12d09402735e6ad3aef9a0187c86addb711531e25c9028244a65526d4cff39b5

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 21:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
Size 72.3MB
Sample260819-1kqccsal21
SHA256 12d09402735e6ad3aef9a0187c86addb711531e25c9028244a65526d4cff39b5
MD5 fa1802431869557e6de87d7cf7d1e7ad
SHA1 d42f49fe19d3ce4b0cecb58288f249e0bb11ec77
SHA512 cfd5d2d5609ae1ba5d4cd1b75fa2801d777e61493da59e50eed4ce93003552114296b4620d8fcfb9cf9ed37c5dbc5dd5c87deecdc76b2a0672a7fdc8b1fef5aa
SSDEEP 1572864:i33333333sn33333333s833333333sn33333333sY:i33333333K33333333733333333K3337
TLSH
T17DF7E147FD8640B0EC7A25304CE7E2374836BE3AC025CA9AF9CA7B067B37E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4460	svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe
1220	svchost_ACBACACACBCAAAAAAACCCAABBABBACCACCABBACCBACBBBCCABBAAAC.exe
4240	svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCBAAABCCBACABACBCBABACBCACBACCBBCAAABBCBBBABCABABBCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe"	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBCABCBCCBAABAACBBCBCBACCABCCACBCBBABBCACAABBBAAAACAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACACACBCAAAAAAACCCAABBABBACCACCABBACCBACBBBCCABBAAAC.exe"	svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3536	sc.exe
4984	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1940	cmd.exe
5116	cmd.exe
4312	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACACACBCAAAAAAACCCAABBABBACCACCABBACCBACBBBCCABBAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2360	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1244	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
1244	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
1244	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
1244	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
4460	svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe
4460	svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe
4460	svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe
4460	svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe
1220	svchost_ACBACACACBCAAAAAAACCCAABBABBACCACCABBACCBACBBBCCABBAAAC.exe
1220	svchost_ACBACACACBCAAAAAAACCCAABBABBACCACCABBACCBACBBBCCABBAAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
Token: SeDebugPrivilege	4460	svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe
Token: SeDebugPrivilege	1220	svchost_ACBACACACBCAAAAAAACCCAABBABBACCACCABBACCBACBBBCCABBAAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4388	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1940	1244	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe	101
PID 1940 wrote to memory of 2360	1940	cmd.exe	103
PID 4460 wrote to memory of 4544	4460	svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe	104
PID 4544 wrote to memory of 728	4544	notepad.exe	105
PID 1244 wrote to memory of 5116	1244	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe	109
PID 5116 wrote to memory of 3536	5116	cmd.exe	111
PID 1244 wrote to memory of 4312	1244	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe	112
PID 4312 wrote to memory of 4984	4312	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCBAACCAABACBACCCBBACCCCABACBABCCACBBABCCBACCABCABBACBBCAAACACBCCAABACACCCACAABBBBCCCCCBCCACACBBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCBAACCAABACBACCCBBACCCCABACBABCCACBBABCCBACCABCABBACBBCAAACACBCCAABACACCCACAABBBBCCCCCBCCACACBBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCAAABBCCABBCCACBCABCCBCACABABACBCBCBCBBCBABBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe" start= auto displayName= "UserDataSvc_AABCAAABBCCABBCCACBCABCCBCACABABACBCBCBCBBCBABBAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCAAABBCCABBCCACBCABCCBCACABABACBCBCBCBBCBABBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe" start= auto displayName= "UserDataSvc_AABCAAABBCCABBCCACBCABCCBCACABABACBCBCBCBBCBABBAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCAAABBCCABBCCACBCABCCBCACABABACBCBCBCBBCBABBAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCAAABBCCABBCCACBCABCCBCACABABACBCBCBCBBCBABBAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4984

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:728

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACACBCAAAAAAACCCAABBABBACCACCABBACCBACBBBCCABBAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACACBCAAAAAAACCCAABBABBACCACCABBACCBACBBBCCABBAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACCCBBBBBBBAACACACABBAAABACACCCBACBABCCBACBCACBBC.exe
1⤵
- Executes dropped EXE
PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dae65c6b2ce1441d294a6dffac973d7853c5ae8887e11af399baa24444788daf
MD5 8bfe55243a4d8e325ebf834c2a32a84c
SHA1 f27e8ae267c31b6a9946af5cd078730b538d0df3
SHA512 5c9e786e95b6e9fccebc973f5431cef941e7677fecfca9f39efe0d1ef3402e6930ed6524e024c3ace1134ea73715b6b345bdd2402789fde2011d288e9ad7fcf8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 68c3361329bdac6566b5c9572287bcaf960ca90e85633d57c69f703da79b39f6
MD5 e3a99a727ab0a2aadae7cbbf6a5a66eb
SHA1 f274891f21d491449d52a97f74bafb135554b40c
SHA512 2ae09903b1cddaeb4930eb70e17d82f90415c30bf2c1a0b3567e61342def76c33e8f7052c3f34de9093cc704eeef52f673c70130ed5fe6d4d06f7e106a5481fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b4bc825bdc7326700910fe73c6186ffed651530265af5c3a99c1765b5ba39b99
MD5 839bd95abd49c4986837ef83897348b6
SHA1 b631c6ce1642a40a41ffcae2637e351ec550805f
SHA512 1eb43e57998e314c22e84b08797549a9fdc1c9b1e824e051a5fb5a06f05ee9d64c31f90f1e7a40d620f5cb538595a376136d4f7d13d1a7eb8a909308f11c4610
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6dc032077f547cf05ce6e71a4287b6b57c989157f03064198dd93272868d5866
MD5 0ce92986abf88304937568cd5f4f02fa
SHA1 c94bc05527895cfe2f40c653c5cd996506f8a16b
SHA512 defbd20a4d527452cbb72ac62b53c3b5333196a7013f523d4a93a5bd9d7356402cb917c3ed2a3bd5f358129fbccb1e92e670658130c877e45b965450766746f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 de40d276c60a40dbe8fc755e7455e9559eb182d0c9080b14b757f8c4c68ae28d
MD5 3e49852bb4a3389402b44ec6d6819e4d
SHA1 6bdfabf139420322f1deafc566b879594b5ece44
SHA512 8d8cbe575241a43bf2e8a817f9a0ceed37695f69292307aeff7faee4fc51e9d046a1adf539d9608f77c963ab51f5d3fd1f0cdd78b19d88ed34093d7789d02794
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 4ee886a30bb211dd3d98afc152ac55a32d39873cf827b55922b11b222c6d661b
MD5 07bdea2aed4ac3fdbf608860895d099a
SHA1 153623c0f2da8ba256ed93eb90507c2cc8b58708
SHA512 7fc14a47176599dc647e02c869c6747d10cf748a8ed6b3bbd1ebce3972fdfd97224b67396dc0024a5cd6dda266931a8d9dae5b7f3fa14a5fc826772cb206e471
TLSH
T1B2118270E4E6DC1BE93728CFAA3DCB42DCA4368B685C6A54630493187B9DC318D1D4D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1244-0-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/1244-8-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/4460-27-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/4460-37-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/4544-61-0x0000000005B30000-0x0000000005B31000-memory.dmp

Download