80cca6b05ddf4a7ed45c41263079782f93a277547a54fb2de4b27e8ecc128aac

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 11.8MB
Sample260813-ejrm5saq4y
SHA256 80cca6b05ddf4a7ed45c41263079782f93a277547a54fb2de4b27e8ecc128aac
MD5 a6e055147c00fe80cf952d241d4b7012
SHA1 4e3b89fe436307805c13f25cfb2ab9c8044c96ea
SHA512 15fc6700f1662cb0af66b484feeff460a0148a6a25fda381a116da51ae9fef0222b37e8ae694a45682d8a5e45a5e272d390e13857a7448f0e4603ae033734446
SSDEEP 49152:U+Ef+EPiw25+Ef+EPiw25+E0qatgll+Ef+EPiw25+Ef+EPiw25+E0qatgll+Ef+3:rPPPPPPP7KjKWQckVgtev5mnlNLW
TLSH
T1D2C65C09BBDD4461E4B7623149A7C27ADAB1B8514B32C7DFA384833E5E33BD0A934B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4188	svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe
4672	svchost_CABCBBABAACCAABCBAAAAABACCBBACCCCBCBBACCCCABBACCAACBCCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBBBAABBBBCAACAABCBBBAABBABCABCBABCBCAAABCBAACCCCBBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe"	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBBCACCCCBCAABCCCCCCAACACABBBBBBCBBAABBBCBCBCCCBCBBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCBBABAACCAABCBAAAAABACCBBACCCCBCBBACCCCABBACCAACBCCC.exe"	svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5976	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCBBABAACCAABCBAAAAABACCBBACCCCBCBBACCCCABBACCAACBCCC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4572	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4572	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4572	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4572	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4188	svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe
4188	svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe
4188	svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe
4188	svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4572	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4188	svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 5976	4572	2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	92
PID 5976 wrote to memory of 2908	5976	cmd.exe	94
PID 4188 wrote to memory of 1960	4188	svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_a6e055147c00fe80cf952d241d4b7012_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAACCAAAABCCCCACABBAACBCACBBAAACABBACAACBCAACCCCBBBABBCAACCACACBCCBBBBCCCACBBABABACBBBACABBBACBAABAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAACCAAAABCCCCACABBAACBCACBBAAACABBACAACBCAACCCCBBBABBCAACCACACBCCBBBBCCCACBBABABACBBBACABBBACBAABAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBABAACCAABCBAAAAABACCBBACCCCBCBBACCCCABBACCAACBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBABAACCAABCBAAAAABACCBBACCCCBCBBACCCCABBACCAACBCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cf615b5482a5961febbad7db2e1e994d8252295b7d6f86ba0c3f75420450ef20
MD5 96ce63a2d2aa86fe95ec8aa9c783ae26
SHA1 787652a21511125f17ee4a7db9bf56ff40eec3b4
SHA512 edf94d5ce5026b1678ea40bdc73996b3d7f66de90133a3be3dc6b267c8c7ff5282b6ef7d0ad0a87bbfe4fbf428beea05af62ad03de60e8346a01825b5a7cd5e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0a0183fbe6570d77aa2223c42f9c531ff7afdef1bc2abffefbea2e05e9fa747c
MD5 a5cbed29b5ff0c51bc227154d5749813
SHA1 2805b0c2c25cf38c46a82487c00a2552aed9248d
SHA512 2b8abfb65710544ecc51326a6c580370a61109a6bade317b0b33e0f88d89f8d5c0d3f3b15189e1a11c10f1490db17f7af21acd03abe0ce47e3727317d1e7ab37
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d2a1f19d0b66fbd71dfb387e3556f5ecdc6302532cc850c513ca8f806c2ca813
MD5 ef22afc4207bf2a104b2ce6ed04f8111
SHA1 82752a345d8da0ea842389bc7d9722deb27243ec
SHA512 1d2dd07640554ee81ecee22f84306e3e6a947300e11153c77fe4a4c6b8bde9df9e7b6e09ff1665697889ad0c6ee4faa2566748b5a06c36fe10aa882f9c3c6410
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e84c38af57673eea464ea0c223b86d876164281619a1b59f028bdd863ee5f34e
MD5 8160cc82d32fb6fc4e3ba59151954820
SHA1 534cd0cec15abeabb9367a0f777e169c47735550
SHA512 4a046c562943e1627f714c0e496bc24d7406b43606983835e32d2a688752a75716166e490f9c520bb95b1e3d747c9ca48aebd224571d469f3e1412b75959f34a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dafea37f8f91c738c561ccbdc224f8a776530cdd51c799605d09c21e46e5c48e
MD5 d76a2e0adc0efe7955f7079239f1aa1c
SHA1 cd43000ed760ebfeee08b8f14f458c102c9313ee
SHA512 43e475e65112efba15c6c7055078ebe0125b721c24ead06f979dfefd03b8f4d06ed942ee033281f8434b419c9cb9ebd85f7d90f9c83b489dd46fff5e73784af0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5593d282d16c1256a59f9ce4e6f1059f8bd29fbe7263816bc50b3d634f461538
MD5 edc59e4f9e9383dda30e9d03377d00ce
SHA1 a703ab167fdcf0009b81e028a136e453eefa3d8f
SHA512 653459ed4bfda10e6b4f12e46389c4d151b2afa52a7a3b7dcbd82ba492e8905ac5a58db93af83ac85ebe3a6ad0d5731c172ff3a6a0f2c99fc189189996db2aff
MD5 SHA1 SHA512

Submit Download

svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABAAACCABAACBCBABABAABACBABCBCACCAACCAABACBBABBAAAA.exe
Size 11.8MB
SHA256 80cca6b05ddf4a7ed45c41263079782f93a277547a54fb2de4b27e8ecc128aac
MD5 a6e055147c00fe80cf952d241d4b7012
SHA1 4e3b89fe436307805c13f25cfb2ab9c8044c96ea
SHA512 15fc6700f1662cb0af66b484feeff460a0148a6a25fda381a116da51ae9fef0222b37e8ae694a45682d8a5e45a5e272d390e13857a7448f0e4603ae033734446
SSDEEP 49152:U+Ef+EPiw25+Ef+EPiw25+E0qatgll+Ef+EPiw25+Ef+EPiw25+E0qatgll+Ef+3:rPPPPPPP7KjKWQckVgtev5mnlNLW
TLSH
T1D2C65C09BBDD4461E4B7623149A7C27ADAB1B8514B32C7DFA384833E5E33BD0A934B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4188-35-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/4572-0-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/4572-8-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/4672-65-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download