28546b9ce00f4f514dbe01232d4451e13b3b101b63e2c72ff7c497c64641131b

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_96f69ed8b39348ab76d48b996cd5a2f5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 6.7MB
Sample260814-eaz8xstgma
SHA256 28546b9ce00f4f514dbe01232d4451e13b3b101b63e2c72ff7c497c64641131b
MD5 96f69ed8b39348ab76d48b996cd5a2f5
SHA1 a07551a066fe728ff4fb9f1d84a4b0048b028eb1
SHA512 699554d5b767017959275ca3ed9044603467a4ea3d3fc29ce41f0fbfe2167e5f48e3395f3a5144958ec8d6d5fbf0ce9050876def30dbbcfdd6b59b7f9bb70dee
SSDEEP 98304:4LZ1oQLZ1oQLZ1oQLZ1oQLZ1oQLZ1oQLZ1oQLZ1oROU/jIEeQfoR/IuOFVjUu5B:4LZ1LZ1LZ1LZ1LZ1LZ1LZ1LZSFIF0wuv
TLSH
T1F3668D11F8834072EA7311714D9FD27A6674BB2446228DEBF7CDCA0B7B32AC15A36716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3956	svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe
1212	svchost_BCBCABCBAABCABCACCAABABCBACCBCABBCCABCBBACAACCAABCBACAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABCCBCCCCAABBCCCCBBBBCABBCCCCBABABBCBAACBCBABCAAACBACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe"	2026-08-14_96f69ed8b39348ab76d48b996cd5a2f5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCBCACBCABBBBBCBBCACCBBAAAAABBACACAAABCBBABCCCCCACCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCABCBAABCABCACCAABABCBACCBCABBCCABCBBACAACCAABCBACAA.exe"	svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5484	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_96f69ed8b39348ab76d48b996cd5a2f5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCABCBAABCABCACCAABABCBACCBCABBCCABCBBACAACCAABCBACAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4968	2026-08-14_96f69ed8b39348ab76d48b996cd5a2f5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4968	2026-08-14_96f69ed8b39348ab76d48b996cd5a2f5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4968	2026-08-14_96f69ed8b39348ab76d48b996cd5a2f5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4968	2026-08-14_96f69ed8b39348ab76d48b996cd5a2f5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3956	svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe
3956	svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe
3956	svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe
3956	svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4968	2026-08-14_96f69ed8b39348ab76d48b996cd5a2f5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	3956	svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 5484	4968	2026-08-14_96f69ed8b39348ab76d48b996cd5a2f5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 5484 wrote to memory of 3864	5484	cmd.exe	94
PID 3956 wrote to memory of 3148	3956	svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-14_96f69ed8b39348ab76d48b996cd5a2f5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_96f69ed8b39348ab76d48b996cd5a2f5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBABBBACABBBACBBBCCACCBACACBBCBBACABAABBCABCACBBACBACACACBCBBACCABCCCCBAABAABBBAACACCAACCBCACBBBCAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBABBBACABBBACBBBCCACCBACACBBCBBACABAABBCABCACBBACBACACACBCBBACCABCCCCBAABAABBBAACACCAACCBCACBBBCAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCBAABCABCACCAABABCBACCBCABBCCABCBBACAACCAABCBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCBAABCABCACCAABABCBACCBCABBCCABCBBACAACCAABCBACAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed9f02e69c6351d49f161ae561d691511d84590472b6c9de609cc165cf5ad284
MD5 294e4a272b642164629cc00dd15ae940
SHA1 ad3e609e6945803a3f3c9e6b7a40a62792419d4c
SHA512 c2b29b0576348adb0b94c3f2dd513f6e0d92f4182635eed25baccbf8d16d0f002dd6b90735f6d2fb12f1e9eae71e193e60a00a9a4a6634c7752cd799670c9084
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3ff173e55f2b5eea5b331ec372d157133fccdeba4c2bdae9d254c0674ad27e87
MD5 7a7317530230878d5ad9447efa2bc771
SHA1 de4255bfa8de7416a7f63a4c6ed03d21e9dd2481
SHA512 366677ce27cb51f218bec4d5c9bb4ef508089aa5a93395cb67f1027d8f1893a9109ad6e30095d11f65c533ae8107bcd59154256c4f2c48212c1ed9b5376cf66f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f542be30237f9c2ca9a33e9265cd2799cecb64fe9df32f108ffb3dd2c19ada6d
MD5 9f4cd9a591a913b553d9373dcfd78450
SHA1 157f286f78d9e75136942b445294e769d303012a
SHA512 b1f597af2808a39ef7c715bbf74d664ae5ce0358e4b2ff755bb6a4a3705752fbb1ff09d1e7f680f2a28e4b78486fa226eb5c2ec98c36dafcae3c6c6e10e10dc9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 84a3859feb0f16a54576e1e89d88a3e05650a046638c86a703936c9ebc4124fd
MD5 e76b6d572f78f23f924f827972f5f85c
SHA1 c2fe3f1e36ca1467c8dea65ac6ad16848bcf1b63
SHA512 a2db2361e28c43ac9bf3fc49f4cb088e9d36ca67f3fdf26b7e2804a562df6e3ce6f9ce7fb2b55d82fc0b101d813686868573d82b7f3b0fafb85ed2f8deec7ebb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 708a0c7ae42858650004896d982c5f4cee919ea7117199b4ce9eb2271de9148a
MD5 2e10edf1df7c19bb4633a208a60c2789
SHA1 0ed8f10e5d2f2c4f9c978a3780f8a06eca0f6497
SHA512 60e7e546b22218da6b2aeccecb077760a2385a8bc8a53f538769592ace2e5e1aed45ce6982a44cf8308e4f3d2add85463c2c88841e728930c5522f71f671184d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 030ee57dfadb18bd75787295de6b6d682d4ebe50010b08939faa7c842b882795
MD5 6b9ad535ec588af03dee2f9e548208f0
SHA1 5082f81835286df19eb886511aca2ad0fd7e42d2
SHA512 30ffaa089efbf68f03d5217e42065bd421e4115fc2370878d193737e59fee65fda75e8889d7f291db26e605c29149fced9dec1391733233b653aca4a485da0ef
MD5 SHA1 SHA512

Submit Download

svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACCBCCBAACBCCBBACCBABAACBCBCABAAABCACABAABACABBBCA.exe
Size 6.7MB
SHA256 28546b9ce00f4f514dbe01232d4451e13b3b101b63e2c72ff7c497c64641131b
MD5 96f69ed8b39348ab76d48b996cd5a2f5
SHA1 a07551a066fe728ff4fb9f1d84a4b0048b028eb1
SHA512 699554d5b767017959275ca3ed9044603467a4ea3d3fc29ce41f0fbfe2167e5f48e3395f3a5144958ec8d6d5fbf0ce9050876def30dbbcfdd6b59b7f9bb70dee
SSDEEP 98304:4LZ1oQLZ1oQLZ1oQLZ1oQLZ1oQLZ1oQLZ1oQLZ1oROU/jIEeQfoR/IuOFVjUu5B:4LZ1LZ1LZ1LZ1LZ1LZ1LZ1LZSFIF0wuv
TLSH
T1F3668D11F8834072EA7311714D9FD27A6674BB2446228DEBF7CDCA0B7B32AC15A36716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3956-35-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/4968-0-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/4968-8-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download