6a2c49d1fd210527879acae5d04450bea6f9b234ad6eefde41e8205cb12d2eea

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_3598135b53ed4c4b7472242ee22f1d49_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.3MB
Sample260816-ff72dsdl3v
SHA256 6a2c49d1fd210527879acae5d04450bea6f9b234ad6eefde41e8205cb12d2eea
MD5 3598135b53ed4c4b7472242ee22f1d49
SHA1 ea37439e62f0e31ea0dddc244985e6271b3ed0a6
SHA512 6476164608b5126dfd53a12ab756d7ef3cba6b1e1940862cc84b5bfeac30c7377df217c5a915e4c9be401019fd3d4d0b139eaa87f9f299d0fd7d6b856887ab76
SSDEEP 49152:U+ESR+ESR+ESR+ESR+ESR+ESR+ESR+ESR+ES8OU/zXNUfEeXAxhF2rl/IuOryOvH:EOU/jIEeQfoR/IuOFVjUu5L
TLSH
T147F58D01F9C28072E47711714CEAD3BE4A70BA6587328DEBF78C461F9B31AD18935B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2092	svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe
2404	svchost_AABCCBBACBACAABBBBABCCAACACBACBBCAACACBAAACCBBBCBBCABCA.exe
4616	svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBACAABACCBBBCBBABBABAABCCACACBACACBBBBCACAABCABCBABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe"	2026-08-16_3598135b53ed4c4b7472242ee22f1d49_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACCAACBCCAACCAAACBCAACAACCCBCAACCAAABAACCAAABBCCBBBBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCCBBACBACAABBBBABCCAACACBACBBCAACACBAAACCBBBCBBCABCA.exe"	svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3224	sc.exe
5668	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2588	cmd.exe
3568	cmd.exe
1080	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCCBBACBACAABBBBABCCAACACBACBBCAACACBAAACCBBBCBBCABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_3598135b53ed4c4b7472242ee22f1d49_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2972	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4544	2026-08-16_3598135b53ed4c4b7472242ee22f1d49_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4544	2026-08-16_3598135b53ed4c4b7472242ee22f1d49_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4544	2026-08-16_3598135b53ed4c4b7472242ee22f1d49_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4544	2026-08-16_3598135b53ed4c4b7472242ee22f1d49_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2092	svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe
2092	svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe
2092	svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe
2092	svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe
2404	svchost_AABCCBBACBACAABBBBABCCAACACBACBBCAACACBAAACCBBBCBBCABCA.exe
2404	svchost_AABCCBBACBACAABBBBABCCAACACBACBBCAACACBAAACCBBBCBBCABCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	2026-08-16_3598135b53ed4c4b7472242ee22f1d49_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2092	svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe
Token: SeDebugPrivilege	2404	svchost_AABCCBBACBACAABBBBABCCAACACBACBBCAACACBAAACCBBBCBBCABCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 2588	4544	2026-08-16_3598135b53ed4c4b7472242ee22f1d49_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 2588 wrote to memory of 2972	2588	cmd.exe	93
PID 2092 wrote to memory of 4720	2092	svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe	94
PID 4544 wrote to memory of 3568	4544	2026-08-16_3598135b53ed4c4b7472242ee22f1d49_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	97
PID 3568 wrote to memory of 3224	3568	cmd.exe	99
PID 4544 wrote to memory of 1080	4544	2026-08-16_3598135b53ed4c4b7472242ee22f1d49_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	100
PID 1080 wrote to memory of 5668	1080	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-16_3598135b53ed4c4b7472242ee22f1d49_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_3598135b53ed4c4b7472242ee22f1d49_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCACAABABBACCCBBBCBBCACCAACAABBCCCCBACAAACBBACBCBBCACCCACCBCABBAAAAACCBBACCABBCBCBCCCBCBBBACBBCCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCACAABABBACCCBBBCBBCACCAACAABBCCCCBACAAACBBACBCBBCACCCACCBCABBAAAAACCBBACCABBCBCBCCCBCBBBACBBCCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCACBCCCBBABABAAAABBBBBCBCBCBCBACBBACCACCCACCACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe" start= auto displayName= "UserDataSvc_ABCCACBCCCBBABABAAAABBBBBCBCBCBCBACBBACCACCCACCACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCACBCCCBBABABAAAABBBBBCBCBCBCBACBBACCACCCACCACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe" start= auto displayName= "UserDataSvc_ABCCACBCCCBBABABAAAABBBBBCBCBCBCBACBBACCACCCACCACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCACBCCCBBABABAAAABBBBBCBCBCBCBACBBACCACCCACCACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCACBCCCBBABABAAAABBBBBCBCBCBCBACBBACCACCCACCACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBACBACAABBBBABCCAACACBACBBCAACACBAAACCBBBCBBCABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBACBACAABBBBABCCAACACBACBBCAACACBAAACCBBBCBBCABCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe
1⤵
- Executes dropped EXE
PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 23c99c82da19520aca64601db98d5415f5373f5a836fb3e4d915309631959379
MD5 4a7b32de179f88b9bb3beb31c5a6883d
SHA1 f18ddc863e45a5f8d9c5731ec82c26b023dc8f85
SHA512 5e65d952a2012a0858f26edf1a89aa7cf9a55776373f130af3f9133e7cda7c74cbc87401e029cbb920ed13c33edaeb776207443afea7e5216380f08511a759b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 459f0b144d3b2c5614bd43711420314c1742ea2e61668960800332485d95a055
MD5 b6669e761b9b39cfa2b879480658bf82
SHA1 9d60504ff158e2c901df934daced901860dacb34
SHA512 ef62fcb502a978056db534f3888155736b3ac46b410c8cbd73d08ce3aeadf9479a0e0b8a4002b82261b05ab3758799d908eb97a23514b58be0056092f187565f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 17c45ce3fe2ad1dac91afb1468238e2009c9b17ec09e6259ba990ecfc0e3f201
MD5 e54a52f903af89168e9417098425f87f
SHA1 61b1979e2767caf582ec11714ffcd7901a5b5cd0
SHA512 85a247be20b27409983b74f3db840457daccfcb95f5f44137f536f1b8972914ab74d5515fbc3c7128c7a9d55f42e8c3ccef7b75e455119ff21cdaf66b95498a7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1110bd907dd5b2cceed0cb5c1fdbb16b8b3df22551315c12a6bc7c199a7879a9
MD5 290796ae5bde75ec69dadc771474bf2a
SHA1 078ea922e813e692653c31b8e72256297fde1e6e
SHA512 4aa586667246d3597b671cbd92cef3306d4754e7083ca65873716c2c823cde28b68c71dead345cb6d4b19cb0863b377592ba2c38581ea28a871b595643645512
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b00530cacb658664ff3a4a3f6609987c15c1276026389cb2090b64d38dcaeeb8
MD5 32257af0039f5dee31e38d8edf4f26b3
SHA1 1866817ec584af86b9253d647764047317cfc924
SHA512 125e18b50dd37ccfe313b6d924df5580f0b83ca7ca7fdc054781797c691b9fc76ebe311f795a7e74d28801a7b2224aff8a5d8da40fee01d62375493cd9bc0bcb
MD5 SHA1 SHA512

Submit Download

svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABCBBABBBBBACCACCBCAACCCACCCBCCBACBACCACACBACBBBA.exe
Size 3.3MB
SHA256 6a2c49d1fd210527879acae5d04450bea6f9b234ad6eefde41e8205cb12d2eea
MD5 3598135b53ed4c4b7472242ee22f1d49
SHA1 ea37439e62f0e31ea0dddc244985e6271b3ed0a6
SHA512 6476164608b5126dfd53a12ab756d7ef3cba6b1e1940862cc84b5bfeac30c7377df217c5a915e4c9be401019fd3d4d0b139eaa87f9f299d0fd7d6b856887ab76
SSDEEP 49152:U+ESR+ESR+ESR+ESR+ESR+ESR+ESR+ESR+ES8OU/zXNUfEeXAxhF2rl/IuOryOvH:EOU/jIEeQfoR/IuOFVjUu5L
TLSH
T147F58D01F9C28072E47711714CEAD3BE4A70BA6587328DEBF78C461F9B31AD18935B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a1cf97586bd03c6f7a962e2110711c563ca63090655386ea83c8b03ab431056d
MD5 0997dd662b5463326af6900fdf9f2915
SHA1 7298c9c5c08486bf02816a07ac02de1fc44a4c63
SHA512 d7c7a7bbf6cbda27dce7aa2ea15fc96e3cdfc256761b58840d8fa8b811b288d14a8cbcf7fb0eae1d134844b76579ec4e31be6f3555a07c35516d48ee5df9fa8e
TLSH
T1EC11C456D8E59C57EE3368CB532DEFC20CA5379BEC1C6A14138C811CBB55D310E654A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2092-24-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/2092-34-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/2404-79-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/4544-0-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/4544-8-0x00000000007E0000-0x0000000000801000-memory.dmp

Download