12d09402735e6ad3aef9a0187c86addb711531e25c9028244a65526d4cff39b5

General

Target
2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
Size 72.3MB
Sample260819-1kqccsal21
SHA256 12d09402735e6ad3aef9a0187c86addb711531e25c9028244a65526d4cff39b5
MD5 fa1802431869557e6de87d7cf7d1e7ad
SHA1 d42f49fe19d3ce4b0cecb58288f249e0bb11ec77
SHA512 cfd5d2d5609ae1ba5d4cd1b75fa2801d777e61493da59e50eed4ce93003552114296b4620d8fcfb9cf9ed37c5dbc5dd5c87deecdc76b2a0672a7fdc8b1fef5aa
SSDEEP 1572864:i33333333sn33333333s833333333sn33333333sY:i33333333K33333333733333333K3337
TLSH
T17DF7E147FD8640B0EC7A25304CE7E2374836BE3AC025CA9AF9CA7B067B37E61541B556
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
6036	svchost_BCBBCABCBACAAABBAAAABBCCAAACACABBCCACABACCAAABCBABABCAA.exe
4456	svchost_BCBBCABCBACAAABBAAAABBCCAAACACABBCCACABACCAAABCBABABCAA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAACBBABBCACCCAACACABCCACBCBABCBCACACCBABCCBAACCBBAACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBCABCBACAAABBAAAABBCCAAACACABBCCACABACCAAABCBABABCAA.exe"	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2564	sc.exe
5916	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4424	cmd.exe
4752	cmd.exe
4420	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBCABCBACAAABBAAAABBCCAAACACABBCCACABACCAAABCBABABCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4252	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4412	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
4412	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
4412	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
4412	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
6036	svchost_BCBBCABCBACAAABBAAAABBCCAAACACABBCCACABACCAAABCBABABCAA.exe
6036	svchost_BCBBCABCBACAAABBAAAABBCCAAACACABBCCACABACCAAABCBABABCAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4412	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
Token: SeDebugPrivilege	6036	svchost_BCBBCABCBACAAABBAAAABBCCAAACACABBCCACABACCAAABCBABABCAA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4752	4412	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe	92
PID 4752 wrote to memory of 4252	4752	cmd.exe	94
PID 4412 wrote to memory of 4420	4412	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe	95
PID 4420 wrote to memory of 2564	4420	cmd.exe	97
PID 4412 wrote to memory of 4424	4412	2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe	98
PID 4424 wrote to memory of 5916	4424	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_fa1802431869557e6de87d7cf7d1e7ad_amadey_coinminer_elex_glassworm_hawkeye_hijackloader_luc.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABBCABABAACBCBBCAACCCAACABACCBCBCBCCCAACBACACCCBBBABCCABACAABACAAAACACCCAAAABACBCBAAABBABBAABBBCBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABCBACAAABBAAAABBCCAAACACABBCCACABACCAAABCBABABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABBCABABAACBCBBCAACCCAACABACCBCBCBCCCAACBACACCCBBBABCCABACAABACAAAACACCCAAAABACBCBAAABBABBAABBBCBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABCBACAAABBAAAABBCCAAACACABBCCACABACCAAABCBABABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACBCACAAACCCBCBBCBBBCCBCABACACABAABCCBCBACAAAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABCBACAAABBAAAABBCCAAACACABBCCACABACCAAABCBABABCAA.exe" start= auto displayName= "UserDataSvc_CBACBCACAAACCCBCBBCBBBCCBCABACACABAABCCBCBACAAAABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACBCACAAACCCBCBBCBBBCCBCABACACABAABCCBCBACAAAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABCBACAAABBAAAABBCCAAACACABBCCACABACCAAABCBABABCAA.exe" start= auto displayName= "UserDataSvc_CBACBCACAAACCCBCBBCBBBCCBCABACACABAABCCBCBACAAAABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACBCACAAACCCBCBBCBBBCCBCABACACABAABCCBCBACAAAABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACBCACAAACCCBCBBCBBBCCBCABACACABAABCCBCBACAAAABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABCBACAAABBAAAABBCCAAACACABBCCACABACCAAABCBABABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABCBACAAABBAAAABBCCAAACACABBCCACABACCAAABCBABABCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABCBACAAABBAAAABBCCAAACACABBCCACABACCAAABCBABABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABCBACAAABBAAAABBCCAAACACABBCCACABACCAAABCBABABCAA.exe
1⤵
- Executes dropped EXE
PID:4456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 93daa2fb55d7c1989262ede875009149cd45ea8b81e371a18b95c00228b56ed2
MD5 5646cf0a29353a807967bb3d2651cc81
SHA1 a6e8f8117d332c2aa3bdc391656c939a7aeec210
SHA512 80fd0354c8d18ffd1beb001b0d4fc89f872308d108eebcaae8b2e07611fde43492743b8df1ba3cd7cefda44ea8217ec965919761446946e98696829349a3cfab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 060f555d0936df9267235c1d9588c5fe5fa164ae999c50fce51a0e06047a354d
MD5 81454dc435912851c0c33a98aff5500d
SHA1 19e54fa4a2b9890fe43abb2ec83a79faee1ed7c0
SHA512 3607be09530a50120974da22257a3572163798de00b4fad570bbf8976d2811b11b546ede1af3b2ee2240868fca21585297f2ae2fffe0837349be07b65ade2045
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 681531c1d3cac793fa5dc1ff6da4298a4da13fc3c29199983c9b1b8339d39a20
MD5 96cc7922d831787950ba6a5249a17403
SHA1 b51ec0a1f854eb8436f266e247a5272804adaa59
SHA512 5aad1878c667bb2882ebc2f46d501a02ed7e7911e8b7654c58e95f452dff14885e3f4b2b3e3bf57adc30e3b18a2ce54205e4c61c44a275a92679fe3c65864e2a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cadee7c13277b11cb948be33fecc5401e748fc3cdda6f9c438563f7779693091
MD5 0fd9794b836f465ccdb51b42ba232884
SHA1 8bc54ed39dc94533445082668d239442dfb0d0db
SHA512 96049dc53dff3f4da8c7f52289d2d56fe55f7249e214f785309f6180332edb16a2899052c4358b839bd1e1c2348713e37912d55473487c576a7e4a0fc4f435e0
MD5 SHA1 SHA512

Submit Download

memory/4412-0-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4412-8-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/6036-25-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/6036-38-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads