6d5853af9108c303e063365c4aab95eb11ac1f0aaf898784ef3ad9e0d1070999

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 30.0MB
Sample260819-e5hblawgmd
SHA256 6d5853af9108c303e063365c4aab95eb11ac1f0aaf898784ef3ad9e0d1070999
MD5 bf07239ee40753220c4cf349d4afaed0
SHA1 5c2239e78a335c359fd3295ef059d29c118ea772
SHA512 8cae4a6061c1e393c86a989e518504fa7d504ccc4ecefacbc18128b0edb7d9ea35c0ed07b18b376534396e11957fda12ee4cd1325a2cfe51f569c2f510094166
SSDEEP 98304:A000k000k000k000k000k000zKjKWQckVgtev5mnlNLv:0KWQc0gEYnvLv
TLSH
T1DE673B09F94340B2D82B01B04CCBD3BF4A70BA258B129EEBF74DC76FA933B916525655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1608	svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe
1640	svchost_CAACCACBABAABCACCCBABBABBAACCCBABCCBCBCBACAACBCABAACBBC.exe
4904	svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCCCABCCACAABCBCCCCAACCBCABABAACCBBCCCBBBCACACCCACCACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe"	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBBCAACBCBABCBBBBBCABBCACBCCABBBCCACCAAAAACBCBACABABACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACCACBABAABCACCCBABBABBAACCCBABCCBCBCBACAACBCABAACBBC.exe"	svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2452	sc.exe
2388	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4756	cmd.exe
4216	cmd.exe
1204	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACCACBABAABCACCCBABBABBAACCCBABCCBCBCBACAACBCABAACBBC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3744	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3744	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3744	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3744	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1608	svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe
1608	svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe
1608	svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe
1608	svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe
1640	svchost_CAACCACBABAABCACCCBABBABBAACCCBABCCBCBCBACAACBCABAACBBC.exe
1640	svchost_CAACCACBABAABCACCCBABBABBAACCCBABCCBCBCBACAACBCABAACBBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3744	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	1608	svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe
Token: SeDebugPrivilege	1640	svchost_CAACCACBABAABCACCCBABBABBAACCCBABCCBCBCBACAACBCABAACBBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
716	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 4756	3744	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	100
PID 4756 wrote to memory of 5112	4756	cmd.exe	102
PID 1608 wrote to memory of 5564	1608	svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe	103
PID 5564 wrote to memory of 4748	5564	notepad.exe	104
PID 3744 wrote to memory of 4216	3744	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	108
PID 4216 wrote to memory of 2452	4216	cmd.exe	110
PID 3744 wrote to memory of 1204	3744	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	111
PID 1204 wrote to memory of 2388	1204	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAACABCCCACBACBCBBBBBACCAAACBCAAABCAAAAACCCBABBBAAACBBCBABCCACAAABABCCACCAAAABABACBBAAACBABBACBBAABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAACABCCCACBACBCBBBBBACCAAACBCAAABCAAAAACCCBABBBAAACBBCBABCCACAAABABCCACCAAAABABACBBAAACBABBACBBAABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABACCBBACCAAACCCCCBCBCACBCBBABCCCBBACBAAABAACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe" start= auto displayName= "UserDataSvc_CAAABACCBBACCAAACCCCCBCBCACBCBBABCCCBBACBAAABAACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAABACCBBACCAAACCCCCBCBCACBCBBABCCCBBACBAAABAACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe" start= auto displayName= "UserDataSvc_CAAABACCBBACCAAACCCCCBCBCACBCBBABCCCBBACBAAABAACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABACCBBACCAAACCCCCBCBCACBCBBABCCCBBACBAAABAACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAABACCBBACCAAACCCCCBCBCACBCBBABCCCBBACBAAABAACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5564
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4748

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCACBABAABCACCCBABBABBAACCCBABCCBCBCBACAACBCABAACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCACBABAABCACCCBABBABBAACCCBABCCBCBCBACAACBCABAACBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe
1⤵
- Executes dropped EXE
PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6fa9e47a94b139133ecfaab60d26ed58bb5bb5968c06010fdcfed530634a095
MD5 b774c4fd991963dd325dd14d114a5296
SHA1 583e1e93f2ed16c53b9a6bbc873ab5fcc6ec92f3
SHA512 2915271b4670eb273a5a4d595a47bbb777ac820d1c74c669417c80b2cfc8e07401db32f4d08f190830be4dbfb0ac242bb9925333b3287da6ac0c2b931d73b05c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 02808048e12b1756d6087973d0125bcca01746e5369ef190bb75ba076ec19904
MD5 45c02072078fda80e7a0810d00b03bd7
SHA1 b89453cd034d0f584426e47890f14472162b98de
SHA512 0da186b82ef864122952d6f4fe22dc52d69a49a9e2141fa0aaef908b77b67ba9b570002096ac7894142dd0a96e4d656eda9c4599dad53a0b87e7ec835dfa519d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fd615669baf9a4b3216cf57514b9d613091e1d9c6f523c8e1088d4a3baf97da9
MD5 8fa32a1683b66936592a6f84479acf09
SHA1 29920729004f0abaced440b4fe8f141755a93bdf
SHA512 3fdf34ff3792b9735ed510d9e695f6509bf2c21694fb768fea401ed70896491b859d1507b4a6a09da18116cfdb5ae5519561091751f94660c0589d7ae9e4b4bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4f374acf440bb2c6527b520f8e1613d9f056a900bbb42d9aeea89dd874acda52
MD5 ce719c969280656053c90ebd8858eb82
SHA1 81cff86fad939e4f35c44bd398ef7d79fd11643d
SHA512 8c8b736a1814289e1f195092b110fb6b8210af57be31793ea5a07d5a7c7d444d0b4ba7ed3670cfc81d6166757144c7212c065a7d0fa38950af3b242ddd8472f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7d70f250eb7feee8b34d7de3ba1618f0ca45534da78642c23bdfcc33d8e8c63f
MD5 f0672b48734d76e05b948ff03aa9dd33
SHA1 e2c442bd3a3cf5761fd3bcc15e8ede1d2dfab762
SHA512 f9c59e1a77cf2e728ca9a77d728088034b60c21b7a58abfd66ca704e075c7f189e0bafe4a67db01e745f84ce63f2211cc2fcf52a7deb2c2804287ef3da450101
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 46f399248f47cb66105bba92759552dfdee665d5fc364a68125c23a251ea05d6
MD5 0b617f5e343c647bc060b5e1b51acb27
SHA1 480e5d4e6cadf2e78ec30ef54e1323ef900ef042
SHA512 5db206697928832b6be3b2867701d187c3f2153f802afb515cfa18094e3a050247cc84a99c92081dd1e3ae06d565f8112bbfa8cf1febec8107c3cf162af1a194
MD5 SHA1 SHA512

Submit Download

svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCCACABCCABBBBABACABCCCAABCBCACABBCACAACBBBCACBACBC.exe
Size 30.0MB
SHA256 6d5853af9108c303e063365c4aab95eb11ac1f0aaf898784ef3ad9e0d1070999
MD5 bf07239ee40753220c4cf349d4afaed0
SHA1 5c2239e78a335c359fd3295ef059d29c118ea772
SHA512 8cae4a6061c1e393c86a989e518504fa7d504ccc4ecefacbc18128b0edb7d9ea35c0ed07b18b376534396e11957fda12ee4cd1325a2cfe51f569c2f510094166
SSDEEP 98304:A000k000k000k000k000k000zKjKWQckVgtev5mnlNLv:0KWQc0gEYnvLv
TLSH
T1DE673B09F94340B2D82B01B04CCBD3BF4A70BA258B129EEBF74DC76FA933B916525655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 d3feed747466df8ba7f050082540e694d60b444eddde4f53729f8e20e55dae4f
MD5 2c72306272051bb14db7fe6983f731c3
SHA1 d2a034fea1c9bc400dd205e7fdfbdd5829fdd99f
SHA512 8cdf8c1e6a360b01232b03828ea989075153e568245a3f634b8203267cf631c935d076f5da6b04ab34deb5c16cf9c461e677dc104fe2955c8598032f8d1f5163
TLSH
T101012610A4F5D42BF932289F513EAF92C8D437876CDCDA04234961086B94C719E090E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1608-36-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/1608-26-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/1640-77-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/1640-90-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/3744-0-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/3744-7-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/4904-89-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/5564-59-0x0000000002300000-0x0000000002301000-memory.dmp

Download