eaef8269e63547c15c83b8f128964cd515c14e4990dc2145ae5f958162c08641

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_820f0e7273be6d87913d62b8818c3971_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 9.4MB
Sample260814-ejhp8sck81
SHA256 eaef8269e63547c15c83b8f128964cd515c14e4990dc2145ae5f958162c08641
MD5 820f0e7273be6d87913d62b8818c3971
SHA1 27d6a760cd335e9263542e9daae65377b3545cce
SHA512 68938976d0633377a8ad4769b02b6432e5834d7a3db3a9e959dbf64fab761ee9f19ab37eedc419e1361f27f9e282adc38591c4b27062ee97e5ca4b1f62b34d03
SSDEEP 49152:U+ES+E2+ES+ES+Eqk+ES+Ee+E4+ES+E2+ES+ES+Eqk+ES+Ee+E4+ES+E2+ES+ESt:5OU/jIEeQfoR/IuOFVjUu56
TLSH
T1D4A67D05F98340B1E97751B04DDFD2BF8630BA6186228DEFF78D861F6E32B906924716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4888	svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe
1948	svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe
3296	svchost_BBCBCCBCBCCBCCCABCCCCABCACBBBBCBCBCBCBBABBCAAABCBBBACCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCACACCCCBBCAACCCACBBABBCBCBBCBBCACACBBBBAACCCCCCBBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe"	2026-08-14_820f0e7273be6d87913d62b8818c3971_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAABCCAACCBCCABACAACABCACBACCACBCBABBCBBACBCBCBBABCAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBCCBCBCCBCCCABCCCCABCACBBBBCBCBCBCBBABBCAAABCBBBACCB.exe"	svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1916	sc.exe
4344	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5608	cmd.exe
5900	cmd.exe
1964	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBCCBCBCCBCCCABCCCCABCACBBBBCBCBCBCBBABBCAAABCBBBACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_820f0e7273be6d87913d62b8818c3971_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2516	2026-08-14_820f0e7273be6d87913d62b8818c3971_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2516	2026-08-14_820f0e7273be6d87913d62b8818c3971_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2516	2026-08-14_820f0e7273be6d87913d62b8818c3971_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2516	2026-08-14_820f0e7273be6d87913d62b8818c3971_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4888	svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe
4888	svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe
4888	svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe
4888	svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	2026-08-14_820f0e7273be6d87913d62b8818c3971_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4888	svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 5608	2516	2026-08-14_820f0e7273be6d87913d62b8818c3971_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 5608 wrote to memory of 5144	5608	cmd.exe	94
PID 2516 wrote to memory of 5900	2516	2026-08-14_820f0e7273be6d87913d62b8818c3971_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	95
PID 5900 wrote to memory of 1916	5900	cmd.exe	97
PID 2516 wrote to memory of 1964	2516	2026-08-14_820f0e7273be6d87913d62b8818c3971_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 1964 wrote to memory of 4344	1964	cmd.exe	100
PID 4888 wrote to memory of 1612	4888	svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_820f0e7273be6d87913d62b8818c3971_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_820f0e7273be6d87913d62b8818c3971_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACACBBBBBBACBBACBACBACBACCCAABCBCCBAABBCBBABBBCAAABABAAABBABBCCACBBACBCCACCAABAACBACCBBACCCABCBAACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACACBBBBBBACBBACBACBACBACCCAABCBCCBAABBCBBABBBCAAABABAAABBABBCCACBBACBCCACCAABAACBACCBBACCCABCBAACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABACAACAABABBCBBBCBCBABAAAACAACCCABCCBBAACAAABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe" start= auto displayName= "UserDataSvc_BCABACAACAABABBCBBBCBCBABAAAACAACCCABCCBBAACAAABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABACAACAABABBCBBBCBCBABAAAACAACCCABCCBBAACAAABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe" start= auto displayName= "UserDataSvc_BCABACAACAABABBCBBBCBCBABAAAACAACCCABCCBBAACAAABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABACAACAABABBCBBBCBCBABAAAACAACCCABCCBBAACAAABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABACAACAABABBCBBBCBCBABAAAACAACCCABCCBBAACAAABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe
1⤵
- Executes dropped EXE
PID:1948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBCBCCBCCCABCCCCABCACBBBBCBCBCBCBBABBCAAABCBBBACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBCBCCBCCCABCCCCABCACBBBBCBCBCBCBBABBCAAABCBBBACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1efcd2e0337199de04a1c4607596e20d4a0ba90af49260565fbe2f25aaf7436d
MD5 689bebac043ce10c4dcd2b97bb306009
SHA1 bc0486f91179ec43c35c49e435c4c8675c933d7a
SHA512 8e28224af31b14570da05a02351465bb6d25683eea1dea2ffbbefae6c9cd179672881a616c7fb7ec78f0a268701c1cbb99e277502e95a248393e292a5670c0e7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c5e658a61a3f15e7b34f19752548d71d039d67e33968b218fb29f9622715cd06
MD5 84275e3ca79d02f0248b7f79188abb03
SHA1 c800247163c62b106b2135c326479f43aa45a751
SHA512 321a4264545c900916ef4059f47e66cc1159921caf3edd049bedc5cce6be3a0f9774edcd9e0519e58c50b9cb89e07b494e54656cbce92d7c0b01c2240335d159
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a7a059a21238c8d6fe501393a747f6d84286241abd7d6b6f2cf5020800ebfe79
MD5 269b52f8b1d6b96aadf0e792db26da85
SHA1 e35064d7bebec75cb2ff4bba55f1aaf99f4fe410
SHA512 eb5689f759e013d8429db6070daeacf6892316d90459afbd18e502d2da49c01a2beeacecc63bdb55ca45dab9c59b30700a62d6b84ebe82a6e026eac9c63e48bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dcdbbc067bb022438bb448498fb75c9df23cdcb1bfa9ad048a461680847c1fa6
MD5 ed81e12da1df070053bb85d1b5c0ecc9
SHA1 bc6e2c1fcfb61a62c6e2c5fc82f059f0b1e8d084
SHA512 528b444d55e3463255f6bc06c0a1ba4cba2387a5d375f1b709aa8bf0cfa78be486e203a756cf98907334c6d90f01f42e55df6550e0b4dc1586059339258e60e1
MD5 SHA1 SHA512

Submit Download

svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCCACCABBABBAABBCCCAABCACCBBABCBBCCAACABBCCCAAAACAA.exe
Size 9.4MB
SHA256 eaef8269e63547c15c83b8f128964cd515c14e4990dc2145ae5f958162c08641
MD5 820f0e7273be6d87913d62b8818c3971
SHA1 27d6a760cd335e9263542e9daae65377b3545cce
SHA512 68938976d0633377a8ad4769b02b6432e5834d7a3db3a9e959dbf64fab761ee9f19ab37eedc419e1361f27f9e282adc38591c4b27062ee97e5ca4b1f62b34d03
SSDEEP 49152:U+ES+E2+ES+ES+Eqk+ES+Ee+E4+ES+E2+ES+ES+Eqk+ES+Ee+E4+ES+E2+ES+ESt:5OU/jIEeQfoR/IuOFVjUu56
TLSH
T1D4A67D05F98340B1E97751B04DDFD2BF8630BA6186228DEFF78D861F6E32B906924716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2516-0-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/2516-8-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/4888-24-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/4888-37-0x0000000000340000-0x0000000000361000-memory.dmp

Download