0893187957d4ba83ead25bf1be3ffb1498781519bab8db01305a9d3c89395253

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 44.2MB
Sample260818-dc5qradk21
SHA256 0893187957d4ba83ead25bf1be3ffb1498781519bab8db01305a9d3c89395253
MD5 c1c857a92c28e7fa64b5c12f54c4e988
SHA1 fd6a0573a79fc9ae2d931680b6c4ee4b898b50dc
SHA512 2795124c1c5f42e780062539891aa198b25a5d8e268d57a68e56d89582ea1b54f7e6360e01e6b8a48de301d9cfde04724a5dfc9751eed80d0ced37ca676f7a40
SSDEEP 49152:U+ES+ELiw2Y+ES+ES+ES+ES+ELiw2Y+ES+ES+ES+ES+ELiw2Y+ES+ES+ES+ES+Ek:pOU/jIEeQfoR/IuOFVjUu5g
TLSH
T183A73B09FADE0460E977617049E7C27ACAB1B9518732CADFE249C72E5E33AD0AC34715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1148	svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe
1768	svchost_CCCACCBACCACBBCBBBABCAACABCBCABCBBCCCBCABBBCCCBBCCAABCA.exe
964	svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCABBAAACBBACBCCACBCABBCABCACBCBCACBCBCACACBABCABABBCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe"	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AACCBBAABACBBBBBCBACABBCAAAABACCAAAAACCABAABAACCBBBCBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCACCBACCACBBCBBBABCAACABCBCABCBBCCCBCABBBCCCBBCCAABCA.exe"	svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1572	sc.exe
3528	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2752	cmd.exe
4800	cmd.exe
5040	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCACCBACCACBBCBBBABCAACABCBCABCBBCCCBCABBBCCCBBCCAABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3184	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3184	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3184	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3184	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1148	svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe
1148	svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe
1148	svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe
1148	svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe
1768	svchost_CCCACCBACCACBBCBBBABCAACABCBCABCBBCCCBCABBBCCCBBCCAABCA.exe
1768	svchost_CCCACCBACCACBBCBBBABCAACABCBCABCBBCCCBCABBBCCCBBCCAABCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3184	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1148	svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe
Token: SeDebugPrivilege	1768	svchost_CCCACCBACCACBBCBBBABCAACABCBCABCBBCCCBCABBBCCCBBCCAABCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2596	OpenWith.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 2752	3184	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	99
PID 2752 wrote to memory of 932	2752	cmd.exe	101
PID 1148 wrote to memory of 4056	1148	svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe	102
PID 4056 wrote to memory of 3296	4056	notepad.exe	103
PID 3184 wrote to memory of 4800	3184	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	107
PID 3184 wrote to memory of 5040	3184	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	110
PID 5040 wrote to memory of 3528	5040	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBBCCBCABCCBACCCABAACACCBCBCACCACABCBABCAACACAAAABABAACBABBABBCCBABACCBACCACABACCBBABBACACAACCACAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBBCCBCABCCBACCCABAACACCBCBCACCACABCBABCAACACAAAABABAACBABBABBCCBABACCBACCACABACCBBABBACACAACCACAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCACAACCCBABCBBAACCCCCCCCAAACBCAAAABCACACACCAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe" start= auto displayName= "UserDataSvc_ABBCACAACCCBABCBBAACCCCCCCCAAACBCAAAABCACACACCAAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4800
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCACAACCCBABCBBAACCCCCCCCAAACBCAAAABCACACACCAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe" start= auto displayName= "UserDataSvc_ABBCACAACCCBABCBBAACCCCCCCCAAACBCAAAABCACACACCAAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCACAACCCBABCBBAACCCCCCCCAAACBCAAAABCACACACCAAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBCACAACCCBABCBBAACCCCCCCCAAACBCAAAABCACACACCAAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCBACCACBBCBBBABCAACABCBCABCBBCCCBCABBBCCCBBCCAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCBACCACBBCBBBABCAACABCBCABCBBCCCBCABBBCCCBBCCAABCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe
1⤵
- Executes dropped EXE
PID:964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d42d41d6c2ff007ce6137f479c7a2b630dbfcbd154df5ef809e91fd420d54267
MD5 8ad76cc9893c0e1c29b6c4230398d1d2
SHA1 e9dc6f691475ad2312ed695c76407f8958ca58d4
SHA512 46fcd1e3f824cca41f9b940dc84e6b67d560313111624123639c065adfc60e815675f0de27e94b2792c8c0079954081069b87731a0aa2b95d2646c1d18842a8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 47becabaf94f1000bef9691f3a2e9f67df437f53933b12e66195a06c6b1ca2ef
MD5 c07ac38feb40e085aa34eb9ac03e1fcc
SHA1 e48a5dfe9f32b393f056f87da2c4d516aa402601
SHA512 12a052c218f683c48cf663e5ae746076c99f62df0bfe182ed6c5ff60492b3db250342f1872192a79a38237a521b234acd9cab84609cbb2f1c1bf6347a9ffb1fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 599b205ce2c245929c9fa0d70fb339d9c17682e40a6a3ff88ec6ed0e34817346
MD5 3cbec1192b9a535a71bbe5d0e585f893
SHA1 45bfd27b73129b3bbed4b85be1a0d2055aa1129d
SHA512 85c0e690232074640931cc76ac541b39931fdaae249d483e3e815b486a65d9ea4da04d7d6d07bd5a6eb5db91f890ae555e7493153fdfa643ce34b676f725399b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d4ae74080b1f7af9d63458dc2fdc49f47bfad315088472abf9b366b5c3f6f4fc
MD5 aba1d0880d38c7be1c1f8e1cbf6987d0
SHA1 e6e793b4410fb2c6ecdc7da9b030793e14644d3f
SHA512 b797b85ae0b1b24c8fe623de07ec24b11ecffb8aa89a1c0e725ca8e5f3bab8c489b14a45c3e73885d408bb867fbfc5323d722e4626fff82648b0e6eaebe57aa9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 97cb68b141bd394089a6601f41aaac349b66a856c730fa29f713fc88f2ea0b84
MD5 7f4b126cefed0d91441f1a5e79070b09
SHA1 002847146b7a8522b250e11519cb89ed8784767d
SHA512 009a6c14f953c2d7aca21b70bad2e3cbe715c7988e24cefd9dc1e1c1ec29596c269929f2cf10e95cd60da930032d4550d1269af0bebae3a5c9cd50459e657001
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 05285e941e1afa05a329b11147526ee6adc32b5079efb64b17ea42c5bb24ffeb
MD5 17bb342fdada260306aa89e145eeeabe
SHA1 48819008aa57e008ef37c32a582886b0fdff7052
SHA512 ff0c983b10fc37c8c5a518c7687e05d77ddbb812a56c32b3104d9acf925ca6e1034c8c37b8364a8b2eaec4425dff739a4098b1d346846e00ad73979fe5b23f7a
MD5 SHA1 SHA512

Submit Download

svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACCBAABCBAABABCAACABCAAABBACBCCACBCAABCCABBCBBABBCBA.exe
Size 44.2MB
SHA256 0893187957d4ba83ead25bf1be3ffb1498781519bab8db01305a9d3c89395253
MD5 c1c857a92c28e7fa64b5c12f54c4e988
SHA1 fd6a0573a79fc9ae2d931680b6c4ee4b898b50dc
SHA512 2795124c1c5f42e780062539891aa198b25a5d8e268d57a68e56d89582ea1b54f7e6360e01e6b8a48de301d9cfde04724a5dfc9751eed80d0ced37ca676f7a40
SSDEEP 49152:U+ES+ELiw2Y+ES+ES+ES+ES+ELiw2Y+ES+ES+ES+ES+ELiw2Y+ES+ES+ES+ES+Ek:pOU/jIEeQfoR/IuOFVjUu5g
TLSH
T183A73B09FADE0460E977617049E7C27ACAB1B9518732CADFE249C72E5E33AD0AC34715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 570686619dcc54bf747135b8516aa7cb8529151cb5590830a40c301844276d9e
MD5 7836b795372e28d0c2eff8d67d1ea0b2
SHA1 69734731f6ae632cf832c63d5dad9fcf87765ec9
SHA512 53ec7275735a7a244d371d6175a5fa7b45158f04f4e88794bb696f4802d0f361b83356d0a81a3c434ba6ed2c673ea3b915e9b34290f11d3be670a842b92ddf12
TLSH
T123119151F4E7D827E93269DF632DEAD24CB4378FAD987A1433099218BB89C324F154D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1148-37-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/1768-73-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/3184-8-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/3184-0-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/4056-60-0x0000000000D70000-0x0000000000D71000-memory.dmp

Download