3f989c5d9470eeea890cca2029db83fe3e5c0f11be888fe45bd4d6060d86e28e

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_2002d2d3a643eec22edcb2edb4f8a2c7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 6.2MB
Sample260815-b7htcsxvbv
SHA256 3f989c5d9470eeea890cca2029db83fe3e5c0f11be888fe45bd4d6060d86e28e
MD5 2002d2d3a643eec22edcb2edb4f8a2c7
SHA1 4788efe322002a408135406d0ae972e1ff3c162b
SHA512 b9ea3c59455dee180011acbe06110d2224ab4eb95daaea70999496c8624275d180ea40676e96811a7146dcc8ea6739ae92c46f5ac4027d9921fe7975ae6ccbf0
SSDEEP 49152:U+ES+ES+ES+ES+ESR+ES+ES+ES+ES+ESR+ES+ES+ES+ES+ESR+ES+ES+ES+ES+E4:sOU/jIEeQfoR/IuOFVjUu5d
TLSH
T1D5665C05F98340B1E97B11B04CDBD3BF8A30BA2586228DFBF74D871B6B32B915439656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2244	svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe
3312	svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACAACCBCABACBBCCCBACBCCCCBCBAAAAABABCAAAABCBBBACACCCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe"	2026-08-15_2002d2d3a643eec22edcb2edb4f8a2c7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4424	sc.exe
2168	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1312	cmd.exe
3504	cmd.exe
5852	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_2002d2d3a643eec22edcb2edb4f8a2c7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4668	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2420	2026-08-15_2002d2d3a643eec22edcb2edb4f8a2c7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2420	2026-08-15_2002d2d3a643eec22edcb2edb4f8a2c7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2420	2026-08-15_2002d2d3a643eec22edcb2edb4f8a2c7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2420	2026-08-15_2002d2d3a643eec22edcb2edb4f8a2c7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2244	svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe
2244	svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe
2244	svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe
2244	svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	2026-08-15_2002d2d3a643eec22edcb2edb4f8a2c7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2244	svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1312	2420	2026-08-15_2002d2d3a643eec22edcb2edb4f8a2c7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 1312 wrote to memory of 4668	1312	cmd.exe	94
PID 2244 wrote to memory of 3788	2244	svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe	95
PID 2420 wrote to memory of 3504	2420	2026-08-15_2002d2d3a643eec22edcb2edb4f8a2c7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	96
PID 3504 wrote to memory of 4424	3504	cmd.exe	98
PID 2420 wrote to memory of 5852	2420	2026-08-15_2002d2d3a643eec22edcb2edb4f8a2c7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	99
PID 5852 wrote to memory of 2168	5852	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-15_2002d2d3a643eec22edcb2edb4f8a2c7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_2002d2d3a643eec22edcb2edb4f8a2c7_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBABBBCACABBACACBCBCCCCCCABAABBCCAABCCACCCCABAACABCBCCCBBBBCABACCCBABACBBBAABBCBACCBAACAABBBABBCACABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBABBBCACABBACACBCBCCCCCCABAABBCCAABCCACCCCABAACABCBCCCBBBBCABACCCBABACBBBAABBCBACCBAACAABBBABBCACABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAACCCCCACACCCBABABAAACAAABCCACCACBACCACCACACBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe" start= auto displayName= "UserDataSvc_BCAACCCCCACACCCBABABAAACAAABCCACCACBACCACCACACBBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAACCCCCACACCCBABABAAACAAABCCACCACBACCACCACACBBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe" start= auto displayName= "UserDataSvc_BCAACCCCCACACCCBABABAAACAAABCCACCACBACCACCACACBBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAACCCCCACACCCBABABAAACAAABCCACCACBACCACCACACBBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAACCCCCACACCCBABABAAACAAABCCACCACBACCACCACACBBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2168

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe
1⤵
- Executes dropped EXE
PID:3312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e3a8206c8ecd5365d2691261ca314d68a5f697848c89eabcca15a4a9ad0f771f
MD5 d55629c2f6a6a80c08238b0d2b9a47d8
SHA1 4a3fbd6a85f10b4ca9190d2861cb885644f16b01
SHA512 246e1d90a195400be581d06bbb6441038b07994538b582bf1beda8fc9d8574c72c1e21afacfd780e5d98dbf8027a8fb365620060afcfe39996b48032ab906b72
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8e1c6c86603f52672f455173f34c50ba3085b56a8ef0acb28648938ad12a92a8
MD5 c542f6108337e2534ce7a73b4777f271
SHA1 d12237518111411dbb420995fe0ef80d2f36a8c0
SHA512 1ec20801b675aa99b71ff25571e9f52eeffffdd91c8186f77f89bc6091ca7db90d2b9690e070937b6934a402dc9642072282864efda06ed2930dd89ff0a15f4e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e65b719f2594747beac213912da95d3df9b631cd96ef3f85fdd302ddb623d80e
MD5 4529e3dab7481e8cbcefd802771a233b
SHA1 74db09d7588b765bcb81507a2e2ff039a6aca42e
SHA512 e867e2752b3bdac5548eb3a20af74ed7c64b9c0e08d3da82cd20098abb6381adf777136618f73bba997df7fec1aa18653f42ef9cc3e8613fccf43f18b8724296
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 47043a4387a07e0586c4a2e2c7f391128eeb6f5fa113d9e7eb20dd0140fc296b
MD5 b3935b6eb7c3d9e01d4ae66d3179db47
SHA1 d98af8e01b3f4d4710c4fa202539d15f4593e5e9
SHA512 7153655bc8f1cb2355a0e1471b9cf1d865a0c12c365cf890848242014363296c00461ecc57153a8678253abe5ff9c8ef3192f13421ea91873ed406a6f98fd5fc
MD5 SHA1 SHA512

Submit Download

svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBCCABBCAAABCCCACBBAACBCCABBABCBACBCABCBCCBACABBCCA.exe
Size 6.2MB
SHA256 3f989c5d9470eeea890cca2029db83fe3e5c0f11be888fe45bd4d6060d86e28e
MD5 2002d2d3a643eec22edcb2edb4f8a2c7
SHA1 4788efe322002a408135406d0ae972e1ff3c162b
SHA512 b9ea3c59455dee180011acbe06110d2224ab4eb95daaea70999496c8624275d180ea40676e96811a7146dcc8ea6739ae92c46f5ac4027d9921fe7975ae6ccbf0
SSDEEP 49152:U+ES+ES+ES+ES+ESR+ES+ES+ES+ES+ESR+ES+ES+ES+ES+ESR+ES+ES+ES+ES+E4:sOU/jIEeQfoR/IuOFVjUu5d
TLSH
T1D5665C05F98340B1E97B11B04CDBD3BF8A30BA2586228DFBF74D871B6B32B915439656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2244-24-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/2244-37-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/2420-0-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/2420-8-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download