d119d037d03c57ad15a5d653d47264e6045436862c6193dd965ec4e039a3c288

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_6680632b15f5c37f9cba3934f71b1eb4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 4.5MB
Sample260816-e1yssacr7w
SHA256 d119d037d03c57ad15a5d653d47264e6045436862c6193dd965ec4e039a3c288
MD5 6680632b15f5c37f9cba3934f71b1eb4
SHA1 b3d9b7b057709d4677e7c509364c6cf34075597d
SHA512 46bb3cd5c8c6b7a227a4d9150972b20107030b5f72b1505d8f719ea5337c14ff06b5359b21063ef63899c90316f57585c2012d23024ce4cb0a44d0d535a36f94
SSDEEP 49152:U+E3qatgl5+E3qatgl5+E3qatgl5+E3qatgl5+E3qatgl5+E3qatgl5+E3qatgly:gMMMMMMMtOU/jIEeQfoR/IuOFVjUu5W
TLSH
T18A266E41BA858172E47702324CAB92B65670BC654F3686DFB38C636E5F327C09733B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3612	svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe
6132	svchost_ACAAACCBBBBCBABAACABBACACAACACCCACBBCBBCABABBCBABBABABB.exe
5460	svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAACBAABACBBABCBBBCBBAACBBAACBAACCABCCAAABACBABBABCACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe"	2026-08-16_6680632b15f5c37f9cba3934f71b1eb4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAACCCCCBBAABABAACBCCAAACCBBBBBABCABBCACCCACCABABACBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAAACCBBBBCBABAACABBACACAACACCCACBBCBBCABABBCBABBABABB.exe"	svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4344	sc.exe
2560	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5584	cmd.exe
2432	cmd.exe
2136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAAACCBBBBCBABAACABBACACAACACCCACBBCBBCABABBCBABBABABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_6680632b15f5c37f9cba3934f71b1eb4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1252	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4972	2026-08-16_6680632b15f5c37f9cba3934f71b1eb4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4972	2026-08-16_6680632b15f5c37f9cba3934f71b1eb4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4972	2026-08-16_6680632b15f5c37f9cba3934f71b1eb4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4972	2026-08-16_6680632b15f5c37f9cba3934f71b1eb4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3612	svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe
3612	svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe
3612	svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe
3612	svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe
6132	svchost_ACAAACCBBBBCBABAACABBACACAACACCCACBBCBBCABABBCBABBABABB.exe
6132	svchost_ACAAACCBBBBCBABAACABBACACAACACCCACBBCBBCABABBCBABBABABB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	2026-08-16_6680632b15f5c37f9cba3934f71b1eb4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3612	svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe
Token: SeDebugPrivilege	6132	svchost_ACAAACCBBBBCBABAACABBACACAACACCCACBBCBBCABABBCBABBABABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 5584	4972	2026-08-16_6680632b15f5c37f9cba3934f71b1eb4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 5584 wrote to memory of 1252	5584	cmd.exe	94
PID 3612 wrote to memory of 2864	3612	svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe	95
PID 4972 wrote to memory of 2432	4972	2026-08-16_6680632b15f5c37f9cba3934f71b1eb4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 2432 wrote to memory of 4344	2432	cmd.exe	100
PID 4972 wrote to memory of 2136	4972	2026-08-16_6680632b15f5c37f9cba3934f71b1eb4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 2136 wrote to memory of 2560	2136	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_6680632b15f5c37f9cba3934f71b1eb4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_6680632b15f5c37f9cba3934f71b1eb4_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBBABBAAAABABBCAAAACCCABAABAABAABACCAABCCBCACACCCBBBABABBCBBCCABCACCCCBACBCBAACBCCABBACABACBCBBCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBBABBAAAABABBCAAAACCCABAABAABAABACCAABCCBCACACCCBBBABABBCBBCCABCACCCCBACBCBAACBCCABBACABACBCBBCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCABCACBBBCCCABBACBBAACBCACACAACBABBAAACACBCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe" start= auto displayName= "UserDataSvc_CBACCABCACBBBCCCABBACBBAACBCACACAACBABBAAACACBCACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACCABCACBBBCCCABBACBBAACBCACACAACBABBAAACACBCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe" start= auto displayName= "UserDataSvc_CBACCABCACBBBCCCABBACBBAACBCACACAACBABBAAACACBCACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCABCACBBBCCCABBACBBAACBCACACAACBABBAAACACBCACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACCABCACBBBCCCABBACBBAACBCACACAACBABBAAACACBCACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACCBBBBCBABAACABBACACAACACCCACBBCBBCABABBCBABBABABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAACCBBBBCBABAACABBACACAACACCCACBBCBBCABABBCBABBABABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe
1⤵
- Executes dropped EXE
PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3fbf216f004801c43fd2cfa4f90a06375e112fc057de45fbc6af973af6ab4cfc
MD5 a7ed9e0d8a04459267c6591b61cea762
SHA1 5eae00bac0bfed7f3be466c1dfb4bc9199b6124c
SHA512 e5da63f49f300fcec1b686f0f25b9f2c24d26e922f546c032e5dd5165453ea91ed46164f1e1f3b377cfce5a6a340ff1427ceb8ebb6d71acbba06fb2c9e2b1733
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 13895fca540ab8277b59ea1c2492fcd47fd3edae00d93296b3b4a5901ed73e56
MD5 74bc05470c5d869bd1fe1f222472cd5a
SHA1 aaeb46ab75122f09242a9e8426db71e1baea9574
SHA512 b649969ccd2f3a1e886f026aee068f4096be7771d4a931fd2f3747486898c7c5d74dca559283c49eec4008234ede3237ed04024a2958d7157cd7cf312bab67dd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 815d33d487cecb2a19ddbfc53e8684bb41a8db98cd6c4e2f2445a97ecebe7a54
MD5 f14f5e04a6f8288242b7a5ad911c44d5
SHA1 9b5f9fb30864ed81df8286188d26821fd6b68a09
SHA512 4e1fae77d75df6f4bbd72959f0c532b3a956a3835c398e167d4aec46c3261df37ec3555af3b1dff38914cb2bf5bbe5f32e32968fe0b73b8948a0861ecc7a0346
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bfd8afbd0357db0c0db3faccade31a4a797d1a150d67b614b3a6b5fc13f5bc51
MD5 3fbf9f1eb59cbacab2bcd74203350688
SHA1 bb9d55cfb08b38545dfdfc985dc3467a17a6b7f4
SHA512 c444b055f45608fc53dd34806509b1c95ccf36bbae3bdf365596aa5f0592adb5b7b3c331c0591dfeb26877d975e3d24ecf173796be129e1364e482b331822439
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1f8efc633a4312ae0865f3895d09db8b3169ccb6dd5df2c5ae040d6a60d301d3
MD5 24a68d249a00b63306d23bec16687141
SHA1 ae6b588a837c5f07c784789707e0a22893a7940b
SHA512 0c6f90e89b78b736ff518283d8cb6ba8fe7f473b15c41c8ed7d5bdff21b7710b0829284b2c1a120268565dc69047710fe7931ff7f05b5ead95fa44a50675c83b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 81f1c04d06c7861ce2d46bdf666180e2e580dbd438ebeb48f486aa1cd9517cef
MD5 a75af1ee28e241c9a6c6b687f5e727bd
SHA1 cec9c9c682208a391669ad27d0f86cf9016a4df9
SHA512 abd5c4de1d01c01e5b5b0d8ca92cd561320f7fa15c133e9f1a25bc004f8558c318230d69e017b1bb8fe6743c86ee775cbbd714a2121696e2839ffe5b82db74a6
MD5 SHA1 SHA512

Submit Download

svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACABCABCCCABCAAACCABAACACACAABABCCAAAAAAABBCABBAAA.exe
Size 4.5MB
SHA256 d119d037d03c57ad15a5d653d47264e6045436862c6193dd965ec4e039a3c288
MD5 6680632b15f5c37f9cba3934f71b1eb4
SHA1 b3d9b7b057709d4677e7c509364c6cf34075597d
SHA512 46bb3cd5c8c6b7a227a4d9150972b20107030b5f72b1505d8f719ea5337c14ff06b5359b21063ef63899c90316f57585c2012d23024ce4cb0a44d0d535a36f94
SSDEEP 49152:U+E3qatgl5+E3qatgl5+E3qatgl5+E3qatgl5+E3qatgl5+E3qatgl5+E3qatgly:gMMMMMMMtOU/jIEeQfoR/IuOFVjUu5W
TLSH
T18A266E41BA858172E47702324CAB92B65670BC654F3686DFB38C636E5F327C09733B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f1a9a049e6ebd7982a80fb10b6f8398dc2e219cf4e35e654892f081d8ad596e9
MD5 b9ec734d90a474a80728df4cb7c0de9c
SHA1 980500d705c935ce95cd749ab6492beba7cf9d21
SHA512 9052fad3e455f59e17fd347a6c59cb7cc8b5b826258ccbeb494ba120f71e26074c9a4e1feeb9554ee8bb51c41fa96517d0521b9cab09f5ab86300831bda0232d
TLSH
T177112B31A8E5EC17FB33B8CBA31DDFC20CBD365B585C6A4053064218A789E31CD594A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3612-34-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/3612-23-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/4972-0-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/4972-7-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/5460-81-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/6132-79-0x0000000000BC0000-0x0000000000BE1000-memory.dmp

Download