34d9c13a14c115fd507544c93ae1f3f9aaa056350056064173b96d89d747d1d3

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_fec477f4c0d661de2bf427b8dc7cf668_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 8.1MB
Sample260814-sqw34aae49
SHA256 34d9c13a14c115fd507544c93ae1f3f9aaa056350056064173b96d89d747d1d3
MD5 fec477f4c0d661de2bf427b8dc7cf668
SHA1 14e1e47317e27f798623925879dd1a56cac097a5
SHA512 a206270837bd3a022d2c8e19f86b9df64261395d20cd4f25f27218309902a28ec0149c1b3baf9e4b2cb207f86c417ce56e2566f192db8dd353f68b94683029bb
SSDEEP 49152:U+EPiw2Iqatglg+EPiw2Iqatglg+EPiw2Iqatglg+EPiw2Iqatglg+EPiw2IqatK:+RRRRRRRROOU/jIEeQfoR/IuOFVjUu5F
TLSH
T121865B05BBDD8562E4B7123148A782669BB1B8515F32D2CF7388933D4F337D0AA31B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4988	svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe
1816	svchost_ABBBCBAABCCACACCCBCCCBCBCABBBAAAABCABCBCABBCCBCBBABCACB.exe
4596	svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACACABBCCBAACAABBBBABACBBAAACABCCBBBBCCBAAABCACABBCAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe"	2026-08-14_fec477f4c0d661de2bf427b8dc7cf668_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACCCCBAABBACAAABBABACCABBACCAAACCAAAACBBABAABCABCBCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBCBAABCCACACCCBCCCBCBCABBBAAAABCABCBCABBCCBCBBABCACB.exe"	svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4164	sc.exe
1504	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6112	cmd.exe
4640	cmd.exe
4408	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_fec477f4c0d661de2bf427b8dc7cf668_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBCBAABCCACACCCBCCCBCBCABBBAAAABCABCBCABBCCBCBBABCACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2128	2026-08-14_fec477f4c0d661de2bf427b8dc7cf668_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2128	2026-08-14_fec477f4c0d661de2bf427b8dc7cf668_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2128	2026-08-14_fec477f4c0d661de2bf427b8dc7cf668_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2128	2026-08-14_fec477f4c0d661de2bf427b8dc7cf668_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4988	svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe
4988	svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe
4988	svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe
4988	svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe
1816	svchost_ABBBCBAABCCACACCCBCCCBCBCABBBAAAABCABCBCABBCCBCBBABCACB.exe
1816	svchost_ABBBCBAABCCACACCCBCCCBCBCABBBAAAABCABCBCABBCCBCBBABCACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2128	2026-08-14_fec477f4c0d661de2bf427b8dc7cf668_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4988	svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe
Token: SeDebugPrivilege	1816	svchost_ABBBCBAABCCACACCCBCCCBCBCABBBAAAABCABCBCABBCCBCBBABCACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 6112	2128	2026-08-14_fec477f4c0d661de2bf427b8dc7cf668_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 6112 wrote to memory of 2548	6112	cmd.exe	94
PID 4988 wrote to memory of 5816	4988	svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe	95
PID 2128 wrote to memory of 4640	2128	2026-08-14_fec477f4c0d661de2bf427b8dc7cf668_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 4640 wrote to memory of 4164	4640	cmd.exe	100
PID 2128 wrote to memory of 4408	2128	2026-08-14_fec477f4c0d661de2bf427b8dc7cf668_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 4408 wrote to memory of 1504	4408	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_fec477f4c0d661de2bf427b8dc7cf668_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_fec477f4c0d661de2bf427b8dc7cf668_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABCABAAABCACCABAAABABACAACBCBABCBBBBAACBCACCAABAABACCABABCBBBBBABCBCBCABABBACACACACAABCACACCCCBBCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABCABAAABCACCABAAABABACAACBCBABCBBBBAACBCACCAABAABACCABABCBBBBBABCBCBCABABBACACACACAABCACACCCCBBCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBCACBCAAACBCCACCCAACBAAABCCACCCAAACCBBBCACBAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe" start= auto displayName= "UserDataSvc_BCCBCACBCAAACBCCACCCAACBAAABCCACCCAAACCBBBCACBAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBCACBCAAACBCCACCCAACBAAABCCACCCAAACCBBBCACBAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe" start= auto displayName= "UserDataSvc_BCCBCACBCAAACBCCACCCAACBAAABCCACCCAAACCBBBCACBAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBCACBCAAACBCCACCCAACBAAABCCACCCAAACCBBBCACBAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBCACBCAAACBCCACCCAACBAAABCCACCCAAACCBBBCACBAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBAABCCACACCCBCCCBCBCABBBAAAABCABCBCABBCCBCBBABCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBAABCCACACCCBCCCBCBCABBBAAAABCABCBCABBCCBCBBABCACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe
1⤵
- Executes dropped EXE
PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 26d0b4310f9db1e7fdeac30fdc184433db4341f9dc677f0f2b7a0e2a9e283595
MD5 6456492f076711982504d755bd068619
SHA1 c617d5bfaa915f98943f2db83fd971ab31441d29
SHA512 e72af840b0c4a8f7e0c138959efc2ef3d3e3018728458ec84150761feabcf76980b705aef3b01f4e060d92f7b6fe537165c9f7f800dfe7b019b3f7725b5b153d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1eefbb3f3c27e87af5825b9e6cad87be93f6cb7f5976b61dba1c2828d61456e8
MD5 0f4e0a62f9dc8edb7c5bc9a2ea2ef121
SHA1 536c8c4946abb648974fd833f9a0c7ea57b3da32
SHA512 437fcc36c64e735e41830a6a248a08c00da22b7c0c54b7df23975cea2bf7db8fd2fb1add9e9efe4421317c70e4119d410ae1b7c62ea4c5a44bafef6976833d3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4aafd48d05dcd94541bcb3476a1053752e46b45a53d3b21a0c5f666c41c49039
MD5 c171a1f6127bca6f5991bbdb6ea4cffa
SHA1 545442fa44ea019c251c705fa9ac9eed991ceea0
SHA512 89c71e9d5e7261c549324dadead66536302e6481b9954d5ffb819bcad103575357088e811e76cbdb16fb89647c9fd73004db5b7463d3a9c0cfb36e43dd434382
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 367b5b79ea29b21cc12990a3c4548094706d64a63cf4656bae19c28a49d40866
MD5 897285ee3ccdd559d2a1990d960fc8ec
SHA1 d0881dc03699098155ef6fbc3254eb75701a25f3
SHA512 6cd75b949d81bbea4a3643576b112da421842177af8e4075b78080cadbbcfd17c567a06c51f55683a00d123d14a4b3214028c179d83361f52da3c76c52154406
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ca91939d660ac953763fe29c4fd0aa34210d6c14945fae165d73c7c0c7bba334
MD5 18c86e95931527cbe0925bdb59f3d65e
SHA1 63799919e5c9cc38762ec4b4e4ba7590b838dc5e
SHA512 1693ac81e04bd1518d2adf5eef884aac1a2319a103dbe79bf05792168c08cea912e2a4f38b8ffdb09f04bc1cd43420749ce22ff19b3371e9d5d82d3d9d33a09f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2626d61a3e18d566b0f2d0f3c93865bcd19153ee0cf92569a01e2bef35443efa
MD5 62229b55e2c0e5e0d7cb03a4fa4b0ee6
SHA1 9cc1b4f96513b6ae9c27ab212aaf88d6a3e1e970
SHA512 e76faa17537fdb0ec710248f19fece711ff38787f7f846930d833c29222319983b555bcbb19ff12b8c074468ea5133b75b99f92ee99282ce0e20a460f0e30b90
MD5 SHA1 SHA512

Submit Download

svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBCCBCBCBBCAAACCCBBAAAAACCACBCABCACBCBBBAACBBAAABAB.exe
Size 8.1MB
SHA256 34d9c13a14c115fd507544c93ae1f3f9aaa056350056064173b96d89d747d1d3
MD5 fec477f4c0d661de2bf427b8dc7cf668
SHA1 14e1e47317e27f798623925879dd1a56cac097a5
SHA512 a206270837bd3a022d2c8e19f86b9df64261395d20cd4f25f27218309902a28ec0149c1b3baf9e4b2cb207f86c417ce56e2566f192db8dd353f68b94683029bb
SSDEEP 49152:U+EPiw2Iqatglg+EPiw2Iqatglg+EPiw2Iqatglg+EPiw2Iqatglg+EPiw2IqatK:+RRRRRRRROOU/jIEeQfoR/IuOFVjUu5F
TLSH
T121865B05BBDD8562E4B7123148A782669BB1B8515F32D2CF7388933D4F337D0AA31B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a7641f27fa76cd5356e48014cdcd2565195d8423c90e44ae5c813d22b1280b1e
MD5 c376fb5d403d08c83c67c5b658739ab6
SHA1 ecb30ea67fd26b099fbb2a6bc795a33d694dac30
SHA512 d02e0b38e11803f23e10ad8c585981abe9663dd04d80598178cfcdceb2d563a2027618beac6bd881b9b531b50dc80d1fae26cc2212a4c34e50dc5be2319d6cbe
TLSH
T1D711EB94F8E6D403DA732CCF5629CFE20CF477AF585C6EA47308C118AB598214D5A0F6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1816-71-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/2128-7-0x0000000000EA0000-0x0000000000EC1000-memory.dmp

Download

memory/2128-0-0x0000000000EA0000-0x0000000000EC1000-memory.dmp

Download

memory/4596-72-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/4988-23-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/4988-33-0x00000000000E0000-0x0000000000101000-memory.dmp

Download