7f3b55ea0eac1b1510b211cbb9e9779eb45d0bf2eb35662bd7b8004867b8f2b2

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 8.6MB
Sample260814-efqlnstyhs
SHA256 7f3b55ea0eac1b1510b211cbb9e9779eb45d0bf2eb35662bd7b8004867b8f2b2
MD5 88e6ac8113e56eedd6cf7bc9b18e37d5
SHA1 881c21b63b64ac94b834eaaf1f112e4396b05949
SHA512 54421418414addbc1d6b1c6989f067ec5f1273e13c7ba1ef0dcbc7e6e446ae13bca30108e2afa84582c7d3e43a7d91d641d0a0a71852f12a08f24537d35a89a5
SSDEEP 98304:i5i5i5i5i5i5i5i5i5pOU/jIEeQfoR/IuOFVjUu5x:i5i5i5i5i5i5i5i5i5pFIF0wuv
TLSH
T1B4966E18B7D71121F6B356B08CBAC2B65D307D208731CAEFB648A61E1F35AD0E539726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1572	svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe
4420	svchost_BAABCCBCCAACAAAACBCBCCBABCABBCAAACAACCBBCCBBBACBCABCAAC.exe
4856	svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCBACCCAABBACBCCBBABBAAABCABABBAABABBABBAAAACABACABBAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe"	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCBBABBBCCBBCCCBCBCAACCACBBACCCCBABACBCBAAABACCCABBBCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABCCBCCAACAAAACBCBCCBABCABBCAAACAACCBBCCBBBACBCABCAAC.exe"	svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3464	sc.exe
2616	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4548	cmd.exe
972	cmd.exe
796	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABCCBCCAACAAAACBCBCCBABCABBCAAACAACCBBCCBBBACBCABCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2316	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2316	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2316	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2316	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1572	svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe
1572	svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe
1572	svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe
1572	svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1572	svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1188	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 4548	2316	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	96
PID 4548 wrote to memory of 3952	4548	cmd.exe	98
PID 1572 wrote to memory of 3476	1572	svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe	99
PID 3476 wrote to memory of 1196	3476	notepad.exe	100
PID 2316 wrote to memory of 972	2316	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	104
PID 972 wrote to memory of 2616	972	cmd.exe	106
PID 2316 wrote to memory of 796	2316	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	107
PID 796 wrote to memory of 3464	796	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABCBBCCABCCCBBCCACAAAABABACACCABACCCCCABBCCBABBAAABCCCBCABCCCCAABCBBCBCBCCBCBBBBBBAAABACBCCBACCCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABCBBCCABCCCBBCCACAAAABABACACCABACCCCCABBCCBABBAAABCCCBCABCCCCAABCBBCBCBCCBCBBBBBBAAABACBCCBACCCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCBCBBCBBCACBAACBBCBBCAACBCBCCBCACAAACCBCBABBCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe" start= auto displayName= "UserDataSvc_ABCCBCBBCBBCACBAACBBCBBCAACBCBCCBCACAAACCBCBABBCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCBCBBCBBCACBAACBBCBBCAACBCBCCBCACAAACCBCBABBCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe" start= auto displayName= "UserDataSvc_ABCCBCBBCBBCACBAACBBCBBCAACBCBCCBCACAAACCBCBABBCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCBCBBCBBCACBAACBBCBBCAACBCBCCBCACAAACCBCBABBCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:796
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCBCBBCBBCACBAACBBCBBCAACBCBCCBCACAAACCBCBABBCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1196

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1188

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCBCCAACAAAACBCBCCBABCABBCAAACAACCBBCCBBBACBCABCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCBCCAACAAAACBCBCCBABCABBCAAACAACCBBCCBBBACBCABCAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe
1⤵
- Executes dropped EXE
PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 25d37af6f8e812de7cc862033ab3e81837803983ad0536105444e41921693aee
MD5 d8ef83e796818031fc78b4155b7416c7
SHA1 7ca2309d7f4623a5d4116adf891809d5a79b2290
SHA512 8d119cfebf56d53cf3ec0403814bafbb2d78349fd96f1d40f3c177506159bb30ba78baad2204cfa28f3f682c4ce6d2cf1178f4a2f1c33d53a422a28d29a2e74a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 95f508ccedc6213a51362dc13b7319f250707df1ff09480904d0466f40c5a0d9
MD5 4c4062680791680bb0a5b4f75da32970
SHA1 611d2f74e4fd3ee17ea2a96300ec8d97f28edae1
SHA512 0be98dc04087aef951bc5c337d82da1e6bb1e394778f616f61bd6f591cb8b97f6d04e15becc514a8edfe83af72bcdd775d44c91d24c758485420962177ffc069
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3e9911ae8d68181875c6a642981b2251ba7cbf71f069b9bfa4248f803e04e81e
MD5 a8ab6fe0e1f055d9138035ecdf21dcd3
SHA1 066ad409e5330f1f7effd059a0046b8489a8b6fe
SHA512 f1b5b47312eb826b62c8e41ef01cac5fa6e9d3d23d68b6dd13cabdcb9af2a0f8c86e65a13ca8e117532f61a0ad2f986ceef07e97561dda9a443595e538b6fe53
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 996ab39ec2bf62cefe86338279e4c8f9d230ff96355748ea65db477f6f66f3f4
MD5 690d0b1d7b9668d5abdb103eab500b36
SHA1 1fcf1acb7485e67143273abff9378404f7f0e3fc
SHA512 2f1f9c8e99fe10ced1f28e9ac6d010258ebaf58cc914997172f4630554ea4cef486827852222631284baebdf2864641f84183c8c092cc5c6593b65f3c6612454
MD5 SHA1 SHA512

Submit Download

svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACCABACBBCBCCACCBABACACBBBCCBACCAABCACABCCABBCBCCC.exe
Size 8.6MB
SHA256 7f3b55ea0eac1b1510b211cbb9e9779eb45d0bf2eb35662bd7b8004867b8f2b2
MD5 88e6ac8113e56eedd6cf7bc9b18e37d5
SHA1 881c21b63b64ac94b834eaaf1f112e4396b05949
SHA512 54421418414addbc1d6b1c6989f067ec5f1273e13c7ba1ef0dcbc7e6e446ae13bca30108e2afa84582c7d3e43a7d91d641d0a0a71852f12a08f24537d35a89a5
SSDEEP 98304:i5i5i5i5i5i5i5i5i5pOU/jIEeQfoR/IuOFVjUu5x:i5i5i5i5i5i5i5i5i5pFIF0wuv
TLSH
T1B4966E18B7D71121F6B356B08CBAC2B65D307D208731CAEFB648A61E1F35AD0E539726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1572-27-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/1572-37-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/2316-0-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/2316-8-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/3476-61-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Download