aa429d7e30ef1409ee6cd5da4ca8f6a0c423a9afdbffb63dccc0d6bdd855963a

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 18.2MB
Sample260814-b3c3basekc
SHA256 aa429d7e30ef1409ee6cd5da4ca8f6a0c423a9afdbffb63dccc0d6bdd855963a
MD5 680bee3d8fa44d3334177235a9c5f6db
SHA1 2a070d539727c7796333ac2c088ea02998fecc70
SHA512 519135f6a31ab39db54d1f939a772fa421c5b6358636d26401d65893947ba37e725e4e589024f56d6e3a35204e9a127f0448b503f5ec94ca0ceeac4ef162002d
SSDEEP 98304:cQ0GQ0GQ0GQ0GQ0GQ0GQ0GQ0GQ0rOU/jIEeQfoR/IuOFVjUu5Q:KFIF0wuq
TLSH
T16F175B45FA4380B2D82B01714CCBD3BB4B70B9158F129AABF74D932FAE337D0A625655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
456	svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe
2688	svchost_BBBBCBACBABACCCBBBACCBCBCACBABBCBABCBBAACBCAABCCABABAAA.exe
2776	svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCCACABBBABBBABAAAAABBBCCCABCCBABBCACCBCBBABBABCABABCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBCBACBABACCCBBBACCBCBCACBABBCBABCBBAACBCAABCCABABAAA.exe"	svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCBCABAACCAACABACBAACABBCCBCBABCBCABCACBCBBBAACCBAAACAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe"	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1600	sc.exe
4204	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1808	cmd.exe
984	cmd.exe
452	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBCBACBABACCCBBBACCBCBCACBABBCBABCBBAACBCAABCCABABAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
916	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
916	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
916	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
916	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
456	svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe
456	svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe
456	svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe
456	svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	456	svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4316	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 1808	916	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 1808 wrote to memory of 5100	1808	cmd.exe	100
PID 456 wrote to memory of 3624	456	svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe	101
PID 3624 wrote to memory of 4404	3624	notepad.exe	102
PID 916 wrote to memory of 984	916	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	106
PID 984 wrote to memory of 4204	984	cmd.exe	108
PID 916 wrote to memory of 452	916	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	109
PID 452 wrote to memory of 1600	452	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACAAABCBBAABBCCAABCCBABACCCACBBAABCBCACBCAACBCCAABCBCBACCBCABAABAABABAAAABAABCCCCABCBABBAACBBCBBCABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACAAABCBBAABBCCAABCCBABACCCACBBAABCBCACBCAACBCCAABCBCBACCBCABAABAABABAAAABAABCCCCABCBABBAACBBCBBCABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCAAACCBCCCAACBCAABCCACBCCCAACBCCBBBABBABCABCAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe" start= auto displayName= "UserDataSvc_BBBCAAACCBCCCAACBCAABCCACBCCCAACBCCBBBABBABCABCAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCAAACCBCCCAACBCAABCCACBCCCAACBCCBBBABBABCABCAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe" start= auto displayName= "UserDataSvc_BBBCAAACCBCCCAACBCAABCCACBCCCAACBCCBBBABBABCABCAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCAAACCBCCCAACBCAABCCACBCCCAACBCCBBBABBABCABCAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCAAACCBCCCAACBCAABCCACBCCCAACBCCBBBABBABCABCAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1600

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4316

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBACBABACCCBBBACCBCBCACBABBCBABCBBAACBCAABCCABABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCBACBABACCCBBBACCBCBCACBABBCBABCBBAACBCAABCCABABAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2688

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe
1⤵
- Executes dropped EXE
PID:2776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d71806d8c72d1dec21950b1fdcf5ab26543ab1392342dfc15da123fbf53cb218
MD5 8179e3b8058a3291dcc88f3c3277323b
SHA1 dba277a44a22b8780f43fd70c467d510dfa8371b
SHA512 9a5bb5bc87d22877ab8b6de59727eb9e2163fd648d72465cb3413d93b3f6613964cdd478cdca46276ebf6d8d85f8033e858ecca9ecef2be526a0269c6db8b754
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 34ab0348c8f95a1bb7cfdd491be175dd6db9e132a15eb01a637c95a6c46ebafc
MD5 3b889a207d521346736867983a91490e
SHA1 df7c51628112264f19573b8bc939a58f08c87bac
SHA512 8443b0ffab31ab0e582ddfb786feabc99fad326be19ca8d1ab43c4e8606977abce9924631672732e0468348660cddcbd73f3e30efe0e5c5771f23db51cc915b8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6c2175a3f8a4ac94eb3711720559e1c2fa9af711dfe202c3c43a6fd92400e5f1
MD5 4f3607e1eac5fd48cf553ad3ff58251c
SHA1 411e5cea5d65c4d0ca60d27dfd03e4ac4e49964a
SHA512 bc16660b8a135788232ff086e7c3ac04248605f4525591cedd2041668047176277d12307f27cdc90c754668408c26bc170c45c88f97dcd94d54beca42037191c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3abfde6ce6ac86993722d213a2f17c4a98179a50429c18ea2780e87e243a51fd
MD5 985007268016f714a2606747972e2385
SHA1 77a864e339c1a9599a26f81ce281759f914d1670
SHA512 d3f0e8a155b78170de2b7a9e6d65c078b7f2b4c8f7606fcdb46fcc5944c9b91434e8079ad7b20f073d9e31948ebd9c0ce08376b81e3bbdd4b58255621e24cebb
MD5 SHA1 SHA512

Submit Download

svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACBCCBABBCCAACBAABBCBABBCBCBAACCCCABBCBCBACAAACACBBB.exe
Size 18.2MB
SHA256 aa429d7e30ef1409ee6cd5da4ca8f6a0c423a9afdbffb63dccc0d6bdd855963a
MD5 680bee3d8fa44d3334177235a9c5f6db
SHA1 2a070d539727c7796333ac2c088ea02998fecc70
SHA512 519135f6a31ab39db54d1f939a772fa421c5b6358636d26401d65893947ba37e725e4e589024f56d6e3a35204e9a127f0448b503f5ec94ca0ceeac4ef162002d
SSDEEP 98304:cQ0GQ0GQ0GQ0GQ0GQ0GQ0GQ0GQ0rOU/jIEeQfoR/IuOFVjUu5Q:KFIF0wuq
TLSH
T16F175B45FA4380B2D82B01714CCBD3BB4B70B9158F129AABF74D932FAE337D0A625655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-27-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/456-37-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/916-0-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/916-8-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/3624-62-0x0000000004F40000-0x0000000004F41000-memory.dmp

Download