2217369923309612083d5c81964b725d2d20a1f0549bad93d6fb6a7ac213e1ec

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_5d1946fea5d79471ed5a008a2ba7501e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 3.6MB
Sample260816-e4qxcazcmh
SHA256 2217369923309612083d5c81964b725d2d20a1f0549bad93d6fb6a7ac213e1ec
MD5 5d1946fea5d79471ed5a008a2ba7501e
SHA1 81086763ac5c464e6c4362f6a4c895d80cad8847
SHA512 c1af24579b8586e145c5ead17e1845d100d338005a430f28020ee87c89f99cd14a2d29f60600c7be3eadc7d9de8ec5572343851c830d8e858d7ce3e1eae4163f
SSDEEP 49152:U+E3qatgl5+E3qatgl5+E3qatgl5+E3qatgl5+E3qatgl5+E3qatgl5+E3qatglv:gMMMMMMMTKjKWQckVgtev5mnlNLk
TLSH
T17F069E86FA4581B3D4270272489B92F71BB0BC154F12979BB399A37E5E337C0A333695
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4568	svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe
4544	svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe
5956	svchost_AABBBACBCABBACACBBCABCCBCCBCBAABCBCACAAAAACACBBCBACBACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCABABCACBCBCABCCBBBABBBBACBACCACBAAABBBACABABCCBACBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe"	2026-08-16_5d1946fea5d79471ed5a008a2ba7501e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBCBBCBCBCACCCABAAACCBBBAABAACBABBABBAABCABCABCBCABCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBBACBCABBACACBBCABCCBCCBCBAABCBCACAAAAACACBBCBACBACA.exe"	svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5456	sc.exe
4572	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4328	cmd.exe
1020	cmd.exe
2460	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_5d1946fea5d79471ed5a008a2ba7501e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBBACBCABBACACBBCABCCBCCBCBAABCBCACAAAAACACBBCBACBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4636	2026-08-16_5d1946fea5d79471ed5a008a2ba7501e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4636	2026-08-16_5d1946fea5d79471ed5a008a2ba7501e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4636	2026-08-16_5d1946fea5d79471ed5a008a2ba7501e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4636	2026-08-16_5d1946fea5d79471ed5a008a2ba7501e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4568	svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe
4568	svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe
4568	svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe
4568	svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe
5956	svchost_AABBBACBCABBACACBBCABCCBCCBCBAABCBCACAAAAACACBBCBACBACA.exe
5956	svchost_AABBBACBCABBACACBBCABCCBCCBCBAABCBCACAAAAACACBBCBACBACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	2026-08-16_5d1946fea5d79471ed5a008a2ba7501e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4568	svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe
Token: SeDebugPrivilege	5956	svchost_AABBBACBCABBACACBBCABCCBCCBCBAABCBCACAAAAACACBBCBACBACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 1020	4636	2026-08-16_5d1946fea5d79471ed5a008a2ba7501e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	91
PID 1020 wrote to memory of 1456	1020	cmd.exe	93
PID 4636 wrote to memory of 2460	4636	2026-08-16_5d1946fea5d79471ed5a008a2ba7501e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	94
PID 2460 wrote to memory of 4572	2460	cmd.exe	96
PID 4636 wrote to memory of 4328	4636	2026-08-16_5d1946fea5d79471ed5a008a2ba7501e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	97
PID 4328 wrote to memory of 5456	4328	cmd.exe	99
PID 4568 wrote to memory of 3692	4568	svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-16_5d1946fea5d79471ed5a008a2ba7501e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_5d1946fea5d79471ed5a008a2ba7501e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACACBAACBAABBCCBCBCCBCBCACAACCCCCAAACAAAAAAAACBBABAACCCABBCACACCCACACCBCCCCABAAAABCAAABACBBBACBBAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACACBAACBAABBCCBCBCCBCBCACAACCCCCAAACAAAAAAAACBBABAACCCABBCACACCCACACCBCCCCABAAAABCAAABACBBBACBBAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACBABBBCACACBABACBBAABBABCABBAACBCBCCACBACCCBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe" start= auto displayName= "UserDataSvc_CCACBABBBCACACBABACBBAABBABCABBAACBCBCCACBACCCBCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACBABBBCACACBABACBBAABBABCABBAACBCBCCACBACCCBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe" start= auto displayName= "UserDataSvc_CCACBABBBCACACBABACBBAABBABCABBAACBCBCCACBACCCBCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACBABBBCACACBABACBBAABBABCABBAACBCBCCACBACCCBCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACBABBBCACACBABACBBAABBABCABBAACBCBCCACBACCCBCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe
1⤵
- Executes dropped EXE
PID:4544

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBACBCABBACACBBCABCCBCCBCBAABCBCACAAAAACACBBCBACBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBACBCABBACACBBCABCCBCCBCBAABCBCACAAAAACACBBCBACBACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f3dc7d10ecbbc32c73d70430f56d044d5c54dda709c85229c702d54f33800eca
MD5 2bb5950554e8955c78fd589eb0117ecc
SHA1 917bd7e2ea88c49988625b69bdff3c2264e455ad
SHA512 16c876ff724e1fdf99c04700d96febad3ffe933b768fdc23c682c300c3f70c49b562eb93f61fd9fc0349f8ea86ec39baf0070b71d4b7e69ed2167b320c4ed8f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c7ea749141ca93a59df40715ebc997404233e27bf1978e6d581fa176f32b044d
MD5 1c3da642d041fcb3cc2e8fe52609cb80
SHA1 58651d8460a304e6d30c19a31a331d27c9a56c73
SHA512 25ba3343ca10cea7be638292f3a15c6796228438cc68e6f948bd00936b23e3919ca1450f147025f74978f2bdc8eb66e7bcbe8ec122efb315cb814e9265eba393
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b39d06c06cf02041c1f5c4e26538bbfa6f77b256776c7aca68a63f39f29854ce
MD5 98fdf3b7bf31ad3ba298aa0accb5e963
SHA1 792a494e7cf43f8550400068d98bfb7df33355ea
SHA512 dcd0cef6d5f5701e3c406d162f342a9b032b0c8bd2360202fd349365016d6d355515c618e6e52efad8fc6f421bae6c8f92da95fe222e9b5fab8be0e1a332346d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dee809406fe06ac0753c150baf54f442c0fa683a06268f490a41c5fcc9292eb3
MD5 2cc1fced9711e4ccdb0e816fec3cafa3
SHA1 af13985dbbb92af0b42dce340a76698a10f3e131
SHA512 20d1548ece9a943c904b2c4414ad32003778573e337f7e1b02e3084632acc91e9c479c4838ac1c815b72010cf8b41a5a940b33ca4bcb93bfca195c7afe040dd8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e5cfad2179c23e8ef374c36fe5834ad3d490bfe8ed5f2f8c66b2229f8c4559cd
MD5 19a1a720d77f8e28c1c357653e39aeb7
SHA1 13da7a4b58a03cca143d2256b5ff913a7f444327
SHA512 1d0bf5df1ee4f1a9af522fe6f3df0fce197de60973d6f936e2397da36bf3c913963d30e8ce7d283fea0af8c7324e34ea08912f192d43c044e14ebc32109850d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 733b32ef83b8d217bca212e9876705c234abcc1b4eb2574eac5f3d0dae0ae237
MD5 91043c3715b79f0c42167868fa7a9726
SHA1 06eeef6e9271322913195cf4c7b0994036ec0888
SHA512 2458002c4e3cacf2e793cead7376a0db5fde548f03cd5f245b2489a7f7a787749962cdc5690afaa923040edca16f292b8fb6edd0f1a22bf9138b2d773eb6e267
MD5 SHA1 SHA512

Submit Download

svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABAAABCCAACBABBBCAABAABABABBABBABCBBCACBCACAABBACAA.exe
Size 3.6MB
SHA256 2217369923309612083d5c81964b725d2d20a1f0549bad93d6fb6a7ac213e1ec
MD5 5d1946fea5d79471ed5a008a2ba7501e
SHA1 81086763ac5c464e6c4362f6a4c895d80cad8847
SHA512 c1af24579b8586e145c5ead17e1845d100d338005a430f28020ee87c89f99cd14a2d29f60600c7be3eadc7d9de8ec5572343851c830d8e858d7ce3e1eae4163f
SSDEEP 49152:U+E3qatgl5+E3qatgl5+E3qatgl5+E3qatgl5+E3qatgl5+E3qatgl5+E3qatglv:gMMMMMMMTKjKWQckVgtev5mnlNLk
TLSH
T17F069E86FA4581B3D4270272489B92F71BB0BC154F12979BB399A37E5E337C0A333695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 faa0f5a50a18480e7cfa25a7ec76e88531b020ca48b7e837d3ba61f5e417bef5
MD5 213359fd2c8ab6831c5f4e2eea3e2844
SHA1 d4e04b178532a97068d22918a732122d49f2a5b0
SHA512 aa0d904f82e95aebec552eb47d575318046a20153d4fa1c779ab79b911ebbd96c31de72e0e98bccf146e530fc7f276662dc4aae0ed51eca572963fa3008c6c57
TLSH
T1CB112B21F8E5CC63EE3228CB970FDFD20CD5338B989CAA04530C4118FB89D319D69092
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4544-66-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/4568-35-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/4568-22-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/4636-6-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/5956-72-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download