cf12e509e71d7a68830ab30046833c1e944ace560537254270fcf8ebcea69dba

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_f9f5334f8bec43e4ed4ef09d980a5eb3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 35.9MB
Sample260818-b4ebrstdpe
SHA256 cf12e509e71d7a68830ab30046833c1e944ace560537254270fcf8ebcea69dba
MD5 f9f5334f8bec43e4ed4ef09d980a5eb3
SHA1 4d368c0636b2b50035961e8a482c517f26f14000
SHA512 fb90b70ea50be1fe270738300e1df2645a340fedbc870129b05f59a863e17cd25a936439379514a6c6d4a5b85b1ff7da84df0fd4ea1f3f49dffdb78954f4df14
SSDEEP 786432:C5H5a5H5T5H5a5H5T5H5a5H5T5H5a5H5T5H5a5H5T5H5a5H59EIvS:8S
TLSH
T125872B09FA874071E97751B04CDBD3BF4E307A2187228EEFE609D71E6932AE0A439755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
556	svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe
5088	svchost_BBBABACBBBABBCBBBAAACBBBABABAABCCCCABACBCCACBBBABBCCABB.exe
5008	svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBAABCCABCAACAACBBCBABCCBCCABBBABBBAACACAAABCACBBCCCCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe"	2026-08-18_f9f5334f8bec43e4ed4ef09d980a5eb3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCCAABCBAACBCBBBBACCBACCCCAAACCBAABACCCBCBCACBBBCBCAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBABACBBBABBCBBBAAACBBBABABAABCCCCABACBCCACBBBABBCCABB.exe"	svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4684	sc.exe
440	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3396	cmd.exe
4372	cmd.exe
4048	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBABACBBBABBCBBBAAACBBBABABAABCCCCABACBCCACBBBABBCCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_f9f5334f8bec43e4ed4ef09d980a5eb3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1060	2026-08-18_f9f5334f8bec43e4ed4ef09d980a5eb3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1060	2026-08-18_f9f5334f8bec43e4ed4ef09d980a5eb3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1060	2026-08-18_f9f5334f8bec43e4ed4ef09d980a5eb3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1060	2026-08-18_f9f5334f8bec43e4ed4ef09d980a5eb3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
556	svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe
556	svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe
556	svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe
556	svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	2026-08-18_f9f5334f8bec43e4ed4ef09d980a5eb3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	556	svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2512	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 3396	1060	2026-08-18_f9f5334f8bec43e4ed4ef09d980a5eb3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	96
PID 3396 wrote to memory of 1756	3396	cmd.exe	98
PID 556 wrote to memory of 1916	556	svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe	99
PID 1916 wrote to memory of 1180	1916	notepad.exe	100
PID 1060 wrote to memory of 4372	1060	2026-08-18_f9f5334f8bec43e4ed4ef09d980a5eb3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	104
PID 4372 wrote to memory of 4684	4372	cmd.exe	106
PID 1060 wrote to memory of 4048	1060	2026-08-18_f9f5334f8bec43e4ed4ef09d980a5eb3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	107
PID 4048 wrote to memory of 440	4048	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-18_f9f5334f8bec43e4ed4ef09d980a5eb3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_f9f5334f8bec43e4ed4ef09d980a5eb3_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACCABBAACCACBACBBACACABBBACCCABAABACBBACBAABABAACBBAACBBBCBBCCACCABCCAABCAACBACAACBBBCABCAABBCABAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACCABBAACCACBACBBACACABBBACCCABAABACBBACBAABABAACBBAACBBBCBBCCACCABCCAABCAACBACAACBBBCABCAABBCABAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAACACBBBCBACAAACBAABAACACBABCAABBBBCCCACBCACBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe" start= auto displayName= "UserDataSvc_CBAACACBBBCBACAAACBAABAACACBABCAABBBBCCCACBCACBCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAACACBBBCBACAAACBAABAACACBABCAABBBBCCCACBCACBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe" start= auto displayName= "UserDataSvc_CBAACACBBBCBACAAACBAABAACACBABCAABBBBCCCACBCACBCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAACACBBBCBACAAACBAABAACACBABCAABBBBCCCACBCACBCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAACACBBBCBACAAACBAABAACACBABCAABBBBCCCACBCACBCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1180

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2512

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABACBBBABBCBBBAAACBBBABABAABCCCCABACBCCACBBBABBCCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABACBBBABBCBBBAAACBBBABABAABCCCCABACBCCACBBBABBCCABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe
1⤵
- Executes dropped EXE
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7b992d5c220ede44119654502319edb4f3e330028018d5c64c9614b2a9d909e3
MD5 5d240c5e848b7cbe60c18f7e9f68db9a
SHA1 3bbc9f9e38cfae1f42dd05c6f21e9d0ec7a6ee3c
SHA512 a06ce6e6c2e30c30c5f9c30d9907da7cf34c4ac8ec7e8f20f0198a087cbbfffb09b2e9f08934df1936265db6b5911c4b76cecfab5a79d5ba5cdf68e9a885d7f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 81b07bde9c7c3f564867923d31556f2a7cb601d448de217aae439994895bdb0f
MD5 acfbe30c7521d370d08888511c7123f2
SHA1 51a499f8379bceabc3aba81fdbbdad3b8f3e3d7c
SHA512 d35eb3fc89b966954884dbd6bbc4c34ab323f1a4025045cc5d113ab6ebdd2a47959ee421e7e44bccae519139d04c79e835110027bcbe7f62e6ff7c6ed1196370
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 de4cc943e2d6de24e6b6105eaa132ff164ebe84dc37bda46dc210a1e0cb5a741
MD5 3d0ac6ae355ba48bf48d1b5de4d33602
SHA1 b4193243024a57fafb30413fa12b362075704c7e
SHA512 04c92b5b9755cdba6b566173c9670f3c5cecf8784337e019e533c8535e957586252377eca7d48ccf5fac70c6ec648dd376c3b9296135ef79d46447207153b42c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 60d012386119b36d4cbedfb37b52bbf9136254c52d7c0d39f53c3f48773dce0e
MD5 9810f397b570b1ed9de1ee31deb66ada
SHA1 d70ede7f1869b78a64f3cd9b210dea3e44f313d3
SHA512 53ae8a1a5a0eb9e2df4bec01a6d32071e3bcfd329b39f450791041eaea033d707d81b5fb547787093c654a3d47b7eb444b3694e57c0c89ba35bc2956b62c8da4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e39765a294055487010fc5b8d2a6fd44e3fec2bdba72c93d06dc2cf750c2bf1e
MD5 a5dc733ef7e60c2862d553fb8127b755
SHA1 3923c7400f99f491163e7a115b97a39189ead871
SHA512 9ecb4bc44bdeeccd8a0caf5957eade54c45f311b54810acc4f97a6971ed1f83070fc6323d3e4447e0ec6f9a65a6c6d1ab7b294d98714b119129f7e47c7734d81
MD5 SHA1 SHA512

Submit Download

svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABABCACCAABBBCBCBAABCAABBBABBCCAAAAACAAACCABAACACAAC.exe
Size 35.9MB
SHA256 cf12e509e71d7a68830ab30046833c1e944ace560537254270fcf8ebcea69dba
MD5 f9f5334f8bec43e4ed4ef09d980a5eb3
SHA1 4d368c0636b2b50035961e8a482c517f26f14000
SHA512 fb90b70ea50be1fe270738300e1df2645a340fedbc870129b05f59a863e17cd25a936439379514a6c6d4a5b85b1ff7da84df0fd4ea1f3f49dffdb78954f4df14
SSDEEP 786432:C5H5a5H5T5H5a5H5T5H5a5H5T5H5a5H5T5H5a5H5T5H5a5H59EIvS:8S
TLSH
T125872B09FA874071E97751B04CDBD3BF4E307A2187228EEFE609D71E6932AE0A439755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-27-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/556-37-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/1060-0-0x0000000000380000-0x00000000003A1000-memory.dmp

Download

memory/1060-8-0x0000000000380000-0x00000000003A1000-memory.dmp

Download

memory/1916-59-0x00000000052F0000-0x00000000052F1000-memory.dmp

Download