7f3b55ea0eac1b1510b211cbb9e9779eb45d0bf2eb35662bd7b8004867b8f2b2

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 8.6MB
Sample260814-efqlnstyhs
SHA256 7f3b55ea0eac1b1510b211cbb9e9779eb45d0bf2eb35662bd7b8004867b8f2b2
MD5 88e6ac8113e56eedd6cf7bc9b18e37d5
SHA1 881c21b63b64ac94b834eaaf1f112e4396b05949
SHA512 54421418414addbc1d6b1c6989f067ec5f1273e13c7ba1ef0dcbc7e6e446ae13bca30108e2afa84582c7d3e43a7d91d641d0a0a71852f12a08f24537d35a89a5
SSDEEP 98304:i5i5i5i5i5i5i5i5i5pOU/jIEeQfoR/IuOFVjUu5x:i5i5i5i5i5i5i5i5i5pFIF0wuv
TLSH
T1B4966E18B7D71121F6B356B08CBAC2B65D307D208731CAEFB648A61E1F35AD0E539726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3908	svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe
1952	svchost_BCBBBBAABACAAABCBACBCBBAACCAABCABACCACCBCACCAABCBAAACCC.exe
4584	svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACCBBCCAACBACBCCBBCBACCABBCCBCBCABCBCBACBCABABAABBCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe"	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBBACCBCACACBCBABCAABAABAABBAACBCCCBCABBABCACBCCACABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBBBAABACAAABCBACBCBBAACCAABCABACCACCBCACCAABCBAAACCC.exe"	svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4492	sc.exe
5404	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4312	cmd.exe
2716	cmd.exe
4220	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBBBAABACAAABCBACBCBBAACCAABCABACCACCBCACCAABCBAAACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3360	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3360	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3360	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3360	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3908	svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe
3908	svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe
3908	svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe
3908	svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3908	svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 4312	3360	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	91
PID 4312 wrote to memory of 4140	4312	cmd.exe	93
PID 3908 wrote to memory of 6084	3908	svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe	94
PID 3360 wrote to memory of 2716	3360	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	97
PID 2716 wrote to memory of 4492	2716	cmd.exe	99
PID 3360 wrote to memory of 4220	3360	2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	100
PID 4220 wrote to memory of 5404	4220	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_88e6ac8113e56eedd6cf7bc9b18e37d5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCAABCCAAACCACACCBBBCBACAAABAABCABCCBABCCCAAAACABBBBBBCBBABBBACCAABCBACBCBCBACBAABBCBBCCCAAABBBBAAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCAABCCAAACCACACCBBBCBACAAABAABCABCCBABCCCAAAACABBBBBBCBBABBBACCAABCBACBCBCBACBAABBCBBCCCAAABBBBAAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCCAACACBAACBABABAABBACCBBCCABACCAABCACCBBACBBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe" start= auto displayName= "UserDataSvc_AABCCAACACBAACBABABAABBACCBBCCABACCAABCACCBBACBBBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCCAACACBAACBABABAABBACCBBCCABACCAABCACCBBACBBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe" start= auto displayName= "UserDataSvc_AABCCAACACBAACBABABAABBACCBBCCABACCAABCACCBBACBBBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCCAACACBAACBABABAABBACCBBCCABACCAABCACCBBACBBBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCCAACACBAACBABABAABBACCBBCCABACCAABCACCBBACBBBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5404

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBAABACAAABCBACBCBBAACCAABCABACCACCBCACCAABCBAAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBAABACAAABCBACBCBBAACCAABCABACCACCBCACCAABCBAAACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe
1⤵
- Executes dropped EXE
PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99e63b23442c69b3f092ce98976f75fd7fff1ca25e3197c93ade8c82789063a6
MD5 530d2384dcaa4e14ecffb07969bbf9c2
SHA1 74b6981aeff88e89e2a059fa0f5d2101805a1409
SHA512 5c43fdf014bd69dff7867d41d435f5f9e9d9a27a8a87a2d727dd351238263a9455697dd12d3300223f4ea4f3ffed04a3fe1e2ba27d54df3f7479dd5ff70022aa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5da05645a9ed36a21fc7628b099a0c0af5aa2896bd4ef8e2fded07032897704a
MD5 783ed24b7dc017340a59ef983a3a426e
SHA1 de7c941a7de508aaa1077fa83ebb51fb0101f648
SHA512 403884cf20e12853ef83fcc7a359a28d2f6516ac7c3a08dca3224f48f304c5d88c1364e5d92e154b46a9cee220aa7757a4920e1e490d16bf9202e6d3f2ffaa31
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 25d37af6f8e812de7cc862033ab3e81837803983ad0536105444e41921693aee
MD5 d8ef83e796818031fc78b4155b7416c7
SHA1 7ca2309d7f4623a5d4116adf891809d5a79b2290
SHA512 8d119cfebf56d53cf3ec0403814bafbb2d78349fd96f1d40f3c177506159bb30ba78baad2204cfa28f3f682c4ce6d2cf1178f4a2f1c33d53a422a28d29a2e74a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 44b191920d1b3125206b80c0b6574697af01f6a23d65260d97291c07fc3ee525
MD5 11a6ee3652ac3aad413dc2a19298062d
SHA1 f5055700c39501787724f4488687c3508013b8e8
SHA512 1635cde3196ec7e94f66aa6b6c30c6c3784583324ada502c43cedb3c38f123b5fcd3e117edd9e13068b4cf318170970c69ea9cc88577eeeec215ad3dc18a1a48
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 996ab39ec2bf62cefe86338279e4c8f9d230ff96355748ea65db477f6f66f3f4
MD5 690d0b1d7b9668d5abdb103eab500b36
SHA1 1fcf1acb7485e67143273abff9378404f7f0e3fc
SHA512 2f1f9c8e99fe10ced1f28e9ac6d010258ebaf58cc914997172f4630554ea4cef486827852222631284baebdf2864641f84183c8c092cc5c6593b65f3c6612454
MD5 SHA1 SHA512

Submit Download

svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBCCBABBCBAAABCBBCBBBABBCCACCCCABCAABACABCABACACCAB.exe
Size 8.6MB
SHA256 7f3b55ea0eac1b1510b211cbb9e9779eb45d0bf2eb35662bd7b8004867b8f2b2
MD5 88e6ac8113e56eedd6cf7bc9b18e37d5
SHA1 881c21b63b64ac94b834eaaf1f112e4396b05949
SHA512 54421418414addbc1d6b1c6989f067ec5f1273e13c7ba1ef0dcbc7e6e446ae13bca30108e2afa84582c7d3e43a7d91d641d0a0a71852f12a08f24537d35a89a5
SSDEEP 98304:i5i5i5i5i5i5i5i5i5pOU/jIEeQfoR/IuOFVjUu5x:i5i5i5i5i5i5i5i5i5pFIF0wuv
TLSH
T1B4966E18B7D71121F6B356B08CBAC2B65D307D208731CAEFB648A61E1F35AD0E539726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1952-70-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/3360-0-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/3360-8-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/3908-32-0x0000000000180000-0x00000000001A1000-memory.dmp

Download