4123b954f7748442e6019d74e9a71c202d98b45e257e8f3d00445ad26fc43f17

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_cfe5724a3fb3e0c12b95bafbd470a74d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 28.6MB
Sample260814-dppkasttdx
SHA256 4123b954f7748442e6019d74e9a71c202d98b45e257e8f3d00445ad26fc43f17
MD5 cfe5724a3fb3e0c12b95bafbd470a74d
SHA1 48e8217dd5c496f46532aaf492da7635d1e12942
SHA512 fab60ff087f36e17d3da978ae2e23c151b086c625f917765ba6a89fda99028dc905f3441a0903b1737a707ef1ad82bf75ac25e4a9d449967577dc1c35b85b80b
SSDEEP 98304:ksWsWHsWsWHsWsWHsWsWHsWsWHsWsWSOU/jIEeQfoR/IuOFVjUu5Y:xFIF0wuy
TLSH
T103673C45FACA84B2E47702704CABC2BB5A30BD154B12D9EFF349935E5D33BD09A31662
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5084	svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe
3232	svchost_CCCABCCCACCCCCCBBCBABABAAAABBBCCCACBABCABBCAACBBCBBAAAA.exe
5148	svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBBBBCBBCBBBACACACACBACACBBBBCCAABABAABBAABCCCABCBAAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe"	2026-08-14_cfe5724a3fb3e0c12b95bafbd470a74d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABAABCCAABBCACBABABCCABBAABAABAACBBABBCCABCBBBACCCACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCABCCCACCCCCCBBCBABABAAAABBBCCCACBABCABBCAACBBCBBAAAA.exe"	svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2688	sc.exe
5880	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3860	cmd.exe
1744	cmd.exe
3688	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_cfe5724a3fb3e0c12b95bafbd470a74d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABCCCACCCCCCBBCBABABAAAABBBCCCACBABCABBCAACBBCBBAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5356	2026-08-14_cfe5724a3fb3e0c12b95bafbd470a74d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5356	2026-08-14_cfe5724a3fb3e0c12b95bafbd470a74d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5356	2026-08-14_cfe5724a3fb3e0c12b95bafbd470a74d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5356	2026-08-14_cfe5724a3fb3e0c12b95bafbd470a74d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5084	svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe
5084	svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe
5084	svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe
5084	svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe
3232	svchost_CCCABCCCACCCCCCBBCBABABAAAABBBCCCACBABCABBCAACBBCBBAAAA.exe
3232	svchost_CCCABCCCACCCCCCBBCBABABAAAABBBCCCACBABCABBCAACBBCBBAAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5356	2026-08-14_cfe5724a3fb3e0c12b95bafbd470a74d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5084	svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe
Token: SeDebugPrivilege	3232	svchost_CCCABCCCACCCCCCBBCBABABAAAABBBCCCACBABCABBCAACBBCBBAAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5356 wrote to memory of 3688	5356	2026-08-14_cfe5724a3fb3e0c12b95bafbd470a74d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	90
PID 3688 wrote to memory of 1112	3688	cmd.exe	92
PID 5084 wrote to memory of 120	5084	svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe	93
PID 5356 wrote to memory of 3860	5356	2026-08-14_cfe5724a3fb3e0c12b95bafbd470a74d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	96
PID 3860 wrote to memory of 2688	3860	cmd.exe	98
PID 5356 wrote to memory of 1744	5356	2026-08-14_cfe5724a3fb3e0c12b95bafbd470a74d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	99
PID 1744 wrote to memory of 5880	1744	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-14_cfe5724a3fb3e0c12b95bafbd470a74d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_cfe5724a3fb3e0c12b95bafbd470a74d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAAAACBBCBCABBBBCCBCBCCABACCCCCBBBACCBBAACBBCCBBCBBBBABCCBACBBABBACAACBAABBACAAACAAABCCABCCAACCBBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAAAACBBCBCABBBBCCBCBCCABACCCCCBBBACCBBAACBBCCBBCBBBBABCCBACBBABBACAACBAABBACAAACAAABCCABCCAACCBBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBABBACACCBBACBCAAAACBCBBBBABCBCACACCAAABBBBAAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe" start= auto displayName= "UserDataSvc_ACBABBACACCBBACBCAAAACBCBBBBABCBCACACCAAABBBBAAAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBABBACACCBBACBCAAAACBCBBBBABCBCACACCAAABBBBAAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe" start= auto displayName= "UserDataSvc_ACBABBACACCBBACBCAAAACBCBBBBABCBCACACCAAABBBBAAAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBABBACACCBBACBCAAAACBCBBBBABCBCACACCAAABBBBAAAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBABBACACCBBACBCAAAACBCBBBBABCBCACACCAAABBBBAAAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCACCCCCCBBCBABABAAAABBBCCCACBABCABBCAACBBCBBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCCACCCCCCBBCBABABAAAABBBCCCACBABCABBCAACBBCBBAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe
1⤵
- Executes dropped EXE
PID:5148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bbac7dc798414f49858c44f3aa446b63764bc60fb39d7ac396768297f95cc047
MD5 93ef81bd9d44ad3d0735bd2a45245dca
SHA1 0dde32c74b941502db3740e26fe2e6e657cd76fa
SHA512 de4301e020758986b114ce1568404523330dc9d68dde694b70f034fb1d364c1c3a172f4816f0b7cce65211f1745c5eb2eb4a63375849ddb0beb9f5bb57e82007
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 354421c3b8b27de79160d676dbbd8edd5dd79d30c8bf36359ad4b2d35ead942d
MD5 0027257e020885ba7c94041c1adede80
SHA1 2dde61037cdacb0a20e10588adab14c218cea06d
SHA512 cf9bc376c30ceb39ba1c483fcb3600d18b187df0d79f874e07f670e1928126122f5004816e2756f5ce72cbcf35111e23046d8969093c96ef12661de7f8967cf5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99b0c159f29830b97c97d9a1e498327cd620c6fb62d1b2d8b31e3cd5f0241458
MD5 004cbcd7bef434dd4f6b2be62c165f95
SHA1 751bfd03ceb19cfe50dffcb6c5895156d494b9cf
SHA512 f4f3ec44027fbec4af50b4765db72a332c42aebcad4b71e69f22f96c67b9f73708892ea57d6f5863ac1e4358335899b2548d2ede75e30d08417d153ac868947e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b18d55a3a209c2edbff6fb0707a2f0dcdb3548c72508796ab55c86222eb22d5
MD5 b201fd4be254cf534d1da885f7fb6ba2
SHA1 83222c843969a9e76051604d68f2950b48a4d345
SHA512 b22014cf439f7d652fa7d6549aafacd324866afb33d07e2c9912444c0d28ac7ae552c78baf762532645615557aed18277b72c020dfce38e12fd5f854f4f8cb4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4930cdcc3e16a425e3ce5b9300542338b2ff18e688a83d78e1a13ccb1da2736c
MD5 0db4a0617627789ae9a32716350bc89b
SHA1 22e550bf2fb109e52caefeb5add817fe5d7a1347
SHA512 d78d64da48057cedcae36994cb65f05a81fdf43437695caff463de9e652966b1a11a0d5d9ce3f91fd3e2610693845d7f5fbf2592e4345e3208bcc98b3cb0abf2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 38dc602a2b1049acca368fd37f684e1dd8b0ff2b964959f257faad585b276d40
MD5 66283f85e0d467caac2c065fd1e900c4
SHA1 daf59bd70a1e92f1e49fe2e8b50cecd37e2ec32d
SHA512 f2934443347eff730378315b68c81aa91dc43db1cb2a9eb0c5f2a4062b27a8fa2c19ce7782ad1a85c3c0d5a5129e1a2cef2410b49a6488ae81671e2e78f8461c
MD5 SHA1 SHA512

Submit Download

svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACABCBCABABBBBBABCCACCABAABCACBCCBACCCABBABCCBBCABCC.exe
Size 28.6MB
SHA256 4123b954f7748442e6019d74e9a71c202d98b45e257e8f3d00445ad26fc43f17
MD5 cfe5724a3fb3e0c12b95bafbd470a74d
SHA1 48e8217dd5c496f46532aaf492da7635d1e12942
SHA512 fab60ff087f36e17d3da978ae2e23c151b086c625f917765ba6a89fda99028dc905f3441a0903b1737a707ef1ad82bf75ac25e4a9d449967577dc1c35b85b80b
SSDEEP 98304:ksWsWHsWsWHsWsWHsWsWHsWsWHsWsWSOU/jIEeQfoR/IuOFVjUu5Y:xFIF0wuy
TLSH
T103673C45FACA84B2E47702704CABC2BB5A30BD154B12D9EFF349935E5D33BD09A31662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 745fa256fc4413be9d30b70dff548a4da5b9f1ff738a14ee9e8db62cd00d3c4b
MD5 042e303dfc706df0bfcb8d9b1dde7e1c
SHA1 8a1eac14946328ae61789b2198faf32f4210b101
SHA512 4a5d948cb1816612966cfd8863894b8004b5dce1d7fe85740dbbca96369ae8c15ce06d1f915ab610611a220d57b1ce92e3a406f4facc3f28c2ee145cd70f773c
TLSH
T1C7110861F4E5C863F832645E922FDB820CB473575CA8AE292285D12D7BD8D338E190E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3232-70-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/5084-32-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/5356-0-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/5356-8-0x0000000000160000-0x0000000000181000-memory.dmp

Download