81ae7399e00283ed492a41e120d3fc1522dc034c485ff768823b43c1ce33b9f3

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_736b805e796299722180eaaa8cd72c21_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 44.3MB
Sample260819-b3534athrf
SHA256 81ae7399e00283ed492a41e120d3fc1522dc034c485ff768823b43c1ce33b9f3
MD5 736b805e796299722180eaaa8cd72c21
SHA1 67ae500aaac60811e1185a50d5e047436ec1492e
SHA512 ee57456cd7f16c8142323e0a542865a3111a95c8c3fe00a29a6109b1c84a9ab6d5916086c12dfac978b7c86f49e6b35eaf2fbaf8fc927dbf00fee1ae4d73fabc
SSDEEP 786432:gY6Y6Y6Y6Y6Y6YJY6Y6Y6Y6Y6Y6YJY6Y6Y6Y6Y6Y6YJY6Y6Y6Y6Y6Y6YJ:u
TLSH
T160A77D05F84380B3EA6611714C9FE2BB6A74AB2047128DEBF7CDDA1F7E32AC15636115
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
440	svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe
936	svchost_ABACCBCBCBCCAACCBCCAABBACBBCCBCBBBAABCCCCCAAABCBACABCBB.exe
2996	svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCBCACBBCCCCABACBBCABACABBBCCBCCCBCCCCABCABCBACCCCCBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe"	2026-08-19_736b805e796299722180eaaa8cd72c21_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAAACCBCBCACAAACCCBCBACBBBCCCBBABABCCCCCCABCBBCBBBBCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACCBCBCBCCAACCBCCAABBACBBCCBCBBBAABCCCCCAAABCBACABCBB.exe"	svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5724	sc.exe
3408	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1980	cmd.exe
3584	cmd.exe
1984	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_736b805e796299722180eaaa8cd72c21_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACCBCBCBCCAACCBCCAABBACBBCCBCBBBAABCCCCCAAABCBACABCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3176	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
620	2026-08-19_736b805e796299722180eaaa8cd72c21_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
620	2026-08-19_736b805e796299722180eaaa8cd72c21_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
620	2026-08-19_736b805e796299722180eaaa8cd72c21_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
620	2026-08-19_736b805e796299722180eaaa8cd72c21_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
440	svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe
440	svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe
440	svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe
440	svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe
936	svchost_ABACCBCBCBCCAACCBCCAABBACBBCCBCBBBAABCCCCCAAABCBACABCBB.exe
936	svchost_ABACCBCBCBCCAACCBCCAABBACBBCCBCBBBAABCCCCCAAABCBACABCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	620	2026-08-19_736b805e796299722180eaaa8cd72c21_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	440	svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe
Token: SeDebugPrivilege	936	svchost_ABACCBCBCBCCAACCBCCAABBACBBCCBCBBBAABCCCCCAAABCBACABCBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1980	620	2026-08-19_736b805e796299722180eaaa8cd72c21_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 1980 wrote to memory of 3176	1980	cmd.exe	94
PID 440 wrote to memory of 4912	440	svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe	95
PID 620 wrote to memory of 3584	620	2026-08-19_736b805e796299722180eaaa8cd72c21_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 3584 wrote to memory of 5724	3584	cmd.exe	100
PID 620 wrote to memory of 1984	620	2026-08-19_736b805e796299722180eaaa8cd72c21_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 1984 wrote to memory of 3408	1984	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-19_736b805e796299722180eaaa8cd72c21_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_736b805e796299722180eaaa8cd72c21_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBACCBACCCCBBCCBBCCAABCACAAABACCCBCBACCABCCBBABACABBBCBCBBAACABABCABCACCAAACBBAACCBCCCCCBACBACABCCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBACCBACCCCBBCCBBCCAABCACAAABACCCBCBACCABCCBBABACABBBCBCBBAACABABCABCACCAAACBBAACCBCCCCCBACBACABCCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBCCCBBBBCCCCACBACBBCCABBACACACCACACCCBABCCBAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe" start= auto displayName= "UserDataSvc_CBCBCCCBBBBCCCCACBACBBCCABBACACACCACACCCBABCCBAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBCCCBBBBCCCCACBACBBCCABBACACACCACACCCBABCCBAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe" start= auto displayName= "UserDataSvc_CBCBCCCBBBBCCCCACBACBBCCABBACACACCACACCCBABCCBAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBCCCBBBBCCCCACBACBBCCABBACACACCACACCCBABCCBAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBCCCBBBBCCCCACBACBBCCABBACACACCACACCCBABCCBAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:440
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBCBCBCCAACCBCCAABBACBBCCBCBBBAABCCCCCAAABCBACABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBCBCBCCAACCBCCAABBACBBCCBCBBBAABCCCCCAAABCBACABCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe
1⤵
- Executes dropped EXE
PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c51a221ae8af14a03c5f4d0c3c1316ae3fcc37dd5940ab8310958fc985e02e94
MD5 1608ef152331672c3477c29fcc80c84c
SHA1 8ef16bdb043ad097af31e90460fcfddc11cd5feb
SHA512 96e9eb4883172ed3ae2cd8a7ce06a01350ea96e6fea1fdfe8485dd9becd45958c9f26cd88b58c39248b43c4b9c57e27712e37b98f751fec0502395e218d85cdb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a03133ddef76d122e5b3b75be7044f9396e4a1134d42f0c03228bad83860c63a
MD5 9862cdd060d9f4d35e2d0e4cd16dbe1c
SHA1 a7522de2b36422885cb802600d1c86d4c644c5a7
SHA512 4eaf5af73a1e377999c6f53efbee919ea7d3638ba862d2e7eef8509df0baf753bfdaec23c712a2ae7c38db2129108e1428a3653831b18bc48d98ab7bc3e28327
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fd1671725d7f5f9bee4cf4624c529594d1d617b8922ba5d8870e586341a4015b
MD5 08b6fd10ee137cac74958fbe1c61e0df
SHA1 c40e1cfe1ecdafb78e9e442adea53bc5a99383a5
SHA512 8477d91b6be963e0f7ac4fd7faf653dbad95c3252effb8ce4a0cd1546765f3db8eb82e5b88915ca323d6a4928ff618bca539de3399e4a58afb0210d0e9d40d34
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a8421ce9ffb4cac26f4ea11fb37a96edef12bf0eb633ce85e03ec577051686d3
MD5 6a8ec65fc188beb8280f1bfc74e97a64
SHA1 f05df4518abc6f48c0ef7321bd2ce540f0647803
SHA512 10e3f039b43d244a9b69de382873e011a46b699625f10123ef415a9679abea7a24a7b53f13169f359becec5d8027fbb79a574b3801bdf453a2e5739adb267f5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9896f3cbc10a747c7ac188e23153d0aed487fa283efe2db3968b984caedd2430
MD5 77450b3c5c355aa11bed542c24231339
SHA1 57d979baff1c681ed92768709aa1e9bc959b2d25
SHA512 982de2936a03a366f728c1e244fcb3d736ac0402cb2a119870605791aeb82b00dfd48f0594737704b90372391e9b6c03969e5c23e53db75fe634be9afae6566f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6c6ec7ea329e79e0370929d569987b92f39d2f2d9a7555657b5e5bb7dc5b9a6b
MD5 86bb3b6a1c855f6fc1dc270bb8c223a3
SHA1 66028e30a4eb71c03c84a8489655ba195831e7a0
SHA512 8323f8a1ff7674fd8c12c26bb291ab2e06e68c59d7692deb939aea6fb4f8b03af1510a245e73ef227884727bde7daedce9f1baa9def3d94fd97787f9a7cb2701
MD5 SHA1 SHA512

Submit Download

svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBABBBBCBACAACACBBBBCBBCAACCBBABACACCBBCCCBCCCBABAC.exe
Size 44.3MB
SHA256 81ae7399e00283ed492a41e120d3fc1522dc034c485ff768823b43c1ce33b9f3
MD5 736b805e796299722180eaaa8cd72c21
SHA1 67ae500aaac60811e1185a50d5e047436ec1492e
SHA512 ee57456cd7f16c8142323e0a542865a3111a95c8c3fe00a29a6109b1c84a9ab6d5916086c12dfac978b7c86f49e6b35eaf2fbaf8fc927dbf00fee1ae4d73fabc
SSDEEP 786432:gY6Y6Y6Y6Y6Y6YJY6Y6Y6Y6Y6Y6YJY6Y6Y6Y6Y6Y6YJY6Y6Y6Y6Y6Y6YJ:u
TLSH
T160A77D05F84380B3EA6611714C9FE2BB6A74AB2047128DEBF7CDDA1F7E32AC15636115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 80c4c6ff1ca52329dffc479a068937a4329677d341c06f5644fc028b25c32f46
MD5 6b7c3d960d060b00a3582325ed3e1371
SHA1 b695007e61f27447db55c4990295b7aede9c3cfe
SHA512 06b147401d5204969bc8601752ac03e876dde3e6322d0bc9eba6ccd9f9631e9e5057c7ce3ea046101798b6cb0c452ea14bbe36f35f0ac45f84ffd75abf27dba7
TLSH
T13111C854F4A9D853ED32ACDE721DEEE209E837979C186A56231C411C6B85C325D154F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/440-23-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/440-33-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/620-7-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/620-0-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/936-79-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/2996-81-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download