839e222ba95673970820e12dfdd69381a8cd80801074c1807b5f68d7a4aa54ab

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_a96b65364da5911c3edcb8a0c908c467_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 6.1MB
Sample260815-2chg8avbnf
SHA256 839e222ba95673970820e12dfdd69381a8cd80801074c1807b5f68d7a4aa54ab
MD5 a96b65364da5911c3edcb8a0c908c467
SHA1 3eeabab390aab8fcc2a29a68d954c3cfa6a728cf
SHA512 cdc3a51ebbd98eb91a24a7d96c20b1869e8b85ed9d5eb6cd1889dfaab0e0055f95bad3669c7bbffea18dc048c0d627904409b1fe086ac0443f5fd8c04e8dd707
SSDEEP 49152:U+ES+E2+ES+ES+EZE+ES+ES+E2+ES+ES+E7+ES+ES+E2+ES+ES+EZE+ES+ES+E22:rOU/jIEeQfoR/IuOFVjUu5m
TLSH
T196567C05F98340B1E97711B04CDBD2BE8630BA2587228DFBF78D871B6B32B916935716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
380	svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe
1700	svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe
5464	svchost_BBBCBBBCCCCBCCAAACABCBCABCBCABBCBAABCABBBBCBBBBCBBAABBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCCACABBCBAACBBABCABBAABCBCBAAACABCAABCBCBABABCAAABBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe"	2026-08-15_a96b65364da5911c3edcb8a0c908c467_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCBCACABBBCABCCCAACCACCAACAABCBABCBBBCCCBCCABCABCBABCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCBBBCCCCBCCAAACABCBCABCBCABBCBAABCABBBBCBBBBCBBAABBA.exe"	svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4104	sc.exe
5256	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1032	cmd.exe
2148	cmd.exe
5772	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCBBBCCCCBCCAAACABCBCABCBCABBCBAABCABBBBCBBBBCBBAABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_a96b65364da5911c3edcb8a0c908c467_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5776	2026-08-15_a96b65364da5911c3edcb8a0c908c467_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5776	2026-08-15_a96b65364da5911c3edcb8a0c908c467_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5776	2026-08-15_a96b65364da5911c3edcb8a0c908c467_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5776	2026-08-15_a96b65364da5911c3edcb8a0c908c467_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
380	svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe
380	svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe
380	svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe
380	svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe
5464	svchost_BBBCBBBCCCCBCCAAACABCBCABCBCABBCBAABCABBBBCBBBBCBBAABBA.exe
5464	svchost_BBBCBBBCCCCBCCAAACABCBCABCBCABBCBAABCABBBBCBBBBCBBAABBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5776	2026-08-15_a96b65364da5911c3edcb8a0c908c467_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	380	svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe
Token: SeDebugPrivilege	5464	svchost_BBBCBBBCCCCBCCAAACABCBCABCBCABBCBAABCABBBBCBBBBCBBAABBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5776 wrote to memory of 1032	5776	2026-08-15_a96b65364da5911c3edcb8a0c908c467_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 1032 wrote to memory of 5424	1032	cmd.exe	94
PID 5776 wrote to memory of 2148	5776	2026-08-15_a96b65364da5911c3edcb8a0c908c467_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	95
PID 2148 wrote to memory of 5256	2148	cmd.exe	97
PID 5776 wrote to memory of 5772	5776	2026-08-15_a96b65364da5911c3edcb8a0c908c467_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 5772 wrote to memory of 4104	5772	cmd.exe	100
PID 380 wrote to memory of 4152	380	svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-15_a96b65364da5911c3edcb8a0c908c467_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_a96b65364da5911c3edcb8a0c908c467_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCACACBBBABBBAAACBCBABAACCAAACACBABBABBACCACCABCAABBBBBCACCACACABABABAABCABCCCBBCCBBBACBACBCCBAAACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCACACBBBABBBAAACBCBABAACCAAACACBABBABBACCACCABCAABBBBBCACCACACABABABAABCABCCCBBCCBBBACBACBCCBAAACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABACBBBCBCBACBBACABCCCBAACAABCBCBABCBBCCABCACCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe" start= auto displayName= "UserDataSvc_ACABACBBBCBCBACBBACABCCCBAACAABCBCBABCBBCCABCACCCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABACBBBCBCBACBBACABCCCBAACAABCBCBABCBBCCABCACCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe" start= auto displayName= "UserDataSvc_ACABACBBBCBCBACBBACABCCCBAACAABCBCBABCBBCCABCACCCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABACBBBCBCBACBBACABCCCBAACAABCBCBABCBBCCABCACCCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABACBBBCBCBACBBACABCCCBAACAABCBCBABCBBCCABCACCCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe
1⤵
- Executes dropped EXE
PID:1700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBBBCCCCBCCAAACABCBCABCBCABBCBAABCABBBBCBBBBCBBAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCBBBCCCCBCCAAACABCBCABCBCABBCBAABCABBBBCBBBBCBBAABBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f98688d816288f2231c3d5a6248cdca2b51c7aeecd99687305a327efeae93cca
MD5 26c621ac130dc649ed5fe391f6a48f46
SHA1 433b960e6c4647f1a92dd23024f98a6d28977d7e
SHA512 9cb6d0d569f5af6916a70dd5e9700e1f66fbf0067f00b60f38bda1c85a30c1117a654565e1274d70177aadd66773472c70da4fc31033c3eef73752db16e5cefe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 37d37bb7033ea0da65501b67cb6e030d9f02674912f463813f1ed34a9208c67e
MD5 9a22a0576913f437a9e7a6eec137d77f
SHA1 6f3089c6576b74cfdf00bc4cb263b56b4ca36e67
SHA512 57c2ab94b3fefbbc8e8b731554c1b587efb17e785725f6e93cb0173cc35b80f7a140e27e74f04bd4dd6536b59580ab315875e1e33035383e4dbc8ccbdfffb801
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 44e3ccae28a4315e6bc2a8f85ea622133332bca90b5be2f10b8cd81c667591b4
MD5 958e31993c183dcac922f817837c7f0f
SHA1 900e56eb5f3ba42d4a36acc7e9b0f756d37f04e8
SHA512 b18912e62593ad0aece2772157249278849e37e25e47968430f34d17fd10e1b75489fd5cee4d4b31c3bf7dc4aaaec875e855988b9c2213bd0aaaca907681bbf1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b1709b4fd5b2becba804435651dfeacad21f77c26ea9e5125691268b4224209a
MD5 b6d677f5211b11ae77f3ed470e388df2
SHA1 add19f66cb11f1dad70f1cb8b21747fb84a94415
SHA512 fc30dcbe119dedcc4c39fa1ec262c3b7b0a91d1d5617d8363c772bf7cfbde0b51952b859195b8952f12a914dd8f086fbde29eccbb7b0d77e7dc110322d82bacb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8dd52b833a129131751805d79e68557e3c708d1db6f1d8305fb7bc42fe430269
MD5 0a16c99fa3cc96c372704d0691658b2f
SHA1 2984c457bc3e85b53c8b7ce8d1798e4a6dffb4f3
SHA512 b53cd710b41d27070ee69531b86f68dc52cbc97c14ddf5f4d0528aa4698bca029aa115ac233e3991358fb8daf41cd18166721b60f6464a5eaff5d5fc001a5839
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cec0cb2667cbbd17b85dc77875e33c7b5c2b63d56cc120b35f08853c7c91f28a
MD5 4aec04e0ff4b48f0629d2cba6e8291f2
SHA1 ce15022c07619e1150531911cf5f60c159abaf25
SHA512 06e2ce1d314ce8a3ca4968c23fbd65a309de4c0dc91ea4f9dbb1788ec611ab9580de6449e8bcd42422bd0fee2a1b2a0c76e1bdf3472a1ed49b426916aa473011
MD5 SHA1 SHA512

Submit Download

svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABACBACABACCCBCCBCBBCBCCACABCABCCBAABABBCCCCACBBACBB.exe
Size 6.1MB
SHA256 839e222ba95673970820e12dfdd69381a8cd80801074c1807b5f68d7a4aa54ab
MD5 a96b65364da5911c3edcb8a0c908c467
SHA1 3eeabab390aab8fcc2a29a68d954c3cfa6a728cf
SHA512 cdc3a51ebbd98eb91a24a7d96c20b1869e8b85ed9d5eb6cd1889dfaab0e0055f95bad3669c7bbffea18dc048c0d627904409b1fe086ac0443f5fd8c04e8dd707
SSDEEP 49152:U+ES+E2+ES+ES+EZE+ES+ES+E2+ES+ES+E7+ES+ES+E2+ES+ES+EZE+ES+ES+E22:rOU/jIEeQfoR/IuOFVjUu5m
TLSH
T196567C05F98340B1E97711B04CDBD2BE8630BA2587228DFBF78D871B6B32B916935716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3f58b2889b735512aba61b84c2f9cb78c9ccdc2e3a3528f2bcccdd126ba5f861
MD5 56aee274b2c8bca6c9876010070bf2d8
SHA1 d6eb49d66f4ff751b444934ed54c18a7733ff5d3
SHA512 b4f51aae619305da0bf781a86d29caaadd8a657037ddc76aa97c44de3886646d4c3dbdd26a722b13992eec53bd373949782fa6ff310337940905264234835b68
TLSH
T1A911A345F8B99C57F932A8DB5729CAD24CB82F97985C7E982308C21CA795C328D158E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/380-35-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download

memory/380-22-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download

memory/1700-66-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download

memory/5464-72-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/5776-6-0x0000000000400000-0x0000000000421000-memory.dmp

Download