8da71725a0dc33603c00b2e5e4b4999fba2a853904ed049112cb6bcc0ad28cb7

Analysis

max time kernel
150s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 22.5MB
Sample260813-lrs99seq9x
SHA256 8da71725a0dc33603c00b2e5e4b4999fba2a853904ed049112cb6bcc0ad28cb7
MD5 4873c4e0e71573602f05b858cc10c304
SHA1 29aee23f060f9fde720808ddb3bdc8e4344acd91
SHA512 71c372616875e91635b49ecda400cb91130b045fd2a557bc8a5f0d616a70e3b5ef10ac905373cd4732372a9f00290178c5c5cb83b5eea58b573571c64d18edc5
SSDEEP 98304:iVVViVfVVViVfVVViVfVVViVfVVViVfVVViVfVVViVfVVViVwKjKWQckVgtev5m5:0KWQc0gEYnvLF
TLSH
T1C4377D41FAC688B3D47B027248A793F70E70BD154F15969BB788A36E6E337C06632791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1140	svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe
4792	svchost_BCCBCCAABCCBABBBAACBBCCCACCBCACBBABCAACBAAAACABCBACCCCB.exe
5608	svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBABBBCBAACAACCAABBBBCCAAAABABCABACCBBABACCCAAABBCAACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCCAABCCBABBBAACBBCCCACCBCACBBABCAACBAAAACABCBACCCCB.exe"	svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBBACAACBBCCAAABABBACCBBABBCBBBAAACABCACCACACAACBBAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe"	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2068	sc.exe
5800	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4636	cmd.exe
3792	cmd.exe
1044	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCCAABCCBABBBAACBBCCCACCBCACBBABCAACBAAAACABCBACCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4512	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4512	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4512	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4512	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1140	svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe
1140	svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe
1140	svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe
1140	svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe
4792	svchost_BCCBCCAABCCBABBBAACBBCCCACCBCACBBABCAACBAAAACABCBACCCCB.exe
4792	svchost_BCCBCCAABCCBABBBAACBBCCCACCBCACBBABCAACBAAAACABCBACCCCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4512	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	1140	svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe
Token: SeDebugPrivilege	4792	svchost_BCCBCCAABCCBABBBAACBBCCCACCBCACBBABCAACBAAAACABCBACCCCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4636	4512	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	92
PID 4636 wrote to memory of 3696	4636	cmd.exe	94
PID 1140 wrote to memory of 5732	1140	svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe	95
PID 4512 wrote to memory of 3792	4512	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	98
PID 3792 wrote to memory of 2068	3792	cmd.exe	100
PID 4512 wrote to memory of 1044	4512	2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	101
PID 1044 wrote to memory of 5800	1044	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_4873c4e0e71573602f05b858cc10c304_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCAAAABBBCCBCCBAAABCACABBBCCBACABCABCCAABBCABBCACAAAACAABBABCBCCBBABACACCBCCCAABCCCABBAAACBCABABCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCAAAABBBCCBCCBAAABCACABBBCCBACABCABCCAABBCABBCACAAAACAABBABCBCCBBABACACCBCCCAABCCCABBAAACBCABABCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACACCAAACBBAACABBBBABAACACCACABABCAACBACCAABCAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe" start= auto displayName= "UserDataSvc_AACACCAAACBBAACABBBBABAACACCACABABCAACBACCAABCAACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACACCAAACBBAACABBBBABAACACCACABABCAACBACCAABCAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe" start= auto displayName= "UserDataSvc_AACACCAAACBBAACABBBBABAACACCACABABCAACBACCAABCAACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACACCAAACBBAACABBBBABAACACCACABABCAACBACCAABCAACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACACCAAACBBAACABBBBABAACACCACABABCAACBACCAABCAACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5800

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5732

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCAABCCBABBBAACBBCCCACCBCACBBABCAACBAAAACABCBACCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCAABCCBABBBAACBBCCCACCBCACBBABCAACBAAAACABCBACCCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe
1⤵
- Executes dropped EXE
PID:5608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f66a719bd5a8277c8dc176b40396aaca1c35aba30dcfc6cf93f41bc767354c90
MD5 6b67c6a1e57d57551cda5da75b395457
SHA1 2e5f6522ec50866b02c45c23e23e63f195128da2
SHA512 a4c3cea348e8d4c026efe8508cb54127c40f5a6c456fb0a5214145ded803e0d161b8a3f26c94b6fe86ac7a14ee67aef06daa677f1909cb7dd5d1fd5697cd05f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 360b9f3abdda2cbf26e12816be0848fcae6713a979f6bf0a8274dcaa91dec284
MD5 7b51ced5b33585885d1d1ab8e8229ae5
SHA1 bb8ee4ac9ce62c32bfa28a58e05acc62217ef3a7
SHA512 c1f1d7b6aba3d390aea9dc55bf0207d9753e731d9f06e53270c934630a7231020bf43bd7419b3717c683e787877acf780042d64f984264ad5997612b9e0946d7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b1af90cf2db7a6c57a3ec1939066311b5eb43008b47fd1c190a1ffbd939dc480
MD5 8669154c00bf789b37c9308e22956df3
SHA1 e09e3cea227354735db3a6d581d39d604c2616a5
SHA512 92ceb99bd754e4cedc68a22b486f694f7a4465aebbdde397b3bd2a681cf534a848328f09076e53274d42a3711902f93eaceed5e357334958b0363f72c3411334
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c350f3ef389522abbe476f42cd3732f4f559681318502b6e2d37d881581b4dc6
MD5 27361ec890ae74d9d281f849c3e6cbb8
SHA1 60a5415072d8c51e8916984c55eb19a8689063fa
SHA512 bcde84b767ee083d975e067ced2981fa0d38bd745355e832445593b848c9d7fbf669b2ecf61d4a8dd340d40b11455612f18f4ae3b07168ede735189787600f43
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2f45143150635529ce4e57de1dc0a219cc27f6b2722efee8d2c145e4fd09bcc5
MD5 a882a0a533e5acb872ee5dd7b68650f7
SHA1 939ff8a9284aa852e37d363a14d58ae7b29160d9
SHA512 f80b1c897835cbf721e656428dddfba7beeaed065254ce589c8538cbfbcf09e698764f048985ac47ae6a652c24c370ae7897c843484a4d2228dcaf48976353e7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 728c61dba17067206785ec5efccec234d930cd84c8768c7d101d72d671a5a793
MD5 56ec52fd03a4249b2ea17f69d06fc3d1
SHA1 cc7e3c77407cb34e1351afa577c9f80a47d1554b
SHA512 e83260fd574d567a1e485936657dc2f7babe6e7b190088aa09d918da4fbca115a34a8e10ad2898da2d8677402e9065e8974391ba3e79eafd5ae10d1ef779e55f
MD5 SHA1 SHA512

Submit Download

svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBCBBCABCBBBCACACACBCABBBAABBCBBBAAAACBCACBCCCCCBBAC.exe
Size 22.5MB
SHA256 8da71725a0dc33603c00b2e5e4b4999fba2a853904ed049112cb6bcc0ad28cb7
MD5 4873c4e0e71573602f05b858cc10c304
SHA1 29aee23f060f9fde720808ddb3bdc8e4344acd91
SHA512 71c372616875e91635b49ecda400cb91130b045fd2a557bc8a5f0d616a70e3b5ef10ac905373cd4732372a9f00290178c5c5cb83b5eea58b573571c64d18edc5
SSDEEP 98304:iVVViVfVVViVfVVViVfVVViVfVVViVfVVViVfVVViVfVVViVwKjKWQckVgtev5m5:0KWQc0gEYnvLF
TLSH
T1C4377D41FAC688B3D47B027248A793F70E70BD154F15969BB788A36E6E337C06632791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a2daa03cdb3684d68d620fcafa6fa31e4381571991f4a295e583f55d33cd6841
MD5 bd9d21e60cc536c2a810a47f5f792c72
SHA1 ca07de82b5e66191a9da441329154d8afa2500fc
SHA512 1dcad5e479de445d31582130b071f9048090e4df623b0c7de9be62bae0d15a5f533566365f242f2891ec5638cc0d709f49168381f8aa9d48629ffe5f2357ceb0
TLSH
T14511C450F4E5D827F97328DE661ACE920CA837AFAC557F182309461AB7A5C724D290E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1140-33-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/1140-23-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/4512-0-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/4512-7-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/4792-79-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download