64f73a12ce479f1363df40795134909f5799e29c72f7993fc421861373150e98

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_f851db8b44701713ad7f6bf733598772_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 4.6MB
Sample260814-c8ad2stalc
SHA256 64f73a12ce479f1363df40795134909f5799e29c72f7993fc421861373150e98
MD5 f851db8b44701713ad7f6bf733598772
SHA1 ac268b586bc5f35a3df160c2b0822790894f84c9
SHA512 1763a4508ee364f52f53bd833c69c2ec70c392ab7abbd8b2aadf10ce26a6a04102a576d5c941c8b156ea79fbd608f6208888d6d5db376188343d876bec70c4f2
SSDEEP 49152:U+ES+EPL+ES+EPL+ES+EPL+ES+EPL+ES+EPL+ES+EPL+ES+EPL+ES+EPL+ES+EPS:AOU/jIEeQfoR/IuOFVjUu5f
TLSH
T127266C01FADA4075F4B302705DAAC27A9530BD658721C9EFF28C865E5F32BD09E35B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5928	svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe
960	svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe
1836	svchost_CAABACCAACBAAAABBAAACBBBBBBBBBCBCACACCBBCABACACBACBCAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACCAABBACCBABCABBABCACACBACCCCBACBCBAACCCCBAAABBBBAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe"	2026-08-14_f851db8b44701713ad7f6bf733598772_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBAABABBBCACBBCCCACCBBCABBBBBBBABBACCCACACCCBABCAAACABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABACCAACBAAAABBAAACBBBBBBBBBCBCACACCBBCABACACBACBCAAA.exe"	svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3432	sc.exe
5804	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5652	cmd.exe
3640	cmd.exe
1016	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABACCAACBAAAABBAAACBBBBBBBBBCBCACACCBBCABACACBACBCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_f851db8b44701713ad7f6bf733598772_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5464	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
724	2026-08-14_f851db8b44701713ad7f6bf733598772_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
724	2026-08-14_f851db8b44701713ad7f6bf733598772_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
724	2026-08-14_f851db8b44701713ad7f6bf733598772_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
724	2026-08-14_f851db8b44701713ad7f6bf733598772_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
5928	svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe
5928	svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe
5928	svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe
5928	svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	724	2026-08-14_f851db8b44701713ad7f6bf733598772_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	5928	svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 5652	724	2026-08-14_f851db8b44701713ad7f6bf733598772_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 5652 wrote to memory of 5464	5652	cmd.exe	94
PID 724 wrote to memory of 3640	724	2026-08-14_f851db8b44701713ad7f6bf733598772_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	95
PID 3640 wrote to memory of 3432	3640	cmd.exe	97
PID 724 wrote to memory of 1016	724	2026-08-14_f851db8b44701713ad7f6bf733598772_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 1016 wrote to memory of 5804	1016	cmd.exe	100
PID 5928 wrote to memory of 5764	5928	svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_f851db8b44701713ad7f6bf733598772_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_f851db8b44701713ad7f6bf733598772_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBAACBCBCCBBACBBBABBCBBABCBCCCACCBBCACCCCBBCCABACBACABBBBBBBBCBBBCCAABAACAABAACBCABBCACCBABACABBCABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBAACBCBCCBBACBBBABBCBBABCBCCCACCBBCACCCCBBCCABACBACABBBBBBBBCBBBCCAABAACAABAACBCABBCACCBABACABBCABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCBACACCABCCACAAAAAACBBBCAAABAACACBCCCCBACBCCAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe" start= auto displayName= "UserDataSvc_BCBCBACACCABCCACAAAAAACBBBCAAABAACACBCCCCBACBCCAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCBACACCABCCACAAAAAACBBBCAAABAACACBCCCCBACBCCAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe" start= auto displayName= "UserDataSvc_BCBCBACACCABCCACAAAAAACBBBCAAABAACACBCCCCBACBCCAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCBACACCABCCACAAAAAACBBBCAAABAACACBCCCCBACBCCAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCBACACCABCCACAAAAAACBBBCAAABAACACBCCCCBACBCCAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5928
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5764

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe
1⤵
- Executes dropped EXE
PID:960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACCAACBAAAABBAAACBBBBBBBBBCBCACACCBBCABACACBACBCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACCAACBAAAABBAAACBBBBBBBBBCBCACACCBBCABACACBACBCAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d7b67a66eff2e0427968936238ec2e241dc6121edc6e98975da7ebd016a0f66a
MD5 0d2006305436da10704fa8ee178b78c7
SHA1 773cae7192ea4e7bcf846a5bce618c756f2339a9
SHA512 088c9a1a4d1f73b81acc7fb85849318ed11eaa46314ee5952915c13fa8cafe9698b4424473d465ded6c1075e42a19ad237937a4923c52332b5a404a34575dcb5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c9706f2a89a80a5449b7b1603016f053a9b8dc3134f9c9fdca82e655749ef01
MD5 93f7f6ec67859921f6d95593655efa9d
SHA1 23ea9cd6e05f29cc86e1f57651912a3a3e7d40a2
SHA512 5830ff8bc2b34e72437903196e1696127da193489991f1bc8a6ae139d7ce97024a869ef225b410268e945c4708a85bba18b74a00da0f4c5bc8219ff8c54fdadb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 944e3b5642eebb3e527c7506a4f75b784875d846e5df696129c9fdf17462fee0
MD5 4bc69b62367a619b5863b85d6e0966db
SHA1 08ca70fb49fb15ed83403a9fc7375a873c710842
SHA512 4297dc19ce3d650458fdb75be1b26fec02a37267369cf68771d66d5ca93ca1fce91ae456e8829f9cf854aeb647e51b7969bc42e06db5edf44da3767fed4b6f44
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3bb21d80dde8618d1193d1994f5081818eb5de754c0316772bf300b82b29a4aa
MD5 f3bed6a43b05217d1d7b03cc91a5b3b2
SHA1 3d6cd50b91a94ddbce2ae36ecb4aa5ee4581ca8c
SHA512 852036d137d3c588b89dde3f128b17f10b11d9eef9a32f95d5631006f71b689341b0318a9229cb03e87ece8948798338cf6947c82403f64029637ed66f96b3f5
MD5 SHA1 SHA512

Submit Download

svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBBBABABACBAACBAACBBAAACBBCCABCBBABACBCBBAABBAABAC.exe
Size 4.6MB
SHA256 64f73a12ce479f1363df40795134909f5799e29c72f7993fc421861373150e98
MD5 f851db8b44701713ad7f6bf733598772
SHA1 ac268b586bc5f35a3df160c2b0822790894f84c9
SHA512 1763a4508ee364f52f53bd833c69c2ec70c392ab7abbd8b2aadf10ce26a6a04102a576d5c941c8b156ea79fbd608f6208888d6d5db376188343d876bec70c4f2
SSDEEP 49152:U+ES+EPL+ES+EPL+ES+EPL+ES+EPL+ES+EPL+ES+EPL+ES+EPL+ES+EPL+ES+EPS:AOU/jIEeQfoR/IuOFVjUu5f
TLSH
T127266C01FADA4075F4B302705DAAC27A9530BD658721C9EFF28C865E5F32BD09E35B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/724-0-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/724-7-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/960-67-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download

memory/5928-23-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download

memory/5928-36-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download