52b9b06c3e7b294d420af38358dff947da4588d2f934d933c771ff459d97737e

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 40.8MB
Sample260819-b3eadace28
SHA256 52b9b06c3e7b294d420af38358dff947da4588d2f934d933c771ff459d97737e
MD5 77901e1c0abbd5457f75d02a6c713a63
SHA1 ee183877bde09d976102036f11ee48c3b6c1bac7
SHA512 db3ff06f288881931373d678abfdc453e08849edbaafef25418d896a131bed7fecfcfeb63849dea40b4b09c1b45ac1954f5f1b829f305e8d69fe1f896b4fc69d
SSDEEP 786432:L5H5D5H5D5H5D5H5Fhasq5H5D5H5D5H5D5H5Fhasq5H5D5H5D5H5D5H5Fhasq5Hn:u
TLSH
T1F6974C18FBD60161E97742B08CEBD2FA9E30792187218EEFE649970E1D37BD0A835715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3296	svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe
2684	svchost_BCCAABBACCCAABBABBBBABBBBBBBACAAABBABACBBCCABBBAABAACAC.exe
3720	svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBACACBABBBCBAAACCCBBBABCBAABBBCCABACBABBBCABACAABCAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe"	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCCBAACCAAAAAACBACBCACACACACACBBBCCBACACBBBCBBABACBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCAABBACCCAABBABBBBABBBBBBBACAAABBABACBBCCABBBAABAACAC.exe"	svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
692	sc.exe
3100	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3028	cmd.exe
1580	cmd.exe
5600	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCAABBACCCAABBABBBBABBBBBBBACAAABBABACBBCCABBBAABAACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2840	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2840	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2840	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2840	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3296	svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe
3296	svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe
3296	svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe
3296	svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe
2684	svchost_BCCAABBACCCAABBABBBBABBBBBBBACAAABBABACBBCCABBBAABAACAC.exe
2684	svchost_BCCAABBACCCAABBABBBBABBBBBBBACAAABBABACBBCCABBBAABAACAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3296	svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe
Token: SeDebugPrivilege	2684	svchost_BCCAABBACCCAABBABBBBABBBBBBBACAAABBABACBBCCABBBAABAACAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1580	2840	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 1580 wrote to memory of 4104	1580	cmd.exe	94
PID 3296 wrote to memory of 1504	3296	svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe	95
PID 2840 wrote to memory of 5600	2840	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 5600 wrote to memory of 692	5600	cmd.exe	100
PID 2840 wrote to memory of 3028	2840	2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 3028 wrote to memory of 3100	3028	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_77901e1c0abbd5457f75d02a6c713a63_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAAAABCACAABABAAAABCACCABABBCBBABBCCAABBBBBBAACCBAABCAACBCCABABBACABABAAAAABAAACBBAAAAAACBABBBBBAAABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAAAABCACAABABAAAABCACCABABBCBBABBCCAABBBBBBAACCBAABCAACBCCABABBACABABAAAAABAAACBBAAAAAACBABBBBBAAABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACABCBAACAABCCBCBCAABAAACACCBACAABCBCBABCBCBABCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe" start= auto displayName= "UserDataSvc_CBACABCBAACAABCCBCBCAABAAACACCBACAABCBCBABCBCBABCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACABCBAACAABCCBCBCAABAAACACCBACAABCBCBABCBCBABCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe" start= auto displayName= "UserDataSvc_CBACABCBAACAABCCBCBCAABAAACACCBACAABCBCBABCBCBABCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACABCBAACAABCCBCBCAABAAACACCBACAABCBCBABCBCBABCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACABCBAACAABCCBCBCAABAAACACCBACAABCBCBABCBCBABCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABBACCCAABBABBBBABBBBBBBACAAABBABACBBCCABBBAABAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABBACCCAABBABBBBABBBBBBBACAAABBABACBBCCABBBAABAACAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe
1⤵
- Executes dropped EXE
PID:3720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cb9a55ba0bc8a8368b62c0447bf2340a91e104f0819fd64d5a0f85b2554bebe0
MD5 e32ddf84bd053cb6d5af8a30d4ee1ad7
SHA1 ac12071060fd6572f4161764c7f34dc9d8b242f4
SHA512 ff236bd3235f56b4349498727992d6b12f0ba3f9050c60c1b36b7457a0414a018ccfa7d06fcc9f1f094ff54dacccd05bdd3c3a7096856d83fdad3fc741da306f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 056d11956ff9f17e07ab19962873243ffffaa6f7252e586bf9989dd9b5949bc2
MD5 d3948b01cc11c3a82cef7c34552d8108
SHA1 276afd4bdb0dae124099788dfaf2b1d1e9d65e87
SHA512 c518a96cb5320d515443aac875d050384f456c06878c08c0f2d191b868e8efc4f5634488604d1360f5e9f7ab6f3ab3723e8719861d86c704f108ce9e720dce67
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b26c32967bf84a1838b8cd61f5fd8bbaa875bc2e85c5ff10dabadd13771b49e9
MD5 4b5ad2836871db2c83196953b5a20b64
SHA1 9b4e6c45bb6d8a9751097518f18b08dacb6125f5
SHA512 58ba84c886bf416f2647e831e5abcb0bbdfcbc844e12f598586cc4101d03754f9f199de17bea53ebd3b6c723d24931e5c4d537117d586b49fb50868c032feade
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5a035f058b35d4ee3db6eeb7ae58be1c5e52dd84f032467709c8f2a0beea3598
MD5 7963a8a0dd275a7a18600eeab389432e
SHA1 babf4d10759a4e31c14baf560703f865ee78a234
SHA512 ed8cab41cc04c8ace404cdd9cdac84a31a1af57a5aff1f7bd62387ce913a4f9fe6424ce2a538723670b3dd27688531f41f20f637ab427f7edbd89112fb50be4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b297d7d76a4b2a13077566920bc2927ebb696284d8b7aaa2ad3046d6f5e1f8a9
MD5 becffd7cd6697f985cf52b4047674861
SHA1 8dd392e1dca2602aca5580727f508b1dd4ec770a
SHA512 1b327290e93e75d331a9d3bfdb6705cd394517d0db16f5066b0cd539052abeac0f6a358af437dab4906c0c1f0b76747d9953141a9df94e024a474ce0067a0420
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6bcfd222ee32327e51af3f04b4d8003b5129964dc1926d684beeabb232a7ddef
MD5 99e7f2dddeeff869c906f48a20d9bbfe
SHA1 821cbb41bd495a5372cf8a0e451e6bfa2d56b939
SHA512 4da1ac1721dd66a7d5f386757b39da882449928dd66c2eacfc609e56564500ea182849fc082ae80c7573fa5099cd9e503d73a48ba728b52c2b72afaf65f590f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ae60f94244cf05d98054794da163a0e21bb31c97b0e9067c318411021c666a47
MD5 2d5b3357c338b13268e7e29bc77e87bb
SHA1 328f1c335a9c6647abe451389529f1251cf2c953
SHA512 8076140899ed1ed56bf3cf9d2279981b68c6f08b0d8a91bbcf0c7a32fd8ce7f35292766e68797649292860eff2f55a5592c18d8224b27eced22ecc5ec0326d9f
MD5 SHA1 SHA512

Submit Download

svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACABCBBAABBCABCBACCBAABBBBCAAAACBABACABACBBCBBBBABBB.exe
Size 40.8MB
SHA256 52b9b06c3e7b294d420af38358dff947da4588d2f934d933c771ff459d97737e
MD5 77901e1c0abbd5457f75d02a6c713a63
SHA1 ee183877bde09d976102036f11ee48c3b6c1bac7
SHA512 db3ff06f288881931373d678abfdc453e08849edbaafef25418d896a131bed7fecfcfeb63849dea40b4b09c1b45ac1954f5f1b829f305e8d69fe1f896b4fc69d
SSDEEP 786432:L5H5D5H5D5H5D5H5Fhasq5H5D5H5D5H5D5H5Fhasq5H5D5H5D5H5D5H5Fhasq5Hn:u
TLSH
T1F6974C18FBD60161E97742B08CEBD2FA9E30792187218EEFE649970E1D37BD0A835715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5c03cba89bcd477a991ad94591102c155904775b8624fc154416c0bff65e4b16
MD5 e92a0da4885778750f097e011cd8add8
SHA1 5ed9e25ef92f1281b288e9e837cf214974e76cac
SHA512 2dbf84bd5e35c97541037eea96d4629ca33a680018eb69ee9c2e8b9a5379a1e0920fbd3a3164eb73f4207f80493b8880510e87389772c1fb8878a863dd0e88ba
TLSH
T131110122D5A5CC8BEC32349B972DDBC2DC9C215B689CAA0423498218BBDDC708D1D4B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2684-78-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/2840-8-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/2840-0-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/3296-34-0x0000000000740000-0x0000000000761000-memory.dmp

Download