cfa3069087462e4646ce4d566ce3ba4016d231854c89cf53cdee12ff6d8eb7e7

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_9b52f2dcae088edf6ff3c1894c888575_amadey_elex_glassworm_luca-stealer_njrat_remcos_stop_vidar.exe
Size 24.8MB
Sample260818-ce66xsvsfv
SHA256 cfa3069087462e4646ce4d566ce3ba4016d231854c89cf53cdee12ff6d8eb7e7
MD5 9b52f2dcae088edf6ff3c1894c888575
SHA1 76a7ce3209727577fab880a4e511091c2d1ea595
SHA512 c24e275cef9c618360b5a359d4598ed3bad8382005ba2a6efaf36b7fcb159ae7669d9b92d475e532d0af67ef8ecbe0ac0b363dd0a4ec1d7c8c6eeaf287213d39
SSDEEP 49152:U+ES+ES+Epqatglk+ES+ES+ES+ES+ES+ES+ES+ES+ES+Epqatglk+ES+ES+ES+El:essssssssssssssssssssssnLZ1oLp7U
TLSH
T105472909F94380B2D92B01B148CBD3BF8A70BA258B128EEBF74DC75FA933B916535155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2780	svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe
4344	svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe
832	svchost_BACBABCABCBABCCABACBBAAABCACBBBCBABBBBBCBBCAABCAACCBCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCCCCBACCBACBBAABBCAABCACCABBCCACCAABBBBAABABCABCCCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe"	2026-08-18_9b52f2dcae088edf6ff3c1894c888575_amadey_elex_glassworm_luca-stealer_njrat_remcos_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACACCBBBCABABCBBCABCACBBACABBCABABBBABCCCBAABBBCBACBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBABCABCBABCCABACBBAAABCACBBBCBABBBBBCBBCAABCAACCBCAB.exe"	svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2532	sc.exe
5904	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2436	cmd.exe
1984	cmd.exe
1436	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBABCABCBABCCABACBBAAABCACBBBCBABBBBBCBBCAABCAACCBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_9b52f2dcae088edf6ff3c1894c888575_amadey_elex_glassworm_luca-stealer_njrat_remcos_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4396	2026-08-18_9b52f2dcae088edf6ff3c1894c888575_amadey_elex_glassworm_luca-stealer_njrat_remcos_stop_vidar.exe
4396	2026-08-18_9b52f2dcae088edf6ff3c1894c888575_amadey_elex_glassworm_luca-stealer_njrat_remcos_stop_vidar.exe
4396	2026-08-18_9b52f2dcae088edf6ff3c1894c888575_amadey_elex_glassworm_luca-stealer_njrat_remcos_stop_vidar.exe
4396	2026-08-18_9b52f2dcae088edf6ff3c1894c888575_amadey_elex_glassworm_luca-stealer_njrat_remcos_stop_vidar.exe
2780	svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe
2780	svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe
2780	svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe
2780	svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe
832	svchost_BACBABCABCBABCCABACBBAAABCACBBBCBABBBBBCBBCAABCAACCBCAB.exe
832	svchost_BACBABCABCBABCCABACBBAAABCACBBBCBABBBBBCBBCAABCAACCBCAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	2026-08-18_9b52f2dcae088edf6ff3c1894c888575_amadey_elex_glassworm_luca-stealer_njrat_remcos_stop_vidar.exe
Token: SeDebugPrivilege	2780	svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe
Token: SeDebugPrivilege	832	svchost_BACBABCABCBABCCABACBBAAABCACBBBCBABBBBBCBBCAABCAACCBCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 1984	4396	2026-08-18_9b52f2dcae088edf6ff3c1894c888575_amadey_elex_glassworm_luca-stealer_njrat_remcos_stop_vidar.exe	92
PID 1984 wrote to memory of 6136	1984	cmd.exe	94
PID 2780 wrote to memory of 3752	2780	svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe	95
PID 4396 wrote to memory of 1436	4396	2026-08-18_9b52f2dcae088edf6ff3c1894c888575_amadey_elex_glassworm_luca-stealer_njrat_remcos_stop_vidar.exe	96
PID 1436 wrote to memory of 5904	1436	cmd.exe	98
PID 4396 wrote to memory of 2436	4396	2026-08-18_9b52f2dcae088edf6ff3c1894c888575_amadey_elex_glassworm_luca-stealer_njrat_remcos_stop_vidar.exe	99
PID 2436 wrote to memory of 2532	2436	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-18_9b52f2dcae088edf6ff3c1894c888575_amadey_elex_glassworm_luca-stealer_njrat_remcos_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_9b52f2dcae088edf6ff3c1894c888575_amadey_elex_glassworm_luca-stealer_njrat_remcos_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAABCBABCBBCCAAABABBACACAABBBCBACBCCBBBBBAACAAACBCCABBBCBCBBCBBBBACBAABBABACBBBBBAABABACCABCBAAAACABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAABCBABCBBCCAAABABBACACAABBBCBACBCCBBBBBAACAAACBCCABBBCBCBBCBBBBACBAABBABACBBBBBAABABACCABCBAAAACABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABACCBCCCBCABAACBCCAACBCBCAACCBCBBCCAACAACABCBAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe" start= auto displayName= "UserDataSvc_CABACCBCCCBCABAACBCCAACBCBCAACCBCBBCCAACAACABCBAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABACCBCCCBCABAACBCCAACBCBCAACCBCBBCCAACAACABCBAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe" start= auto displayName= "UserDataSvc_CABACCBCCCBCABAACBCCAACBCBCAACCBCBBCCAACAACABCBAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABACCBCCCBCABAACBCCAACBCBCAACCBCBBCCAACAACABCBAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABACCBCCCBCABAACBCCAACBCBCAACCBCBBCCAACAACABCBAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3752

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe
1⤵
- Executes dropped EXE
PID:4344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABCABCBABCCABACBBAAABCACBBBCBABBBBBCBBCAABCAACCBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABCABCBABCCABACBBAAABCACBBBCBABBBBBCBBCAABCAACCBCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d18adfcb34e8e0872e295d4c2c12ac9668470ea22290f8a040c1c53a5b8e702
MD5 79bfa2805c78453bacf2a266f644aab1
SHA1 a75825ca609cdb01c6c25fb13fc65416b713552d
SHA512 c0e9f739b69541e20061fa9c766eecc9a0b3d20046011334077bd4f3932717da3425d6425db2ff07646f5555dea664d0c9c2b8ca0a7f9e61708d54fa159e173f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa2f07eb919387a3271e8bcd764a2196f163808b0961755e940ea76c8803a3b5
MD5 3291e1c5e18e9941e346a7b5b8f42a30
SHA1 fb3167bed0cafc73a615709497b1fe696883ae5a
SHA512 135aa25e4341a9a6ad0c198e6c6d0b0f5dfda10b04e2573f97ab3aab0a1f23dca167a638ab33da9e6f38d3ffa5774a9e2d8f4e1ccceb35e4c7b73fb8b6fea87d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4d40f493c01bb69cca883c2fd1e765a4448018ecd1ec7e9dcaa06b5a4907b253
MD5 7f47138a6f6ecd2f0da225fc055b8ece
SHA1 0384a1ee6a5127736c897a85c8fad4bdc40dc211
SHA512 3f5d9a5d903a525bf759023d3ff513f79c6a8ed14f41bbfd1bdae33b720e8a7c0252df50fb7c881ec173983d5e8e057934866a0b22dcfa08ebd0727396a2ee1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed189c7effd9775b558a2f8b934dc47ed11005ccfe540e342e1cc37ef4983c64
MD5 f9fc6d5f2ffbbcdff3e364e1ad1e93bd
SHA1 28db6b79a5483cffb0889fda28fdc67c0004ca3d
SHA512 27c4fe620d996e42bf58e307010b70e952a4d46f93422c4ea77908563875dadf10aa25c54e29e342be2372d7cb866309bf86911d17731578b7645b09d5ce18da
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4d511f2de99e2d92661f843e8b9689d0a4229fc1baefb1e94481629c578bc13d
MD5 0c2bd14ac152d74b3740996e74d57391
SHA1 49372a587e6914c526785e0ffe45f7e47d189a0c
SHA512 3c9f0e0580e039bae4eaa5e08f4b9cc79bec2f28a8ddf94e8d1edd1c776013f7fec5f5b288e6ee7592431eb7ab03c2065dd7d98ac5139d4ca32baccbe152fbb2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dad331b32fd318415a589a37ef4c293d22a18eb2aad396ae1bfc41c8897d0576
MD5 8f4c35ff8e783a97201d2c0ae5c59adb
SHA1 a48925a25ccc4ba2936102e4651f3ffdcb718ae6
SHA512 e9707128d9e37e3d2b0ea75c4de093ca78082f1581d9e886ab8ef6f7905ce3a57b961b0e2d6fce9968b6f18fb436b34087817cd77fdfc8fcb706ee396357f2df
MD5 SHA1 SHA512

Submit Download

svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAAABBACCBCBCCBBAABCACCCBAACCCCACACABAABCCACCAABBCAC.exe
Size 24.8MB
SHA256 cfa3069087462e4646ce4d566ce3ba4016d231854c89cf53cdee12ff6d8eb7e7
MD5 9b52f2dcae088edf6ff3c1894c888575
SHA1 76a7ce3209727577fab880a4e511091c2d1ea595
SHA512 c24e275cef9c618360b5a359d4598ed3bad8382005ba2a6efaf36b7fcb159ae7669d9b92d475e532d0af67ef8ecbe0ac0b363dd0a4ec1d7c8c6eeaf287213d39
SSDEEP 49152:U+ES+ES+Epqatglk+ES+ES+ES+ES+ES+ES+ES+ES+ES+Epqatglk+ES+ES+ES+El:essssssssssssssssssssssnLZ1oLp7U
TLSH
T105472909F94380B2D92B01B148CBD3BF8A70BA258B128EEBF74DC75FA933B916535155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 07f6dd52ca294287800c84f4cdd6e915703fec82393a8e41b1a9e7eff021ed63
MD5 ace095546d027689d28db333b5fd6cc6
SHA1 a5e81117d993d7af034bca458ccc3d434f97cf2d
SHA512 ab17288fecc6714a5b1825d1864ce41c095e7727a02325ff46503657cdd24574905d666f846bef91777de19d50fb459fedeea77c4f13e5b25b41bbb9ee554ca8
TLSH
T12A11C47055E7D877EC32688A521DDBC34CE8369BAC1C7A14134D4118AFD9C319D190E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/832-81-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download

memory/2780-23-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/2780-36-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/4344-67-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/4396-0-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/4396-7-0x0000000000200000-0x0000000000221000-memory.dmp

Download