8da71725a0dc33603c00b2e5e4b4999fba2a853904ed049112cb6bcc0ad28cb7

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 22.5MB
Sample260813-lrs99seq9x
SHA256 8da71725a0dc33603c00b2e5e4b4999fba2a853904ed049112cb6bcc0ad28cb7
MD5 4873c4e0e71573602f05b858cc10c304
SHA1 29aee23f060f9fde720808ddb3bdc8e4344acd91
SHA512 71c372616875e91635b49ecda400cb91130b045fd2a557bc8a5f0d616a70e3b5ef10ac905373cd4732372a9f00290178c5c5cb83b5eea58b573571c64d18edc5
SSDEEP 98304:iVVViVfVVViVfVVViVfVVViVfVVViVfVVViVfVVViVfVVViVwKjKWQckVgtev5m5:0KWQc0gEYnvLF
TLSH
T1C4377D41FAC688B3D47B027248A793F70E70BD154F15969BB788A36E6E337C06632791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4924	svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe
2644	svchost_CCACBAAABBCBABAACCBACBCACCBBCBBACBCABCCABCACAABACBCBCBB.exe
1984	svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CABABACABCBBCCBBACABBBBAACCACBCBBCAACCCCBBABABABCACBACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe"	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCABCACABCACAAACAABACCBBBCACCBACACCCABCCCCBACCAABBCAACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACBAAABBCBABAACCBACBCACCBBCBBACBCABCCABCACAABACBCBCBB.exe"	svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4616	sc.exe
3744	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2468	cmd.exe
4392	cmd.exe
3636	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACBAAABBCBABAACCBACBCACCBBCBBACBCABCCABCACAABACBCBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3600	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3600	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3600	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3600	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4924	svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe
4924	svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe
4924	svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe
4924	svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe
2644	svchost_CCACBAAABBCBABAACCBACBCACCBBCBBACBCABCCABCACAABACBCBCBB.exe
2644	svchost_CCACBAAABBCBABAACCBACBCACCBBCBBACBCABCCABCACAABACBCBCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3600	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4924	svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe
Token: SeDebugPrivilege	2644	svchost_CCACBAAABBCBABAACCBACBCACCBBCBBACBCABCCABCACAABACBCBCBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4320	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 2468	3600	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	105
PID 2468 wrote to memory of 1352	2468	cmd.exe	107
PID 4924 wrote to memory of 1600	4924	svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe	108
PID 1600 wrote to memory of 3572	1600	notepad.exe	109
PID 3600 wrote to memory of 4392	3600	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	113
PID 4392 wrote to memory of 4616	4392	cmd.exe	115
PID 3600 wrote to memory of 3636	3600	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	116
PID 3636 wrote to memory of 3744	3636	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABCBBACACACABCCBABBBBBBCACCBBCCCBAAABCAACABBCCCABBCAAABBAABBCAAABBBBCABBCABCCCCBBCAACCACACBBCBABABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABCBBACACACABCCBABBBBBBCACCBBCCCBAAABCAACABBCCCABBCAAABBAABBCAAABBBBCABBCABCCCCBBCAACCACACBBCBABABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBABABCCACBBAACAAABCACBACBACBBAAACCACBAABBBBAABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe" start= auto displayName= "UserDataSvc_BBBABABCCACBBAACAAABCACBACBACBBAAACCACBAABBBBAABAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBABABCCACBBAACAAABCACBACBACBBAAACCACBAABBBBAABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe" start= auto displayName= "UserDataSvc_BBBABABCCACBBAACAAABCACBACBACBBAAACCACBAABBBBAABAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBABABCCACBBAACAAABCACBACBACBBAAACCACBAABBBBAABAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBABABCCACBBAACAAABCACBACBACBBAAACCACBAABBBBAABAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3572

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4320

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBAAABBCBABAACCBACBCACCBBCBBACBCABCCABCACAABACBCBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBAAABBCBABAACCBACBCACCBBCBBACBCABCCABCACAABACBCBCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe
1⤵
- Executes dropped EXE
PID:1984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f053d7925385462f2140f6bc33369c8c1d1bf54d7207de58a9062023433c19e8
MD5 532937f5d080c929686099b80a45b97b
SHA1 53a9ad5dcaddc113bca97c9691905e5353b09abb
SHA512 7e4b89bd21dcafce075c3bb579ba8e3f0464893f0323366ffe40ffd43cb508b65b8c18fc4f0e17caae57a82e334e658bf98cdf5a03f7232ac61fd5d6c0938cc6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 86f0fc68521750eda6211bb9738606b7b1756527b64fc7a65169a5b0ab16642a
MD5 e09100d0d2a78acdb270fa8d6f91bdcb
SHA1 500910550947297ac330f5d746e8ca13efe097e3
SHA512 8f6109bc1ed8687ba0b05c29226c2fc5cb76886ca42f812b530e834788e8489c249aacd87b93c2caa061b0d8c3971cca3d667a623dfce935a9599c0ea4d14b51
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 07188b1242a950d2da52a04b33361ee1af9be0cd9f1c1fcd3e03b8d72c91b6dc
MD5 39e92061bfadf3a3c2dcf6942e1adc66
SHA1 274222b30c77afa91f396d66a2ab0ce7791bf849
SHA512 f89b66c962298893fed5c2c9976be5d7c38b75be8c8d4ca96eeaacae5e87084bb05e918afcbf0bb52d9d9ba587e2853c1d9fcd98c07c5259b0194dae6b46f89b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9d2d2bfef78fa7e5e8fdb0f78a761a86fa2fe07363d46bb267ad5a508d758a33
MD5 5e150d6509eba518406dc2b446f4bfe7
SHA1 05caf386b5e1e2b1f73904482b5c77484f99e501
SHA512 728e758ba35000aa3e67d1403888adb85e9e17d0cd9a6003e4bb22c93f76baaf7e3d0c41acbb56f18df71f383aaea436e082dd103f0a5c2683c57efd2979d8fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ca3ae0f5963bd9173ab8d59caa2d15081542a2663ab27cee4023330ef309b68f
MD5 c1d3533383bce8be90736e8638c108eb
SHA1 f66b7aa70ca687f5bdde7f3b9c3dae7ef563454a
SHA512 0e2a24141dca3b1158d4e0d65e5d5a342e14f4eea458604817a3adfe929aca834a9f6824c129600950aa9cdfe2140c3058a633f3ea40982f3548abca3ee9cb6c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3fa10b4e8d9aa41edc3afcfa22d38a1d8f8ca64e35dadeb77fdbc73b34b71301
MD5 f471e103406d394dcd9768e134f7c068
SHA1 14fe29c1305f304f0ee153e49d847d9efd8dce8f
SHA512 b1cb5a4cb8523656b4c39876650da8dd57c2c0383b84507bb236609ba29bd3d2e50164a6e9b3c6a8ae194b8b0dab9131b810f74e404a65d9e132c28868b56c50
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 728c61dba17067206785ec5efccec234d930cd84c8768c7d101d72d671a5a793
MD5 56ec52fd03a4249b2ea17f69d06fc3d1
SHA1 cc7e3c77407cb34e1351afa577c9f80a47d1554b
SHA512 e83260fd574d567a1e485936657dc2f7babe6e7b190088aa09d918da4fbca115a34a8e10ad2898da2d8677402e9065e8974391ba3e79eafd5ae10d1ef779e55f
MD5 SHA1 SHA512

Submit Download

svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBBBABCBACAACBACBCCAABCCACACCCABBABABABCCACAAABACAA.exe
Size 22.5MB
SHA256 8da71725a0dc33603c00b2e5e4b4999fba2a853904ed049112cb6bcc0ad28cb7
MD5 4873c4e0e71573602f05b858cc10c304
SHA1 29aee23f060f9fde720808ddb3bdc8e4344acd91
SHA512 71c372616875e91635b49ecda400cb91130b045fd2a557bc8a5f0d616a70e3b5ef10ac905373cd4732372a9f00290178c5c5cb83b5eea58b573571c64d18edc5
SSDEEP 98304:iVVViVfVVViVfVVViVfVVViVfVVViVfVVViVfVVViVfVVViVwKjKWQckVgtev5m5:0KWQc0gEYnvLF
TLSH
T1C4377D41FAC688B3D47B027248A793F70E70BD154F15969BB788A36E6E337C06632791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 1e63d954acb4f0e1f2df222fa9c36184d0308310d2721fa26bc9a161bf2bdda0
MD5 ef8dc5c23b337286b65a72c11cb4db04
SHA1 eca738431310000bbf659839e1bda82bbf84fe93
SHA512 34b62bafe38d261fec808d0395e05ff12f395a3d4ff8613cc20fa5bfca5a73affb23d8e0b477ca0830b5c99d2cd6b5744f39000f7b693be03da593e016738a5d
TLSH
T11811C850B4E5DC53F97324DBA51A9BC30CD836EFAC196B08230D461967D98738E154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1600-59-0x0000000005060000-0x0000000005061000-memory.dmp

Download

memory/1984-82-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download

memory/2644-72-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/3600-0-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/3600-7-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/4924-36-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download