3de33134663b5dff15560f2153348a487275b0cc77a096f25e3edcca0e741244

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_4cf4e7727220add46df2c44d1c67a360_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 19.9MB
Sample260814-e47vvsvcpb
SHA256 3de33134663b5dff15560f2153348a487275b0cc77a096f25e3edcca0e741244
MD5 4cf4e7727220add46df2c44d1c67a360
SHA1 4302869a1f34ffe5b52b9b95f1202142acbbb73c
SHA512 1acec6211ddb226fc7fceea7dcec98f7f764e5e389c73887a36034974695ed03fd77db18c4277ae77d59ab873dc854aa2dccf273d8d4124aaa65d783f41972b2
SSDEEP 98304:+XQVXQVXQVXQVXQVXQVXQVXQCOU/jIEeQfoR/IuOFVjUu5b:5FIF0wuB
TLSH
T132276C41FAD98862E0B702315CB792B60E31BD254F25D5DFB29C535E6E337C09A327A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4308	svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe
4852	svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe
2916	svchost_AACCCAACCBCABCABBAACBBCABCBBCABBACABBBCBABBBCBACAABBAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBCBBCBCABBBBCCABCCABCABCACBAAAABABCAABCCBCABABCCACABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe"	2026-08-14_4cf4e7727220add46df2c44d1c67a360_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBBCCABAABAABCCCBBACBACCABAACAACACCACBCCBABBBCCBCBCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCCAACCBCABCABBAACBBCABCBBCABBACABBBCBABBBCBACAABBAAC.exe"	svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
7012	sc.exe
5908	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5464	cmd.exe
1048	cmd.exe
5744	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCCAACCBCABCABBAACBBCABCBBCABBACABBBCBABBBCBACAABBAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_4cf4e7727220add46df2c44d1c67a360_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4260	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1728	2026-08-14_4cf4e7727220add46df2c44d1c67a360_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1728	2026-08-14_4cf4e7727220add46df2c44d1c67a360_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1728	2026-08-14_4cf4e7727220add46df2c44d1c67a360_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1728	2026-08-14_4cf4e7727220add46df2c44d1c67a360_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4308	svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe
4308	svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe
4308	svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe
4308	svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	2026-08-14_4cf4e7727220add46df2c44d1c67a360_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4308	svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 5464	1728	2026-08-14_4cf4e7727220add46df2c44d1c67a360_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 5464 wrote to memory of 4260	5464	cmd.exe	94
PID 1728 wrote to memory of 1048	1728	2026-08-14_4cf4e7727220add46df2c44d1c67a360_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	95
PID 1048 wrote to memory of 7012	1048	cmd.exe	97
PID 1728 wrote to memory of 5744	1728	2026-08-14_4cf4e7727220add46df2c44d1c67a360_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 5744 wrote to memory of 5908	5744	cmd.exe	100
PID 4308 wrote to memory of 2796	4308	svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_4cf4e7727220add46df2c44d1c67a360_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_4cf4e7727220add46df2c44d1c67a360_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCAABBCCBBBBCCBABBCABAACBBCAACCCBBBCCCBBCCBACBACCCBACAABAAACACCBCCABCAACBCCACACCBBBAAABCCBBCBCABBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCAABBCCBBBBCCBABBCABAACBBCAACCCBBBCCCBBCCBACBACCCBACAABAAACACCBCCABCAACBCCACACCBBBAAABCCBBCBCABBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAACBCCCCBBCACBCCACCBBCBAAACCACBCAACACBBBCACCBBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe" start= auto displayName= "UserDataSvc_CCAACBCCCCBBCACBCCACCBBCBAAACCACBCAACACBBBCACCBBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAACBCCCCBBCACBCCACCBBCBAAACCACBCAACACBBBCACCBBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe" start= auto displayName= "UserDataSvc_CCAACBCCCCBBCACBCCACCBBCBAAACCACBCAACACBBBCACCBBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:7012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAACBCCCCBBCACBCCACCBBCBAAACCACBCAACACBBBCACCBBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAACBCCCCBBCACBCCACCBBCBAAACCACBCAACACBBBCACCBBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe
1⤵
- Executes dropped EXE
PID:4852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAACCBCABCABBAACBBCABCBBCABBACABBBCBABBBCBACAABBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAACCBCABCABBAACBBCABCBBCABBACABBBCBABBBCBACAABBAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 edee72219e97c3dc607c7cbc5eccde605c8d446cfe2f8404b131e757d3c3db8a
MD5 061ca68412804ce98059035075bd9f5a
SHA1 02766f3f4d93f68329e6f92ff22f0580ff84306c
SHA512 830e1a6d03f70085af469e372b9f87423a3779fcc7752a229fc05ba8fc7be4c8aaee0efe58f093454418b6aeaadbb097720a549eadcc831d7da5157f9ee5f107
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 df78f8f2433d3f9cd106a4ab242f0d82a63a5f1c536c1ed6c560f19dcfe3c1df
MD5 9f32ac6c355a4bc7d64a453667758cb9
SHA1 2cc4de27bf1555c8344031aee164d873791cee36
SHA512 ceb7c0e9e57c6bf9b36cb9f8eef448f84c9ad760451749710ba0eb8a944cf88f638a2155c759060b03cadf7e7047269ce0d143ae5e0a71385b97bafdfbd2519d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b79aeb903d9edb9d29175549bc08213e6489ce30a3373ea272631eb8b3a1bd4c
MD5 8d3e9977480ade787e76d052e07bc987
SHA1 91dac5df8afce681f57b1da59cdbbfe547a14724
SHA512 b165ce6a6549b04ec3b9df3243d6f620d13149e3112cd55b9ecab36d86fc51543a4005be4eea7941d6707cde19a823d12605caa58f0c17cceef369f702533cf0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 347b6ec0623c17279e5bd839c87146d2410815e0712e120d4f282148d852af84
MD5 0b2c4b78b99ce7d91ca14c5a242cde01
SHA1 465f67eb6762874fb0a60cfadc25df6abc7597c7
SHA512 3b57be2ed0d53fe0787a3e5f7030a43df32ce1e57c819d4c1dbfd5dbc1ef23ea46c59528d199461fedb13dee0def15a3bc26c5cb725bf63e289c21d8f7aff760
MD5 SHA1 SHA512

Submit Download

svchost_AACCCAACCBCABCABBAACBBCABCBBCABBACABBBCBABBBCBACAABBAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAACCBCABCABBAACBBCABCBBCABBACABBBCBABBBCBACAABBAAC.exe
Size 18.1MB
SHA256 55ef39c6ad3e0f75eec467bb5d9d72ce98465416a4ff11f0be289164b41f9810
MD5 964fbb9d71838c2a706ebb202b39408b
SHA1 0f66e35068d6738c04812f5fa8d37c48d0a72670
SHA512 c886a6fb6507842f3ef760037a14ab732edb2677d52b53cf6ada5097d5403f0d0b46d07652d574bb75d9865134a1945207ea9b7e1a41be8346dd4297370b0402
SSDEEP 98304:+XQVXQVXQVXQVXQVXQVXQVXQCOU/jIEeQF:5FIF+
TLSH
T13C176C41FBD988A2E07702715CB792B60E31BD254F15D2DFB298935E6D337C09A327A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBBCCBCAABAABAACCCCABABCACCBAABCBBBAABBABBAAABCBAAB.exe
Size 19.9MB
SHA256 3de33134663b5dff15560f2153348a487275b0cc77a096f25e3edcca0e741244
MD5 4cf4e7727220add46df2c44d1c67a360
SHA1 4302869a1f34ffe5b52b9b95f1202142acbbb73c
SHA512 1acec6211ddb226fc7fceea7dcec98f7f764e5e389c73887a36034974695ed03fd77db18c4277ae77d59ab873dc854aa2dccf273d8d4124aaa65d783f41972b2
SSDEEP 98304:+XQVXQVXQVXQVXQVXQVXQVXQCOU/jIEeQfoR/IuOFVjUu5b:5FIF0wuB
TLSH
T132276C41FAD98862E0B702315CB792B60E31BD254F25D5DFB29C535E6E337C09A327A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1728-0-0x00000000004A0000-0x00000000004C1000-memory.dmp

Download

memory/1728-8-0x00000000004A0000-0x00000000004C1000-memory.dmp

Download

memory/4308-24-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/4308-37-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download