3bf1b4653a09ad9d5d9e2d336f7ded3534e1f39abb74aea9fc5bddf8fa9b8f30

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_aed74b3765e4f82a63c218b1f77969d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 27.3MB
Sample260818-df95msvcqf
SHA256 3bf1b4653a09ad9d5d9e2d336f7ded3534e1f39abb74aea9fc5bddf8fa9b8f30
MD5 aed74b3765e4f82a63c218b1f77969d6
SHA1 e68608c903abb3823949b0975cd16ca3ec2b01d4
SHA512 9e3fffccf67d8de3da7aab226a989cccce361be7e321932037ee0a232fb78fc8227961fee15bf54876e2076fe6afc16f60a64fbc26f9d35e4545154ebb75b182
SSDEEP 786432:W5252525I5252525I5252525I5252525I5252525I5252525I5252525J:d
TLSH
T19D573B1DFA8350B1D92751B04CCBD2FF9D60762183224EFBFA0DDB1A6A27AD1A43D215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5732	svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe
5464	svchost_BBBBBCCACCBCABBBABBABBACABAABAABBCBAABCCAABBABCCCBBBBCB.exe
6052	svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBCCAACBACBCCACAAACBCCACCBCCCACAACACAACAABACCCCCBBBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBBCCACCBCABBBABBABBACABAABAABBCBAABCCAABBABCCCBBBBCB.exe"	svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCABCCACBBBABBBBBAABAACCCCACCBCBBABCCCCACCCCABCBACCAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe"	2026-08-17_aed74b3765e4f82a63c218b1f77969d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5104	sc.exe
3340	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1580	cmd.exe
4888	cmd.exe
2596	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_aed74b3765e4f82a63c218b1f77969d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBBCCACCBCABBBABBABBACABAABAABBCBAABCCAABBABCCCBBBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6008	2026-08-17_aed74b3765e4f82a63c218b1f77969d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6008	2026-08-17_aed74b3765e4f82a63c218b1f77969d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6008	2026-08-17_aed74b3765e4f82a63c218b1f77969d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6008	2026-08-17_aed74b3765e4f82a63c218b1f77969d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5732	svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe
5732	svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe
5732	svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe
5732	svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe
5464	svchost_BBBBBCCACCBCABBBABBABBACABAABAABBCBAABCCAABBABCCCBBBBCB.exe
5464	svchost_BBBBBCCACCBCABBBABBABBACABAABAABBCBAABCCAABBABCCCBBBBCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6008	2026-08-17_aed74b3765e4f82a63c218b1f77969d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5732	svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe
Token: SeDebugPrivilege	5464	svchost_BBBBBCCACCBCABBBABBABBACABAABAABBCBAABCCAABBABCCCBBBBCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6008 wrote to memory of 1580	6008	2026-08-17_aed74b3765e4f82a63c218b1f77969d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 1580 wrote to memory of 3320	1580	cmd.exe	94
PID 5732 wrote to memory of 5408	5732	svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe	95
PID 6008 wrote to memory of 4888	6008	2026-08-17_aed74b3765e4f82a63c218b1f77969d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 4888 wrote to memory of 5104	4888	cmd.exe	100
PID 6008 wrote to memory of 2596	6008	2026-08-17_aed74b3765e4f82a63c218b1f77969d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 2596 wrote to memory of 3340	2596	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-17_aed74b3765e4f82a63c218b1f77969d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_aed74b3765e4f82a63c218b1f77969d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBACCCABAACCBACBACCBABCBBBBCCABCAABABBAAACBBBBCCBAAABABCBCCBACBCBCBBBBCAAAAAABBBACABAACABACCBCCCBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBACCCABAACCBACBACCBABCBBBBCCABCAABABBAAACBBBBCCBAAABABCBCCBACBCBCBBBBCAAAAAABBBACABAACABACCBCCCBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBAAABBCBBABABBBCCCBAAAAACBBACAABAACCCBAABACCCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe" start= auto displayName= "UserDataSvc_AABBAAABBCBBABABBBCCCBAAAAACBBACAABAACCCBAABACCCACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBAAABBCBBABABBBCCCBAAAAACBBACAABAACCCBAABACCCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe" start= auto displayName= "UserDataSvc_AABBAAABBCBBABABBBCCCBAAAAACBBACAABAACCCBAABACCCACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBAAABBCBBABABBBCCCBAAAAACBBACAABAACCCBAABACCCACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBAAABBCBBABABBBCCCBAAAAACBBACAABAACCCBAABACCCACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCCACCBCABBBABBABBACABAABAABBCBAABCCAABBABCCCBBBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCCACCBCABBBABBABBACABAABAABBCBAABCCAABBABCCCBBBBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe
1⤵
- Executes dropped EXE
PID:6052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 770bf2a9a3e3590d7ad66d64633689ca0553170e61e4766641ee7e47ce9e0e19
MD5 01123dcd3e08285e828af7eceb8c1390
SHA1 31968a0c497f3dc5ff74050cb7d925bd31c50a91
SHA512 57b9ef84bb8018e908f6abaa3eff8aa9f611f13964ca05f28774c016218c3de1be47a59b0babb3168599f8c86e2e8f7573b2a5a42012b5cea2d805414a4c7660
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 46026739fd1cb6f5321583dbf8700e4dfca7f714fc47c5b9d95227f4bb75ba5d
MD5 cbe6b256e2fad6f0535658ea6164c50a
SHA1 dce78b2bb598d891c6b799acb675cc5ff50994cc
SHA512 f0c173e19cd13a1eacbec5d13c5955bb18c43af43a9277f842672748008d2f8771e23a2c92b3c3573a929881233bdee2386426a1df09f226a8a937cdf739c06f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8466eb19ba8dfbfc19f0eba56ff70c67500572d57ce239fcf0750cf7130ab4f0
MD5 03f22acbd638bffd0a9890015243b853
SHA1 c74de7569a26b854278f60c80d2a511f1e646180
SHA512 0db5da947640b7d39596c5f914354bd21e8fff1f1f3115da2e8b7041c0b69eb0d75294d31821fe7b73043134b9093214e6d5cb70c2f5c62921a111dc4796f935
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1ee38a391feb85007ddfb64f89185708b5791e43a98d9a71b1f114bed868b29a
MD5 589c0c7769a50ca1b508ac90baf67dcb
SHA1 4d667006d0389d38460cb8990dab06698de24336
SHA512 549c6d52d72a7df102ed2964d9b91480995a8d4ea04aa0dbebd77eda6553a86361140619c782ac2dab4f9c9795865b895ca15b3182740a2d4908e11acd1034f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6d8ef9217d911475078c0797f0ebdbffee90faf61946735fbe2c9e8b8c0b8aff
MD5 a9a68876111a178efdb30cdb3cc2754e
SHA1 337f48ba8fbd22cc76aef27387f617395b02637e
SHA512 b1eee96acf918e25bcc9c7ecd4df233fe455d24dcea3ef72a9fef64ae5c2333adad3052bb22951eed9b764404ff73572cd2a4d1db9697e31df774bd40a449b46
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 54e7580ee219320874e87b8e2a963d9e8dc6b3cb04b3cd81887a906f754a8ffb
MD5 bb28635c0479c406e8a761a4cdc89bf8
SHA1 8ef0d9e9bbbd1b0f68b00406823d46ca2da380c9
SHA512 b538628c0dca16cda848554bb85903450e6fff6cff3cef5ead8d8c3c762eab180250d3181c08891089860a6826a9f9d4e5c576066695e0750651dcaa97093036
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bd381a4287832045aa0149f7ebfee3f73316e8e94bc223e3852fde2bd11066b6
MD5 03580d04764bb364395b237f02873d71
SHA1 5844810371e082daec9c392f2f9b7c47a31f4276
SHA512 98141c7178131a507a34e1310f3a59e0d2088b77ebd03cd61527c052b3842a00454a0e53014192b6b23d91c365b7bc1dd431d1ec9ce4d2256f05314f0fcec17a
MD5 SHA1 SHA512

Submit Download

svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBBACBBBCCCCBAACBBCBCCACAAABACCCACBAABBACBBCAABAA.exe
Size 27.3MB
SHA256 3bf1b4653a09ad9d5d9e2d336f7ded3534e1f39abb74aea9fc5bddf8fa9b8f30
MD5 aed74b3765e4f82a63c218b1f77969d6
SHA1 e68608c903abb3823949b0975cd16ca3ec2b01d4
SHA512 9e3fffccf67d8de3da7aab226a989cccce361be7e321932037ee0a232fb78fc8227961fee15bf54876e2076fe6afc16f60a64fbc26f9d35e4545154ebb75b182
SSDEEP 786432:W5252525I5252525I5252525I5252525I5252525I5252525I5252525J:d
TLSH
T19D573B1DFA8350B1D92751B04CCBD2FF9D60762183224EFBFA0DDB1A6A27AD1A43D215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 4491595018de92a02bbce2a361d31b21be8102dfbbab3abbe598d7907377e6ed
MD5 761b388edc6766a779a0df0333b4eeeb
SHA1 4365857cb72f67cf312342237fcab3725456d16b
SHA512 1309020c40838ae16d3c043c186a7a743f7dd6c5bdf35384de7b215298e6b3d107b10871655e5bb9f380c8298a56d1d3bafbfcfb832f28ae29c7e2ad0fcb723a
TLSH
T15011E352D8B7D897F83365CB572ECAC30C98379B585C6A5853058218EF99C389E194F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5464-65-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/5732-34-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/6008-8-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/6008-0-0x0000000000280000-0x00000000002A1000-memory.dmp

Download