dc79c22b6992372ca73022e3aad52e3602ef124a3448cf22ab3fb986edd049bf

Analysis

max time kernel
151s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_dd9c1ef7109b9d1c5d820cf4c0d5864d_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 21.4MB
Sample260814-bsb29sscpf
SHA256 dc79c22b6992372ca73022e3aad52e3602ef124a3448cf22ab3fb986edd049bf
MD5 dd9c1ef7109b9d1c5d820cf4c0d5864d
SHA1 b444469e8cf6306805924fd1ce7b5bbdbf769e25
SHA512 cf29402a9a2c5ea74a1b57639089247a8feaa5d380627adabb68531e19e94bac7817f86f05b600aeeaea409fe820f0f0431857f2173b03d075ffef2f77e8a8b6
SSDEEP 98304:+QXQVQXQVQXQVQXQVQXQVQXQVQXQIKjKWQckVgtev5mnlNLi:CKWQc0gEYnvLi
TLSH
T138376C41FBD988A2E07702714CB792B70A30BD254F16D6DFB299935E6D337C09A32762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
5040	svchost_BBABCCABCACCBCCABAACACCBBACBBBACBACCBCCCBBACACACBABACBB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAABAABBABBCABAACBBCBABBBCCBCBCACCAABBAABCBCBCABABABCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABCCABCACCBCCABAACACCBBACBBBACBACCBCCCBBACACACBABACBB.exe"	2026-08-14_dd9c1ef7109b9d1c5d820cf4c0d5864d_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6040	sc.exe
2720	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3784	cmd.exe
3728	cmd.exe
3736	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_dd9c1ef7109b9d1c5d820cf4c0d5864d_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABCCABCACCBCCABAACACCBBACBBBACBACCBCCCBBACACACBABACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3584	2026-08-14_dd9c1ef7109b9d1c5d820cf4c0d5864d_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3584	2026-08-14_dd9c1ef7109b9d1c5d820cf4c0d5864d_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3584	2026-08-14_dd9c1ef7109b9d1c5d820cf4c0d5864d_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3584	2026-08-14_dd9c1ef7109b9d1c5d820cf4c0d5864d_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5040	svchost_BBABCCABCACCBCCABAACACCBBACBBBACBACCBCCCBBACACACBABACBB.exe
5040	svchost_BBABCCABCACCBCCABAACACCBBACBBBACBACCBCCCBBACACACBABACBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3584	2026-08-14_dd9c1ef7109b9d1c5d820cf4c0d5864d_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	5040	svchost_BBABCCABCACCBCCABAACACCBBACBBBACBACCBCCCBBACACACBABACBB.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 3784	3584	2026-08-14_dd9c1ef7109b9d1c5d820cf4c0d5864d_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	92
PID 3784 wrote to memory of 6020	3784	cmd.exe	94
PID 3584 wrote to memory of 3728	3584	2026-08-14_dd9c1ef7109b9d1c5d820cf4c0d5864d_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	95
PID 3728 wrote to memory of 6040	3728	cmd.exe	97
PID 3584 wrote to memory of 3736	3584	2026-08-14_dd9c1ef7109b9d1c5d820cf4c0d5864d_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-14_dd9c1ef7109b9d1c5d820cf4c0d5864d_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_dd9c1ef7109b9d1c5d820cf4c0d5864d_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCACAABBACBACBABBBCCAAACABBCCCACBAAACCABBBABCBBABCBCABBBABBACAABABBBBBCBCCBCABAAABCAAACBACAACBCBABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCABCACCBCCABAACACCBBACBBBACBACCBCCCBBACACACBABACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCACAABBACBACBABBBCCAAACABBCCCACBAAACCABBBABCBBABCBCABBBABBACAABABBBBBCBCCBCABAAABCAAACBACAACBCBABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCABCACCBCCABAACACCBBACBBBACBACCBCCCBBACACACBABACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAABBCCBBBAACCCAAACCCACBBAAABCCCCCBCCACACBCABACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCABCACCBCCABAACACCBBACBBBACBACCBCCCBBACACACBABACBB.exe" start= auto displayName= "UserDataSvc_BAAABBCCBBBAACCCAAACCCACBBAAABCCCCCBCCACACBCABACCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAABBCCBBBAACCCAAACCCACBBAAABCCCCCBCCACACBCABACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCABCACCBCCABAACACCBBACBBBACBACCBCCCBBACACACBABACBB.exe" start= auto displayName= "UserDataSvc_BAAABBCCBBBAACCCAAACCCACBBAAABCCCCCBCCACACBCABACCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAABBCCBBBAACCCAAACCCACBBAAABCCCCCBCCACACBCABACCAA"
  2⤵
  - Executes a command shell one-liner
  PID:3736
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAABBCCBBBAACCCAAACCCACBBAAABCCCCCBCCACACBCABACCAA"
    3⤵
    - Launches sc.exe
    PID:2720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCABCACCBCCABAACACCBBACBBBACBACCBCCCBBACACACBABACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCABCACCBCCABAACACCBBACBBBACBACCBCCCBBACACACBABACBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3354b05a0a847d18e3313b447dd4ebdf241349068b057b3f2ec56f9ea8ae78b6
MD5 74aa8fb91e1075c5426bd6f4e415818a
SHA1 84d83ae33b94e77ceeeaf90628da5d1155fd463e
SHA512 7b9a142631270cf8ea397da33cc44de7334ca2bbbc75c902b3c40885201e92108db7e86c8a90d495fce28de44ee18996e8d01d6c906c292ec17c197172a59b39
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7f95bb336456b8839fa259c9bdd6d4c93ebeb0e32bccaf963e954a8e19180c03
MD5 cb5c75ae9132fc1e8a433dbfd923bec4
SHA1 6106a1ef48c7b3c8f549110cf4b87515b1ee4947
SHA512 83fe657be315e077b977321504bce16bf2a8ed89625fb042112d783511a22282217cf8a2273788c6501a9b6ad1c729fb839df437f45dd2f5dbc40acc408b7f08
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eae3962dfc61bd370177fbd1d73cd28a9925f5867fc9435cd37a3f554bcd405a
MD5 39088fe6862d2fe158cfb2fd1aebab59
SHA1 4745381e16a33bc0d5b12d49a8b7746f51da40f2
SHA512 b6bc14a6ce13e6394f21d77463a48e939f7e9a7dd55855fb0c54c441056391de848568f32ed07c28897628c2473787c128d644508f5434df6b8b8acdc00b8f7e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b73193cc4cf76ce1f3ca510691c8c10c35d4021c460f83f955e028eba46e2c76
MD5 6ce63d102c643bcbe580500c28833fe6
SHA1 b41ee8183fac9156952279602b12b7f5915fe25a
SHA512 c759cb8458ac9e5bac0f02cce829348d6e75b341f7c8489422cc16a60b894cfb7c1099188d40c1013da32d087eb8cc6c3a60b6b8922353630758724dc1a58439
MD5 SHA1 SHA512

Submit Download

svchost_BBABCCABCACCBCCABAACACCBBACBBBACBACCBCCCBBACACACBABACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCABCACCBCCABAACACCBBACBBBACBACCBCCCBBACACACBABACBB.exe
Size 21.4MB
SHA256 dc79c22b6992372ca73022e3aad52e3602ef124a3448cf22ab3fb986edd049bf
MD5 dd9c1ef7109b9d1c5d820cf4c0d5864d
SHA1 b444469e8cf6306805924fd1ce7b5bbdbf769e25
SHA512 cf29402a9a2c5ea74a1b57639089247a8feaa5d380627adabb68531e19e94bac7817f86f05b600aeeaea409fe820f0f0431857f2173b03d075ffef2f77e8a8b6
SSDEEP 98304:+QXQVQXQVQXQVQXQVQXQVQXQVQXQIKjKWQckVgtev5mnlNLi:CKWQc0gEYnvLi
TLSH
T138376C41FBD988A2E07702714CB792B70A30BD254F16D6DFB299935E6D337C09A32762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3584-0-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/3584-8-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/5040-25-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/5040-38-0x00000000006F0000-0x0000000000711000-memory.dmp

Download