0893187957d4ba83ead25bf1be3ffb1498781519bab8db01305a9d3c89395253

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 44.2MB
Sample260818-dc5qradk21
SHA256 0893187957d4ba83ead25bf1be3ffb1498781519bab8db01305a9d3c89395253
MD5 c1c857a92c28e7fa64b5c12f54c4e988
SHA1 fd6a0573a79fc9ae2d931680b6c4ee4b898b50dc
SHA512 2795124c1c5f42e780062539891aa198b25a5d8e268d57a68e56d89582ea1b54f7e6360e01e6b8a48de301d9cfde04724a5dfc9751eed80d0ced37ca676f7a40
SSDEEP 49152:U+ES+ELiw2Y+ES+ES+ES+ES+ELiw2Y+ES+ES+ES+ES+ELiw2Y+ES+ES+ES+ES+Ek:pOU/jIEeQfoR/IuOFVjUu5g
TLSH
T183A73B09FADE0460E977617049E7C27ACAB1B9518732CADFE249C72E5E33AD0AC34715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3356	svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe
1308	svchost_CAACABABCCCCCCCCBCBCAAAACCABACCABCBAAABBCBABCBABCCACBAA.exe
1320	svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBCCAAAABACBCBAABBCBACCABCBCACCBBCBBACBABACBBABCCCBCCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe"	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCCCABBCBABCAABBCACBCBABBBBBABAAABACCCCABCCCACCBBCAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACABABCCCCCCCCBCBCAAAACCABACCABCBAAABBCBABCBABCCACBAA.exe"	svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2616	sc.exe
5656	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1896	cmd.exe
3460	cmd.exe
2860	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACABABCCCCCCCCBCBCAAAACCABACCABCBAAABBCBABCBABCCACBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1348	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4324	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4324	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4324	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4324	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3356	svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe
3356	svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe
3356	svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe
3356	svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe
1308	svchost_CAACABABCCCCCCCCBCBCAAAACCABACCABCBAAABBCBABCBABCCACBAA.exe
1308	svchost_CAACABABCCCCCCCCBCBCAAAACCABACCABCBAAABBCBABCBABCCACBAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4324	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3356	svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe
Token: SeDebugPrivilege	1308	svchost_CAACABABCCCCCCCCBCBCAAAACCABACCABCBAAABBCBABCBABCCACBAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 3460	4324	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 3460 wrote to memory of 1348	3460	cmd.exe	94
PID 3356 wrote to memory of 1268	3356	svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe	95
PID 4324 wrote to memory of 2860	4324	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 2860 wrote to memory of 5656	2860	cmd.exe	100
PID 4324 wrote to memory of 1896	4324	2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 1896 wrote to memory of 2616	1896	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_c1c857a92c28e7fa64b5c12f54c4e988_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABAAACCBCCABAABCAAACBABCABCBBACAABCCABCAACCACBACABCABABACABBBBABCBCBAACCACAACABCAAAACAAACBCCACAACACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABAAACCBCCABAABCAAACBABCABCBBACAABCCABCAACCACBACABCABABACABBBBABCBCBAACCACAACABCAAAACAAACBCCACAACACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCCAACABACCAAABBABCAAACCCAABBBAABCCACCCACCBCABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe" start= auto displayName= "UserDataSvc_BCCCCAACABACCAAABBABCAAACCCAABBBAABCCACCCACCBCABBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCCCAACABACCAAABBABCAAACCCAABBBAABCCACCCACCBCABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe" start= auto displayName= "UserDataSvc_BCCCCAACABACCAAABBABCAAACCCAABBBAABCCACCCACCBCABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCCAACABACCAAABBABCAAACCCAABBBAABCCACCCACCBCABBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCCCAACABACCAAABBABCAAACCCAABBBAABCCACCCACCBCABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2616

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABABCCCCCCCCBCBCAAAACCABACCABCBAAABBCBABCBABCCACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABABCCCCCCCCBCBCAAAACCABACCABCBAAABBCBABCBABCCACBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe
1⤵
- Executes dropped EXE
PID:1320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 57758152c708098c6434c01601d37835c8d60fff0c6a90f9e75c7be1b155670c
MD5 895d9fa2822bd47a59277034d87a2c78
SHA1 57914bbe01c43928a8dd27df51051a2295158ed5
SHA512 b8c429332c057a3bf82104f17e40ad9846dd7d26d5a2658bed1f5c076b130fed0082b2c594e6e9b4db671fd726eae9c6479dca247f6d1a105834d28cdd544f90
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7be0491585ad1e9fbcaeca4eaa43416e44f16f35f4dfbfc633ec10e54a020580
MD5 16de10f5a9a26f6c607e972051ba7b40
SHA1 e7836ae47635944c34e9cc2e7b3d974a0f12ae18
SHA512 350b3c72debfad478a98a47b8ac50b35e0fca110af5da1ffc02ad50dd927cfdbdc63785cbeaccc4cf7927cd705530f749eaa28c9108fe1eb800d7139e6522aa6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 094e926e8171554e4bc9e0b2afa05a54d7f2d37c2c83264ed5029e303589baf7
MD5 4c72d8910a6d7791bc3edcd6a40876f1
SHA1 683f477fd349c7103300f3350a98f825db9055ab
SHA512 94ff2aaae0404d7fab4b5240cdfbfc0175a1fa9d10689e54104d8a65fb2c2d3bcf74b99cfcc50cce291e0ce2b033a9b670172d9f510a8aca0a9d728450f4200d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8154e26f96dfced6ad1a1cc8645678e48e70a8597899d57a8d250f63c0717243
MD5 4ceb8ee0029920b1534d265313249b9d
SHA1 21d38239bbb13f4169dff6beaa59aebb7b846298
SHA512 2120b504a3211eff9b7f68b14c899785fb4c907d32551f961c110ca2aad95aadea59c9493652ca8ffcb0a92d806793c85e059186aea62c98cca450b155e1dac7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 48f306c802a840f9cb907d91d193e1df3aff184692cc1729a81a81d4542b29d2
MD5 73b41fdd5ce891a74430de8b672ff1b8
SHA1 61fdd655b7d936aabd014fd8a6894d09e47feb51
SHA512 aa12e30ae40e3aad0faa79ac079be78930cb9195a4e0a21b3fb8a16b3a67bd15cb1f4663b712d8865a6356759862f04e4f72f81a0b335cbd42c5d57e6db00ec7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 903629a9cc5381f2df0481ebd707e7fa983152438ff9e767bb2fffad6083f322
MD5 78a0d5c13dff5a00c72a7bf98491ad39
SHA1 6d2570efa652ad079c167f41e10733b90b63267a
SHA512 89624e65b3cfdfdc40233f40c1135c9d8269d66f424bed1dd96c444b629d08a376fa43ec0e978ef14f4cd3f11c24a6d62c003dd6e5c3ec069d0dcd6bea952770
MD5 SHA1 SHA512

Submit Download

svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAAABCABABCBBBACBCBCBCBABCCCCBBABCCBCBABCACBBBBBCCACA.exe
Size 44.2MB
SHA256 0893187957d4ba83ead25bf1be3ffb1498781519bab8db01305a9d3c89395253
MD5 c1c857a92c28e7fa64b5c12f54c4e988
SHA1 fd6a0573a79fc9ae2d931680b6c4ee4b898b50dc
SHA512 2795124c1c5f42e780062539891aa198b25a5d8e268d57a68e56d89582ea1b54f7e6360e01e6b8a48de301d9cfde04724a5dfc9751eed80d0ced37ca676f7a40
SSDEEP 49152:U+ES+ELiw2Y+ES+ES+ES+ES+ELiw2Y+ES+ES+ES+ES+ELiw2Y+ES+ES+ES+ES+Ek:pOU/jIEeQfoR/IuOFVjUu5g
TLSH
T183A73B09FADE0460E977617049E7C27ACAB1B9518732CADFE249C72E5E33AD0AC34715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 835c091ebc4e9483da994b1d2d548d6e995ce2c7f192f55cf99828d8866810e8
MD5 66e9ac11415db274a1d5c341846984a8
SHA1 b91b5790771f5af022bf2f6e731407027e85c2ee
SHA512 f869fde9671614801bc9eee3efaf9b049acf0ecd490a4d200cb0254d303e9445593788d7329fea2b8be7dfb824a958b61d4404944e5be064db6a89664a951f07
TLSH
T1E411A771F4F7D827EA33398F412DEAD28CA437AB59587A14230D52187BE9D30CE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1308-70-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/3356-24-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/3356-34-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/4324-7-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/4324-0-0x0000000000140000-0x0000000000161000-memory.dmp

Download