fe1f62d36fdc55a5aa7b4ff1ef1784a29a03937f91c29b9f8cda9898fc21610d

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_8cc80f47b9680784d235055031008cf3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 12.7MB
Sample260814-eekn2acj8s
SHA256 fe1f62d36fdc55a5aa7b4ff1ef1784a29a03937f91c29b9f8cda9898fc21610d
MD5 8cc80f47b9680784d235055031008cf3
SHA1 85796e55a6f089ccb2f089a051b50a52c714494a
SHA512 1ad7f884e99ca82b886459c6257ced66ec714f21b4b629769b93be9787afa7c9ea54690be7615c39c789977b9e39f10bbbdb5db738670f6356fe19010bd00d6f
SSDEEP 196608:nxsZxsZxsZxsZxsZxsZxsZxsZxszFIF0wuV:cV
TLSH
T1EBD67B02FBC64071E5B32631497B92B61A76B9110B31C99F738C552E9F33BC09A3676B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1572	svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe
4288	svchost_BCAAAACBABCACCAAACBCACACACBABBABACACCABBCBBCACACCBBAAAB.exe
6120	svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBABCCCBCAABBBABBCACCBACCACBBCBABBBBCACBBBBAACCBABCBCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe"	2026-08-14_8cc80f47b9680784d235055031008cf3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBBACBBCBBAAABCAAABBCCCAABCACABCBABBAABCABAACBCCBBAAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAAAACBABCACCAAACBCACACACBABBABACACCABBCBBCACACCBBAAAB.exe"	svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2736	sc.exe
4544	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3432	cmd.exe
4900	cmd.exe
1188	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAAAACBABCACCAAACBCACACACBABBABACACCABBCBBCACACCBBAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_8cc80f47b9680784d235055031008cf3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4600	2026-08-14_8cc80f47b9680784d235055031008cf3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4600	2026-08-14_8cc80f47b9680784d235055031008cf3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4600	2026-08-14_8cc80f47b9680784d235055031008cf3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4600	2026-08-14_8cc80f47b9680784d235055031008cf3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1572	svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe
1572	svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe
1572	svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe
1572	svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe
4288	svchost_BCAAAACBABCACCAAACBCACACACBABBABACACCABBCBBCACACCBBAAAB.exe
4288	svchost_BCAAAACBABCACCAAACBCACACACBABBABACACCABBCBBCACACCBBAAAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	2026-08-14_8cc80f47b9680784d235055031008cf3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1572	svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe
Token: SeDebugPrivilege	4288	svchost_BCAAAACBABCACCAAACBCACACACBABBABACACCABBCBBCACACCBBAAAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1188	4600	2026-08-14_8cc80f47b9680784d235055031008cf3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 1188 wrote to memory of 5216	1188	cmd.exe	94
PID 1572 wrote to memory of 2952	1572	svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe	95
PID 4600 wrote to memory of 3432	4600	2026-08-14_8cc80f47b9680784d235055031008cf3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 3432 wrote to memory of 4544	3432	cmd.exe	100
PID 4600 wrote to memory of 4900	4600	2026-08-14_8cc80f47b9680784d235055031008cf3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 4900 wrote to memory of 2736	4900	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_8cc80f47b9680784d235055031008cf3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_8cc80f47b9680784d235055031008cf3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABAACAAAAABABCACBBBBABCACAABCCACCBBAACCBCACCAABBABCACCBCACAACCBBBBBCABAAACBCABABACBABBCBCAACBCAABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABAACAAAAABABCACBBBBABCACAABCCACCBBAACCBCACCAABBABCACCBCACAACCBBBBBCABAAACBCABABACBABBCBCAACBCAABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBCACCBCABBBCCBBACABCBCBCCBBCCBCBBBCCAACCBBACCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe" start= auto displayName= "UserDataSvc_AABBCACCBCABBBCCBBACABCBCBCCBBCCBCBBBCCAACCBBACCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBCACCBCABBBCCBBACABCBCBCCBBCCBCBBBCCAACCBBACCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe" start= auto displayName= "UserDataSvc_AABBCACCBCABBBCCBBACABCBCBCCBBCCBCBBBCCAACCBBACCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBCACCBCABBBCCBBACABCBCBCCBBCCBCBBBCCAACCBBACCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBCACCBCABBBCCBBACABCBCBCCBBCCBCBBBCCAACCBBACCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2736

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAACBABCACCAAACBCACACACBABBABACACCABBCBBCACACCBBAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAACBABCACCAAACBCACACACBABBABACACCABBCBBCACACCBBAAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe
1⤵
- Executes dropped EXE
PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ebfd26612302ce071515a08735b0a065aa6626e59a7b6bc472e2ed8654e10218
MD5 2bfd5b49dbbc792310b93b1334c909dd
SHA1 ac174580ddd3ffbdcc1fd22e8b9fdd52e3143096
SHA512 d360d0b458ce81883d384f75dc29e4dad1ccd869aa36e9877781d975545e2550ea17399f9cfadafd2390a93729d8a5b1126448a88095f63565a2e2d581325dc5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 644956a90d2aa7dcd193fedccb9f87e419e875618ca6be6b2016f3631eb7f33e
MD5 b601eaaf9b49196d4bf58ebfa37c9cc7
SHA1 c3ac92b01146cf9c653d9a28657acba2d7f8ffd2
SHA512 4250fa49e0b3c485de0abe4d08884b6cfce4a536c1d5101bd46da3f8fbd7a8aeec75b4709395e7214914aedaf205fa58ab82546eab0fbab27b6560d49f7a9507
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 17f3f2de796c5ffa29aaa7c046254b4ad7117f1ddb6c6a0122d6f6ca38e4b56b
MD5 aec5c16188b60f672c5cc219072bf298
SHA1 50462d4a79f5025b10bc79b20538f9f3b3967d5a
SHA512 9bada5dc817d5b3dc933717b4280108b6ab9f802e0ab02031e318cd642f562a253e72ed4a1c75b4af22cfeca7b4d9abbdbf1186c59eec09c9cc38a1d251c7f74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1eec05e4424a0e351c9bcfec3c21a2552e8120cf16647893c9ac8c45cbb59432
MD5 edfaa7f895aacb31bb390ffbd308f29a
SHA1 dbec936a121a4ccd795e24bc4b712f3008af3dd1
SHA512 7e84ab58358ffef2f46358626ecca81f824b6fc6120ae9596bee49c4181c481fff01729aa055d510a0fbb21eb194dccfcbe0bd32e35da4fdb461ed7686471166
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dbadc2ae211e9974ec931bddccdf016522bb7623c765b9fb5e0a23f7f093b516
MD5 cd7dfa6eca1c2d542a22e6dd387555a0
SHA1 6fe319b931370fa86070fba002007717413f30c4
SHA512 23b24f260984728d3d170eb7b7d713ecc6933166d7911c8b57c4d01ca5efe5ce7d07c8297fd9310464c0fc2188de8bd8315bd07041cd7fdbc0475e2ed856cfd9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 53a1121bdeed1830eaae03d6f8ad4a1852d78d553a37905ffd3dcc8faee3563d
MD5 239e27cec199214b3d3587fb74f73d87
SHA1 620cdddc2d781130b0ab5f0aaf8099eb3c911e83
SHA512 40bb5ddbd9d7cdedc6cd4873354e4e6583662ccd788cb08a6a7004a9183f4bc5bcbb5db2fc0403f1526eaf574cec8b7e1b0b60f7f060220cb0c1a77ab832e14e
MD5 SHA1 SHA512

Submit Download

svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBBBACBBAAACBABAACAAACAACABACCBBABBCBBCBACBCBCAAACC.exe
Size 12.7MB
SHA256 fe1f62d36fdc55a5aa7b4ff1ef1784a29a03937f91c29b9f8cda9898fc21610d
MD5 8cc80f47b9680784d235055031008cf3
SHA1 85796e55a6f089ccb2f089a051b50a52c714494a
SHA512 1ad7f884e99ca82b886459c6257ced66ec714f21b4b629769b93be9787afa7c9ea54690be7615c39c789977b9e39f10bbbdb5db738670f6356fe19010bd00d6f
SSDEEP 196608:nxsZxsZxsZxsZxsZxsZxsZxsZxszFIF0wuV:cV
TLSH
T1EBD67B02FBC64071E5B32631497B92B61A76B9110B31C99F738C552E9F33BC09A3676B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 4f7d1344f5cbb49dc2cb590dc88679b50445a08a44321a3c5fee3c0a4c2bc4fa
MD5 8f4d783ed7c4356da95e2ac2a6438f62
SHA1 1b0e7b758c4c1b1b6c4d52c6f72918e98e60cff9
SHA512 34273b04b497fe9417ccc57ca3e2a084c9a99a582ab9d8461b92f60575031dbd4dbeb57a23724294de76cc99040907f9ba7bcad545373acdeccff0f2623e18d3
TLSH
T110112B1165E58C93F9332CC7952AAF920CB4719FDCACAA2552C9022C7F95C32DE194E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1572-34-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/1572-24-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/4288-79-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/4600-8-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4600-0-0x0000000000780000-0x00000000007A1000-memory.dmp

Download