16e72ea806f1876efdb6f1549ebad2357c4a4a2f8d9e7eae072a3ab75f1cb67a

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 5.3MB
Sample260814-dfptpseg82
SHA256 16e72ea806f1876efdb6f1549ebad2357c4a4a2f8d9e7eae072a3ab75f1cb67a
MD5 e479372e7baf20f1b3d0bc34d73be25b
SHA1 47ddf9c23175b9c3a70dfda5e7fb3d8e2ff586ca
SHA512 896f7cd87e030d5882987e6c473f5e6af3da403d43d9a4423f47694a0372c46c634cd72fb2e2cb808efce6a3e70cb6b950eedf5309d22bf2abc7cd766520f633
SSDEEP 49152:U+EkqatglaV+EkqatglaV+EkqatglaV+EkqatglaV+EkqatglaV+EkqatglaV+Ey:reeeeeeeeqKjKWQckVgtev5mnlNLz
TLSH
T1BE468D82BA8991B2E4770231486B82B75B70FC155F12E6DFB384A36D5D337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5668	svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe
1552	svchost_CBBCCABBABBBCAACCBBCAABACBBACACCABAACBBCABBCAABACCBCBBC.exe
5856	svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBAABAAAABCCCABACACBBAACCCABACCACCABBAACABCBBCAACCACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe"	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABCBAABACCACBAACBABBCBAAAACBACCBCABABBABBAAABBAABCBCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCCABBABBBCAACCBBCAABACBBACACCABAACBBCABBCAABACCBCBBC.exe"	svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2284	sc.exe
5472	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4784	cmd.exe
5764	cmd.exe
6120	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCCABBABBBCAACCBBCAABACBBACACCABAACBBCABBCAABACCBCBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1468	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1468	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1468	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1468	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5668	svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe
5668	svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe
5668	svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe
5668	svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1468	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	5668	svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 5764	1468	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	91
PID 5764 wrote to memory of 2980	5764	cmd.exe	93
PID 5668 wrote to memory of 4940	5668	svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe	94
PID 1468 wrote to memory of 6120	1468	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	97
PID 6120 wrote to memory of 2284	6120	cmd.exe	99
PID 1468 wrote to memory of 4784	1468	2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	100
PID 4784 wrote to memory of 5472	4784	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e479372e7baf20f1b3d0bc34d73be25b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBBCBCABCACBBCABBBBABBBCBBCACBBCAACCBCBCBBCAAAAACCABBBCBCACAAABACBCABBAABBACBBCCABACBBAABCBBACBBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBBCBCABCACBBCABBBBABBBCBBCACBBCAACCBCBCBBCAAAAACCABBBCBCACAAABACBCABBAABBACBBCCABACBBAABCBBACBBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACAABBCBBACBBBBBCAACBBCACBAAABAABCCCBBCCCCCBACABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe" start= auto displayName= "UserDataSvc_BACAABBCBBACBBBBBCAACBBCACBAAABAABCCCBBCCCCCBACABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACAABBCBBACBBBBBCAACBBCACBAAABAABCCCBBCCCCCBACABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe" start= auto displayName= "UserDataSvc_BACAABBCBBACBBBBBCAACBBCACBAAABAABCCCBBCCCCCBACABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACAABBCBBACBBBBBCAACBBCACBAAABAABCCCBBCCCCCBACABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACAABBCBBACBBBBBCAACBBCACBAAABAABCCCBBCCCCCBACABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCABBABBBCAACCBBCAABACBBACACCABAACBBCABBCAABACCBCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCABBABBBCAACCBBCAABACBBACACCABAACBBCABBCAABACCBCBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe
1⤵
- Executes dropped EXE
PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 52add2009bb44cd4ddd2d8535dd75a4b34e3c3a5499b9951c7a69619dbd4cc82
MD5 b3f46322865b2860f20f4ef80ee6385e
SHA1 6fdea8116480639bd8ccc01bb6f7384d80be7341
SHA512 b79b9a3a0f63b0d609be2f9c3621ff98a4f3a194e950ab650525c9026dce41c99727dc1ec37a4059d196d22e88bba281e7e853dd5881ef4560cf146b5be71abb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b8be77d07e225df8507b89a8a646d1ef9e01e0c435334dac5e5cb84a395d5352
MD5 5f57cae9d9db6b26b7a51487c0452eab
SHA1 ebbb7bf8fdac8380c43a5560ddebe645f4b87d11
SHA512 ceaa5f3839a41cd19d1602e467c369c7533cdca7b020c148cf14216b3cca2633ff3ef959b17acc3f708be35c994e81a1ea6492bc425d965e2c44590d6ece25bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8cfa91398bae5876e98cd09438840698ea5c2f7ac81f6de0484056c2916b054a
MD5 203be8f9fb98761c490f2f6183e4934a
SHA1 a8b8651585501d85678a5117b9ff13623c914778
SHA512 a4e4eb52259fb62691b9e7eb6f1fa1c8cf48075cc5cf2b8d828b6c993220472e91dff6269e0a62dc58e34ee730a050a19ced4ea1c97f2bb0a0131a4aa0440116
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 580cadc73f5bedbc458b84d400d315312744d09921e870a4551be3e6ba311253
MD5 fa31c6b62c44b8d7b339c56d2ae0330b
SHA1 455d2e9fcfbafa4da8ed6c51037652817b0315ca
SHA512 dff7e4971ac056b1e6a2211a1cae0bfdfbf95dcf65bde2960b2776a30eb26bf8faa600ee49df5b43d61bfaf29acfe6e84dd9664500e98b8a0c0f11dea72574aa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f3a6b45dc638e7214d2ef6e75f3a066179c22806f19fb410cbeb28a965fe1c3f
MD5 4163649ebc03f48df69f3dc37b033e04
SHA1 ca40853932decdb25f5822c873e75006a2f73f88
SHA512 67c9985459f4c82d125de4bd5419c19c1c8db975e49ff605192b1e28eaab159cd606b677ec8ce56f6ea99ef8030de33ded8a3ac6e235f13bb3c5ee79045af26f
MD5 SHA1 SHA512

Submit Download

svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCABCBCACAABABCAACABABCAACABBCCCCBBACBBCCBBCCCCBCCC.exe
Size 5.3MB
SHA256 16e72ea806f1876efdb6f1549ebad2357c4a4a2f8d9e7eae072a3ab75f1cb67a
MD5 e479372e7baf20f1b3d0bc34d73be25b
SHA1 47ddf9c23175b9c3a70dfda5e7fb3d8e2ff586ca
SHA512 896f7cd87e030d5882987e6c473f5e6af3da403d43d9a4423f47694a0372c46c634cd72fb2e2cb808efce6a3e70cb6b950eedf5309d22bf2abc7cd766520f633
SSDEEP 49152:U+EkqatglaV+EkqatglaV+EkqatglaV+EkqatglaV+EkqatglaV+EkqatglaV+Ey:reeeeeeeeqKjKWQckVgtev5mnlNLz
TLSH
T1BE468D82BA8991B2E4770231486B82B75B70FC155F12E6DFB384A36D5D337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1468-0-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/1468-8-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/5668-24-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/5668-34-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download