f2ac035bfa34fd164bc9c0183263162e5f81c7ee457d6045109624d5c921060d

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_1d49d66c16fbe74aa5738a35cc80d019_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 21.1MB
Sample260816-kc9g9stdnd
SHA256 f2ac035bfa34fd164bc9c0183263162e5f81c7ee457d6045109624d5c921060d
MD5 1d49d66c16fbe74aa5738a35cc80d019
SHA1 a3b23382ed9f71896f433e7b3794c93b01e2236b
SHA512 b69cfe64b05fc5c3915c80b05a0e57c1bd1e25cdd84065c4b64fd9d037cbe55bab33a3e88a862832df5f654be5271237490d30900c0590ce2fb786623cac9712
SSDEEP 49152:U+ES+ElyR+ES+ES+Ei+ES+Ek+ES+ES+E2+ES+ES+ElyR+ES+ES+E6wqp+ES+ElyN:pOU/jIEeQfoR/IuOFVjUu5k
TLSH
T159277C18FAD614B1E577017049A7D27A4930BE3583219AEFF6CDC62FAA33BC05835B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3236	svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe
3392	svchost_AABACCACCCBCCCACAABCBACCBCBACBCBCCACCBACBBBABCACABBABCA.exe
2004	svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABAABCCABCCCCBACACBBBBABACAABBBBCBBABBBAAAABACBBCCCACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe"	2026-08-16_1d49d66c16fbe74aa5738a35cc80d019_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCCABBCBBAAACBAACCBABCBBACCBAACAACABAAABABBAABBACACBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABACCACCCBCCCACAABCBACCBCBACBCBCCACCBACBBBABCACABBABCA.exe"	svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4980	sc.exe
1972	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6108	cmd.exe
3908	cmd.exe
4860	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_1d49d66c16fbe74aa5738a35cc80d019_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABACCACCCBCCCACAABCBACCBCBACBCBCCACCBACBBBABCACABBABCA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2528	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2508	2026-08-16_1d49d66c16fbe74aa5738a35cc80d019_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2508	2026-08-16_1d49d66c16fbe74aa5738a35cc80d019_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2508	2026-08-16_1d49d66c16fbe74aa5738a35cc80d019_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2508	2026-08-16_1d49d66c16fbe74aa5738a35cc80d019_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3236	svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe
3236	svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe
3236	svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe
3236	svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe
3392	svchost_AABACCACCCBCCCACAABCBACCBCBACBCBCCACCBACBBBABCACABBABCA.exe
3392	svchost_AABACCACCCBCCCACAABCBACCBCBACBCBCCACCBACBBBABCACABBABCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	2026-08-16_1d49d66c16fbe74aa5738a35cc80d019_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3236	svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe
Token: SeDebugPrivilege	3392	svchost_AABACCACCCBCCCACAABCBACCBCBACBCBCCACCBACBBBABCACABBABCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 6108	2508	2026-08-16_1d49d66c16fbe74aa5738a35cc80d019_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 6108 wrote to memory of 2528	6108	cmd.exe	94
PID 3236 wrote to memory of 6116	3236	svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe	95
PID 2508 wrote to memory of 3908	2508	2026-08-16_1d49d66c16fbe74aa5738a35cc80d019_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 3908 wrote to memory of 4980	3908	cmd.exe	100
PID 2508 wrote to memory of 4860	2508	2026-08-16_1d49d66c16fbe74aa5738a35cc80d019_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 4860 wrote to memory of 1972	4860	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_1d49d66c16fbe74aa5738a35cc80d019_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_1d49d66c16fbe74aa5738a35cc80d019_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCCABCCCACAABCBAAABBABACACBACCBCABCBCAACABBBBCCBBAAABABBABBACCCBAAABBACCCCCCBBBCCBCBBABCCBCBBCCBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCCABCCCACAABCBAAABBABACACBACCBCABCBCAACABBBBCCBBAAABABBABBACCCBAAABBACCCCCCBBBCCBCBBABCCBCBBCCBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBCCCAACBBACCCAACCBCCBBCCABABBBCBACBBBCBCACACCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe" start= auto displayName= "UserDataSvc_ACBBCCCAACBBACCCAACCBCCBBCCABABBBCBACBBBCBCACACCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBCCCAACBBACCCAACCBCCBBCCABABBBCBACBBBCBCACACCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe" start= auto displayName= "UserDataSvc_ACBBCCCAACBBACCCAACCBCCBBCCABABBBCBACBBBCBCACACCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBCCCAACBBACCCAACCBCCBBCCABABBBCBACBBBCBCACACCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBBCCCAACBBACCCAACCBCCBBCCABABBBCBACBBBCBCACACCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6116

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCACCCBCCCACAABCBACCBCBACBCBCCACCBACBBBABCACABBABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCACCCBCCCACAABCBACCBCBACBCBCCACCBACBBBABCACABBABCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe
1⤵
- Executes dropped EXE
PID:2004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 527519c52c098469140a5be75db9e89779df3c454f68d82b1064bf4d0011ebdc
MD5 69a4b0cebbac054c34c4469484b70bb7
SHA1 3c1d6255b1c15125d108ac997e7e19e5e70c9ce3
SHA512 901073cfb770bdd77188777fa40c8dd41abf9491a9c02de4bace3bea1e18eaa3ed9c8e210b7055de03034642bc723383c177be79097cdf05cedd7bcf0140441c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6cdf154e1d28408d81f0868290db02c4a2d541abec37dc3c2f0581f7879bfa88
MD5 8e03505f24e50318fb325db15414d4b4
SHA1 5781962aff17289610d3f62cbcc55fc71cd542f0
SHA512 ee25c8367604576466f4c842ee8eee1f449312961417bfeda740aaf38beba1d099a95b4b227c590297c15e7552d6522f9200a92bd5de6352d4f37185f78da52a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cd17269b4187c6cf5059c790708c2685bde7a48476092db03b674a46024f17c2
MD5 44aab9814162873ee1286e9e5bcc67bc
SHA1 b9fbe8c658fe5cedf1a565fa004d087b6178f91b
SHA512 e0d2bd1b1e616cf0dcae21dbba5c58729d9e77d90a6898a86eee53c3a0d855a41551f0c522e4481bc9cdc4a951cd399f173a54376a007dd52b1855b77f8246a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 530211eed44b6c665e00c870f8c098f6d5ae13c8fc60097ac86c125cf6a6268a
MD5 f19cf84138c5fdfb57bdc41c1631b676
SHA1 f67f3320a08263b58158efa4f558d2ffb4266afa
SHA512 7937e0f4d366141b3d4f52a7b597da166445dccda78d1a391c8a75d782f0917794959f61d089ba7405e78611469a48b0a32fb62236856d088440608ee8005479
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 764bdbcb80937c4f5ffa678c0bb69ec77996848e87b1ee35bc78c08644fad8f7
MD5 4d766718dd4befc655853b08e0b2b87f
SHA1 643e7801ab5fb19a522e000a920d404cc8e36847
SHA512 fe57fef25a6a81d8def9ff89e545532b0b531953d1856e80a73ec5687eb3833985a8fa886ace7a6d287c288e6035889bf4393a6482fb64fd8770f222010a958a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 217261b996fbcf7a08a884d2ba02bb0c2a2b0b7da6a7bd7a08ac6cebe1f8863f
MD5 f5b6f4e72225c508b8997b725af2402f
SHA1 255d7da7960595cfb502b34b571df93c894374e5
SHA512 d4d8c9710e5c56b315f5d1ec950c06d7a13728dc76d96652425fa4724f241514ecb50969000ee8792d20325ae4b0ef68315c998ba61fc9a80f19f490beca97d9
MD5 SHA1 SHA512

Submit Download

svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACAABCAABBACBBACAABABBAABCBBAAABBABBBCBCBABBAACBBCCA.exe
Size 21.1MB
SHA256 f2ac035bfa34fd164bc9c0183263162e5f81c7ee457d6045109624d5c921060d
MD5 1d49d66c16fbe74aa5738a35cc80d019
SHA1 a3b23382ed9f71896f433e7b3794c93b01e2236b
SHA512 b69cfe64b05fc5c3915c80b05a0e57c1bd1e25cdd84065c4b64fd9d037cbe55bab33a3e88a862832df5f654be5271237490d30900c0590ce2fb786623cac9712
SSDEEP 49152:U+ES+ElyR+ES+ES+Ei+ES+Ek+ES+ES+E2+ES+ES+ElyR+ES+ES+E6wqp+ES+ElyN:pOU/jIEeQfoR/IuOFVjUu5k
TLSH
T159277C18FAD614B1E577017049A7D27A4930BE3583219AEFF6CDC62FAA33BC05835B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6d62ca629bfbe48bb21f7a1fe706768478fdba24e1113e942254bb5e6e61a57a
MD5 b98bc6e6b4e03e194843a162150b4a06
SHA1 d8e36b77fafb89f564430424607fc14bc128590c
SHA512 a8d1ac9d68e8288454bd2c715d5e1ca1a24d0fd89408987aa99b9f037f00177d7428256e00b0e1ddc64939c4c299cc92a055d9a3337280515dcab41fd51b8575
TLSH
T18111C161E4E5D8B3EC32288F621D8ED308A6778B689CAF14630D5118F7A9C758E210E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2508-0-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/2508-8-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/3236-34-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/3392-74-0x0000000000520000-0x0000000000541000-memory.dmp

Download