4c8390a38302415b0819051c06875bb45ba86e45be454db689dfb429b0ee66ee

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_5c26bd8be796c03bd073c6ae31dc7032_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 24.0MB
Sample260815-eex95aybra
SHA256 4c8390a38302415b0819051c06875bb45ba86e45be454db689dfb429b0ee66ee
MD5 5c26bd8be796c03bd073c6ae31dc7032
SHA1 3be97ceab90fbbd3ec29f7d11bcf6fa0f3ed13b8
SHA512 f70ba0ed3f77b3d6fda650536969e8548d53b1489dd9f8d22be2e63d8cfe9efd6c1266d4a66aaa7dba0bd0c6ded5dfa0560d5396b88d79ec15cf94a01eb8a4b4
SSDEEP 98304:oC7C7C7C7C7C7CeKjKWQckVgtev5mnlNLC:dKWQc0gEYnvLC
TLSH
T13C473A09F94340B2D92B11B14CCBD3BF8A60BA2587128EE7FB4DC75FA933BA16439155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5096	svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe
6064	svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe
3236	svchost_CCBAABCCCAABABABABAACAABACBCACCCBCAACAAABACBACBBCACCACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAACCCABCCBABCBCCBBCCBCABCCBCABCACCBCBBCABAABBABCCBCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe"	2026-08-15_5c26bd8be796c03bd073c6ae31dc7032_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAAAACCBCABCABACBBBBACBCBACCBCACBBBCACABBBBBCCCCBBCBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAABCCCAABABABABAACAABACBCACCCBCAACAAABACBACBBCACCACA.exe"	svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1952	sc.exe
1972	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4212	cmd.exe
2476	cmd.exe
1032	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_5c26bd8be796c03bd073c6ae31dc7032_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAABCCCAABABABABAACAABACBCACCCBCAACAAABACBACBBCACCACA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4908	2026-08-15_5c26bd8be796c03bd073c6ae31dc7032_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4908	2026-08-15_5c26bd8be796c03bd073c6ae31dc7032_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4908	2026-08-15_5c26bd8be796c03bd073c6ae31dc7032_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4908	2026-08-15_5c26bd8be796c03bd073c6ae31dc7032_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5096	svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe
5096	svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe
5096	svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe
5096	svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe
3236	svchost_CCBAABCCCAABABABABAACAABACBCACCCBCAACAAABACBACBBCACCACA.exe
3236	svchost_CCBAABCCCAABABABABAACAABACBCACCCBCAACAAABACBACBBCACCACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	2026-08-15_5c26bd8be796c03bd073c6ae31dc7032_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	5096	svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe
Token: SeDebugPrivilege	3236	svchost_CCBAABCCCAABABABABAACAABACBCACCCBCAACAAABACBACBBCACCACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4212	4908	2026-08-15_5c26bd8be796c03bd073c6ae31dc7032_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	93
PID 4212 wrote to memory of 2716	4212	cmd.exe	95
PID 5096 wrote to memory of 2628	5096	svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe	96
PID 4908 wrote to memory of 2476	4908	2026-08-15_5c26bd8be796c03bd073c6ae31dc7032_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	97
PID 2476 wrote to memory of 1952	2476	cmd.exe	99
PID 4908 wrote to memory of 1032	4908	2026-08-15_5c26bd8be796c03bd073c6ae31dc7032_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	100
PID 1032 wrote to memory of 1972	1032	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-15_5c26bd8be796c03bd073c6ae31dc7032_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_5c26bd8be796c03bd073c6ae31dc7032_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCCBCAAABACBACBAAACCCCCBABABAACACCCBBBBACABCACCABACAAABABCABACBBBABCCABABBAABCCCACBACAABAACBABBCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCCBCAAABACBACBAAACCCCCBABABAACACCCBBBBACABCACCABACAAABABCABACBBBABCCABABBAABCCCACBACAABAACBABBCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBAACBBBACBBBACACCCACAABACBBCCCBBCCCCBBCAABABCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe" start= auto displayName= "UserDataSvc_BCBAACBBBACBBBACACCCACAABACBBCCCBBCCCCBBCAABABCAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBAACBBBACBBBACACCCACAABACBBCCCBBCCCCBBCAABABCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe" start= auto displayName= "UserDataSvc_BCBAACBBBACBBBACACCCACAABACBBCCCBBCCCCBBCAABABCAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBAACBBBACBBBACACCCACAABACBBCCCBBCCCCBBCAABABCAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBAACBBBACBBBACACCCACAABACBBCCCBBCCCCBBCAABABCAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2628

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe
1⤵
- Executes dropped EXE
PID:6064

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABCCCAABABABABAACAABACBCACCCBCAACAAABACBACBBCACCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABCCCAABABABABAACAABACBCACCCBCAACAAABACBACBBCACCACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f00e07e5272a89f60467fc4f6e4131dc409cfa6d0748a1ec0ef61b10fde990d4
MD5 c846f62743de1cad028cc62206ee55bc
SHA1 37d2a657af152b5350538ae19d495b3c82f88991
SHA512 1c7e0866346bd2eac10fd529a5b21422fe7e78744787bdf4e204720bb6daab37002e70819e87a19e801727ed222344fc18dc63603f9bc911283bae8e8fb5394e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6b976f4fc9613da2967506851fc37e6675fc9e8613ac4c774a6b5f67d559567d
MD5 fbe79a9ccfbe08cb4b2033e63d8cdc02
SHA1 f00d44901256afcb341c4feb3fb288b5e534ee52
SHA512 9ee87749b456f1e27fb0c0aec543f5634b6ae6a84c5f7c409855be90c3cba77cfe67e8ee6f5243fab616c561484c9498a337e3004813c41e9e687ac955d1d91e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9c064ce04fb60bbdc71cc84edc61f62697b81c3b1c8ea485852c8320d1b454be
MD5 c384a9062000f8a9c94a7d1521aaadf8
SHA1 301ad171728fa191a4530b0e7d963a1936c2a556
SHA512 f9775bd235a907ee10f8cad114cc7165791dd327885284f489541fc4d60824d77377ea8631977b92df734048fd89c5c6fb4e15e907b98fd8147de39617da613b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7b380ecc922fddcd6c640f915a3492da739a87128ce517c16bd6f9a94254a680
MD5 011372a9c43bd2c5d84ffffb25021e1a
SHA1 fd05cc7da4769444e8987423d08088e8105aab75
SHA512 7d224d516a6baa718628c94ae0221aa3732eba0afaa8560857132d38ee730e3e437407f90a3e5a64b3220b9472e0e25cb4851b1d8e5a5a311cadf090dedd7469
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 22d3f674ebdf2c2b0057c7f86e359bae4a33fe14ab2f1183255b7c79a94356f2
MD5 64058c701917ac14381ec2cf856c0dcf
SHA1 5da4ab324ce353e4f5e55d6260748be9682bb82e
SHA512 36a74068db7b8ae832b0595120fcb827908ad8494240e6d85b3c6e908b60420fdaafd99651f2de26bc617b024fe0e7792fc52d1dd5e357946f74f7630d0f5752
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 93d3d3e48cd77342ba9ee5e8b411fdbc63bb2dd45d8afdc7cde02797ba2bd5a9
MD5 366ef7e37e955a30eb7d9af77099c1c7
SHA1 f95e65d7199c12a6d2190692ee0422776af807e2
SHA512 dfedc61218d648c469a7f17e1d5408effb61d1c08bfde4024a2eb7a4c7a61c90bcc202bff75d3d504943694ad523e6f1333c16669899a62d4aa22831e9d0e0dd
MD5 SHA1 SHA512

Submit Download

svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBCCBAACCACCCCBBBBBACBBCBCCBBCCABBAABCABCBBABABBCACA.exe
Size 24.0MB
SHA256 4c8390a38302415b0819051c06875bb45ba86e45be454db689dfb429b0ee66ee
MD5 5c26bd8be796c03bd073c6ae31dc7032
SHA1 3be97ceab90fbbd3ec29f7d11bcf6fa0f3ed13b8
SHA512 f70ba0ed3f77b3d6fda650536969e8548d53b1489dd9f8d22be2e63d8cfe9efd6c1266d4a66aaa7dba0bd0c6ded5dfa0560d5396b88d79ec15cf94a01eb8a4b4
SSDEEP 98304:oC7C7C7C7C7C7CeKjKWQckVgtev5mnlNLC:dKWQc0gEYnvLC
TLSH
T13C473A09F94340B2D92B11B14CCBD3BF8A60BA2587128EE7FB4DC75FA933BA16439155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b8a5189dd58d4582ee42ce0dc9bd1713fdb049952da256c1591be8e613c0f154
MD5 73f55adac3c980294b372be17b202351
SHA1 b3eb8963c2efb7b276a5b404ce69fb2fa0efe25a
SHA512 c00bb6a352988c46c1ef2858f31d9a39392a117d531f15122bc1981f1ea87aeb69af287a72ad248d32212f86276a9d67313ebde6df95127ecac94546541cda6d
TLSH
T1EF11AB6194E5DC13F83324CB9A2EBB564CB43A9BDC5CAE68228D411D7789C31CD154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3236-81-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/4908-6-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/5096-22-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/5096-35-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/6064-66-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download