6e4e5bc8885b0d16b87103acf98f8ab80c1ebce87c91ba76182acc49f8ccc20f

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 16.3MB
Sample260813-ebrm6sap4w
SHA256 6e4e5bc8885b0d16b87103acf98f8ab80c1ebce87c91ba76182acc49f8ccc20f
MD5 b7fb0831d0db3f67d0bab5c3e26dd0ea
SHA1 fd50b0d330fc7ac36f92ecab5572f29ae7eb9a77
SHA512 4cf19a8321c00b5c2a792b9e03671a65f93d97c279b00ec222b4fd8f1648fcf95bbfb28f40f83b5077cba3a2d16fd5fadb001ba15591727bf81b04820343f64b
SSDEEP 49152:U+E2+ES+EP/+ES+Ek+ES+ES+E2+ES+EP/+ES+Ek+ES+ES+E2+ES+EPL+E2+ES+E0:nOU/jIEeQfoR/IuOFVjUu5P
TLSH
T134075C05F98740B1E87B11B04DDBD2BF8A30BB2587128DFBF64DC71B6932B919934626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2460	svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe
3564	svchost_BCABCBBACAAAACABBCABAAABCBCCAAABBABAAAAACBCABCACAACACCB.exe
4628	svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABACACCABCCAAABACCCCABAAACBAAAACBBCBAABCBCCBBACACBAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe"	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABCBCABABCCAACABACACAABCACCABCACAACBBABACCABABBBACBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCBBACAAAACABBCABAAABCBCCAAABBABAAAAACBCABCACAACACCB.exe"	svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1648	sc.exe
2940	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6020	cmd.exe
3540	cmd.exe
3348	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABCBBACAAAACABBCABAAABCBCCAAABBABAAAAACBCABCACAACACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4904	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4904	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4904	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4904	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2460	svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe
2460	svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe
2460	svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe
2460	svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe
3564	svchost_BCABCBBACAAAACABBCABAAABCBCCAAABBABAAAAACBCABCACAACACCB.exe
3564	svchost_BCABCBBACAAAACABBCABAAABCBCCAAABBABAAAAACBCABCACAACACCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2460	svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe
Token: SeDebugPrivilege	3564	svchost_BCABCBBACAAAACABBCABAAABCBCCAAABBABAAAAACBCABCACAACACCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 6020	4904	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 6020 wrote to memory of 5824	6020	cmd.exe	93
PID 2460 wrote to memory of 3500	2460	svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe	94
PID 4904 wrote to memory of 3540	4904	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	97
PID 3540 wrote to memory of 1648	3540	cmd.exe	99
PID 4904 wrote to memory of 3348	4904	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	100
PID 3348 wrote to memory of 2940	3348	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCBCCCACAACACBACCCBBAAACACACAAABBACBBCBAABACCACCCBCBABAACACBACBBAABCBAAACBCBAACCACBAACBBABBBCAABACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCBCCCACAACACBACCCBBAAACACACAAABBACBBCBAABACCACCCBCBABAACACBACBBAABCBAAACBCBAACCACBAACBBABBBCAABACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACAACCCBABAABABCBCBBBBABCBAABACABCAAABACAABABCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe" start= auto displayName= "UserDataSvc_AACAACCCBABAABABCBCBBBBABCBAABACABCAAABACAABABCCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACAACCCBABAABABCBCBBBBABCBAABACABCAAABACAABABCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe" start= auto displayName= "UserDataSvc_AACAACCCBABAABABCBCBBBBABCBAABACABCAAABACAABABCCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACAACCCBABAABABCBCBBBBABCBAABACABCAAABACAABABCCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACAACCCBABAABABCBCBBBBABCBAABACABCAAABACAABABCCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBACAAAACABBCABAAABCBCCAAABBABAAAAACBCABCACAACACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBBACAAAACABBCABAAABCBCCAAABBABAAAAACBCABCACAACACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe
1⤵
- Executes dropped EXE
PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0f4aa96185de562addf9fcb71770dfae4d5072118379d1bda2cf5c4c7b0e5bdf
MD5 8450035594c24565bd3ba61f0edf10b2
SHA1 173c475a6ef3f8457f95a9893b1f3b24ab8ad95e
SHA512 aea032920487f241b3da8991fd9592ff48021b99fb6b61d2dfa15f95c37486e32b8dc95753e0211344cee59906496efae352efb23358b1df5d9c25133c8bd25a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d980487fe6eda653437cebf83534fdb77108c5ee1511689d8c7349b486c2aef
MD5 e47470fdda9d8016ae9bfc0f64fa84a7
SHA1 f3ec3b098f32688cd63719464f1bc1397bac350a
SHA512 678d579c26ce41f9bce905237dc6c4921084a67066f3c2be70027a4d50f2b617f46b3ed2949ea88f167b034df5157d88a8e6b014b53632ed1d684f573bf740cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ceaba9a475913406d17b639812fa3b8d83cfc227abf70be2995a672d6c134c0c
MD5 bb775fba4e76c5531d4f4b7ed57b294f
SHA1 51b5ca2f8f9ce5bd38ce55c2b618be142eb233df
SHA512 94407fb8245e494ed0279124760e1ed274c2730e5f92ae8f6c8bc4e654997e02ff9cec268c646a2b8fdbac7bc4f9d414b9ce05f77814f432b37904ecaf5fa9ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 376f737a688c236fe6eda4d3d262f3492b95fea063cd3aca951db8201909a842
MD5 cd14ac2f7eb49a766c699f877b5737f2
SHA1 c59f2a65c12cecd18d04d9576a2dadc31bb66bc4
SHA512 0467413655314fb62f4e220985b1302e33a5db30e1d5c48f94fe90ea02590dddaca866beb94768b74b2d90306984900d1790122e49cff67ff53889b0484b279e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ab63dfffb1b298c3c2c1d292eea7227a5d515c124ea98aca107455e0f53c8b57
MD5 7e35e02bba399cbddf11f8935bd0db59
SHA1 1e8c0f6115202456c42033b2efdce2dfe9d69a1d
SHA512 94fb9ddffb9e5ea879618b9820933c1585341e1c7ee10b93444aeeee8a9342938437a4f939324653cdb2a74087d434768330eb3bd45369efeca4ed847d352724
MD5 SHA1 SHA512

Submit Download

UseCompare.exe

Path C:\Users\Admin\Downloads\UseCompare.exe
Size 49.4MB
SHA256 6f2a0fe93ad65562992ebb48cbe7ac84023613e8d10eb5885231676694cf5605
MD5 dadb4e93efae50bf6c5dadd72c5c2857
SHA1 88eac0184039b0e57d10fcd376f50c33a6cdac09
SHA512 45060e10ac52e0ae244e2ae86807dc7608769252ddf9574679c0948d7048e031d8454d7fc886e71d32f78834cc42673088c72818b2131d1e9bff6b662adbc5ef
SSDEEP 98304:nOU/jIEeQfoR/IuOFVjUu5vOU/jIEeQfoR/IuOFVjUu5vOU/jIEeQfoR/IuOFVjd:nFIF0wupFIF0wupFIF0wuYmRn
TLSH
T1C1B75C05F98740B1E87B11B04DDBD2BF8A30BB2587128DFBF64DC71B6932B919934626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 db50690cdd57a5701a08a7afc8bd33c685e508a8fb40366221974452dfb40649
MD5 550297eaeb789dcfc29719423128658b
SHA1 f7ac95abc7a10ecc18bf33a69ef5b803c36021d7
SHA512 963b979a5392446a0cb3f1354648b55239b9d75cf7055cf90c09f5658042f32452838d6de6f7e1693863b76ceabf9a96848aa3539fd0ea15271ec12466f00bae
MD5 SHA1 SHA512

Submit Download

svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCABBBBABAACCCBBBCAABBBCBCBAAABBAAACBCCAACABCBABAABA.exe
Size 16.3MB
SHA256 6e4e5bc8885b0d16b87103acf98f8ab80c1ebce87c91ba76182acc49f8ccc20f
MD5 b7fb0831d0db3f67d0bab5c3e26dd0ea
SHA1 fd50b0d330fc7ac36f92ecab5572f29ae7eb9a77
SHA512 4cf19a8321c00b5c2a792b9e03671a65f93d97c279b00ec222b4fd8f1648fcf95bbfb28f40f83b5077cba3a2d16fd5fadb001ba15591727bf81b04820343f64b
SSDEEP 49152:U+E2+ES+EP/+ES+Ek+ES+ES+E2+ES+EP/+ES+Ek+ES+ES+E2+ES+EPL+E2+ES+E0:nOU/jIEeQfoR/IuOFVjUu5P
TLSH
T134075C05F98740B1E87B11B04DDBD2BF8A30BB2587128DFBF64DC71B6932B919934626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 fbcaaa77f14c9deb3cc38a36fd3099550bf30fc0e2b824c7d640319b1b6357a8
MD5 cde87f12fc9103356acd526aa2bc5416
SHA1 3b7015e8045f5bb1ab33f13d3e544bce87cd1f37
SHA512 2a6e36aaf186c8a00ef2072ebb4940472cfd28a7c212e7a210e5c1b3578d71a5abccfa324f71f1b52c5c3bcebe15bef78c70e88649a50c37f4fcd695d91400a7
TLSH
T14011EB6178E5D843FA333987E12BDF820CE43A879C587A285308471E5AC5C73CD258A6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2460-49-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/2460-71-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/2460-34-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/3564-93-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/4904-59-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/4904-0-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/4904-85-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/4904-33-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/4904-22-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/4904-11-0x0000000000840000-0x0000000000861000-memory.dmp

Download