16e72ea806f1876efdb6f1549ebad2357c4a4a2f8d9e7eae072a3ab75f1cb67a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 5.3MB
Sample260814-dfptpseg82
SHA256 16e72ea806f1876efdb6f1549ebad2357c4a4a2f8d9e7eae072a3ab75f1cb67a
MD5 e479372e7baf20f1b3d0bc34d73be25b
SHA1 47ddf9c23175b9c3a70dfda5e7fb3d8e2ff586ca
SHA512 896f7cd87e030d5882987e6c473f5e6af3da403d43d9a4423f47694a0372c46c634cd72fb2e2cb808efce6a3e70cb6b950eedf5309d22bf2abc7cd766520f633
SSDEEP 49152:U+EkqatglaV+EkqatglaV+EkqatglaV+EkqatglaV+EkqatglaV+EkqatglaV+Ey:reeeeeeeeqKjKWQckVgtev5mnlNLz
TLSH
T1BE468D82BA8991B2E4770231486B82B75B70FC155F12E6DFB384A36D5D337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1960	svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe
3692	svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe
4648	svchost_BCBBBABBAAACCCBABBCBCBCBAACCACBBBCBACCCACBAABBCCCCBBBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBAACBACCBCCBBCBABBCACBACACAAAABAABAAACCCBCAAACAACBCAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe"	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBACCAAAAABBCACCCAABBBBAAABAABBCABABCAACABACCCACCCBAABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBBABBAAACCCBABBCBCBCBAACCACBBBCBACCCACBAABBCCCCBBBAB.exe"	svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2944	sc.exe
2376	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4448	cmd.exe
5100	cmd.exe
4980	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBBABBAAACCCBABBCBCBCBAACCACBBBCBACCCACBAABBCCCCBBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3024	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3024	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3024	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3024	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1960	svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe
1960	svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe
1960	svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe
1960	svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe
4648	svchost_BCBBBABBAAACCCBABBCBCBCBAACCACBBBCBACCCACBAABBCCCCBBBAB.exe
4648	svchost_BCBBBABBAAACCCBABBCBCBCBAACCACBBBCBACCCACBAABBCCCCBBBAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	1960	svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe
Token: SeDebugPrivilege	4648	svchost_BCBBBABBAAACCCBABBCBCBCBAACCACBBBCBACCCACBAABBCCCCBBBAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
880	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 4448	3024	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	99
PID 4448 wrote to memory of 5032	4448	cmd.exe	101
PID 1960 wrote to memory of 1796	1960	svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe	104
PID 3024 wrote to memory of 5100	3024	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	105
PID 5100 wrote to memory of 2944	5100	cmd.exe	107
PID 3024 wrote to memory of 4980	3024	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	108
PID 4980 wrote to memory of 2376	4980	cmd.exe	110
PID 1796 wrote to memory of 1032	1796	notepad.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCBBBAAABBAABCCBCABCBAACABCABCBCABAABBCBBCCCBBCCABBBABBABCAACBACCCBCAACCCAABBACABCCCABABABBCCBBBACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCBBBAAABBAABCCBCABCBAACABCABCBCABAABBCBBCCCBBCCABBBABBABCAACBACCCBCAACCCAABBACABCCCABABABBCCBBBACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBACBBBCACBBAACAABBCACACABACBCBCCBCABBCBBCABCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe" start= auto displayName= "UserDataSvc_AACBACBBBCACBBAACAABBCACACABACBCBCCBCABBCBBCABCAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBACBBBCACBBAACAABBCACACABACBCBCCBCABBCBBCABCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe" start= auto displayName= "UserDataSvc_AACBACBBBCACBBAACAABBCACACABACBCBCCBCABBCBBCABCAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBACBBBCACBBAACAABBCACACABACBCBCCBCABBCBBCABCAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBACBBBCACBBAACAABBCACACABACBCBCCBCABBCBBCABCAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe
1⤵
- Executes dropped EXE
PID:3692

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBABBAAACCCBABBCBCBCBAACCACBBBCBACCCACBAABBCCCCBBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBABBAAACCCBABBCBCBCBAACCACBBBCBACCCACBAABBCCCCBBBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 36623bef69d186a754100a7b0d0dc3267a4b093e2cad79515c57dfba47531cf5
MD5 0fc9b01bf1ac26d9b1dad739af9405a1
SHA1 b9c1724b204df422bb0e55c86d2a90802619a66e
SHA512 edd6f934cfaab7d2137c9641879c6030bdfe5c1bd898c4c0fda4c7b5bcfe092dc39d3859f7fd75bc30a46acbcfbeee08fdb66dc3c0eea8d8f943f146121122cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ad4f83f86082a1e52f2be326859a055bca2353a8d3a0002fd92ab39ee7797da6
MD5 77f87bb6f46f3e69433df9c5a9b842c4
SHA1 d3fea3e6ff759dca9d93fcb45311e44a22ac6833
SHA512 ee6efe7b265e0d55f4c862b4f937b782307db38df8b968bb158c3b4d4e2863f7a4e433dc17cc565d0891bc3d0e030e16120ca3c4802b783232cbbfbec1ec15ed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 81076af7365d854c454d722b54b7e7e4eb08886bcf8d899ff613ff3e38076af9
MD5 440971ef9bf423f35dfd110f07239d74
SHA1 0b7fa1a2c933c05106ea8a0d3fde99df211bd8a6
SHA512 956e8ee62501356bb7379a1bbaf79801507a7fde285398d38343d9cc2d2d3b1cb9424034078b0863476ce5a6d2c2ccde1a46a6cc3042ed248a6c9bef6cd5c129
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 32e2a681c7a06761e2d31d7af94e86b22926bd800df170f8568f95f27288de04
MD5 7ec399d14b2f2164242f687f77b9afc4
SHA1 1686517446ed223726c61bb6e6b91a4c8563b095
SHA512 9ad9e0f2a703e6e424c09c50ad651aa98671a0d2eb6b74ba01fd566c79c0c77dc8a493f08de6bf22a3fe87a5779e83563ab948513908579cc93baff11b659084
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2e20fc48dfbb97f3e80e48810973816478f11d7ecc673f545430b10030f24c22
MD5 5ec265feac4eba359ff20053cef19d65
SHA1 933d47d090aacebd3c0925bf25ef047ebf15a1bb
SHA512 bdf6128f62ade46cccdb1d6b74ed85bd88c8e67cd06e8d773cbc7c93b537214bdd2522597b4f2efcdd02b2c23800dc6309b428bfe941f33e88d90ba946b4e0af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 81dff9fa552656aef2c6f974466d91cc6a096ba9ce9b1061d5c520fe32c85984
MD5 df832fc4affa9a73767778a47ad91e56
SHA1 8527d50e402ab80b02c56688b07d4b9d8bada4ed
SHA512 60612290ea4c18b290c3d813984d6c4ab8fe8a36706b864747d577aac45324b36adc3f3bb28e48486f3c2cc2a664bea14b9d22bd3c07d788df73dda8b5edc9e1
MD5 SHA1 SHA512

Submit Download

svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBAABABAACAACCBABBCCBBBBAACBACCBABBCACBAACACACAAACB.exe
Size 5.3MB
SHA256 16e72ea806f1876efdb6f1549ebad2357c4a4a2f8d9e7eae072a3ab75f1cb67a
MD5 e479372e7baf20f1b3d0bc34d73be25b
SHA1 47ddf9c23175b9c3a70dfda5e7fb3d8e2ff586ca
SHA512 896f7cd87e030d5882987e6c473f5e6af3da403d43d9a4423f47694a0372c46c634cd72fb2e2cb808efce6a3e70cb6b950eedf5309d22bf2abc7cd766520f633
SSDEEP 49152:U+EkqatglaV+EkqatglaV+EkqatglaV+EkqatglaV+EkqatglaV+EkqatglaV+Ey:reeeeeeeeqKjKWQckVgtev5mnlNLz
TLSH
T1BE468D82BA8991B2E4770231486B82B75B70FC155F12E6DFB384A36D5D337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 55ad0f69a05ddda1f4ef9f6c70743dc0a6f832c1513b41110551901a22036d5d
MD5 d76a2164a89fd120e1dddf9a30df4fba
SHA1 156989e2768da48ecc07583fbd514010dd9371fa
SHA512 fb8a07ed0093427929265769522b6f9be0576d07e98880fa0f9b5bf284808664c1cc435467abbd37fe462ea3728af7033a610c5d66e3b6b18799d7c99dd0a229
TLSH
T1C511E750A4F59897F933E9CB5329CBE20CF877AF2818EA05234D422CBB9AC304D154F6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1796-66-0x0000000003120000-0x0000000003121000-memory.dmp

Download

memory/1960-38-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/1960-25-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/3024-6-0x0000000000A10000-0x0000000000A31000-memory.dmp

Download

memory/3692-74-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/4648-89-0x0000000000830000-0x0000000000851000-memory.dmp

Download