1f7aa51b3fa90222c2f0c9f00e87a99f6286a71d532868c28efa84411f7a1684

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 5.9MB
Sample260816-falafazdpc
SHA256 1f7aa51b3fa90222c2f0c9f00e87a99f6286a71d532868c28efa84411f7a1684
MD5 4bbd8d1d8d9f960c32b277539b4fd112
SHA1 3a4787bf2b0c2c5df6d58055a5c6702812813696
SHA512 91a4f9e2b0cafacc628a5af6a427ec11206b175260e736f03535120e79147ef245979e1e05e4493dbbb7edca4dc0079fbcc6ba9e575bd5bd0bce35d7d3f14a25
SSDEEP 49152:U+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+E5:vOU/jIEeQfoR/IuOFVjUu5v
TLSH
T18D563A01FAD94075F4B752705DAAC27A9530BE658B22C9EFF24C834E5B32BD09E35722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1448	svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe
4072	svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe
3668	svchost_CCCBABBAABABABABAACCCCBCACCBABBBBACACABAACACCBCABBCABCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCAABCCAACCAAACACCBBBBAABBBABACBAAAAACCAABBCCCBACACACBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe"	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AABBCAACABAAAABACAACBACACCAABBBAACABCBCACCABBCBBCACCAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBABBAABABABABAACCCCBCACCBABBBBACACABAACACCBCABBCABCB.exe"	svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2776	sc.exe
4204	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2024	cmd.exe
820	cmd.exe
3416	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBABBAABABABABAACCCCBCACCBABBBBACACABAACACCBCABBCABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3312	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4148	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4148	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4148	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4148	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
1448	svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe
1448	svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe
1448	svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe
1448	svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe
3668	svchost_CCCBABBAABABABABAACCCCBCACCBABBBBACACABAACACCBCABBCABCB.exe
3668	svchost_CCCBABBAABABABABAACCCCBCACCBABBBBACACABAACACCBCABBCABCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	1448	svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe
Token: SeDebugPrivilege	3668	svchost_CCCBABBAABABABABAACCCCBCACCBABBBBACACABAACACCBCABBCABCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3828	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 2024	4148	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	96
PID 2024 wrote to memory of 3312	2024	cmd.exe	98
PID 4148 wrote to memory of 820	4148	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	100
PID 820 wrote to memory of 2776	820	cmd.exe	102
PID 4148 wrote to memory of 3416	4148	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	103
PID 3416 wrote to memory of 4204	3416	cmd.exe	105
PID 1448 wrote to memory of 4360	1448	svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe	107
PID 4360 wrote to memory of 3524	4360	notepad.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBCACAABBACACCCAABCBCABBACBBABCCBACACBCBAAABCBACBAACCBBCAAABCCACAAACBBABCAABCBBCBAACACABCCACCBAABCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBCACAABBACACCCAABCBCABBACBBABCCBACACBCBAAABCBACBAACCBBCAAABCCACAAACBBABCAABCBBCBAACACABCCACCBAABCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAABBCCBBACBACBBBAACCBBACAACACBBBACACAABABAAAACCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe" start= auto displayName= "UserDataSvc_BAAABBCCBBACBACBBBAACCBBACAACACBBBACACAABABAAAACCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAABBCCBBACBACBBBAACCBBACAACACBBBACACAABABAAAACCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe" start= auto displayName= "UserDataSvc_BAAABBCCBBACBACBBBAACCBBACAACACBBBACACAABABAAAACCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAABBCCBBACBACBBBAACCBBACAACACBBBACACAABABAAAACCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAABBCCBBACBACBBBAACCBBACAACACBBBACACAABABAAAACCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3524

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe
1⤵
- Executes dropped EXE
PID:4072

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBAABABABABAACCCCBCACCBABBBBACACABAACACCBCABBCABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABBAABABABABAACCCCBCACCBABBBBACACABAACACCBCABBCABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 eac8eb613c1f5fa6be85117093d8eb55ad8a62f8c41f66fa122424948afc8c07
MD5 8ac2c7a878f48f262675e1a85a011ce4
SHA1 5067490b086e4a118be039505551f3abab2df771
SHA512 d02e7b85fcccf4070064383694586399c949697e1e52c75fb661fbe5706b92dee5d7be45c87280ea2e0c4577768ce1b32ee49acfade79083879ed4e16863de7f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b5851bbed69abd6850ac18a20abcc52e93aef01eada634298431decd240007ae
MD5 506f4158bce017468c7b7d7a8bb8513a
SHA1 4bc961e66bfff16e191bf6b13b631572152218dd
SHA512 a3d365d31266da640e018458f1835ab74b15bbe50794a5deb7abb62095acae42a5bb90abba1fd9cd8314dce077f4ff98179c1f9bc92f6d54990b4593dff3363a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 df05987dc18c437e0c833aab29735821886d116f5c0f7a08f9f6608b221b1643
MD5 9273a0020336562b6950882630c43858
SHA1 52aabba987fcb219bd46e260592129f330438520
SHA512 b6e7c48fee68d4d393e9ff7e4d381ed9091cc1c484a5a9a7f5f575ee4b52035e362ac26e4bd214e0b9a20455c459d15f411359922f10f6efef1bd1dddd49aa01
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e415d5e8db715644e6cfb6aee3c5b8a7c5ecf6ed56afdf37bfba070447425a49
MD5 ec0b376394758ff7cc766e9ddda6b503
SHA1 6a90390953561b54bac0e9880b85d01b8bc82ae5
SHA512 4039a0e405ee737ada37824dfb3c3bbf7e493c1c2829ca30df4f2516fe6a833b11a3479bfcb88fe58bac0ac38715ad9177ce5576bb1538be7dc90972dcf9e86d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9f305cf2945a515d9b195c313fdf24235dc64e64546c7da1ed5a69b76cc452a4
MD5 00e3f6527633b3a177cb5683de2fcf74
SHA1 41a1c6b2193b4984a0e0e365a59882da9c0c6b18
SHA512 96c440de775ac91df0e99762577d9eecf69cb7f9c92616297efb362c5eb05ddf79d2766cd2e11edbc36a2dfbd6f3816d0cff27cc41b63a13f03d5ed777028e93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5f2241447a042cfdd4ff213374b54651dbf9826f8919772d2c30ce1a68ce879f
MD5 539e4f06215a0015309612959a74f48c
SHA1 24b9fe71b6769fba4ff8721899bb9c5dcbb6f04a
SHA512 64055b8cad701a3d10f363eb9ee0b2efb29a1eff6340bad252f4c4cdc0de9d802c5278141b9646a286ccf69f1bf4476f20faf749f3896dead906e7ccb8eb9694
MD5 SHA1 SHA512

Submit Download

svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBCCBAACBABBBBBCBBCBABAACCCACCBCABBBABABCACCBAAAACAA.exe
Size 5.9MB
SHA256 1f7aa51b3fa90222c2f0c9f00e87a99f6286a71d532868c28efa84411f7a1684
MD5 4bbd8d1d8d9f960c32b277539b4fd112
SHA1 3a4787bf2b0c2c5df6d58055a5c6702812813696
SHA512 91a4f9e2b0cafacc628a5af6a427ec11206b175260e736f03535120e79147ef245979e1e05e4493dbbb7edca4dc0079fbcc6ba9e575bd5bd0bce35d7d3f14a25
SSDEEP 49152:U+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+E5:vOU/jIEeQfoR/IuOFVjUu5v
TLSH
T18D563A01FAD94075F4B752705DAAC27A9530BE658B22C9EFF24C834E5B32BD09E35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 ce0e7b4052e6777273c8dd930c032b72f712cea39e99c37e16b1977f2c6967e1
MD5 0e2e8c1df13e6797f6cc2db62f88b51a
SHA1 827b8eb60f902951731a7665d7dbd4f3bf324afc
SHA512 ccdf9b77da4029b7c51cb13095a998caf6a8553269c1a0ed01c904067875e40a785e91ea483c6f7cb1a031f8d1113f0ce70791eeadc1418a3003a6802ffcb04e
TLSH
T15E110D58ACE5D447FA3324D6D71D9F830CD9374FAC986A54230A4218E6EDD10CD454F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1448-25-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/1448-38-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/3668-91-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/4072-72-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/4148-6-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/4360-67-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Download