13717ef41a623d69ad7f77c1643bdf3d1244c0c2013629a19aa1ba08f1d15190

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 12.2MB
Sample260814-ff2vdavejd
SHA256 13717ef41a623d69ad7f77c1643bdf3d1244c0c2013629a19aa1ba08f1d15190
MD5 31e6af90dd4c1a40affe6afe80c3dd49
SHA1 a85ada507d1601d4ea8b3e0b5de01ded7d2f3c18
SHA512 9acd0e3ef1284a80f88516654bdde38b27dc41cf1b17a045c6d310be077d202f5532b8ccb980ed861b5242655635c35e03113e6d6435738fd73d4f8d6333bb77
SSDEEP 196608:YxsixsixsixsixsixsixsixsSKWQc0gEYnvLL:tcZEIvH
TLSH
T190D69E02FBC64071E577253148BB92BA4E76BA114A31CA9FA38C592F5F33BC0963535B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4568	svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe
5244	svchost_ABACCCCABCBCAABABAAABAACBCBABCBCCBBACCAAACCBBBBBACCCBAC.exe
672	svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABACCABAABBACBCBABBACCABCBACCBBBCACAAACBCABCCCBACABBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe"	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCABCCCCCCCBBACACACCACAACBAABACBBCBBBAAACAAABABACBBCBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACCCCABCBCAABABAAABAACBCBABCBCCBBACCAAACCBBBBBACCCBAC.exe"	svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5116	sc.exe
3420	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5472	cmd.exe
3020	cmd.exe
4656	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACCCCABCBCAABABAAABAACBCBABCBCCBBACCAAACCBBBBBACCCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3344	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3344	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3344	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3344	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4568	svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe
4568	svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe
4568	svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe
4568	svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe
5244	svchost_ABACCCCABCBCAABABAAABAACBCBABCBCCBBACCAAACCBBBBBACCCBAC.exe
5244	svchost_ABACCCCABCBCAABABAAABAACBCBABCBCCBBACCAAACCBBBBBACCCBAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3344	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4568	svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe
Token: SeDebugPrivilege	5244	svchost_ABACCCCABCBCAABABAAABAACBCBABCBCCBBACCAAACCBBBBBACCCBAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 4656	3344	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	93
PID 4656 wrote to memory of 1308	4656	cmd.exe	95
PID 4568 wrote to memory of 4712	4568	svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe	96
PID 3344 wrote to memory of 5472	3344	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	99
PID 5472 wrote to memory of 5116	5472	cmd.exe	101
PID 3344 wrote to memory of 3020	3344	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	102
PID 3020 wrote to memory of 3420	3020	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCAABABBABAABACCCCCCBCAABACBABCCACBAABACACBCAABBCBCCBBCCAACCCABCCABAAACCCCBACBCABCBBBCBCABACBCBCCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCAABABBABAABACCCCCCBCAABACBABCCACBAABACACBCAABBCBCCBBCCAACCCABCCABAAACCCCBACBCABCBBBCBCABACBCBCCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABCAABABCBBBBCACCAACABCCCABCCCAACAABCCBBABBACBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe" start= auto displayName= "UserDataSvc_CCABCAABABCBBBBCACCAACABCCCABCCCAACAABCCBBABBACBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5472
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABCAABABCBBBBCACCAACABCCCABCCCAACAABCCBBABBACBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe" start= auto displayName= "UserDataSvc_CCABCAABABCBBBBCACCAACABCCCABCCCAACAABCCBBABBACBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABCAABABCBBBBCACCAACABCCCABCCCAACAABCCBBABBACBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABCAABABCBBBBCACCAACABCCCABCCCAACAABCCBBABBACBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCCABCBCAABABAAABAACBCBABCBCCBBACCAAACCBBBBBACCCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCCCABCBCAABABAAABAACBCBABCBCCBBACCAAACCBBBBBACCCBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5244

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe
1⤵
- Executes dropped EXE
PID:672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a9096f1664681306ad8892926c7bdba318132c543616e053795bd3b155afade8
MD5 090cbc7fbf13fb3c114089d4420a2377
SHA1 44c50552b44124cc14bc2daa2b8a9d211f61d5cc
SHA512 55d641829f50b9095deff3ff67de3ee9c1e7f70075dba54f1243080b850f9cab670368a474534944b5e0fef2f4bfc773c7270085b301dad5dbc89b868413e91f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d60743bc1d69d728b315ac09ac8621b3a7b965a1b7a955b61d66ead683d7b8f9
MD5 f464ed92b150fa8aa519be46347a7812
SHA1 4035ccd2838c316d6b6cacf103bb9d8154c19ef3
SHA512 225ccaa2503ea62a61f7f733b1b8dd3b7966b4d14f4092e45af8990678c768bf7b66892c4ff8ee328a269fad30e408986a398d477c2e17470af52f907f7ab9ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 62b897c75508340a2b5f213c1cfcf90b0022d8919b437eaa0133c3a6b1f399db
MD5 a122726727f7a9eec512ba084ddc4e79
SHA1 70da93c1d43d022d8d88d3ba89b58148f204070f
SHA512 8c1939ce3c92bdcbea949805dfc3921e5405361c1ce4b68192e0e2833f0c44ab59cd5857633f53890b177c03f7b60aa716c797a90ac27853bf5749507b8910f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c2588c249db003d93b808065e35951fda1aec1a692ce214df094fc216203f712
MD5 6f938542d287ce71edc88c00ec61dd42
SHA1 82547a18f6e7bbaf123adb744550eeb0a59facf5
SHA512 5ab4ee2c641407a4bd0086b9dc830d8d9fa0f632f28b79abc82f7b1311e1a53f2495a76da6a3cc7cc33c87d41a43daf4d7b924dcb62be5f426d99114a4e5b5a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e86146cf460eb67469dc8d76eff927236d34928dc86139a3cb3ee9c43ea5b615
MD5 fcf5921c2a5d6f475780d0da806758af
SHA1 7626831496dfe86da029a0017ff54c653539ac65
SHA512 0b977a3046c20f34ea6b24d29c41b18aa14ead0d66818cd4eb4a13b80893d3c7f6010cce0aa5be1310f7e04cf25d957dd135b5a9913e95cb8acffb5f43be160f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4807d29fdf3f2e3e892b4010fa4904f14b239a55e1aae22d29f1aae3c297101a
MD5 db47fb04f8077ba2bce794447bb5235c
SHA1 382069f42d56ff44d35e1e9852eb194bebacf2dd
SHA512 4dd86c2693a5e7024ecb2825378c894317fcc6cbf3e81f1222601bd4a4d189292de656eaabc2bf9c97d43f290820c1c38f02efd99035539115f9987f5c6ad517
MD5 SHA1 SHA512

Submit Download

svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACBBACABBBBBCBBCACBCCACAAACCACCBBCCCCCABCCCBBBABBBCAC.exe
Size 12.2MB
SHA256 13717ef41a623d69ad7f77c1643bdf3d1244c0c2013629a19aa1ba08f1d15190
MD5 31e6af90dd4c1a40affe6afe80c3dd49
SHA1 a85ada507d1601d4ea8b3e0b5de01ded7d2f3c18
SHA512 9acd0e3ef1284a80f88516654bdde38b27dc41cf1b17a045c6d310be077d202f5532b8ccb980ed861b5242655635c35e03113e6d6435738fd73d4f8d6333bb77
SSDEEP 196608:YxsixsixsixsixsixsixsixsSKWQc0gEYnvLL:tcZEIvH
TLSH
T190D69E02FBC64071E577253148BB92BA4E76BA114A31CA9FA38C592F5F33BC0963535B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7946949223876b96be77ae4371caa6c02e18c4115399209fb6006bd8f73e1ab2
MD5 135e7745329515c6f239a2176a64e0e5
SHA1 28e54149c68623a7c8626a3df6406cef78fffc4c
SHA512 6fd494dd8d7d35d600600dcc7064b9fec69c316bda4cf9ad75036ab5bc51bdb8613f21e0b173c8c95a473c31ee1464c3d6d40ad1811ef6a760d962fa83a43a82
TLSH
T17B112B24D8F5C873E932A9DB563DDBD208E8734FA8546A041389112CABA8D219D690D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/672-80-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/3344-7-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/3344-0-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/4568-34-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/4568-24-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/5244-70-0x00000000002F0000-0x0000000000311000-memory.dmp

Download