52b9b06c3e7b294d420af38358dff947da4588d2f934d933c771ff459d97737e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 40.8MB
Sample260819-b3eadace28
SHA256 52b9b06c3e7b294d420af38358dff947da4588d2f934d933c771ff459d97737e
MD5 77901e1c0abbd5457f75d02a6c713a63
SHA1 ee183877bde09d976102036f11ee48c3b6c1bac7
SHA512 db3ff06f288881931373d678abfdc453e08849edbaafef25418d896a131bed7fecfcfeb63849dea40b4b09c1b45ac1954f5f1b829f305e8d69fe1f896b4fc69d
SSDEEP 786432:L5H5D5H5D5H5D5H5Fhasq5H5D5H5D5H5D5H5Fhasq5H5D5H5D5H5D5H5Fhasq5Hn:u
TLSH
T1F6974C18FBD60161E97742B08CEBD2FA9E30792187218EEFE649970E1D37BD0A835715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4764	svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe
3512	svchost_BBBCCCCCAABAAACCABAAAAAAAABCBBCCABAABCBCBCCBCAABCAAABAC.exe
5108	svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCBABCABACCBCAACBCCCAABAAACCABCAACCBABCAABABCCCBBCABBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe"	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAACCABABABBBABBCCABBABCCBCCABACCCCBCAABBBABABACCABBBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCCCCCAABAAACCABAAAAAAAABCBBCCABAABCBCBCCBCAABCAAABAC.exe"	svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2144	sc.exe
2760	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3944	cmd.exe
1532	cmd.exe
3428	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCCCCCAABAAACCABAAAAAAAABCBBCCABAABCBCBCCBCAABCAAABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1788	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1788	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1788	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1788	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4764	svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe
4764	svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe
4764	svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe
4764	svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe
3512	svchost_BBBCCCCCAABAAACCABAAAAAAAABCBBCCABAABCBCBCCBCAABCAAABAC.exe
3512	svchost_BBBCCCCCAABAAACCABAAAAAAAABCBBCCABAABCBCBCCBCAABCAAABAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4764	svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe
Token: SeDebugPrivilege	3512	svchost_BBBCCCCCAABAAACCABAAAAAAAABCBBCCABAABCBCBCCBCAABCAAABAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4420	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 3428	1788	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	105
PID 3428 wrote to memory of 4480	3428	cmd.exe	107
PID 4764 wrote to memory of 1940	4764	svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe	109
PID 1940 wrote to memory of 2500	1940	notepad.exe	110
PID 1788 wrote to memory of 3944	1788	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	114
PID 3944 wrote to memory of 2144	3944	cmd.exe	116
PID 1788 wrote to memory of 1532	1788	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	117
PID 1532 wrote to memory of 2760	1532	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBBACBCACCABABACACACCBAABBCBAABAAAACACBACBBBBAABBCBBBBBABABBACCBAABABCCBAABACACABABBCACABACBCCABCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBBACBCACCABABACACACCBAABBCBAABAAAACACBACBBBBAABBCBBBBBABABBACCBAABABCCBAABACACABABBCACABACBCCABCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCBCAACCABBAACABBABBACBBABABCCCCCBCACAACABBABCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe" start= auto displayName= "UserDataSvc_CBBCBCAACCABBAACABBABBACBBABABCCCCCBCACAACABBABCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCBCAACCABBAACABBABBACBBABABCCCCCBCACAACABBABCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe" start= auto displayName= "UserDataSvc_CBBCBCAACCABBAACABBABBACBBABABCCCCCBCACAACABBABCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCBCAACCABBAACABBABBACBBABABCCCCCBCACAACABBABCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCBCAACCABBAACABBABBACBBABABCCCCCBCACAACABBABCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCCCAABAAACCABAAAAAAAABCBBCCABAABCBCBCCBCAABCAAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCCCAABAAACCABAAAAAAAABCBBCCABAABCBCBCCBCAABCAAABAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3512

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe
1⤵
- Executes dropped EXE
PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ba4e1773744f25ce4d69bc7f515bbce80de07673911d770223689b73299efc12
MD5 961e0ebe375bdd3e728782bdb50b3787
SHA1 dce678a1bf426ee38b6fca8240266eaf8cd7c7c4
SHA512 c056570dedbaa39732eba7b4d907dcf970b84d313e9e0a29bfb40d51c198ab44d7c1ef20c0c218b6556af4befdf523921371412f9ac9a73c58d5b10c5a467dd1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be4bc3a38b99076d46744795d640ad22ea33a84620e177dc37123a5614b2608f
MD5 a75dfac67608eb28d1961ab0d9e97677
SHA1 9b4ecc570ae0115cbfe75541d8aea9fd34a23452
SHA512 1b85b816f7bd462de2ad61b54cc864e3a1b13ec2888fa0245b13f4bb9fef1386617874b12552c75f448bd73d401646a5b87d1874fcc693bb6ad49a7f81d6020a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b297d7d76a4b2a13077566920bc2927ebb696284d8b7aaa2ad3046d6f5e1f8a9
MD5 becffd7cd6697f985cf52b4047674861
SHA1 8dd392e1dca2602aca5580727f508b1dd4ec770a
SHA512 1b327290e93e75d331a9d3bfdb6705cd394517d0db16f5066b0cd539052abeac0f6a358af437dab4906c0c1f0b76747d9953141a9df94e024a474ce0067a0420
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cb9a55ba0bc8a8368b62c0447bf2340a91e104f0819fd64d5a0f85b2554bebe0
MD5 e32ddf84bd053cb6d5af8a30d4ee1ad7
SHA1 ac12071060fd6572f4161764c7f34dc9d8b242f4
SHA512 ff236bd3235f56b4349498727992d6b12f0ba3f9050c60c1b36b7457a0414a018ccfa7d06fcc9f1f094ff54dacccd05bdd3c3a7096856d83fdad3fc741da306f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b26c32967bf84a1838b8cd61f5fd8bbaa875bc2e85c5ff10dabadd13771b49e9
MD5 4b5ad2836871db2c83196953b5a20b64
SHA1 9b4e6c45bb6d8a9751097518f18b08dacb6125f5
SHA512 58ba84c886bf416f2647e831e5abcb0bbdfcbc844e12f598586cc4101d03754f9f199de17bea53ebd3b6c723d24931e5c4d537117d586b49fb50868c032feade
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6bcfd222ee32327e51af3f04b4d8003b5129964dc1926d684beeabb232a7ddef
MD5 99e7f2dddeeff869c906f48a20d9bbfe
SHA1 821cbb41bd495a5372cf8a0e451e6bfa2d56b939
SHA512 4da1ac1721dd66a7d5f386757b39da882449928dd66c2eacfc609e56564500ea182849fc082ae80c7573fa5099cd9e503d73a48ba728b52c2b72afaf65f590f9
MD5 SHA1 SHA512

Submit Download

svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABAACCABCBCACBCAAAACBCABBABCBBAAAABBCBBBBABACBABCABA.exe
Size 40.8MB
SHA256 52b9b06c3e7b294d420af38358dff947da4588d2f934d933c771ff459d97737e
MD5 77901e1c0abbd5457f75d02a6c713a63
SHA1 ee183877bde09d976102036f11ee48c3b6c1bac7
SHA512 db3ff06f288881931373d678abfdc453e08849edbaafef25418d896a131bed7fecfcfeb63849dea40b4b09c1b45ac1954f5f1b829f305e8d69fe1f896b4fc69d
SSDEEP 786432:L5H5D5H5D5H5D5H5Fhasq5H5D5H5D5H5D5H5Fhasq5H5D5H5D5H5D5H5Fhasq5Hn:u
TLSH
T1F6974C18FBD60161E97742B08CEBD2FA9E30792187218EEFE649970E1D37BD0A835715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 1f6e7c67c77b8966cf17bfbc97ebcd92b7802092e0eada87cd46372e13e59a23
MD5 2b67d87115beb265c80bf53366bd8a90
SHA1 feda45b9261e4ac4eb2c6509e9e16bd54e25f017
SHA512 da7af1c3243873e1a10ad15db471616d5c3ed0871cb93913eda81bedb6397cbea16b0883a570799af5eb541dcc82730d770738fa1c4ea5409e1fc5ba8bbe7848
TLSH
T1C411363294A5DC5BE9333CCF923DEA92DCE422CBA45CAA00634C411867DDC70CD154F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1788-8-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/1788-0-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/1940-59-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Download

memory/3512-78-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/4764-27-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/4764-37-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download