70e7267b0b92b6994068c417db1bf523de0696d750bbaf57a9df3a96b56db44b

Analysis

max time kernel
149s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_38b74c395331fb3e2b84bf601bc3857c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 7.0MB
Sample260815-esslssydrb
SHA256 70e7267b0b92b6994068c417db1bf523de0696d750bbaf57a9df3a96b56db44b
MD5 38b74c395331fb3e2b84bf601bc3857c
SHA1 6efeefc1db337ba48f5d55eb1ce851aa66de9aa4
SHA512 4b398db1ce6fee7a99483d3796593993aa64a64a82041d221d3bfc023375d1de085c0e22cae74bee265ee334fbf099f84ac45b2e16b1095f6e411aa3f1f92f30
SSDEEP 49152:U+EPiw27P+EPiw27P+EPiw27P+EPiw27P+EPiw27P+EPiw27P+EPiw27P+EPiw28:6OU/jIEeQfoR/IuOFVjUu5C
TLSH
T1F7764A0977ED5461F5B3623089B682259AB2BC614B31C6DF72C8923D4F73AD0AD34F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
52	svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe
4296	svchost_ABACBAABBABABBCACAABCACCACBCABBCBCCCAACCAACABBCABABBBAB.exe
2788	svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACCBBAABABBCBBBABCBBAABBCCAABABBCCABABBABACAACCCCAAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACBAABBABABBCACAABCACCACBCABBCBCCCAACCAACABBCABABBBAB.exe"	svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCAABCCABCCCBAACBBABBBBABACBBACABCAABCAABCABCCABAABABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe"	2026-08-15_38b74c395331fb3e2b84bf601bc3857c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4848	sc.exe
2372	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5828	cmd.exe
1872	cmd.exe
1972	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACBAABBABABBCACAABCACCACBCABBCBCCCAACCAACABBCABABBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_38b74c395331fb3e2b84bf601bc3857c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5356	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6092	2026-08-15_38b74c395331fb3e2b84bf601bc3857c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6092	2026-08-15_38b74c395331fb3e2b84bf601bc3857c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6092	2026-08-15_38b74c395331fb3e2b84bf601bc3857c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6092	2026-08-15_38b74c395331fb3e2b84bf601bc3857c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
52	svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe
52	svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe
52	svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe
52	svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe
4296	svchost_ABACBAABBABABBCACAABCACCACBCABBCBCCCAACCAACABBCABABBBAB.exe
4296	svchost_ABACBAABBABABBCACAABCACCACBCABBCBCCCAACCAACABBCABABBBAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6092	2026-08-15_38b74c395331fb3e2b84bf601bc3857c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	52	svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe
Token: SeDebugPrivilege	4296	svchost_ABACBAABBABABBCACAABCACCACBCABBCBCCCAACCAACABBCABABBBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6092 wrote to memory of 5828	6092	2026-08-15_38b74c395331fb3e2b84bf601bc3857c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 5828 wrote to memory of 5356	5828	cmd.exe	94
PID 52 wrote to memory of 3052	52	svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe	95
PID 6092 wrote to memory of 1872	6092	2026-08-15_38b74c395331fb3e2b84bf601bc3857c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 1872 wrote to memory of 4848	1872	cmd.exe	100
PID 6092 wrote to memory of 1972	6092	2026-08-15_38b74c395331fb3e2b84bf601bc3857c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 1972 wrote to memory of 2372	1972	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_38b74c395331fb3e2b84bf601bc3857c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_38b74c395331fb3e2b84bf601bc3857c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCAABBCBCBCCCBACAABCACBCABBBACBCCACCAAABBCCAABCCCCABABCCCABABACCACBCACCCAABBCACAABACBCCABABACBCCCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCAABBCBCBCCCBACAABCACBCABBBACBCCACCAAABBCCAABCCCCABABCCCABABACCACBCACCCAABBCACAABACBCCABABACBCCCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCCCAABBBBBAACCBAABBBCCABABBBBCBBACBCACACABABBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe" start= auto displayName= "UserDataSvc_CBBCCCAABBBBBAACCBAABBBCCABABBBBCBBACBCACACABABBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCCCAABBBBBAACCBAABBBCCABABBBBCBBACBCACACABABBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe" start= auto displayName= "UserDataSvc_CBBCCCAABBBBBAACCBAABBBCCABABBBBCBBACBCACACABABBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCCCAABBBBBAACCBAABBBCCABABBBBCBBACBCACACABABBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCCCAABBBBBAACCBAABBBCCABABBBBCBBACBCACACABABBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2372

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:52
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBAABBABABBCACAABCACCACBCABBCBCCCAACCAACABBCABABBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBAABBABABBCACAABCACCACBCABBCBCCCAACCAACABBCABABBBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe
1⤵
- Executes dropped EXE
PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 481e81f842cc750bf6b73bf794fd6e9291a15d9c1484d0957aa7fa00073cd761
MD5 de6c1f1a3270c4c5f70921ad9252f7d0
SHA1 5305c508e025f05b2883b7e14369373b5a740e32
SHA512 906ebc2114d474005d84cc9739f254ec0166e524ad98d7caaa94dc0f938b8a09f75a93989e109e5b45157d6b9225df432128997ac4bef4822610b3a83cb9ac5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b37e8d4cd1f8117619d66668c9045c08fbefcae30cb852b303a1da1411c7b0cf
MD5 613d9b59a7550ded84d742d3b4647aa7
SHA1 b95dd4d9ab7f7f6671a0b951899653778004d886
SHA512 33e8d8ea8b3ca88952b3194706f9b2e163d61ec7724dce34cce50389cdb08cfad135a461ac4058fb103773d49f5caa4aa47ed6e04ed27ce980f0c2e39b951c61
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f94a943e95ae526ed87d031dce2628e97c8c57023e03e984c10fa4f97108dd30
MD5 c0858f8e2e1304d2ca438723d1b3186a
SHA1 fe17858ab147c16ba656e8dcd1ebeabe6b40c34d
SHA512 de6f56770f268fbff2d07e871d3ba1d0dde1f9849df1316432174c2978b5a25988fd4c6fac24ad701dcbc3482a3139620cafcd985cf9501a49a862c4ffd38bb5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7bcd2c50b2938fa23437ea8e6914e3a8de5ea893d3bd249b0e9a92d4a4d278ea
MD5 011606e8df05ead8708a52ddbb3d586a
SHA1 c167efb0542e637a3476ad321d3a01739c5074de
SHA512 1596c3644a3306bbbc5e680a943a4fc6090478feab08f1aca15db15a6819c251204b0247fbc2d2c21820eeda9071b2dc552d6441eb960147b116246142854b85
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1131d9244c324438672f44345aac0d7447924ffe8865850534866c2dd2c0b7dd
MD5 f1a4f60de204e58384d3a98921d9f992
SHA1 0d328e63053a034ecab7ba377141a36a622aa922
SHA512 0a9c789172ea89a54669496a75d8d8dbe61dfe9d97bbe58f624ea887d4ac1dc1a0dc91349d19650bfbb288a8c21343ad3af4bcd5eb21360e3617fa15a1f895aa
MD5 SHA1 SHA512

Submit Download

svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABAABABBBCBCCBABCACCCBCBBACACCCBBBBBABBCABAAACBBCBC.exe
Size 7.0MB
SHA256 70e7267b0b92b6994068c417db1bf523de0696d750bbaf57a9df3a96b56db44b
MD5 38b74c395331fb3e2b84bf601bc3857c
SHA1 6efeefc1db337ba48f5d55eb1ce851aa66de9aa4
SHA512 4b398db1ce6fee7a99483d3796593993aa64a64a82041d221d3bfc023375d1de085c0e22cae74bee265ee334fbf099f84ac45b2e16b1095f6e411aa3f1f92f30
SSDEEP 49152:U+EPiw27P+EPiw27P+EPiw27P+EPiw27P+EPiw27P+EPiw27P+EPiw27P+EPiw28:6OU/jIEeQfoR/IuOFVjUu5C
TLSH
T1F7764A0977ED5461F5B3623089B682259AB2BC614B31C6DF72C8923D4F73AD0AD34F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b6819c187409472414d1ee8556a0f036e8c35b0924ca8cdaec5b77589e9d0a71
MD5 fa38c4f7da4862bdbc956a8f3d66a3c2
SHA1 b1439543a8d8bf00ac00cd30d1c30f0da6eecb9e
SHA512 adbcc34576bde35bb049b679d973220885e5cb543e1f6537594c1da7707136f01c7b8747161316e1239c7fed70891ad2f0d89b23e78ea9bbe7f067fdabdeb9c5
TLSH
T116112B52E8E6CC23FC31A8CB5E198BD209F43ADB9C6C6E0422464718AB89D71CE554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/52-23-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/52-33-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/4296-79-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/6092-0-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/6092-7-0x0000000000700000-0x0000000000721000-memory.dmp

Download