ab56a0d615a42c948e14e711e1aa72c1fbb90be91b9c1ea5d29e99895dbc3937

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_742847a05a28bf74e9ccdd1d20e99810_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 21.3MB
Sample260818-clbctsvtex
SHA256 ab56a0d615a42c948e14e711e1aa72c1fbb90be91b9c1ea5d29e99895dbc3937
MD5 742847a05a28bf74e9ccdd1d20e99810
SHA1 7da1e4f85db15db94df132d4974def4edb5f9a2b
SHA512 c3f1d200c9513f537da723e5d573d9ab07755c5da3033104c659245e529b060dcfbad1a3f7408fca9d5c88252923b5c645fa268b7534e09b11d59f1d7759d8b3
SSDEEP 393216:9O4q78UhasVO4q78UhasVO4q78UhasVO4q78UhasVO4q78UhasVO4q78UhasVO4H:shaskhaskhaskhaskhaskhaskhaskha+
TLSH
T1A6373A2CBDE441B6D4728671C8E6E6EDEA3179126B004ECF61D5534E4E3BBD26C30E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2700	svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe
5804	svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe
1476	svchost_ACABBCCCABACBACCABACCBBABBACABABBCAAAAACABBCABCABCABCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACCCABBAAACBBABACBBCBBBACCBCACACBBACAAACCCCBABBAABBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe"	2026-08-18_742847a05a28bf74e9ccdd1d20e99810_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBBCBBACBBBBBCBABCBCACAAAABBAAACAACCCBACCCABCCABCBBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABBCCCABACBACCABACCBBABBACABABBCAAAAACABBCABCABCABCBB.exe"	svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4744	sc.exe
2128	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4816	cmd.exe
6048	cmd.exe
4312	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABBCCCABACBACCABACCBBABBACABABBCAAAAACABBCABCABCABCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_742847a05a28bf74e9ccdd1d20e99810_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4056	2026-08-18_742847a05a28bf74e9ccdd1d20e99810_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4056	2026-08-18_742847a05a28bf74e9ccdd1d20e99810_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4056	2026-08-18_742847a05a28bf74e9ccdd1d20e99810_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4056	2026-08-18_742847a05a28bf74e9ccdd1d20e99810_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2700	svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe
2700	svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe
2700	svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe
2700	svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4056	2026-08-18_742847a05a28bf74e9ccdd1d20e99810_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	2700	svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4816	4056	2026-08-18_742847a05a28bf74e9ccdd1d20e99810_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 4816 wrote to memory of 3700	4816	cmd.exe	94
PID 4056 wrote to memory of 6048	4056	2026-08-18_742847a05a28bf74e9ccdd1d20e99810_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	95
PID 6048 wrote to memory of 4744	6048	cmd.exe	97
PID 4056 wrote to memory of 4312	4056	2026-08-18_742847a05a28bf74e9ccdd1d20e99810_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 4312 wrote to memory of 2128	4312	cmd.exe	100
PID 2700 wrote to memory of 2060	2700	svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-18_742847a05a28bf74e9ccdd1d20e99810_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_742847a05a28bf74e9ccdd1d20e99810_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAABCCABBBABBAABCCAABCABCACBCAACCCABCCCCCBABBBCABABCCACABBCAABABCBCCBCBCBCCBBCABAAACACCBABAABBAACCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAABCCABBBABBAABCCAABCABCACBCAACCCABCCCCCBABBBCABABCCACABBCAABABCBCCBCBCBCCBBCABAAACACCBABAABBAACCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABCABBBBACCCBABACBABCAABCCABABAABCCBACCCACACBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe" start= auto displayName= "UserDataSvc_CAAABCABBBBACCCBABACBABCAABCCABABAABCCBACCCACACBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAABCABBBBACCCBABACBABCAABCCABABAABCCBACCCACACBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe" start= auto displayName= "UserDataSvc_CAAABCABBBBACCCBABACBABCAABCCABABAABCCBACCCACACBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABCABBBBACCCBABACBABCAABCCABABAABCCBACCCACACBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAABCABBBBACCCBABACBABCAABCCABABAABCCBACCCACACBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2128

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe
1⤵
- Executes dropped EXE
PID:5804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBCCCABACBACCABACCBBABBACABABBCAAAAACABBCABCABCABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBCCCABACBACCABACCBBABBACABABBCAAAAACABBCABCABCABCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 832fc3a9d844293de546da487e4d11f1f1d50b755d3e4498c68493b00939f4c2
MD5 e293c1681a15fafed8cc41ee58e83fe7
SHA1 b2903abfd63ce3d0890a2bddbde1888be5c66277
SHA512 ba9cc268b154c545db113c2f36f57e4c16be7299406a147128864ca3cfb4445f2049e2f13b5709c3837d0bb05ae97af95c0dae5f9a46b85a26d36fff1612ebea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3802c5b87ba627d9303b08850730868d804828852bb96491ebb1d8ffda37d58e
MD5 56327e68208e62f212d545521be52348
SHA1 a15b57077ecb5450cd287f39acc813fc4303db04
SHA512 5b33d833f3302fbe52f342da7e469b9a4c8628c7bd5353938bc478d6e90cac7cf22b19438bd6dd9e3af4ed21807483f79078b724c5d6de91584036ce86d8b1c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 290c8ec4c04d91527dbe8e97d0a481eec7b56f86495865601ef5d2f61e5c9938
MD5 8db5fc30442383f49536055ba6dab470
SHA1 08946980a15fbe3b3cef56020bd0dce653d64fa1
SHA512 e947a0744cc358bb847778be35715c0492173bad51fff71abaa59646d5e468fe9e2b0a9a16d54480f8d860969fbe5d89b9312e885481c1cf5f412092351034ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c60c86030d694cb0c02ade447dd4644cbd56cef60fd74e1e5bc72516e3f9f97c
MD5 de9564826a613fc3c307663b042d9b50
SHA1 6f87a842705a3ad35327b2bcb62c46fec97b1fc7
SHA512 704e0d5c7a04c8fd8dc9b1a1fc88ee703a4904d3db24ad1c98af9be3f8bddf1ac32f4c4d23f8b2490c2ea3f05b213b0bbdaf044ccd8e301565b29cc34a3b2d79
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ac6a55056f6eb7e93aa5de4c50d4074f5cbd958c2e01b71e0b15a3d9855aafeb
MD5 f1c599159c25f406694721a3c6271d02
SHA1 9d6bb55dbcf870a3bc192e3672c4878dcce1296c
SHA512 4a251e9c87917a044482cd33e9ee106f81dd7b843a862e7721efb7604623ab89cc7e28a27a8d23929b0a76ee04582417cff0d212745ae66b1982ad828cccc357
MD5 SHA1 SHA512

Submit Download

svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBBBCBCCACABCCACCBBCAACBABCBBAACBACACBCBCCACABABBCCB.exe
Size 21.3MB
SHA256 ab56a0d615a42c948e14e711e1aa72c1fbb90be91b9c1ea5d29e99895dbc3937
MD5 742847a05a28bf74e9ccdd1d20e99810
SHA1 7da1e4f85db15db94df132d4974def4edb5f9a2b
SHA512 c3f1d200c9513f537da723e5d573d9ab07755c5da3033104c659245e529b060dcfbad1a3f7408fca9d5c88252923b5c645fa268b7534e09b11d59f1d7759d8b3
SSDEEP 393216:9O4q78UhasVO4q78UhasVO4q78UhasVO4q78UhasVO4q78UhasVO4q78UhasVO4H:shaskhaskhaskhaskhaskhaskhaskha+
TLSH
T1A6373A2CBDE441B6D4728671C8E6E6EDEA3179126B004ECF61D5534E4E3BBD26C30E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1476-73-0x0000000000D70000-0x0000000000D91000-memory.dmp

Download

memory/2700-22-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/2700-35-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/4056-6-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/5804-65-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download