20a1faf805cdcb793b694adbbe00069cc9e358398b10923734e09b36c536e9b1

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_d47d1449b79d3e1ea4336c4185a32f7e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 48.1MB
Sample260818-daagtsfa64
SHA256 20a1faf805cdcb793b694adbbe00069cc9e358398b10923734e09b36c536e9b1
MD5 d47d1449b79d3e1ea4336c4185a32f7e
SHA1 b37ecf83de3dcfaa8bb61124f49127558f45ae60
SHA512 4a02d95bb668bb2b051ef10ed33734251253201303ee0e39f09d9f10391d6daa0ed6fe6b2f20d94300fd5d26163b30445d286f5217581405af69a108e257be6d
SSDEEP 98304:TUjrU57UjrU57UjrU57UjrU5XKjKWQckVgtev5mnlNLF:J5x5x5x5cKWQc0gEYnvLF
TLSH
T125B71909F645C0A1D42A43708896D2B65971BC114B219AFFFE78B72DEA3FAF0563D630
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2756	svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe
4988	svchost_BBAACCBBCBBAAABBABABCCCAACCCABCACCACCAAAABCAABBCBBAACCA.exe
4372	svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AAAACABCBAACABACAACCBBAACBCBBBCACAAAABABCAACABBBBCBCCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe"	2026-08-17_d47d1449b79d3e1ea4336c4185a32f7e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCBACBCACBCABAACACBBAACCBBBBBCCBABBCCBABCAACAABAACBCCBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAACCBBCBBAAABBABABCCCAACCCABCACCACCAAAABCAABBCBBAACCA.exe"	svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4452	sc.exe
4268	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2844	cmd.exe
4412	cmd.exe
1708	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_d47d1449b79d3e1ea4336c4185a32f7e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAACCBBCBBAAABBABABCCCAACCCABCACCACCAAAABCAABBCBBAACCA.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4512	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2544	2026-08-17_d47d1449b79d3e1ea4336c4185a32f7e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2544	2026-08-17_d47d1449b79d3e1ea4336c4185a32f7e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2544	2026-08-17_d47d1449b79d3e1ea4336c4185a32f7e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2544	2026-08-17_d47d1449b79d3e1ea4336c4185a32f7e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2756	svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe
2756	svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe
2756	svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe
2756	svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe
4988	svchost_BBAACCBBCBBAAABBABABCCCAACCCABCACCACCAAAABCAABBCBBAACCA.exe
4988	svchost_BBAACCBBCBBAAABBABABCCCAACCCABCACCACCAAAABCAABBCBBAACCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	2026-08-17_d47d1449b79d3e1ea4336c4185a32f7e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	2756	svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe
Token: SeDebugPrivilege	4988	svchost_BBAACCBBCBBAAABBABABCCCAACCCABCACCACCAAAABCAABBCBBAACCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1604	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2844	2544	2026-08-17_d47d1449b79d3e1ea4336c4185a32f7e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	95
PID 2844 wrote to memory of 4512	2844	cmd.exe	97
PID 2756 wrote to memory of 4628	2756	svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe	98
PID 4628 wrote to memory of 2244	4628	notepad.exe	99
PID 2544 wrote to memory of 4412	2544	2026-08-17_d47d1449b79d3e1ea4336c4185a32f7e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	103
PID 4412 wrote to memory of 4452	4412	cmd.exe	105
PID 2544 wrote to memory of 1708	2544	2026-08-17_d47d1449b79d3e1ea4336c4185a32f7e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	106
PID 1708 wrote to memory of 4268	1708	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-17_d47d1449b79d3e1ea4336c4185a32f7e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_d47d1449b79d3e1ea4336c4185a32f7e_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCAACCBBCAAABCCACCCACBCAABAAAAABABCABBCBCAABBAACABAACCBABBCBBCAABBBCCCBAABBBACAAABBCBBABBBBCAAACABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCAACCBBCAAABCCACCCACBCAABAAAAABABCABBCBCAABBAACABAACCBABBCBBCAABBBCCCBAABBBACAAABBCBBABBBBCAAACABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBABCBCAAABBAABCCABBABCCBBBBACBACBBABBAAAAABBCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe" start= auto displayName= "UserDataSvc_ABCBABCBCAAABBAABCCABBABCCBBBBACBACBBABBAAAAABBCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBABCBCAAABBAABCCABBABCCBBBBACBACBBABBAAAAABBCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe" start= auto displayName= "UserDataSvc_ABCBABCBCAAABBAABCCABBABCCBBBBACBACBBABBAAAAABBCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBABCBCAAABBAABCCABBABCCBBBBACBACBBABBAAAAABBCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBABCBCAAABBAABCCABBABCCBBBBACBACBBABBAAAAABBCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2244

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1604

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCBBCBBAAABBABABCCCAACCCABCACCACCAAAABCAABBCBBAACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAACCBBCBBAAABBABABCCCAACCCABCACCACCAAAABCAABBCBBAACCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe
1⤵
- Executes dropped EXE
PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9aca7c34c182472514925061c1fc3dd61099e768a593b9b347f050a0317fd6c4
MD5 9b4daa7c3650da98a8d30c370001380c
SHA1 3613586f25a6297166d1abcc4b3133256ebd3836
SHA512 925afd1ed15021fcb24648eaa622a3e9b1b489792ac2447ddcf45f2a31176a8489661e8722a305f6ac341c0c639d96509422f0c738bcb6d922e7395cff7609b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 170fb2c0c9e065d42e68f3583e4e4b5b67d6c1d6acb7acd795f5f6843e08a909
MD5 58b123a675c9af7c8399d95b9e085930
SHA1 e9e0da1ed835f9d905be1e34c0566b6e90099889
SHA512 624fd791dc6ab898412da98b01460cab2571977195c3b64beaee31d2a80fbb6461453d9840f7098316d1d99e827dd034b515895f2ae2e06c9352ee54d2882d1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f534cf731531de3b2d07f1f5c62d9490bc53fd16d0fb8a37a703dfc266b88f80
MD5 3b1156ef41a9d1643b371ed67a99b819
SHA1 6a7eebb02e02727546b601207ffc0d0704be8e63
SHA512 f2f8290102767b24448360bc089b1d57d492b0db1696f95881931a21a180e0426b9e7e0fdddeb377f33ce915c7b9553ce4fb2fe38ed11dac400a7c797f0306c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f9ccdbf546956ccdbcbf24a302d3327e1605862464559fff7bbf4ad564d097cf
MD5 d836592cfdd08263fa29269a40943b0e
SHA1 1b689769362d6a06389f48b67791099763aca7c0
SHA512 e5251bd7f559681a07ae1ba52cb96a5fe8da6fff0e1a4d75f8a5fc7e8bd9755819a19ada74c530f6f090285ef68a81e0cb7c8cb66b9fa7b4bbceef9bc7b5ca41
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a575b2ee2d047a65de77c635f98414e224bccb2ea1b6d4ba1afb88f4d7606bca
MD5 d4f64d63bff58508895c9df1efd80de5
SHA1 261da64dd339169236637dfeae42f03056e6605d
SHA512 ae040ac80b2662255c8822503f5c6fe6ca6da6a90d80a374aca0e98167f016ee960da512353a08deb4f7d818a3eb6fd53bb98cec97cea89d69a84f2e1ea7fb06
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 309161057b33f0cdb8675c7c7ba3d70822ce8fe3cb26596e9ad2217e15462b9f
MD5 b667fe0eaa60532c9fbc9c1af1045119
SHA1 e935d5376b05adb230b4d19949d458a3ef210f50
SHA512 41c825fd3750cbd26d0ff550f327a2ff191e82c6fb929d4368b14f83af285922c36152ff7f49b768adeb9895ededaa676166fc2d8816ea8c7777172d14f88003
MD5 SHA1 SHA512

Submit Download

svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBBCACABABACABACABACCBBAAABBBCBCACBCCBAABCCCBCBABACBC.exe
Size 48.1MB
SHA256 20a1faf805cdcb793b694adbbe00069cc9e358398b10923734e09b36c536e9b1
MD5 d47d1449b79d3e1ea4336c4185a32f7e
SHA1 b37ecf83de3dcfaa8bb61124f49127558f45ae60
SHA512 4a02d95bb668bb2b051ef10ed33734251253201303ee0e39f09d9f10391d6daa0ed6fe6b2f20d94300fd5d26163b30445d286f5217581405af69a108e257be6d
SSDEEP 98304:TUjrU57UjrU57UjrU57UjrU5XKjKWQckVgtev5mnlNLF:J5x5x5x5cKWQc0gEYnvLF
TLSH
T125B71909F645C0A1D42A43708896D2B65971BC114B219AFFFE78B72DEA3FAF0563D630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 fa49dea3c3d0a88634e0d48d21edbf88194cb5ed316c033aec75d2308586b8fe
MD5 c8de6bba012f333e2e5c1688f4d7b78a
SHA1 8d661b8907a28b680603ede2df28ec04673fe7ba
SHA512 b3fcf5cb883619748e7792dbe7a3ae47c92ca3501b17ef69e33fb3f7116367d9474aa87bbeab2e4b16dd1763059ac87d5242f738b8be6472fc0cbbd2a49037e3
TLSH
T1F3110850E4E7DC63F833699B862DBA824CF576AFAC187A4023054208BBD8C30CE094F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2544-0-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/2544-7-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/2756-36-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/2756-26-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/4628-59-0x0000000002400000-0x0000000002401000-memory.dmp

Download

memory/4988-87-0x0000000000EA0000-0x0000000000EC1000-memory.dmp

Download