0b937664981caed2f6c46c9856f2251c8077ce1b6a95cb99cb00414fc4aecdef

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_bbd3d8cff60a02bc2fe1e46ffa736fe3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 18.1MB
Sample260814-dwl3ratele
SHA256 0b937664981caed2f6c46c9856f2251c8077ce1b6a95cb99cb00414fc4aecdef
MD5 bbd3d8cff60a02bc2fe1e46ffa736fe3
SHA1 073129d3f4a35a08bb40940f44022543c630f05a
SHA512 9e7c68c5a71bb6ade8264fa483bfd385ab2aece077d5f7ecac62230b3731fc76cce30baf65ff47cf2dec16a1846ff5fe9619b1df9425cfd63ee130947ac266c4
SSDEEP 98304:1eQpeQpeQpeQpeQpeQpeQpeQTKjKWQckVgtev5mnlNLc:UKWQc0gEYnvLc
TLSH
T110175C42FBC584B2E477023148AB82B75A71BC115F12D6DFB358A36E5E33BC0AA31765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2360	svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe
2136	svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe
1436	svchost_BCCABAABCACCBAABCBAABCACBABBBBBCACBACCBABACCABAAACBBABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACCCCBAACBCCABCBBAACABACAAAAAACABAABABAABAABABCBACAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe"	2026-08-14_bbd3d8cff60a02bc2fe1e46ffa736fe3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBBCACAACBCAAACABCAAAABBBCBBBCAABBAABCACCACCCAAABACACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCABAABCACCBAABCBAABCACBABBBBBCACBACCBABACCABAAACBBABB.exe"	svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2108	sc.exe
4348	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2408	cmd.exe
4064	cmd.exe
5832	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCABAABCACCBAABCBAABCACBABBBBBCACBACCBABACCABAAACBBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_bbd3d8cff60a02bc2fe1e46ffa736fe3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1640	2026-08-14_bbd3d8cff60a02bc2fe1e46ffa736fe3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1640	2026-08-14_bbd3d8cff60a02bc2fe1e46ffa736fe3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1640	2026-08-14_bbd3d8cff60a02bc2fe1e46ffa736fe3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1640	2026-08-14_bbd3d8cff60a02bc2fe1e46ffa736fe3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2360	svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe
2360	svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe
2360	svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe
2360	svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe
1436	svchost_BCCABAABCACCBAABCBAABCACBABBBBBCACBACCBABACCABAAACBBABB.exe
1436	svchost_BCCABAABCACCBAABCBAABCACBABBBBBCACBACCBABACCABAAACBBABB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	2026-08-14_bbd3d8cff60a02bc2fe1e46ffa736fe3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	2360	svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe
Token: SeDebugPrivilege	1436	svchost_BCCABAABCACCBAABCBAABCACBABBBBBCACBACCBABACCABAAACBBABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 5832	1640	2026-08-14_bbd3d8cff60a02bc2fe1e46ffa736fe3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	92
PID 5832 wrote to memory of 4712	5832	cmd.exe	94
PID 1640 wrote to memory of 2408	1640	2026-08-14_bbd3d8cff60a02bc2fe1e46ffa736fe3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	95
PID 2408 wrote to memory of 2108	2408	cmd.exe	97
PID 1640 wrote to memory of 4064	1640	2026-08-14_bbd3d8cff60a02bc2fe1e46ffa736fe3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	98
PID 4064 wrote to memory of 4348	4064	cmd.exe	100
PID 2360 wrote to memory of 5876	2360	svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_bbd3d8cff60a02bc2fe1e46ffa736fe3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_bbd3d8cff60a02bc2fe1e46ffa736fe3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABAACACBAACBBBBBAAACBCBBCABABCABCBCCCBBAACBAABCBBBBBBCBBCBABCAAAAAABBBCBCCBCCCABCABCBAACACBCABCABBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABAACACBAACBBBBBAAACBCBBCABABCABCBCCCBBAACBAABCBBBBBBCBBCBABCAAAAAABBBCBCCBCCCABCABCBAACACBCABCABBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAAABCCBBCABCBABBCABCACBBABCABCBABCACCACCBBCACCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe" start= auto displayName= "UserDataSvc_BBAAABCCBBCABCBABBCABCACBBABCABCBABCACCACCBBCACCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAAABCCBBCABCBABBCABCACBBABCABCBABCACCACCBBCACCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe" start= auto displayName= "UserDataSvc_BBAAABCCBBCABCBABBCABCACBBABCABCBABCACCACCBBCACCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAAABCCBBCABCBABBCABCACBBABCABCBABCACCACCBBCACCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAAABCCBBCABCBABBCABCACBBABCABCBABCACCACCBBCACCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe
1⤵
- Executes dropped EXE
PID:2136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABAABCACCBAABCBAABCACBABBBBBCACBACCBABACCABAAACBBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABAABCACCBAABCBAABCACBABBBBBCACBACCBABACCABAAACBBABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3541da3bda94639b07d98dae7c38ecfdd3b3413ba31347b9697496b97b0219ea
MD5 cc48d25035b09fd7db2fba319867b29b
SHA1 76668518e31d4ec957e874761af751dbfe0332f7
SHA512 29d5c6296a273fd2e32a18bae371fc5800f89d5f981a2ceba8a0df7645a462fb637069b367c49396aab0794a0bd7e6c9a03fb1c097fe87b054700c6198d4de29
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ad2e9587be4a458256e1f565e2a8813a009b56c226a77f390c14cd51c7b85d05
MD5 b46e3f827d262884f0f5695014285c49
SHA1 cc1929239782899c9dfa8d4c7fa6c6096cb008fe
SHA512 6aef9afbe72b2186e74f838ef951c402a3843a6c801b01d3b71e79d72e220c942af9467578ef22d2daf2415a003af9835cafcfb758742428af38d812a31984f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2674c0f4bbab2834d38e032fd900f2b7b04172eba9f371b54b29fa5bf1724efa
MD5 d28320b2bccf86178c188c0e9aa775ad
SHA1 b6989a37151f8d4b9abf7164cb2c415062c8be48
SHA512 83571544cce3a231f683ecb3026614874db1b8d7cbc0e4d2937bf010b279112405239603e9c6872dfb5ccb089a5a74406049499c619b5230ff234e66f940394b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 329c6f7832a97e842126a99c2060744e940fd776f15e52ede88ec8dc4cc6eeda
MD5 50097392dbc5bc59df88a58d705268d5
SHA1 a9a051c2e9161b78757419de772b8fb8663273f7
SHA512 76903c261f7a749bdfeca13766984ba31702f56041161dd2e57823704ad1b714a9c7f3784b6a556ab0325bebc4d70ea640e58b7b276ce07c442532320ff7835a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e63fd36fc76d3705c1d1bbc04f0d32573232eaa26608306227ff1831cc72957e
MD5 134be93c35e18d58c81b73d938f9626c
SHA1 8de416ec8ebf4d58d7e3224861e034f5c63c4507
SHA512 11821ae23aa16df0d45da354b7500280a4ba9cae1f77ca2729cd9aadd583807ebdfe95711b1f6edfc668c5af83d239c1deabb2af5e8291fb8d272cf896de7f88
MD5 SHA1 SHA512

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 55.2MB
SHA256 8677122efaa048858d93df2e65e92963d35768444d0316d6a7992d56e15f2eee
MD5 b1ce1324af121bdc4bb2c68dc072c8f8
SHA1 9b300289d856658800b15af934db3fd73276ebd9
SHA512 e8281149f71cf9469a6fea864f3581f7bab0d30a42292f3bc63bb5762341ff2956b3e4cb712f0689bd38a975bf6cb18833edd97e78156b543ed0040817650502
SSDEEP 196608:UKWQc0gEYnvLNKWQc0gEYnvLNKWQc0gEYnvL2Cqzi8Oqz:9cZEIvAcZEIvAcZEIvC1POS
TLSH
T1D4C75D42FBC584B2E477023148AB82B75A71BC115F12D6DFB358A36E5E33BC0AA31765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e286211c8dee2704394a3a482637b619acf329e15ace49e09a15687e667128d8
MD5 592c311aa624c73aed5a9a9abd1cb852
SHA1 0132efcc55eb0fcca800d8e19c72da57e9698745
SHA512 ca7fc2120c06e75b7d1e7fb87248172545446e5c93cd3b13e7659a21d7172ff07533c99241c75e4c9686c8fe0732ef070342ecca02be240a3d55e5c51cf92b5b
MD5 SHA1 SHA512

Submit Download

svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACBCCCCACACAAAAACCAAAACCABBAABBABAACCAABACBCCAACBBCB.exe
Size 18.1MB
SHA256 0b937664981caed2f6c46c9856f2251c8077ce1b6a95cb99cb00414fc4aecdef
MD5 bbd3d8cff60a02bc2fe1e46ffa736fe3
SHA1 073129d3f4a35a08bb40940f44022543c630f05a
SHA512 9e7c68c5a71bb6ade8264fa483bfd385ab2aece077d5f7ecac62230b3731fc76cce30baf65ff47cf2dec16a1846ff5fe9619b1df9425cfd63ee130947ac266c4
SSDEEP 98304:1eQpeQpeQpeQpeQpeQpeQpeQTKjKWQckVgtev5mnlNLc:UKWQc0gEYnvLc
TLSH
T110175C42FBC584B2E477023148AB82B75A71BC115F12D6DFB358A36E5E33BC0AA31765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2b07bf6bcd4b9e8fe05e86773006974b95a5a94a19ca6fae50bf798f44e9c567
MD5 0b79a154f77948a9688909183f329ed1
SHA1 34c7d3d36415036b504c462b94da3cca50bb81eb
SHA512 1396655a03b708903ff16630cdde71e46c518496d57272d93164d4bf10a51498f06525f1aa81638c94eb1c1cfb731cc69f3e6e9aaf94c12de6fea6a5adeb4cec
TLSH
T1C2112B2054E5EC53FD322CDAD75EEB920CF876CB689CAA655389422CBB49C318D514F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1436-95-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/1640-10-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/1640-59-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/1640-21-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/1640-83-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/1640-33-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/2136-86-0x0000000000490000-0x00000000004B1000-memory.dmp

Download

memory/2360-71-0x0000000000490000-0x00000000004B1000-memory.dmp

Download

memory/2360-50-0x0000000000490000-0x00000000004B1000-memory.dmp

Download

memory/2360-32-0x0000000000490000-0x00000000004B1000-memory.dmp

Download

memory/2360-110-0x0000000000490000-0x00000000004B1000-memory.dmp

Download