18ff13fbfbef8838e819638cf13b77b872f73aa17627ccbc1578da687ca6bc02

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_726a311d678f5fe07f8b1067044d91b6_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 22.8MB
Sample260813-e8wndszyay
SHA256 18ff13fbfbef8838e819638cf13b77b872f73aa17627ccbc1578da687ca6bc02
MD5 726a311d678f5fe07f8b1067044d91b6
SHA1 c9e392a7abf35a0c0b8a0eb45b92c2c9b386afc7
SHA512 bbfcf772f43ea071a4dfa62aa7116900d023b92e624ba05f347eea60ea2fc20b70096b7d9a57af26ef5f45770703fe3f14b219cbe9f82e836a97eebf18184355
SSDEEP 393216:NO4q78UhasVO4q78UhasVO4q78UhasVO4q78UhasVO4q78UhasVO4q78UhasVO4o:8haskhaskhaskhaskhaskhaskhaskhal
TLSH
T1B3374A2CFD9541B2D436827188D7E6FEAA3079126B015EDFA2D5530E4D3BBD26C30E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
992	svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe
5244	svchost_BCACBAACABABAAACACACAAAAACCCABBBCCCCBBCACAACABBAACBAACA.exe
3436	svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCBBCCBCCBBCCBBCACBACAAACCACAAAABCAABCACBABAAABBCCCBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe"	2026-08-13_726a311d678f5fe07f8b1067044d91b6_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCAACACCBACABBAACCCACCCBCBCAABAACBCBBBBCABBABCBACBCBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACBAACABABAAACACACAAAAACCCABBBCCCCBBCACAACABBAACBAACA.exe"	svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
948	sc.exe
5840	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4972	cmd.exe
5812	cmd.exe
2320	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACBAACABABAAACACACAAAAACCCABBBCCCCBBCACAACABBAACBAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_726a311d678f5fe07f8b1067044d91b6_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5044	2026-08-13_726a311d678f5fe07f8b1067044d91b6_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5044	2026-08-13_726a311d678f5fe07f8b1067044d91b6_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5044	2026-08-13_726a311d678f5fe07f8b1067044d91b6_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5044	2026-08-13_726a311d678f5fe07f8b1067044d91b6_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
992	svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe
992	svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe
992	svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe
992	svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	2026-08-13_726a311d678f5fe07f8b1067044d91b6_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	992	svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4972	5044	2026-08-13_726a311d678f5fe07f8b1067044d91b6_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	92
PID 4972 wrote to memory of 3852	4972	cmd.exe	94
PID 992 wrote to memory of 3820	992	svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe	95
PID 5044 wrote to memory of 5812	5044	2026-08-13_726a311d678f5fe07f8b1067044d91b6_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	97
PID 5812 wrote to memory of 948	5812	cmd.exe	99
PID 5044 wrote to memory of 2320	5044	2026-08-13_726a311d678f5fe07f8b1067044d91b6_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	100
PID 2320 wrote to memory of 5840	2320	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-13_726a311d678f5fe07f8b1067044d91b6_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_726a311d678f5fe07f8b1067044d91b6_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACBBACBBCBCCAABCAAAACACAABAAACBCBBAAAAAABCBACACABABBBACACBBBABBABCBBCCBCAABCCBACAACABACABCCABCBAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACBBACBBCBCCAABCAAAACACAABAAACBCBBAAAAAABCBACACABABBBACACBBBABBABCBBCCBCAABCCBACAACABACABCCABCBAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBABACCCCBCAABBBACBACACCBCCBCCACABBBBCCBACACBBAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe" start= auto displayName= "UserDataSvc_CCBABACCCCBCAABBBACBACACCBCCBCCACABBBBCCBACACBBAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBABACCCCBCAABBBACBACACCBCCBCCACABBBBCCBACACBBAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe" start= auto displayName= "UserDataSvc_CCBABACCCCBCAABBBACBACACCBCCBCCACABBBBCCBACACBBAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBABACCCCBCAABBBACBACACCBCCBCCACABBBBCCBACACBBAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBABACCCCBCAABBBACBACACCBCCBCCACABBBBCCBACACBBAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3820

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBAACABABAAACACACAAAAACCCABBBCCCCBBCACAACABBAACBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBAACABABAAACACACAAAAACCCABBBCCCCBBCACAACABBAACBAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5244

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe
1⤵
- Executes dropped EXE
PID:3436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c1ac69813369a195992b94429c4dc1c4946ce1733903188cecfea81f4aade707
MD5 4bfd49c9c51a3ccd08debcf450b3597c
SHA1 36611b6ba9159cbb5866e5ed151ea2807c774f2d
SHA512 6ebf772d011cc59568ce5aee5ff671dfb092e97c130ba300561902a779cf67657707d03a00116b77b33524789e29083f3b86ea4bb2c09eedeab5574bcc254c57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 70b738221c1f7bbb0bf72443862529ba9340393c7043ce0fa094b4afe54289f8
MD5 5a92171b4688ad1df9968dc1c96c3780
SHA1 68707602bef3b93e6dbbce3173b11caccfb8897c
SHA512 940762360c18fb409bac04fff0b9c3143cbe9f5c0480d7521a06f2bf435496a7c9fd5a10a1526008039ced57c08711cedc3891a34fdb2789d01705da2aab0250
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6ff5f73b86ffa215a74d1db0b6b4e7aaa711cabcc7cd778c17c5d930f0bcfcc7
MD5 09210ade385cc5f8cd5360a1a6e5f664
SHA1 051d2287798d158a317e28401969ae256396ada9
SHA512 2cc2072132af08f4d5487939d8679b816ca65c9ce3e86337b0c9823cf11ff50883917db361b5723724c2fc646cb34272df3490fea741b5f91e3b9b90b55569b9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7ce8a12df8fe061b59813e5aadf2babdd1e74ec071442408c01db2057fe21609
MD5 32d30675750c88c8a15dcf30ec100844
SHA1 a9f894090aaab33e863a49d368c0e47658fbc240
SHA512 0a7a71c403a78ed833205fbe4bc1f3cd898b9e25f74d4a45b9e682a9f6a831f363445c900528c01abd2f5de63baf6dad4bb6d28ce23aee570c5b4288cca01480
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9e45a35803d7ffd0b240db18f19c7658db72e40f930abf68baa604941cbad9b5
MD5 bbdd656103ded29e1f3b349a7e27c474
SHA1 6db56416649a6f4fe35b98c5cbb10a06d45d75c0
SHA512 d3d78323eb898eb3c089e0464356d772a6b46e03ac3f1b73e00f023ea9e749df928a108b67c9647bc96320104e5104ead20eefc1e238b505f13634e48dcf746d
MD5 SHA1 SHA512

Submit Download

svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCABCABCACBCACCAAABACCAACCACCABCBCAACACBBAABABCBBBAA.exe
Size 22.8MB
SHA256 18ff13fbfbef8838e819638cf13b77b872f73aa17627ccbc1578da687ca6bc02
MD5 726a311d678f5fe07f8b1067044d91b6
SHA1 c9e392a7abf35a0c0b8a0eb45b92c2c9b386afc7
SHA512 bbfcf772f43ea071a4dfa62aa7116900d023b92e624ba05f347eea60ea2fc20b70096b7d9a57af26ef5f45770703fe3f14b219cbe9f82e836a97eebf18184355
SSDEEP 393216:NO4q78UhasVO4q78UhasVO4q78UhasVO4q78UhasVO4q78UhasVO4q78UhasVO4o:8haskhaskhaskhaskhaskhaskhaskhal
TLSH
T1B3374A2CFD9541B2D436827188D7E6FEAA3079126B015EDFA2D5530E4D3BBD26C30E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/992-24-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/992-34-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/5044-0-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/5044-7-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download