01fea77670ad8bf4a09db9ad7c86bec3f88ab518264d0eb816ea97e5177a5f9d

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_8b93a55f550c1bfe71b8e5ae8fa5b265_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 13.9MB
Sample260814-eewfjacj9t
SHA256 01fea77670ad8bf4a09db9ad7c86bec3f88ab518264d0eb816ea97e5177a5f9d
MD5 8b93a55f550c1bfe71b8e5ae8fa5b265
SHA1 9659328f6c2f20ee7da1a2c0bcb9e0e6e92b53dd
SHA512 1e521fa5f55fa99d3bebf0396d41755e24f1069319dd35eeb269906fd2450ac56c2f8ed9bdbe420374a7413fe7d7de30f66c3c83e4ffecc0fd3a148a305797b7
SSDEEP 98304:+OO/OO/OO/OO/OO/OO/OO/OO/OOIOU/jIEeQfoR/IuOFVjUu5x:lFIF0wuz
TLSH
T1E7E64A45BB8591A2E4670231485B82A75B70BC254F2297EF73C8B37D9F337C0AA32B55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4616	svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe
4500	svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe
1800	svchost_AACBAACBACBCAACABCABAACCBBBCCCCCACABCACBCABCBCCABBCAABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACABABACAAAAACACABACABBAAABBABABBAAAAACBCABABCABBBACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe"	2026-08-14_8b93a55f550c1bfe71b8e5ae8fa5b265_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACACAACBAACABCCACAACCAAACCACCCABBBAAABBBCABBABBABBAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBAACBACBCAACABCABAACCBBBCCCCCACABCACBCABCBCCABBCAABA.exe"	svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1056	sc.exe
1384	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2940	cmd.exe
2756	cmd.exe
2832	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBAACBACBCAACABCABAACCBBBCCCCCACABCACBCABCBCCABBCAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_8b93a55f550c1bfe71b8e5ae8fa5b265_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5048	2026-08-14_8b93a55f550c1bfe71b8e5ae8fa5b265_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5048	2026-08-14_8b93a55f550c1bfe71b8e5ae8fa5b265_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5048	2026-08-14_8b93a55f550c1bfe71b8e5ae8fa5b265_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5048	2026-08-14_8b93a55f550c1bfe71b8e5ae8fa5b265_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4616	svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe
4616	svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe
4616	svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe
4616	svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5048	2026-08-14_8b93a55f550c1bfe71b8e5ae8fa5b265_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4616	svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2940	5048	2026-08-14_8b93a55f550c1bfe71b8e5ae8fa5b265_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 2940 wrote to memory of 4560	2940	cmd.exe	94
PID 4616 wrote to memory of 1892	4616	svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe	95
PID 5048 wrote to memory of 2756	5048	2026-08-14_8b93a55f550c1bfe71b8e5ae8fa5b265_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	96
PID 2756 wrote to memory of 1056	2756	cmd.exe	99
PID 5048 wrote to memory of 2832	5048	2026-08-14_8b93a55f550c1bfe71b8e5ae8fa5b265_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	100
PID 2832 wrote to memory of 1384	2832	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_8b93a55f550c1bfe71b8e5ae8fa5b265_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_8b93a55f550c1bfe71b8e5ae8fa5b265_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCBBBCACBCCABABACCBABBACBABCABCCAABCCBABCBAACABACBCCABBCBBAABBBBBBCCCBACACABAAABAABACCBAAABBBCABACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCBBBCACBCCABABACCBABBACBABCABCCAABCCBABCBAACABACBCCABBCBBAABBBBBBCCCBACACABAAABAABACCBAAABBBCABACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBACBAABBAACBCBAABAABBBAACAABBBACBBBCBCACBCCACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe" start= auto displayName= "UserDataSvc_BCBBACBAABBAACBCBAABAABBBAACAABBBACBBBCBCACBCCACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBACBAABBAACBCBAABAABBBAACAABBBACBBBCBCACBCCACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe" start= auto displayName= "UserDataSvc_BCBBACBAABBAACBCBAABAABBBAACAABBBACBBBCBCACBCCACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBACBAABBAACBCBAABAABBBAACAABBBACBBBCBCACBCCACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBACBAABBAACBCBAABAABBBAACAABBBACBBBCBCACBCCACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe
1⤵
- Executes dropped EXE
PID:4500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACBACBCAACABCABAACCBBBCCCCCACABCACBCABCBCCABBCAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACBACBCAACABCABAACCBBBCCCCCACABCACBCABCBCCABBCAABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a688a3ec9441909e9b3d7c6d755d390e214900e2109eb68a44c9623c829287e7
MD5 536fcad36b745a6a4426665a3f40cfab
SHA1 d07d54a47d98506bafc8af4851275719be7c01d5
SHA512 e1d46324d36acbd2d359ed7b0f50da6fcd2532840d82f587ee16e0a2b5da9412ff981579c251a96737b45733bff7f5b3fddd223c6399e25cc9262e057aeca819
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1eec05e4424a0e351c9bcfec3c21a2552e8120cf16647893c9ac8c45cbb59432
MD5 edfaa7f895aacb31bb390ffbd308f29a
SHA1 dbec936a121a4ccd795e24bc4b712f3008af3dd1
SHA512 7e84ab58358ffef2f46358626ecca81f824b6fc6120ae9596bee49c4181c481fff01729aa055d510a0fbb21eb194dccfcbe0bd32e35da4fdb461ed7686471166
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 badb9ad0ea0e207912137f9a30d7c264c2e8d430a6d2c9dfa16522b69c8fd4cd
MD5 1ba7b621d6b79b17cafee4d21bedfa29
SHA1 00a76ec1e1fc94c50ba905838e2091afe0a5e88e
SHA512 b22d6e2497e3a18164cd7734e0b92cbb5f9d82517dd9e560187fd9f4b0a42b2232e97aba6f2e69692f22daf1a50d18871b7eddfd7b4f7ccb0ef1374028a6887f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0239c5c4323e72036dbf2a3e4e1ff89629b293f262348f028d2a97646b750153
MD5 40a59ccfab677bfbbc0d01d98ffc2af3
SHA1 8269ca17f15ec2ed1a5b6a0bfc6e21090cd71709
SHA512 b7ef29f20466310dde88cfdefa7b41dbaf8b5ccd8a8abcc358ec0691ac444ccd289bb704144d3da33e7b0b8a636145bde3fc9eaf5902f5249e4f557b75e91f4f
MD5 SHA1 SHA512

Submit Download

CloseGroup.exe

Path C:\Users\Admin\Downloads\CloseGroup.exe
Size 41.9MB
SHA256 56704e34d27ca3f0dc6c731ec25607cefda6ba4eb1227530e41bf6e46e9594fb
MD5 d0ca00d61b0e58bf7bf3e7adf5b35005
SHA1 f2459209ad99601942cf7951a4ad14c6f33569af
SHA512 2890042be7a90ce329bc29cd882fff5df14094530d79664895a83729c7fbcf8e291f3070a4e335db773a0257efd82310af1b58aac5f04af62da634a8c6826e8f
SSDEEP 98304:+OO/OO/OO/OO/OO/OO/OO/OO/OOIOU/jIEeQfoR/IuOFVjUu5YOO/OO/OO/OO/OX:lFIF0wuRFIF0wuRFIF0wu5
TLSH
T188A74A45BB8591A2E4670231485B82A75B70BC254F2297EF73C8B37D9F337C0AA32B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCBCABBCCCCBAABACAACACCBACBBABBBBAACCCABBACAAAACBA.exe
Size 13.9MB
SHA256 01fea77670ad8bf4a09db9ad7c86bec3f88ab518264d0eb816ea97e5177a5f9d
MD5 8b93a55f550c1bfe71b8e5ae8fa5b265
SHA1 9659328f6c2f20ee7da1a2c0bcb9e0e6e92b53dd
SHA512 1e521fa5f55fa99d3bebf0396d41755e24f1069319dd35eeb269906fd2450ac56c2f8ed9bdbe420374a7413fe7d7de30f66c3c83e4ffecc0fd3a148a305797b7
SSDEEP 98304:+OO/OO/OO/OO/OO/OO/OO/OO/OOIOU/jIEeQfoR/IuOFVjUu5x:lFIF0wuz
TLSH
T1E7E64A45BB8591A2E4670231485B82A75B70BC254F2297EF73C8B37D9F337C0AA32B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4616-34-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/4616-49-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/4616-71-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/5048-0-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download

memory/5048-33-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download

memory/5048-59-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download

memory/5048-22-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download

memory/5048-11-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download