113a9530a00919fb2f259a634f456cb0a3dbee721271e026351fd67ce8bf2a30

Analysis

max time kernel
151s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_2c3315b5569bc5db1bb6137de6fe2911_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 24.9MB
Sample260817-qs1sysck91
SHA256 113a9530a00919fb2f259a634f456cb0a3dbee721271e026351fd67ce8bf2a30
MD5 2c3315b5569bc5db1bb6137de6fe2911
SHA1 827f05a0e839cd3931ae274437aca8190005d483
SHA512 fa52da2c36e1a27b39a5235329afcbc136fc0d83f3fb372e0b32f0dcda50928a7cbb7b1f12d080de8259217ce8c1e202a0be905f125e85ab54927922c20ba36f
SSDEEP 98304:Lxwxw4xwxw4xwxw4xwxw4xwxw4xwxw4xwxw2KjKWQckVgtev5mnlNLf:pKWQc0gEYnvLf
TLSH
T1CE475B45FA4380B2D82B01714CCBD3BB4B70BA158F129AEBF74D876EAA337D06635255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2736	svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe
1552	svchost_BCABCACABABCCCACBAABBACBBBCBCBCABCCAABBCAAAABABCBAACAAC.exe
4380	svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCCBCABBBBAACBCBACABCCAABACCAABAAABBBBCAABAACABCABABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe"	2026-08-17_2c3315b5569bc5db1bb6137de6fe2911_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABAABACCBABBABACBBBBCBABCBACCBBAAAABBBBCCABBCBBCBACAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCACABABCCCACBAABBACBBBCBCBCABCCAABBCAAAABABCBAACAAC.exe"	svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1932	sc.exe
3856	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2172	cmd.exe
772	cmd.exe
4876	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABCACABABCCCACBAABBACBBBCBCBCABCCAABBCAAAABABCBAACAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_2c3315b5569bc5db1bb6137de6fe2911_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3964	2026-08-17_2c3315b5569bc5db1bb6137de6fe2911_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3964	2026-08-17_2c3315b5569bc5db1bb6137de6fe2911_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3964	2026-08-17_2c3315b5569bc5db1bb6137de6fe2911_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3964	2026-08-17_2c3315b5569bc5db1bb6137de6fe2911_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2736	svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe
2736	svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe
2736	svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe
2736	svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe
1552	svchost_BCABCACABABCCCACBAABBACBBBCBCBCABCCAABBCAAAABABCBAACAAC.exe
1552	svchost_BCABCACABABCCCACBAABBACBBBCBCBCABCCAABBCAAAABABCBAACAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3964	2026-08-17_2c3315b5569bc5db1bb6137de6fe2911_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	2736	svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe
Token: SeDebugPrivilege	1552	svchost_BCABCACABABCCCACBAABBACBBBCBCBCABCCAABBCAAAABABCBAACAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 2172	3964	2026-08-17_2c3315b5569bc5db1bb6137de6fe2911_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	92
PID 2172 wrote to memory of 1352	2172	cmd.exe	94
PID 2736 wrote to memory of 5780	2736	svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe	95
PID 3964 wrote to memory of 772	3964	2026-08-17_2c3315b5569bc5db1bb6137de6fe2911_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	98
PID 772 wrote to memory of 1932	772	cmd.exe	100
PID 3964 wrote to memory of 4876	3964	2026-08-17_2c3315b5569bc5db1bb6137de6fe2911_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	101
PID 4876 wrote to memory of 3856	4876	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-17_2c3315b5569bc5db1bb6137de6fe2911_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_2c3315b5569bc5db1bb6137de6fe2911_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCBBBABCCABACCAACBCACCCCBCCBACACCCACAAABBCCAACABBCBBAABCBBABABABBBBCCBAACACCBAAACAACACABABACCACACACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCBBBABCCABACCAACBCACCCCBCCBACACCCACAAABBCCAACABBCBBAABCBBABABABBBBCCBAACACCBAAACAACACABABACCACACACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACBCACCCBABACCAACAACABABCACBBAAABBCCCCBAAABCBBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe" start= auto displayName= "UserDataSvc_CBACBCACCCBABACCAACAACABABCACBBAAABBCCCCBAAABCBBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACBCACCCBABACCAACAACABABCACBBAAABBCCCCBAAABCBBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe" start= auto displayName= "UserDataSvc_CBACBCACCCBABACCAACAACABABCACBBAAABBCCCCBAAABCBBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACBCACCCBABACCAACAACABABCACBBAAABBCCCCBAAABCBBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACBCACCCBABACCAACAACABABCACBBAAABBCCCCBAAABCBBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCACABABCCCACBAABBACBBBCBCBCABCCAABBCAAAABABCBAACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCACABABCCCACBAABBACBBBCBCBCABCCAABBCAAAABABCBAACAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe
1⤵
- Executes dropped EXE
PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d4e44135e96e08ff76b38e060d69a44115aef0d5a03fb98cce147544521592cd
MD5 b79f741f5bd077bf1dee68e3e3e44e55
SHA1 f3aa1edf5a34dbf82b03920a68f28177d13c85fc
SHA512 db557e4531365d27527b924c3b14be69cf88222f82a75902f7a030ac80cf031e83af6263fb8ea9b5ec412ab952bbbe8e79cb6dc98bfff29728eb5c6042ad8831
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d507f98ae86a35e7683f1e4ca6cd0ddf75585837e5b82e5da9143be0660f6ecb
MD5 427de66b528027d78dad82585ed72c72
SHA1 28d48c559396f8ec1dd5aa6fbd7275c789719792
SHA512 0ffc89899097b87e350bfcf43a4f1e4029274fb1d007e96ceb11c72276124384eb19d98bb52021e06899a318e59eb2b765461d1427e13c2fd868c040a34dad74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8bde4eb52b78427cac99041cd23972d2610aade753e4c64e5a99aa5e5d2a4d13
MD5 87aba04c9bacc14c71ec37872ffca6f4
SHA1 1bd3d794c219cb29e9b6a0b0440d55b2b33a84df
SHA512 08df38498409c14abe1ad72c8b95d6e244fe46a0d9eb605de2cef82ddbd7be3a0a799cd35df8e062e993021c84bca23e27b9dc0cf3e070babdaf63f4b957658d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b16dd10a1a11674a52a2c24c7998197aaccee8bc5b176756fee002f9f1326de8
MD5 17b1efea548af955d1aa76c1d99776aa
SHA1 f6acbad1d23a34939869e3f2a56ae14204fe7e23
SHA512 45429dcf7bd4edd05e5acef3c06465cf6cbaef688ea2098c9964ad82e0a6c176531057e86b9e0ff6a926c0ab0eecccb73676dd7693163d0e3d3492d66670c550
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 de1d02b356e8b709cccb16282bfcb5005c02e1416d93e395d7f3550f4245ba6f
MD5 228fa51c63f077e07356893d41fb177c
SHA1 3c745d536994a40aedb285dbef6657b1b5a1e128
SHA512 97f508655b95ca6a5d36ce08bd0b0bede189b6f65291e6cb486a021dbe1731f4cdff9fb950b99caf7e39c8724ebce6d5de51bfc66d6574033b4fb14054ee3349
MD5 SHA1 SHA512

Submit Download

svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCCBBBBBABACCABABBBCBBABCBBAACAABCCABBACBCCACCACBAC.exe
Size 24.9MB
SHA256 113a9530a00919fb2f259a634f456cb0a3dbee721271e026351fd67ce8bf2a30
MD5 2c3315b5569bc5db1bb6137de6fe2911
SHA1 827f05a0e839cd3931ae274437aca8190005d483
SHA512 fa52da2c36e1a27b39a5235329afcbc136fc0d83f3fb372e0b32f0dcda50928a7cbb7b1f12d080de8259217ce8c1e202a0be905f125e85ab54927922c20ba36f
SSDEEP 98304:Lxwxw4xwxw4xwxw4xwxw4xwxw4xwxw4xwxw2KjKWQckVgtev5mnlNLf:pKWQc0gEYnvLf
TLSH
T1CE475B45FA4380B2D82B01714CCBD3BB4B70BA158F129AEBF74D876EAA337D06635255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e8af5796b42ad484127f219e6c4c4d8c226373c967d9d28b2ff42fd245f98726
MD5 21f9b1aa8843b46f3c69c0a77704721c
SHA1 dd30e2b185d85babf397ae87ab6f9a76e4139470
SHA512 3c11e32aed5052ed257b2fa6822d1a80c0a830b36e58e79d7909049e787821bc9e38e99b96c26179f103b33458d86399f2df6249ca01dd6afa9754fea8cf9b3e
TLSH
T12A117190B4A6CC63EC32344E5A2FCBD20CE0337F9E9CEA041309811D6A96C31CD144D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1552-82-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download

memory/2736-42-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/2736-60-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/2736-80-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/3964-12-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/3964-23-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/3964-43-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/3964-61-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/3964-0-0x0000000000510000-0x0000000000531000-memory.dmp

Download