4c64cc92bcddce6e4b4ad778166b8a876a7b18f8221b32328925b0a4b0e0fe0c

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_5c8ba89309ec7e6d9fc0ecef85664e85_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 20.4MB
Sample260819-b7p8face49
SHA256 4c64cc92bcddce6e4b4ad778166b8a876a7b18f8221b32328925b0a4b0e0fe0c
MD5 5c8ba89309ec7e6d9fc0ecef85664e85
SHA1 0411ebb29e0b7f26d2a2a5d6196d587bd0d4bbd4
SHA512 eee65879ba28f05ac26dd3800f312d91e7f7d04de6f3372cf2664ad6814438706a2cca489b1bf267f4ccf91dabadcba4ef731f72a189337c22fcb965a09485fc
SSDEEP 98304:j5A5A5A5A5A5A5A54OU/jIEeQfoR/IuOFVjUu59:j5A5A5A5A5A5A5A54FIF0wuH
TLSH
T1E3274D09FAC60071E97751B04CEBD2BE4930BE2587228AFFF649D71E6932BD09835716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2016	svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe
1684	svchost_BAABACABBBCACABACAACCABCBCBACAABCCAAACACBBCBBCACACCABCB.exe
3348	svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACACBCBAAACCCBBCCABCBBBAACCABACBCCBCCCCCCAAACBAABAABBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe"	2026-08-19_5c8ba89309ec7e6d9fc0ecef85664e85_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCAABBBBCCAABBCBBAACCBBBBABACCBAAAABBCABBCBBAACBBCABBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABACABBBCACABACAACCABCBCBACAABCCAAACACBBCBBCACACCABCB.exe"	svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3852	sc.exe
4556	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3100	cmd.exe
2760	cmd.exe
3508	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_5c8ba89309ec7e6d9fc0ecef85664e85_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABACABBBCACABACAACCABCBCBACAABCCAAACACBBCBBCACACCABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4824	2026-08-19_5c8ba89309ec7e6d9fc0ecef85664e85_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4824	2026-08-19_5c8ba89309ec7e6d9fc0ecef85664e85_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4824	2026-08-19_5c8ba89309ec7e6d9fc0ecef85664e85_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4824	2026-08-19_5c8ba89309ec7e6d9fc0ecef85664e85_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2016	svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe
2016	svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe
2016	svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe
2016	svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe
1684	svchost_BAABACABBBCACABACAACCABCBCBACAABCCAAACACBBCBBCACACCABCB.exe
1684	svchost_BAABACABBBCACABACAACCABCBCBACAABCCAAACACBBCBBCACACCABCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	2026-08-19_5c8ba89309ec7e6d9fc0ecef85664e85_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	2016	svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe
Token: SeDebugPrivilege	1684	svchost_BAABACABBBCACABACAACCABCBCBACAABCCAAACACBBCBBCACACCABCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1868	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 2760	4824	2026-08-19_5c8ba89309ec7e6d9fc0ecef85664e85_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	102
PID 2760 wrote to memory of 1880	2760	cmd.exe	104
PID 2016 wrote to memory of 3664	2016	svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe	108
PID 3664 wrote to memory of 3700	3664	notepad.exe	109
PID 4824 wrote to memory of 3508	4824	2026-08-19_5c8ba89309ec7e6d9fc0ecef85664e85_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	113
PID 3508 wrote to memory of 3852	3508	cmd.exe	115
PID 4824 wrote to memory of 3100	4824	2026-08-19_5c8ba89309ec7e6d9fc0ecef85664e85_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	116
PID 3100 wrote to memory of 4556	3100	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-19_5c8ba89309ec7e6d9fc0ecef85664e85_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_5c8ba89309ec7e6d9fc0ecef85664e85_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBACCBBBBBCCBBCACCAABABBBCBBCAABBABCABBCABBCCCCCABCCACACBACBBBBCABCCABAACCABACABAACAACABBBABAACCCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBACCBBBBBCCBBCACCAABABBBCBBCAABBABCABBCABBCCCCCABCCACACBACBBBBCABCCABAACCABACABAACAACABBBABAACCCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABBABBABABCCBBBBCCABAACCACBBCAACABBCBBABABCACBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe" start= auto displayName= "UserDataSvc_ABABBABBABABCCBBBBCCABAACCACBBCAACABBCBBABABCACBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABABBABBABABCCBBBBCCABAACCACBBCAACABBCBBABABCACBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe" start= auto displayName= "UserDataSvc_ABABBABBABABCCBBBBCCABAACCACBBCAACABBCBBABABCACBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABBABBABABCCBBBBCCABAACCACBBCAACABBCBBABABCACBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABABBABBABABCCBBBBCCABAACCACBBCAACABBCBBABABCACBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABACABBBCACABACAACCABCBCBACAABCCAAACACBBCBBCACACCABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABACABBBCACABACAACCABCBCBACAABCCAAACACBBCBBCACACCABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe
1⤵
- Executes dropped EXE
PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a927fe9be65c6aa3f06ef0b5be6c278e321a07079fc2aa20aef55b57b0bae2f2
MD5 168aa52614316057a5b8df9e7c7aa17c
SHA1 b67d2947a8c1889f695344606887987ec7443894
SHA512 5377a05eb268f89822df5d75b9026b8b860067444b974ee5d7df46cf8bf84329f18c934b7639ea2c3211c88271a724dbaa72d5985bc7ba93077425b3b4a8cc53
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2712d3f2d7689a57afd4e427246b7a5a334d0bc01fe70eba3d33c53429fae686
MD5 639ccc7eb0b1311e042e915e7275170b
SHA1 51ea4977dedeaaa78dff00bf8e36f3480eb683ad
SHA512 a181ac5a9964b8f9d2dc72b25917e1a41854cb9e20e88bd711a7d666b6f0982d42b87090af2b96d539285f80669513b56a5f0a1affeb74570581badc75503762
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 179679c16e0e0fc2fa715ee6b2f92dd4a31b8f00b95ee97d7912cd7a97c263cf
MD5 a43c316c39ee3138f320c1278c38cec3
SHA1 cec9d03329ce4d900bc45da5071d17da737bd262
SHA512 799988dab8d12ee10b98004ebee8b527e80ed6a304a9684ff2ebd608477f1ed3394393b40e35d95e4b4b516e99add6bbc6aacd016f3454395a10b89cc66331e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 96f56c8592a24e10f4c42ccc99dcfbf7fa743ded8f47f400da865132d630185c
MD5 6d03a47eb4d7bdb29201a02f8b4ce461
SHA1 509eb7a39e678455107cc59f688e9dbd0968c89e
SHA512 7a3c26ab01aa32c2c3fdf52a2278d2f9570f5aa9fd93891e90bde36342c3dc761a2cc83f4216c798ea8c07d953321793af0f9fb5c8448fce72af03bf4d1f7ef5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 12adb23b57240d1c1d91f80f78ef38566aee2f2e7c20be7864ded656c028686a
MD5 d9cdd5cd9f1f9d1efda76ffa45a5a357
SHA1 95420023cdc05a18da4020d3291bbe56178f9583
SHA512 bef25b1ee94cb8372360289ea60346ecf9989184c753d897768aad05cde19d123b9f0cb84e48ff0f064337ac8cb2b250feafc65016c6db109bf51adfa5f6b211
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d72146a4d4dadefc84b40fc699eb25dd81e1044f21527c45c15f21379d7cddf5
MD5 fb04d0b0c3fcaa00a474dd71146b7b6e
SHA1 c7e50654123b0267c1f6b4cf73409a5fc2c50f9e
SHA512 20b669f025b6564b8a32c817cdd1800899ac1b956d786fda839311d0982e653e7c3dbe0b1f6351b69de1f287c68192814a7ce9faa53d1e3425da2aeb9b1b15cb
MD5 SHA1 SHA512

Submit Download

svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCABACACACBCCBCABABBBCBBAAABBCABABAAACBBBCABCCCACAA.exe
Size 20.4MB
SHA256 4c64cc92bcddce6e4b4ad778166b8a876a7b18f8221b32328925b0a4b0e0fe0c
MD5 5c8ba89309ec7e6d9fc0ecef85664e85
SHA1 0411ebb29e0b7f26d2a2a5d6196d587bd0d4bbd4
SHA512 eee65879ba28f05ac26dd3800f312d91e7f7d04de6f3372cf2664ad6814438706a2cca489b1bf267f4ccf91dabadcba4ef731f72a189337c22fcb965a09485fc
SSDEEP 98304:j5A5A5A5A5A5A5A54OU/jIEeQfoR/IuOFVjUu59:j5A5A5A5A5A5A5A54FIF0wuH
TLSH
T1E3274D09FAC60071E97751B04CEBD2BE4930BE2587228AFFF649D71E6932BD09835716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 470d05c7d118f935ae7ced45eecdffe8af03a43b396749a7ba4f7f81258d53b6
MD5 6eb27c6d6394c42dacf0c4b92b64d98a
SHA1 8d7faaa47ebcd6dc62fbc634135e5d631bbb577b
SHA512 ffdcb49c60ed5a079235194bd3f9d90eb9afb8c594d5966c82e348c321aee3e2e40c6972908f1f8695e7ccad0e71ead7fa88ac97ef82c098541f39e81ed82aa3
TLSH
T17011B665B4E9D823E923ACC7B21DDBD20DF976AFAC586A46231885186F44822CD154F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1684-78-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/2016-37-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/2016-27-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/3664-59-0x0000000005A20000-0x0000000005A21000-memory.dmp

Download

memory/4824-0-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/4824-8-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download