aa429d7e30ef1409ee6cd5da4ca8f6a0c423a9afdbffb63dccc0d6bdd855963a

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 18.2MB
Sample260814-b3c3basekc
SHA256 aa429d7e30ef1409ee6cd5da4ca8f6a0c423a9afdbffb63dccc0d6bdd855963a
MD5 680bee3d8fa44d3334177235a9c5f6db
SHA1 2a070d539727c7796333ac2c088ea02998fecc70
SHA512 519135f6a31ab39db54d1f939a772fa421c5b6358636d26401d65893947ba37e725e4e589024f56d6e3a35204e9a127f0448b503f5ec94ca0ceeac4ef162002d
SSDEEP 98304:cQ0GQ0GQ0GQ0GQ0GQ0GQ0GQ0GQ0rOU/jIEeQfoR/IuOFVjUu5Q:KFIF0wuq
TLSH
T16F175B45FA4380B2D82B01714CCBD3BB4B70B9158F129AABF74D932FAE337D0A625655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5980	svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe
3048	svchost_BABBBBCCABCBCACCBCBBACBCBABACCACABACBCCACCCCBCBBCACAAAA.exe
3492	svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBACAACCCAABBACCACCAAACAAAABACBBABBCABABCCBCABCCABCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe"	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBACACBBABBCABABBCCABABCCBCBACBBCBABAAAACCBABCBCCAACAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBBBCCABCBCACCBCBBACBCBABACCACABACBCCACCCCBCBBCACAAAA.exe"	svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2912	sc.exe
3508	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2428	cmd.exe
1720	cmd.exe
4592	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBBBCCABCBCACCBCBBACBCBABACCACABACBCCACCCCBCBBCACAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4368	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4276	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4276	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4276	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4276	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5980	svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe
5980	svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe
5980	svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe
5980	svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5980	svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 2428	4276	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 2428 wrote to memory of 4368	2428	cmd.exe	94
PID 5980 wrote to memory of 1736	5980	svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe	95
PID 4276 wrote to memory of 1720	4276	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 1720 wrote to memory of 2912	1720	cmd.exe	100
PID 4276 wrote to memory of 4592	4276	2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 4592 wrote to memory of 3508	4592	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_680bee3d8fa44d3334177235a9c5f6db_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBBBBABCCBAAABBABBAACCBACACABABAABBACCACCCBCBABBBCBABABBCCBAABACACCABBCACBBAABAACAAACABABBCACAABAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBBBBABCCBAAABBABBAACCBACACABABAABBACCACCCBCBABBBCBABABBCCBAABACACCABBCACBBAABAACAAACABABBCACAABAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABCCCBCCAAAABCAACCCACAACBCCAACCCBBCBABBABABAABACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe" start= auto displayName= "UserDataSvc_BAABCCCBCCAAAABCAACCCACAACBCCAACCCBBCBABBABABAABACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABCCCBCCAAAABCAACCCACAACBCCAACCCBBCBABBABABAABACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe" start= auto displayName= "UserDataSvc_BAABCCCBCCAAAABCAACCCACAACBCCAACCCBBCBABBABABAABACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABCCCBCCAAAABCAACCCACAACBCCAACCCBBCBABBABABAABACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABCCCBCCAAAABCAACCCACAACBCCAACCCBBCBABBABABAABACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1736

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBBCCABCBCACCBCBBACBCBABACCACABACBCCACCCCBCBBCACAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBBCCABCBCACCBCBBACBCBABACCACABACBCCACCCCBCBBCACAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3048

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe
1⤵
- Executes dropped EXE
PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6513116350b00fc21099291340c10bb21d218849980699de0b11c4fcbd592517
MD5 951ca48cfbca2921aae2520f59351c1e
SHA1 f6dedd2e17df61371cbbc710816d60a773814724
SHA512 b24e55a8a21c8ed72e05cda955c4ff88ea02563f014e8461ecd288fc6e6ca61dd4a1231ced3213c1be7f74d031f7561e5e7a58815fc7fe63620265fb5cd27871
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d71806d8c72d1dec21950b1fdcf5ab26543ab1392342dfc15da123fbf53cb218
MD5 8179e3b8058a3291dcc88f3c3277323b
SHA1 dba277a44a22b8780f43fd70c467d510dfa8371b
SHA512 9a5bb5bc87d22877ab8b6de59727eb9e2163fd648d72465cb3413d93b3f6613964cdd478cdca46276ebf6d8d85f8033e858ecca9ecef2be526a0269c6db8b754
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e7e0de441e69d7ead7f0d3f09fcb0a244a177a1f75e2e326f559539b7835b7c5
MD5 17a47065c9532879ad7abc3a871db559
SHA1 c406f9b32d26ab8dd1d4fb382b473376eddc70b0
SHA512 2fdab7976e625dda023e0f7ab41eef31591dfcd43a7d445dd284fa4cbd0dba22a80507679210df7c91a9b4efa480be41f4fd11c05bc19d38205a31589ad4f29e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 16e8bfbc5609af3ed67d1aef0175d14c7f8dc23fd989dc134866e7cca5f0f9a1
MD5 9fd5b36caa1bff833413bc1d6a34bfdf
SHA1 228dde1a3bfea2d727a41e06617407b44a945444
SHA512 03af3894e644d033bcaffc90f08bfe03edefce74aa25363e9d48d2e8a6aff5baae3bec4f174833c8da2ec2db97b83db7675b10c31f3833b134189f9916a78a28
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3758b0d985fdb20574838aee4ad97a2b6df71182fac16e64e93a6baae53b29d8
MD5 72099ce3e59448a67afdd6caf9725d78
SHA1 10b1372cf955fcffed324f639972e2ce9dc7a659
SHA512 eb46030909e6efc4aacd21d657cf60559bdf21598a3ea724e56b650bd9f2dc97eb350713135ed33a6635df597fbd810fd6bb06047427873351400039ee78f38b
MD5 SHA1 SHA512

Submit Download

svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBBCACABAAAACCBACAACACACBACBCABBABACCCACCACBAAAACA.exe
Size 18.2MB
SHA256 aa429d7e30ef1409ee6cd5da4ca8f6a0c423a9afdbffb63dccc0d6bdd855963a
MD5 680bee3d8fa44d3334177235a9c5f6db
SHA1 2a070d539727c7796333ac2c088ea02998fecc70
SHA512 519135f6a31ab39db54d1f939a772fa421c5b6358636d26401d65893947ba37e725e4e589024f56d6e3a35204e9a127f0448b503f5ec94ca0ceeac4ef162002d
SSDEEP 98304:cQ0GQ0GQ0GQ0GQ0GQ0GQ0GQ0GQ0rOU/jIEeQfoR/IuOFVjUu5Q:KFIF0wuq
TLSH
T16F175B45FA4380B2D82B01714CCBD3BB4B70B9158F129AABF74D932FAE337D0A625655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3048-70-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/4276-0-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/4276-8-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/5980-24-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/5980-34-0x0000000000430000-0x0000000000451000-memory.dmp

Download