23c95af94ebe92e3b20c954b4ae7b75b27c4a0110cbdcf7363e2311c792fb1ddc43ea88b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7b02c1d15e8eff5e4cb2550e5b145173050b35be03d540fc7325662500f3c6d2
MD5 602aa2bb7b5130b3d0bce405bd3dff82
SHA1 07b3a15573566aaf0937e13705c27b2ccb222cc8
SHA512 0c4b72d96335636eb82513099149f0c7a6288996cd55b209438a1dd6b8532ac91e53a75e0190fe953dcd43733b0460366ad1a98fac1020a525adeb1068850905
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 532d17dd981e7395394b8af209f0ea4e9c22bad5e85d1786aabd57f4ea4c2fd9
MD5 310a96ceb974c9f0fffb295b3baca83c
SHA1 be9c178869674d72de85682a160adaa7845cf2af
SHA512 4c865c0e32633bff79a925566d0464ba883e46efbdf377402d91b0c462680801495a97c618c6b39520266e2c945ea004cfd5e0117bf00f5b639a411d6cc3fc00
MD5 SHA1 SHA512

Submit Download

svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBACBABBCABCAABBCBCABCBACCCCAAAACBAACCBCAAACCACCABC.exe
Size 19.0MB
SHA256 93e0926a5ffa7a31c18db2e9f457379d463321a776bdf88fb045ef30aa5ca9e1
MD5 eb9cdeb49c12df5728e85de504f9dbb6
SHA1 7016d1363ab2883d9333d65b82ac4fa0e5f76744
SHA512 13534c3acfa7e25cc11e87cc01ed848c341ee8caeb99770dbe4a4ca2d425d5a4319bff11bd9965c3aea0035507783a060f33e40aada3ae12f452f7be2a70283f
SSDEEP 49152:U+ES+E8+ES+ES+ES+E7+ES+ES+ES+E0+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+ED:xOU/jIEeQfoR/IuOFVjUu5E
TLSH
T13D174C09F94340B1D92B51B04CCFE3BF8A60BB25C6128DF7FB4DCB5B6923BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4084-0-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/4084-7-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/5876-24-0x00000000005A0000-0x00000000005C1000-memory.dmp

Download

memory/5876-34-0x00000000005A0000-0x00000000005C1000-memory.dmp

Download