e30f0e465d8268258d66bd77d0020c09edfeae9bb5bdbcbe620086da38181518

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_79a6f4ed6236230253db4760b4b7e756_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 21.0MB
Sample260818-ckdfsscp3v
SHA256 e30f0e465d8268258d66bd77d0020c09edfeae9bb5bdbcbe620086da38181518
MD5 79a6f4ed6236230253db4760b4b7e756
SHA1 3c30806b6e9211a73d6a33c3ebb7de70e0639df9
SHA512 07909f22f5f2f3ebd131d2d29c3470e60be6fde8ba97ca5ec5d4e987c1c28b1cda9e67f705de8b260345d00042c82cdaa6ea3014ee1f9425eabcf9631a34237e
SSDEEP 393216:gT59T59T5PT59T59T5PT59T59T5PT59T59T5PT59T59T5PT59T59T5PT59T59T5o:gT59T59T5PT59T59T5PT59T59T5PT59g
TLSH
T121277D15B7D60121FBB326718C79D2B56D397A204730CADFA788A91D2F329C1D93A327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2408	svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe
2672	svchost_BCBACCCBCBCBACCAABBAACBACBABCAABAAABBAACBCCBAABCAABBCAC.exe
1696	svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAACBCACBBBBAABCABABCACBCACBCBABBBBBCACBBBBCABBAAACBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe"	2026-08-18_79a6f4ed6236230253db4760b4b7e756_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABABCAAABCCCCCBACBCAABABABABCCBCBACCBBBABABACBAACBBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBACCCBCBCBACCAABBAACBACBABCAABAAABBAACBCCBAABCAABBCAC.exe"	svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1912	sc.exe
4672	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5524	cmd.exe
792	cmd.exe
3916	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_79a6f4ed6236230253db4760b4b7e756_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBACCCBCBCBACCAABBAACBACBABCAABAAABBAACBCCBAABCAABBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5844	2026-08-18_79a6f4ed6236230253db4760b4b7e756_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5844	2026-08-18_79a6f4ed6236230253db4760b4b7e756_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5844	2026-08-18_79a6f4ed6236230253db4760b4b7e756_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5844	2026-08-18_79a6f4ed6236230253db4760b4b7e756_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2408	svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe
2408	svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe
2408	svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe
2408	svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe
2672	svchost_BCBACCCBCBCBACCAABBAACBACBABCAABAAABBAACBCCBAABCAABBCAC.exe
2672	svchost_BCBACCCBCBCBACCAABBAACBACBABCAABAAABBAACBCCBAABCAABBCAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5844	2026-08-18_79a6f4ed6236230253db4760b4b7e756_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	2408	svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe
Token: SeDebugPrivilege	2672	svchost_BCBACCCBCBCBACCAABBAACBACBABCAABAAABBAACBCCBAABCAABBCAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5844 wrote to memory of 3916	5844	2026-08-18_79a6f4ed6236230253db4760b4b7e756_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	91
PID 3916 wrote to memory of 5548	3916	cmd.exe	93
PID 2408 wrote to memory of 2376	2408	svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe	94
PID 5844 wrote to memory of 5524	5844	2026-08-18_79a6f4ed6236230253db4760b4b7e756_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	97
PID 5524 wrote to memory of 1912	5524	cmd.exe	99
PID 5844 wrote to memory of 792	5844	2026-08-18_79a6f4ed6236230253db4760b4b7e756_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	100
PID 792 wrote to memory of 4672	792	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-18_79a6f4ed6236230253db4760b4b7e756_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_79a6f4ed6236230253db4760b4b7e756_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBBCCCBAAAABBAAACBCACCCBCABACBCBAABCBCACCACCABBBCBCBCAAACAACBBCBBBACCBCABBCBAAAABCAABCBABCABACCACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBBCCCBAAAABBAAACBCACCCBCABACBCBAABCBCACCACCABBBCBCBCAAACAACBBCBBBACCBCABBCBAAAABCAABCBABCABACCACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBCBCACCCCCACCBAAACBBBCBBCAABBBCCCCBACCBCCBCCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe" start= auto displayName= "UserDataSvc_CBCBCBCACCCCCACCBAAACBBBCBBCAABBBCCCCBACCBCCBCCAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5524
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBCBCACCCCCACCBAAACBBBCBBCAABBBCCCCBACCBCCBCCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe" start= auto displayName= "UserDataSvc_CBCBCBCACCCCCACCBAAACBBBCBBCAABBBCCCCBACCBCCBCCAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBCBCACCCCCACCBAAACBBBCBBCAABBBCCCCBACCBCCBCCAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBCBCACCCCCACCBAAACBBBCBBCAABBBCCCCBACCBCCBCCAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4672

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCCBCBCBACCAABBAACBACBABCAABAAABBAACBCCBAABCAABBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCCBCBCBACCAABBAACBACBABCAABAAABBAACBCCBAABCAABBCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe
1⤵
- Executes dropped EXE
PID:1696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed27e7508347dd6d560cff4d2338c126797c184282bf539091ccfcf54db48b67
MD5 696ce5f335d5142f3ad03351a11a0a45
SHA1 82607b541f1399741213500a57c65a1ba8b72c45
SHA512 e53b24527153bb40378c529d5d93e7c22373bb4ded6f9ecf567721f60e646e4da97fb5c00f512888bd5e8356bd2d876d3e665b0c0ff0204a0bf87ecc518cd718
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a774d16a6f0d620021644d313f8a5c8295e09a662047f96d502aedc5b5898bf5
MD5 f2436125341c40569f991c7c63aed725
SHA1 055f0bd242861f414247ee8366430ac65b4d249c
SHA512 c117e4560a482e966f4f537206bf6d2bdbda89d0314bbbed6d224d645ad3eff4b1dd3da81013f1e83edfdb54dbc1a6e8b88b5a9d6c31c2cbfb316b5489ae4f98
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 091504de0fcc65fa58171d6ed95cd0cab116286566a574e1e674c8b07385f1e2
MD5 dc55945038927ffefb227ed5181d4905
SHA1 c7ddc401328003b77eb4644a85feae713d4f9c38
SHA512 cac8356ec9808fea3f554e3fb87aa3fcf7797ecaff533c0bc5ce0ac4bc02563d3c733bcc52a1ff0e49fe5b199b8248c8382c019a4f471c95f97a2546cc188d2d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6fb79d4ed37ca41c4552cde6e644a93e11aeea311f9cdfd0f034ff2894570b31
MD5 24ec0624c02f67b5099d0b4067bb1fcc
SHA1 b80c766e63c4028d70fc402693b8aab7bdb5f1f5
SHA512 d7cc2bbb6514e85d2db1d59cf3bafa666d55cde2eb89972113b7374d5dcaf69999dda9d6a01c49b858feb1daaa2db9ee9c2445bd168b4c69edebdcfa51748549
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4d49ded7b4ae91028084e1713e6996c3df1b67ea5239f7798499868ef734e7b2
MD5 1bdfe2f75fe5990703586ac48052ea0e
SHA1 6c681431b6679f6462bd02b16489633ebed563f6
SHA512 c1c7b3e642367c707990be74dc88667bc8a29aeac17a76bcc016c4a6db8eb366d24611b6e8952578b107d4c7b647e9994c0d7f5c92a64fa0724cfba78ee5d8e9
MD5 SHA1 SHA512

Submit Download

svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBCCBAABBACABBCACABBCBBABCBBCCACCCABABCBCACABACACBB.exe
Size 21.0MB
SHA256 e30f0e465d8268258d66bd77d0020c09edfeae9bb5bdbcbe620086da38181518
MD5 79a6f4ed6236230253db4760b4b7e756
SHA1 3c30806b6e9211a73d6a33c3ebb7de70e0639df9
SHA512 07909f22f5f2f3ebd131d2d29c3470e60be6fde8ba97ca5ec5d4e987c1c28b1cda9e67f705de8b260345d00042c82cdaa6ea3014ee1f9425eabcf9631a34237e
SSDEEP 393216:gT59T59T5PT59T59T5PT59T59T5PT59T59T5PT59T59T5PT59T59T5PT59T59T5o:gT59T59T5PT59T59T5PT59T59T5PT59g
TLSH
T121277D15B7D60121FBB326718C79D2B56D397A204730CADFA788A91D2F329C1D93A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7d7ef0143c2ca3ba5a16095cf7eb3e8d6ec3d89c89d2af5643bbdda5f9a426de
MD5 87ec0e4ca863beefe5d97cb97d415b56
SHA1 bce0f692e5c0ea040f436b9a024426f710ea5fed
SHA512 f9644a41269924c6caeea2811b456bb59538e9fdc2bf414bc073f4566192d88d9d632b8fd5091c66535a43b8e0ea31d27dfef781711f28ed5dc1abdcb976535d
TLSH
T10011C160B4E7D863FC32259BA52DEAD34CA077CF19987A14630C8219FBE5C309E154F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2408-32-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2672-79-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/5844-0-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/5844-8-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download